HBGary Responder™ User Guide 1 HBGary, Inc. 3604 Fair Oaks Blvd, Suite 250 Sacramento, CA 95864 http://www.hbgary.com/ Copyright © 2003 - 2010, HBGary, Inc. All rights reserved. HBGary Responder™ User Guide 2 Copyright © 2003 - 2010, HBGary, Inc. All rights reserved. HBGary Responder™ User Guide 3 HBGary Responder™ 2.0 User guide Copyright © 2003 - 2010, HBGary, Inc. All rights reserved. HBGary Responder™ User Guide 4 Copyright © 2003 - 2010, HBGary, Inc. All rights reserved. HBGary Responder™ User Guide 5 Contents Copyright and Trademark Information ....................................................................................................... 11 Privacy Information ..................................................................................................................................... 11 Notational Conventions .............................................................................................................................. 12 Contacting Technical Support ..................................................................................................................... 12 Responder™ Installation Prerequisites ....................................................................................................... 13 Minimum Hardware Requirements ........................................................................................................ 13 Prerequisite Software ............................................................................................................................. 13 REcon™ .................................................................................................................................................... 14 FastDump Pro™ ....................................................................................................................................... 14 Responder™ Installation ............................................................................................................................. 15 Responder™ Removal ................................................................................................................................. 18 Removing Responder™ from Windows™ 7 ............................................................................................. 19 Responder™ License Management ............................................................................................................. 21 HASP key installation .............................................................................................................................. 21 Software-based licensing ........................................................................................................................ 23 Responder™ Projects .................................................................................................................................. 24 Creating a New Physical Memory Snapshot Project ............................................................................... 25 Creating a New Remote Memory Snapshot Project ............................................................................... 29 Creating a Live REcon™ Session Project .................................................................................................. 32 Best practices for VM creation ............................................................................................................... 32 VMware setup ......................................................................................................................................... 32 Starting a Live REcon™ session ............................................................................................................... 34 Creating a Static Binary Project .............................................................................................................. 41 Copyright © 2003 - 2010, HBGary, Inc. All rights reserved. HBGary Responder™ User Guide 6 Creating a New Forensic Binary Journal Project ..................................................................................... 43 Report Tab................................................................................................................................................... 45 Report Toolbar ........................................................................................................................................ 46 Report Items Right-click Menu ............................................................................................................... 47 Adding a Report Folder ........................................................................................................................... 48 Editing a Report Folder ........................................................................................................................... 49 Deleting a Report Folder ......................................................................................................................... 50 Adding a Report Item .............................................................................................................................. 51 Moving Report Items Up/Down .............................................................................................................. 52 Editing a Report Item .............................................................................................................................. 53 Deleting a Report Item ............................................................................................................................ 55 Report Detail Panel ................................................................................................................................. 56 Google™ Search Feature ......................................................................................................................... 59 A Brief Introduction to OS Memory ............................................................................................................ 60 Objects Tab ................................................................................................................................................. 61 Objects Tab Components ........................................................................................................................ 61 The Object Tree ....................................................................................................................................... 63 Objects Panel Column Chooser ............................................................................................................... 65 Detail Panels............................................................................................................................................ 67 Basic Detail Panel .................................................................................................................................... 68 Spawning a Detail Panel .......................................................................................................................... 70 Details Panel Toolbar .............................................................................................................................. 71 Case Summary Panel ............................................................................................................................... 73 Snapshot Summary Panel ....................................................................................................................... 74 Interrupt Descriptor Table Panel ............................................................................................................ 75 Copyright © 2003 - 2010, HBGary, Inc. All rights reserved. HBGary Responder™ User Guide 7 OS Summary ............................................................................................................................................ 76 All Modules Panel ................................................................................................................................... 77 Modules Panel Right-click Menu Options ............................................................................................... 78 All Open Files Panel ................................................................................................................................. 80 All Open Network Sockets Panel ............................................................................................................. 81 All Open Registry Keys Panel .................................................................................................................. 82 Documents and Messages Panel ............................................................................................................ 83 Drivers Panel ........................................................................................................................................... 84 Internet History Panel ............................................................................................................................. 85 Keys and Passwords Panel ...................................................................................................................... 86 Processes Panel ....................................................................................................................................... 87 System Service Descriptor Tables Panel ................................................................................................