FastIR Collector – Windows Incident Response Tool

 FastIR Collector – Windows Incident Response Tool

FastIR Collector is a “Fast Forensic” acquisition tool. Traditional forensics has reached its limit with the constant evolution of information technology. With the exponentially growing size of hard drives, their copy can take several hours, and the volume of the data may be too large for a fast and efficient analysis. “Fast Forensic” allows to respond to those issues. It aims a extracting a limited, but with high informational value, amount of data. These targeted data are the most consistent and important ones for an incident response analyst and allows the analyst to quickly collect artifacts and thus, to be able to quickly take decisions about cases.

FastIR Collector is Windows incident response tool that offers the possibility to extract classic artefacts such as memory dump, auto-started software, MFT, MBR, Scheduled tasks, Services and records the results in csv files. The tool can also perform smart acquisitions thanks to the filecatcher, certificate filtering or support of Yara rules.

FastIR Collector is dedicated to the extraction of the most well-known Windows artifact used by different malwares. It helps the analyst to make quick decisions about the status of the acquired system: whether it is compromised or not. Classic forensic tools need to shutdown systems in order to extract data. FastIR, on the contrary, runs on live systems, without having to turn the system off. This allows investigators to quickly be able to run the tool on systems.

Features

FastIR looks for various artefacts, including (but not limited to):

.Drive Identification – Archives all PE files not signed by Microsoft in Windows directories.

.Persistence Identification – Collects several persistence mechanisms.

.Named Pipes Identification – Rootkits often use named pipes to communication between components.

.Virtual File Systems – Collects & analyses Windows Prefetch files.

.Malware Identification – Using various artefacts and techniques.

.Process & Injection Identification – Able to identify various RATs, malware and rootkits from these artefacts.

The average execution time of FastIR Collector using the default parameters is about five minutes. Most of the results are outputted under the CSV format. Currently, FastIR Collector can analyze the following versions of Windows:

.Windows XP (In Best Effort);

.Windows Vista ;

.Windows 7 ;

.Windows 8,8.1;

.Windows 10

.Windows Server 2008, 2008R2

.Windows Server 2012, 2012R2

FastIR Collector is composed of several analysis packages, each one being able to retrieve a certain class of artifacts. These packages are presented in detail in the “The profile bloc” part. FastIR Collector generated data can be analyzed by either the analyst him/herself or a post-processing tool.

FastIR is designed to counter the growing size of hard drives, traditional forensics tools can take several hours to make a copy of the data and the volume of the data may be too large to make a reasonably speedy analysis.