Skip to content

WAC 3.0.0

Choose a tag to compare

View all tags
@reygiss reygiss released this 29 Oct 17:30
· 269 commits to master since this release
3.0.0
afd85f4

WAC 3.0.0 — major release

Every client Windows, from XP SP1 to Windows 11

  • WAC32.exe, the 32-bit WAC built from the same sources, collects on Windows XP SP1 to Windows 8 x86; WAC.exe (x64) on the 64-bit versions.
  • The formats of each version are decoded: Prefetch of XP to 8.1, ShimCache of XP, Vista, 7, 8.0 and 8.1, Amcache of 8 and 8.1, thumbnail caches and Thumbs.db, BITS queues before Windows 10, WMI repository and RDP bitmap cache of XP, XP firewall.
  • An artefact table by Windows version: an artefact absent from a version is not collected; a source that should be there and is not is declared "expected but not found"; a format without a decoder is declared "not supported", never returned as an empty list.

Shadow copies read raw, without the VSS service

Hives, logs and files as each shadow copy kept them, read from the volume itself: no VSS service or API is used, nothing is written to the examined disk. What a shadow copy keeps and the volume no longer has is reported.

Deleted files

Recovered by raw reading, in three levels set in wac.yml: $MFT records, names left in directory indexes ($I30), and carving of PE, ZIP and PDF files in free space at their exact size; FAT and exFAT volumes too. Each recovered file goes into the sealed exhibit store with its SHA-256.

New artefacts

Windows Search index (Windows.edb), Sysmon (configuration, archives) and relocated event logs, PowerShell profiles, Entra ID, OneDrive, ETW files, Defender for Endpoint, firewall, boot and Intune traces. Their MITRE ATT&CK coverage is tabulated in the manuals.

Review and verification

  • A code and security review of the whole project before this release: decoders, raw readers, exhibit store, scripts.
  • The manifest's seal is printed at the end of the collection, to be written down in the report; verify-exhibits.ps1 -Seal / verify-exhibits.sh --seal hold the manifest against it. The PowerShell verifier works from PowerShell 4.
  • --output and output: accept a plain folder name only: the collection stays on the medium WAC runs from.
  • Full test cycles in VMs: Windows 11 and 8.1 with no failure, and XP, Vista, 7 and 8.

Files

WAC.exe (x64), WAC32.exe (x86, XP SP1 to 8), wac.yml, verify-exhibits.ps1|.sh, verifier-consigne.ps1|.sh (French messages), raw_hive_test.exe, SHA256SUMS.

Assets 11
Loading