Good afternoon, my white rabbits🐰
Today I want to do a little post about forensics and a little bit about torus attacks 🧅

Let's start with investigations.

I will show the directories where there might be useful information for investigations . 
For more in-depth investigations, check out the archive below .✨

To start with windows .

In investigations, it is important to know when the browser is started, and the system tracks how the system is started and which programs the user usually opens. This information is saved as several small files in the Prefetch folder:
C:\Windows\Prefetch\START TOR BROWSER.EXE-F5557FAC.pf
C:\Windows\Prefetch\TBB-FIREFOX.EXE-35050502C5.pf
C:\Windows\Prefetch\TOR-BROWSER-2.3.25-6_EN-US.EX-1354A499.pf
C:\Windows\Prefetch\TOR.EXE-D7159D93.pf
C:{Windows\Prefetch\VIDALIA.EXE-5167E0BC.pf

The cache files are most likely similar to prefetch files. They may contain traces of Tor Browser Bundle:
C:\Users\runa\AppData\Local\Microsoft\Windows\Caches\cversions.1.db
C:\Users\runa\AppData\Local\Microsoft\Windows\Caches{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db
C:\Windows\AppCompat\Programs\RecentFileCache.bcf

Microsoft Windows uses a file pagefile.sys, to store memory chunks that are not placed in physical memory. It contains information about the external drive connected, as well as the name of the Tor Browser Bundle executable.


C:{Windows\Prefetch is also probably a useful directory 

Here is probably important information and the date of the tor

C:\Users\username\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor

here torrc


C:\Users\User\User\ Desktop\Tor Browser\Browser\TorBrowser\Data\Tor

Extensions.ini and compatibility.ini files are located here:

C:\Users\Username\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default

To get information about visited sites, etc., open the places.sqlite file from here:

C:\Users\Username\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default

Now let's talk about linux and its possibly important directories

Important date and logs


/var/log/tor/
/var/lib/tor/ 

or

/usr/local/var/lib/tor

browser and its data

~/.local/share/tor-browser/

torrc configuration file

/etc/tor/

Now about the mac and the important directories on it

ASL log :

/var/log/asl/
/var/log/asl/

Probably important files

/var/log/asl/StoreData
/var/log/asl/SweepStore

The path to the Tor package on the desktop and the path to the Tor browser package in the trash:

/.fseventsd/0000000000172019

Other important directories are

var/folders/fb/v5wqpgls029d8tp_pcjy0yth0000gn/C/ 
/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/

I suggest reading more specifically about forenzika and investigations in the articles below in the archive 🔥
#network #linux #tor #forensics #windows