CDQR — Cold Disk Quick Response tool by Alan Orlikoski
For latest release click here
Open Letter to the users of Skadi, CyLR, and CDQR
The CDQR tool uses Plaso to parse forensic artifacts and/or disk images with specific parsers and create easy to analyze custom reports. The parsers were chosen based triaging best practices and the custom reports group like items together to make analysis easier. The design came from the Live Response Model of investigating the important artifacts first. This is meant to be a starting point for investigations, not the complete investigation.
In addition to processing entire forensic images it also parses extracted forensic artifact(s) as an individual file or collection of files inside of a folder structure (or inside a .zip file).
It creates up to 18 Reports (.csv files) based on triaging best practices and the parsing option selected
Appcompat, Amcache, Bash, Event Logs, File System, MFT, UsnJrnl, Internet History, Prefetch, Registry, Scheduled Tasks, Persistence, System Information, AntiVirus, Firewall, Mac, Linux, and Android Appcompat, Amcache, Bash, Event Logs, File System, MFT, UsnJrnl, Internet History, Prefetch, Registry, Scheduled Tasks, Persistence, System Information, AntiVirus, Firewall File System, Internet History, System Information, AntiVirus, Firewall, Mac, and Linux File System, Internet History, Persistence, System Information, AntiVirus, Firewall, and AndroidThis program uses Plaso and a streamlined list of its parsers to quickly analyze a forenisic image file (dd, E01, .vmdk, etc) or group of forensic artifacts. The results are output in either ElasticSearch, JSON (line delimited), or the following report files in CSV format:
Appcompat, Amcache, Bash, Event Logs, File System, MFT, UsnJrnl, Internet History, Prefetch, Registry, Scheduled Tasks, Persistence, System Information, AntiVirus, Firewall, Mac, Linux, and Android Appcompat, Amcache, Bash, Event Logs, File System, MFT, UsnJrnl, Internet History, Prefetch, Registry, Scheduled Tasks, Persistence, System Information, AntiVirus, Firewall File System, Internet History, System Information, AntiVirus, Firewall, Mac, and Linux File System, Internet History, Persistence, System Information, AntiVirus, Firewall, and Androidpositional arguments:
src_location Source File location: Y:/Case/Tag009/sample.E01
dst_location Destination Folder location. If nothing is supplied
then the default is 'Results'
optional arguments:
-h, --help show this help message and exit
-p PARSER, --parser PARSER
Choose parser to use. If nothing chosen then 'win' is
used. The parsing options are: win, mft_usnjrnl, lin,
mac, datt
--nohash Do not hash all the files as part of the processing of
the image
--mft Process the MFT file (disabled by default except for
DATT)
--usnjrnl Process the USNJRNL file (disabled by default except
for DATT)
--max_cpu Use the maximum number of cpu cores to process the
image
--export Creates zipped, line delimited json export file
--artifact_filters ARTIFACT_FILTERS
Plaso passthrough: Names of forensic artifact
definitions, provided on the command command line
(comma separated). Forensic artifacts are stored in
.yaml files that are directly pulled from the artifact
definitions project. You can also specify a custom
artifacts yaml file (see
--custom_artifact_definitions). Artifact definitions
can be used to describe and quickly collect data of
interest, such as specific files or Windows Registry
keys.
--artifact_filters_file ARTIFACT_FILTERS_FILE
Plaso passthrough: Names of forensic artifact
definitions, provided in a file with one artifact name
per line. Forensic artifacts are stored in .yaml files
that are directly pulled from the artifact definitions
project. You can also specify a custom artifacts yaml
file (see --custom_artifact_definitions). Artifact
definitions can be used to describe and quickly
collect data of interest, such as specific files or
Windows Registry keys.
--artifact_definitions ARTIFACT_DEFINITIONS
Plaso passthrough: Path to a directory containing
artifact definitions, which are .yaml files. Artifact
definitions can be used to describe and quickly
collect data of interest, such as specific files or
Windows Registry keys.
--custom_artifact_definitions CUSTOM_ARTIFACT_DEFINITIONS
Plaso passthrough: Path to a file containing custom
artifact definitions, which are .yaml files. Artifact
definitions can be used to describe and quickly
collect data of interest, such as specific files or
Windows Registry keys.
--file_filter FILE_FILTER, -f FILE_FILTER
Plaso passthrough: List of files to include for
targeted collection of files to parse, one line per
file path, setup is /path|file - where each element
can contain either a variable set in the preprocessing
stage or a regular expression.
--es_kb ES_KB Outputs Kibana format to elasticsearch database.
Requires index name. Example: '--es_kb my_index'
--es_kb_server ES_KB_SERVER
Kibana Format Only: Exports to remote (default is
127.0.0.1) elasticsearch database. Requires Server
name or IP address Example: '--es_kb_server
myserver.elk.go' or '--es_kb_server 192.168.1.10'
--es_kb_port ES_KB_PORT
Kibana Format Only: Port (default is 9200) for remote
elasticsearch database. Requires port number Example:
'--es_kb_port 9200 '
--es_kb_user ES_KB_USER
Kibana Format Only: Username (default is none) for
remote elasticsearch database. Requires port number
Example: '--es_kb_user skadi '
--es_ts ES_TS Outputs TimeSketch format to elasticsearch database.
Requires index/timesketch name. Example: '--es_ts
my_name'
--plaso_db Process an existing Plaso DB file. Example:
artifacts.plaso
-z Indicates the input file is a zip file and needs to be
decompressed
--no_dependencies_check
Re-enables the log2timeline the dependencies check. It
is skipped by default
--process_archives Extract and inspect contents of archives found inside
of artifacts or disk images
-v, --version show program's version number and exit
-y Accepts all defaults on prompted questions in the
program.cdqr.py c:\mydiskimage.vmdk myresultscdqr.exe -p win c:\images\badlaptop.e01cdqr.exe -p datt --max_cpu C:\artifacts\tag009cdqr.exe -p datt --max_cpu C:\artifacts\tag009\$MFT --exportcdqr.exe -z --max_cpu C:\artifacts\tag009\artifacts.zipcdqr.exe -z --max_cpu C:\artifacts\tag009\artifacts.zip --es myindexnameAlan Orlikoski