Computer Forensics: Using Evidence Cleaners to Find Artifacts

I have used CCleaner for years and it is one of the first programs I put on new computers. It has handy functions to clean up temporary files, logs, and even the Registry. While many can argue that such a program may help erase digital evidence, it can also shed light on where to look for important items of interest.

CCleaner used to store settings in the Registry, but has now opted to use an .INI file to assist in application portability. This is a great asset to forensic examiners who like to research new artifacts. The default installation has the necessary .INI files embedded within the executable, but they are usually available for download in this support thread (forum registration required). Lifehacker recently posted an article about the enhanced version of the application .INI file which can be downloaded towards the bottom of the article.

Here are two entries from the application .INI file:

[*LimeWire]
LangSecRef=3022
DetectFile=%ProgramFiles%\LimeWire\LimeWire.exe
Default=True
FileKey1=%userprofile%\Incomplete|*.*|RECURSE
FileKey2=%userprofile%\Application Data\LimeWire|fileurns.cache
FileKey3=%userprofile%\Application Data\LimeWire|createtimes.cache
FileKey4=%userprofile%\Application Data\LimeWire|responses.cache
FileKey5=%userprofile%\Application Data\LimeWire|ttree.cache
FileKey6=%userprofile%\Application Data\LimeWire|gnutella.net

[Windows Media Player]
ID=2033
LangSecRef=3023
Detect=HKCU\Software\Microsoft\MediaPlayer\Player
Default=True
RegKey1=HKCU\Software\Microsoft\MediaPlayer\Player\RecentFileList
RegKey2=HKCU\Software\Microsoft\MediaPlayer\Player\RecentURLList
RegKey3=HKCU\Software\Microsoft\MediaPlayer\Preferences|LastPlayList
RegKey4=HKCU\Software\Microsoft\MediaPlayer\Preferences|LastPlayListIndex
RegKey5=HKCU\Software\Microsoft\MediaPlayer\Player\Settings|SaveAsDir
RegKey6=HKCU\Software\Microsoft\MediaPlayer\AutoComplete\MediaEdit
RegKey7=HKCU\Software\Microsoft\MediaPlayer\Radio\MRUList

All of the entries within the .INI files follow similar format. CCleaner only shows options to clean those programs that it knows exist on the system by using the "Detect" key to determine if a program has been installed. The entries that follow are items that will probably be of interest to a forensic examiner. The items that are listed are what CCleaner will attempt to delete or erase and are typically log files or Most Recently Used entries.

Irongeek.com posted a similar article showcasing areas of interest that are cleaned using Nirsoft.net's CleanAfterMe tool. CleanAfterMe doesn't use an .INI file, but does create a log of items that it's cleaned. You can run the program and look at the logs to see where each cleaning option points to. There are a multitude of other evidence cleaning programs that can provide similar intel. Even if there is no .INI file or log file, you can still use something like Process Monitor to see what is actually happening when the program is ran.

In my opinion, if someone was to take CCleaner's .INI files and create a tool that does the exact opposite of CCleaner - parse each item and create an information report instead of cleaning them, they would have one heck of a triage tool.

Matt Churchill currently manages the digital forensics practice at Continuum Worldwide and has earned the GCFA, CFCE, CCE, and CISSP certifications. You can follow him on Twitter @matt_churchill.