Anti-forensics detection for Windows investigations
Lacuna cross-checks Windows artifacts to find signs that evidence was disabled, deleted or altered, and shows the records behind each finding.
Lacuna is currently in development. Are you a digital forensics investigator interested in testing it? Get in touch.
Features
Detection
Missing evidence
Compares the independent places where Windows records the same activity, to find the evidence a machine should hold but doesn't, and the artifact that disagrees with the rest.
Disabled logging and tracking
Detects logging and tracking switched off before an attack: audit policy, event logs, PowerShell logging, Prefetch, Amcache, user activity tracking and browser history.
Deleted records
Detects records removed after the fact: event log records, the USN journal, Prefetch files, browser history and shadow copies, and files deleted without going to the Recycle Bin.
Timestamp integrity
Detects rewritten file times and a system clock set back, and lists what was written while the clock was behind.
Cleaners and wipers
Recognizes history and USB cleaners, secure deletion and wipers, and recovers the original names of wiped files.
Third-party tools
Identifies 370+ remote access, remote execution, tunneling and file transfer tools from their installs, runs, services and registry keys.
Malicious activity
Detects persistence, credential theft, data exfiltration, ransomware, Defender tampering and vulnerable drivers.
Sigma rules
A built-in Sigma engine runs the SigmaHQ rule sets (2500+ rules) against every event log, with each match showing its rule and the events it matched.
Review
Evidence behind every finding
Each finding lists the artifacts it read and the exact records that support it, no AI guessing!
Documented severity
Each severity level rests on vendor security guidance, documented attacker use, and how directly the evidence proves what happened.
Linked artifact browser
Every source Lacuna reads, browsable, with each record linked to its findings and to its matches in other artifacts.
Source status
Lists every artifact source as read, empty, not read or not found, with the reason when a source could not be read.
Evidence handling
Triage collections
Reads triage collections, including the shadow copies they hold, or a folder containing loose artifacts.
Images, archives and drives
Opens disk images, archives and drives directly, unlocks BitLocker volumes and reads volume shadow copies.
Works offline
Runs entirely on the analysis computer: no internet connection is needed, and no data leaves the machine.
Upcoming features
1. Display settings In development
Timestamps shown in a selectable time zone, with configurable thousands and decimal separators.
2. Linux desktop app In development
Lacuna's desktop application for Linux operating systems.
3. Saved cases Planned
Save an analysis with its tags and reopen it later.
4. Records from the finding Planned
Open the exact records a finding cites, in their own artifact, from the finding itself.
5. Windows 11 support Planned
Artifacts from Windows 11, as file system timestamps and other artifacts behave differently from Windows 10.
6. Timeline Planned
Every artifact's records on one time axis.
7. Windows Server support Planned
Artifacts from Windows Server, as default settings and logging differ from desktop Windows.
8. Reports Planned
Findings exported as an HTML / PDF report.
9. Baseline comparison Planned
Compares a machine against measured baselines of clean systems on the same Windows version, to tell an unusual absence from a normal one.
?. Other Operating Systems support ?
Support for and analysis of artifacts from other non-Windows systems (Linux, Android, iOS).
Specifications
Input
Folders
- Triage collections
- Folder containing collected artifact files
Archives
- Zip
- 7z
- Tar, gzip, bzip2 or xz compressed
Disk images
- EnCase (E01)
- Raw (dd, img, raw), including images split in numbered files
- Virtual Hard Disk (VHD and VHDX)
- VMware Virtual Machine Disk (VMDK)
- VirtualBox Disk Image (VDI)
Drives
- Drives attached to the analysis computer
- BitLocker volumes, unlocked with a recovery password, password or startup key
- Volume shadow copies, in images and on drives
Artifacts
File system
- $MFTThe NTFS Master File Table: a record for every file and folder on the volume, with its names, size and timestamps. A deleted file's record remains until NTFS reuses it.
- USN journal ($J, $Max)The NTFS change journal: each file creation, modification, rename and deletion on the volume, with its time ($J), and the journal's size settings ($Max).
- Recycle Bin
- Shadow copies' $MFTThe $MFT of each volume shadow copy: the files the volume held when the snapshot was taken.
Program execution
- PrefetchFiles (.pf) Windows writes to speed up program launches. Each records a program's name, run count, last run times and the files it opened while starting.
- AmcacheA registry hive (Amcache.hve) in which Windows inventories the programs and drivers on the system, with their path, SHA1 hash and publisher.
- ShimCacheThe Application Compatibility Cache, in the SYSTEM hive: executables Windows checked for compatibility, with their path and last modification time.
- BAM and DAMBackground and Desktop Activity Moderator: entries in the SYSTEM hive recording, for each user, the programs run and when each last ran.
- UserAssistEntries in each user's NTUSER.DAT counting the programs started from the Windows interface, with the last time each was started.
- SRUMThe System Resource Usage Monitor database (SRUDB.dat): about hourly records of each program's resource use, including the bytes it sent and received over the network.
Registry
- SYSTEM, SOFTWARE, SECURITY, SAMThe system's registry hives: services, devices and system configuration (SYSTEM), installed software and system-wide settings (SOFTWARE), the security policy (SECURITY) and local accounts (SAM).
- NTUSER.DAT, UsrClass.datEach user's registry hives, holding their settings and many records of their activity, such as recently used files, typed commands and folders opened.
- BCDThe Boot Configuration Data store: how Windows starts, including recovery options and security settings applied at boot.
Event logs
- EVTX filesWindows event logs (.evtx): records of system, security and application events, such as logons, service installations and errors.
User activity
- ShellbagsRegistry records of the folders a user browsed in File Explorer, kept even after a folder is deleted.
- Recent shortcuts and Jump ListsShortcut files (.lnk) and per-application lists Windows keeps of the files and folders a user recently opened, with the target's path and timestamps.
- RunMRUThe commands a user typed in the Run dialog (Win+R).
- Windows Timeline (ActivitiesCache.db)A per-user database of activity: the applications used and the files opened, with their times.
- PowerShell history
Browsers
- Chromium browsers and Firefox: history, downloads, extensions
- Internet Explorer and Edge Legacy (WebCacheV01.dat)The browsing history database of Internet Explorer and Edge Legacy, which also records files opened through File Explorer.
Security
- Windows Defender logs, detection history and quarantine
- Firewall configuration
- Audit policy
System
- Scheduled tasks and services
- WMI repositoryThe database where WMI stores its classes and objects (OBJECTS.DATA), including event subscriptions, which can start programs automatically.
- setupapi.dev.logWindows' device installation log: each device and driver installed, with its time, USB storage included.
- USB device records
- Recovery environment (ReAgent.xml)The configuration file of the Windows Recovery Environment, recording whether it is enabled.
- CryptnetUrlCacheWindows' cache of files downloaded by its certificate services, where downloads made with certutil are kept too.
Third-party toolsRead when the collection holds them. Small configuration files are also read from their $MFT record when they were not collected.
- Remote access tools' connection logs
- File transfer tools' configurations and logs
- Tunneling tools' configurations
- History cleaners' settings
Compatibility
- Runs on
- Windows 10, Windows 11 (Linux: in development). GUI desktop app
- Evidence from
- Windows 10 (Windows 11 and Windows Server: planned)
Interested in testing Lacuna?
We are looking for digital forensics investigators to try Lacuna on real-world evidence and share their feedback.