Logo
RSS Feed

🖥 System Information


Created: 12.10.2020

Windows

Installed programs and applications

Key 🔑: Microsoft\Windows\CurrentVersion\Uninstall. There can be some data for programs that do not exist on the system anymore. The last write time is when the application was installed.

Key 🔑 Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore for installed Microsoft applications. Defines between those that were installed for a specific user or system-wide.

Key 🔑: Wiw6432Node (SYSTEM hive root node) - those that run a 32-bit mode. Separate sub-keys for different versions of a program.

Key 🔑: Classes\Installer\Products - installed using Miscrosoft installer (those with msi extension).

OS Information

Key 🔑: Microsift\Windows NT\CurrentVersion. Value InstallDate - Install date, Unix, numeric value (for 🛠 Decode).

Login info

Key 🔑: Microsoft\Windows\CurrentVersion\Authentication\LogonUI - last logged in user.

Key 🔑: Microsoft\Windows NT\CurrentVersion\Winlogon. Manages the boot process, logging operations, loading profiles.

Domain Accounts

Key 🔑 : Software\Microsoft\Windows NT\CurrentVersion\ProfileList.

The key above will have a ProfileImagePath.

SAM doesn’t have any informaiton about domain accounts. For this information refer to the key above. Even though in case of a domain user there is no relevant information in SAM hive, you can still view the machine/domain ID in SAM and use it to determine whether the files were created on the local machine. For example, in the Recycle Bin.

Computer name

Key 🔑: Computer\HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ComputerName and Computer\HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName. Can be either manufacturer or user-defined.

Last shutdown time

Key 🔑: Computer\HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Windows\LastShutdownTime

A 64-bit little-endian value, Windows FileTime. ⚠️ If the PC was shutdown due to some power source loss (plugged out), you won’t see this value being updated.

Crash dump setting

Key 🔑: Computer\HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\CrashControl\DumpFile and --\\--\MinidumpDir.

Stores the location of *.DMP.

NtfsDisableLastAccessUpdate

Key 🔑: ControlSet001\Control\FileSystem\NtfsDisableLastAccessUpdate.

Last access file time settings. If 1 - disabled (default), 0 - enabled. ⚠️ If it’s disabled (more likely), the access times are not reliable in this case. However, this doesn’t apply to MFT file records updates.

NTFS Last Accessed Update (Win10+) -

80000000 (hex) = User Managed, Last Access Updates Enabled
80000001 (hex) = User Managed, Last Access Updates Disabled
80000002 (hex) = System Managed, Last Access Updates Enabled - default for Windows 11 (in my case).
80000003 (hex) = System Managed, Last Access Updates Disabled

System time

Key 🔑: Computer\HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\TimeZoneInformation\TimeZoneKeyName

macOS

TODO: same structure as for Windows

system_profiler, sw_vers, uname

osquery

In case osquery was perinstalled on the machine in question, we are in a better position. It’s a very powerful tool. It queries the system for various information and presents it as a table.

osqueryi
# config on macOS (installed via brew) is /var/osquery/osquery.example.config

## mac addresses
grep -iro '[0-9a-f]\{2\}:[0-9a-f]\{2\}:[0-9a-f]\{2\}:[0-9a-f]\{2\}:[0-9a-f]\{2\}:[0-9a-f]\{2\}'

daily.out

Stored at /root/private/var/log/daily.out along with interfaces. Example of the file contents:

Sun Apr 12 13:27:17 EDT 2020

Removing old temporary files:
Cleaning out old system announcements:
Removing stale files from /var/rwho:

Disk status:

Filesystem     Size   Used  Avail Capacity iused      ifree %iused  Mounted on

/dev/disk1s5  100Gi  9.9Gi   83Gi    11%  481695 1044735185    0%   /
/dev/disk1s1  100Gi  6.3Gi   83Gi     8%   34701 1045182179    0%   /System/Volumes/Data
/dev/disk1s4  100Gi  1.0Mi   83Gi     1%       1 1045216879    0%   /private/var/vm

Network interface status:
Name       Mtu   Network       Address            Ipkts Ierrs    Opkts Oerrs  Coll
lo0   16384 <Link#1>                          1072     0     1072     0     0
lo0   16384 127           localhost           1072     -     1072     -     -
lo0   16384 localhost   ::1                   1072     -     1072     -     -
lo0   16384 fe80::1%lo0 fe80:1::1             1072     -     1072     -     -
gif0* 1280  <Link#2>                             0     0        0     0     0
stf0* 1280  <Link#3>                             0     0        0     0     0
en0   1500  <Link#4>    00:0c:29:c4:65:77   372733     0    73025     0     0
en0   1500  fe80::8c8:8 fe80:4::8c8:87c2:   372733     -    73025     -     -
en0   1500  184.171.151/2 stu-181-151-171   372733     -    73025     -     -
utun0 1380  <Link#5>                             0     0        2     0     0
utun0 1380  fe80::8375: fe80:5::8375:3ebe        0     -        2     -     -
utun1 2000  <Link#6>                             0     0        2     0     0
utun1 2000  fe80::feea: fe80:6::feea:9530        0     -        2     -     -

Local system status:
13:27  up 7 mins, 1 user, load averages: 7.76 3.82 1.64

-- End of daily output --

Linux

/etc/*-release
/etc/hostname
/etc/hosts
/var/lib/networkmanager, dhclient, and dhcp

AWS

On AWS there is a service that can be quieried for EC2 information. Official docs.This data should be quieried from within the instance.

⚠️ Turn off IMDS if you don’t need it for work.

📘 BTFM

# list all buckets using sso
aws s3 ls --profile dev

# Querying the EC2 IMDS for different instance information
curl -s "http://169.254.169.254/latest/meta-data/ami-id

Android

📘 BTFM

# Battery stats
cat /data/data/com.google.android.gms/shared_prefs/Batterystats.xml

# BatterystatsDumpsysTask
cat /data/data/com.google.android.gms/files/BatterystatsDumpsysTask.gz

iOS

If this package is installed, run ideviceinfo. Will also show data for connected devices. With this utility you can also target specific device by its UUID. One of the use cases: connect an iOS device and query. Read full focs here. How to use ideviceinfo command here.

Power Log

📘 BTFM

/private/var/containers/Shared/SystemGroup/[APPGUID]/Library/BatteryLife/CurrentPowerlog.PLSQL

/private/var/containers/Shared/SystemGroup/[APPGUID]/Library/BatteryLife/Archives/powerlog_ DATE_ID.PLSQL.gz

# KnowledgeC
/private/var/mobile/Library/CoreDuet/Knowledge/knowledgeC.db

Kubernetes

📘 BTFM

kubectl describe node | grep -i image # get OS info
kubectl describe pod <podname> | grep -i node # get image info and master node info as well as lots of other information
kubectl describe pod <podname> # get the amount of containers within the pod

kubectl describe pod <podname> would also contain events section which can be though of as some sort of logs.