Analysis of Internet Download Manager for Collection of Digital Forensic Artefacts
Total Page：16
File Type：pdf, Size：1020Kb
digital investigation 7 (2010) 90e94 available at www.sciencedirect.com journal homepage: www.elsevier.com/locate/diin Analysis of Internet Download Manager for collection of digital forensic artefacts Muhammad Yasin*, Ahmad R. Cheema, Firdous Kausar National University of Sciences and Technology (NUST), Islamabad, Pakistan article info abstract Article history: Internet Download Manager (IDM) provides accelerated download speed and flexibility in Received 15 February 2010 features. Its attractiveness lies behind video content processing and automatic handling of Received in revised form downloads. This paper analyzes IDM activities recorded across multiple files that includes 21 August 2010 Windows Registry, history and log files from artefacts collection view point. The tools and Accepted 30 August 2010 techniques used for extracting evidence are also elaborated. In case of download managers, the foremost concerns are installation location, download path, downloaded Keywords: file, URL address, login credentials for password protected websites, date and time the Digital forensics activity was performed. This enables digital forensic investigators to envisage and deduce Download manager suspicious activities. Forensic artefacts ª 2010 Elsevier Ltd. All rights reserved. Internet Download Manager Password Cracking Windows registry analysis IDM 1. Introduction this paper accentuates the footprints of IDM. The research is accomplished on IDM versions 5.16 and 5.18 running on IDM is a widely used download manager that runs on Windows Microsoft Windows XP platform. The test cases are carried out operating systems. It supports HTTP, HTTPS, FTP and MMS at multiple machines to acquire better results. The forensic protocols. IDM file management system maintains multiple dissection characterizes the information about user (Installer categories of downloaded files depending on their file type. of IDM), downloaded files (complete or incomplete) history, IDM provides seamless integration with most popular web login credentials (password protected websites/servers and browsers. The unorthodox support of downloading webpage FTP/HTTP proxy servers), blocked websites/servers, URL embedded videos distinguishes it from other standard down- addresses and search keywords history. Moreover, it provides load managers. Along with all these characteristics, IDM soft- precise detail of password encryption/encoding technique used ware does not provide checksum verification (Internet by IDM to secure the user login credentials. The analysis covers Download Manager, 2010). windows registry examination, History and log files analysis to This analysis follows on from the preceding research that gather the fertile evidences from the intended system. examined the forensic artefacts left behind by Download This paper is organized into five sections. The first section Accelerator Plus (Yasin et al., 2009a) and Free Download introduces IDM and how this endeavor accommodates digital Manager (Yasin et al., 2009b). The examination carried out in forensic investigators with considerable information. The * Corresponding author. Tel.: þ92 3005170839. E-mail address: [email protected] (M. Yasin). 1742-2876/$ e see front matter ª 2010 Elsevier Ltd. All rights reserved. doi:10.1016/j.diin.2010.08.005 digital investigation 7 (2010) 90e94 91 second section performs windows registry examination. The 2.1. Proxy settings third section gives details on history and log files analysis to cite an encompassing representation of the downloaded activities. IDM holds proxy setting information under ‘DownloadManager’ The forth section emphasizes the method used to encrypt registry key. Which contains proxy address, port number, passwords by IDM. The paper is concluded in the last section. username and password for FTP, HTTP and HTTPS proxies as illustrated in Fig. 2. These UseFtpProxy, UseHttpProxy and UseHttpsProxy key values hold information whether user takes 2. Windows registry examination advantage of these FTP, HTTP and HTTPS proxies or not as portrayed in Fig. 3. IDM does not store passwords of these Windows registry is a splendid repository for digital forensic proxies in clear text, rather encrypted with their own devel- investigators to examine, investigate and collect evidence oped encryption technique. The IDM encryption technique is from Windows operating systems (Carvey, 2005; Farmer, 2007; explained in Section 4. Vivienne et al., 2006). A key to access registry information is to understand structure of the registry itself (Carvey, 2005). The 2.2. History of downloaded files information collected from registry and file system can be correlated to display a magnificent sketch of downloaded IDM organizes downloaded files by their file types in several activities. There are numerous freely obtainable tools for default and user created categories. The default categories for extracting information from the registry such as RegEdit downloading files are Music, Compressed Documents, Video (Microsoft Windows default Registry Editor), Registrar Lite and Programs. In Fig. 1 ‘Hacking Tools’, name of user created (Resplendence, 2008) and Registry Viewer (Access Data, 2010). category. It has conspicuous and imperative information These tools have been used to analyze windows registry to about the user interests and download activities for an trace the activities performed by IDM. investigator when inspecting dubious system. Windows Windows registry contains download activity entries, registry manages category settings within sub-keys under especially related to IDM, under HKEY_CURRENT_USER\Soft- ‘FoldersTree’ as depicted in Fig. 1. It is comprised of category ware\DownloadManager branch. Fig. 1 depicts the logical view name as the title of sub-key, supported extensions, unique of IDM in windows registry using RegEdit. The left pane Identity and download directory path. Each download file contains hierarchical tree structure of sub-keys of Internet contains a key value ‘categoryID’ which represents the unique Download Manager and right pane presents the key values of ID of category. Unique ID can be accustomed to relate the category type ‘Compressed’. This section highlights essential category of each downloaded file. Table 1 on next page registry keys and delineates how these keys can be useful and describes the corresponding ID’s of categories. It is worth beneficial to investigate download activities on suspicious mentioning that the user created category unique ID starts computer. from 64 onward. The default registry key ‘DownloadManager’ contains Windows Registry keeps information about all downloaded crucial and evident information regarding the configuration files. It maintains each downloaded file as sub-key of ‘Down- and user settings. Investigators can acquire information about loadManager’. For example 3, 4, 5 and 6 are the downloaded the execution path of IDM, its version, connection speed, Path files by the user as illustrated in Fig. 1. Each downloaded file is of folder used for maintaining logs, history of download represented with a File ID for instance ‘6’. The sequence of File activities, last URL address used to download a file, download ID starts from three rather than one. The value ‘6’ represents destination path and temporary folder information. Further- that user has downloaded forth file. The File ID is incremented more, it keeps proxy setting for IDM. with value one for each new file. The invaluable and essential Fig. 1 e IDM Registry view. 92 digital investigation 7 (2010) 90e94 Fig. 2 e HTTP and HTTPS proxy settings of IDM in Windows Registry. key values of downloaded files are file name, file size, date of passwords in clear text, rather in encrypted form. The IDM adding a URL address to IDM for downloading a file, URL encryption technique is explained in Section 4. address, login credentials, download directory path, Category ID and status of file. By default IDM uses ‘anonymous’as 2.6. Site Grabber username and ‘IEUser’ as password for user that does not provide login credentials. The site grabber of IDM is used to download a complete website or required files for offline browsing. IDM maintains 2.3. Files requested to download these downloaded files separately from the normal down- loaded files under ‘GrabberSts\Projects’ branch. The ‘maxID’ sub-key contains maximum File ID that provides total number of files requested to download using IDM as 2.7. Uninstall location shown in Fig. 4. The value name ‘maxID’ contains hexadecimal and numeric value formats. In this case the total number of Each registry key stores particular information under its sub- files requested by user is 34. This number is irrespective of the keys. For example the ‘Uninstall’ branch sub-keys indirectly files successfully downloaded or still incomplete. indicate all the installed programs. The ‘Internet Download Manager’ key under the ‘Uninstall’ branch contains execution 2.4. Incomplete download files path, program name and uninstall path of IDM. This infor- mation is contained under the following path in Windows Queue The sub-key ‘ ’ contains File ID’s of all incomplete register:‘HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft downloaded files which are interrupted during downloading \Windows\CurrentVersion\Uninstall\Internet Download Manager’. as illustrated in Fig. 5. The value name ‘Queue’ contains File IDs’ of 3 27, 33 and 34 that are still queued. 3. Log files analysis 2.5. Password protected websites IDM maintains history and log files under user profile: The enumeration of all password protected websites and ‘C:\Documents