Allegretto

Scenario

In this Sherlock, you will investigate artifacts from a computer seized by law enforcement from Shadow, a notorious drug dealer known to use advanced technology, such as Dark Web platforms, encrypted devices, and privacy-oriented email providers, to hide his criminal activities.

Executive Summary

The seized host held a KAPE-style collection of the suspect’s profile plus an image of an encrypted USB drive. Registry software inventory and the Thunderbird profile gave the suspect’s installed GIS tooling and both of his mailboxes. The sent mail carried the payment wallet, while the Tor Browser profile showed the marketplace onion address and, through its cookie store, when it was last visited. The Thunderbird calendar and an emailed spreadsheet’s embedded metadata supplied a planned meeting and a document creation time. A BitLocker recovery key stored in the user’s documents unlocked the USB image, where the Recycle Bin metadata exposed a deleted file whose recovered contents held the stash coordinates.

Artifacts

• Registry hives: NTUSER.DAT / SOFTWARE from the collection → RECmd with a batch file, then read the CSV
• Thunderbird profile: ImapMail/, Local Folders/, prefs.js, calendar local.sqlite → read mbox files as text, sqlite3 for the calendar
• Tor Browser profile: places.sqlite, cookies.sqlite → sqlite3 on a copy (the originals are locked WAL databases)
• Encrypted USB image: E01 with a BitLocker partition → ewfmount, then dissect.fve and dissect.ntfs

Timestamp note: Firefox and Thunderbird SQLite stores use epoch microseconds, and the calendar is stored in UTC. December falls outside British Summer Time, so Europe/London equals UTC for the meeting.

Discovery

Installed software lives in the registry uninstall keys. Run RECmd over the collected hives with an installed-software batch file that dumps Uninstall entries, then search the CSV for the GIS package. The DisplayName carries the full version string, codename included.

RECmd -d <collected hives> --bn tools/ez/RECmd/BatchExamples/InstalledSoftware.reb --csv work/recmd

grep -i qgis work/recmd/*.csv

The suspect’s identity on the privacy mail provider shows up in the Thunderbird mailbox. Grep the IMAP INBOX and Sent mbox files for the provider’s domain and read the From: header on outgoing mail, which carries the display name Shadow with the address.

grep -rhoiE 'shadow[^ ]*@darkmail[^ >]*' ImapMail "Local Folders" | sort | uniq -c

Thunderbird keeps account definitions in prefs.js. The second configured account holds the Hotmail identity, so the mail.identity.*.useremail and mail.server.*.userName entries give it directly.

grep -iE 'hotmail|useremail' prefs.js

Collection

From Q2 we know the Sent mailbox in Local Folders is the suspect’s own outgoing mail. The payment-request messages there quote the wallet in the body. The address is a 34-character legacy P2PKH string that matches the format mask.

grep -oE '[13][a-km-zA-HJ-NP-Z1-9]{25,34}' "Local Folders/Sent" | sort | uniq -c

Copy places.sqlite out of the Tor profile and read moz_places. The marketplace host appears in the visit history, and the same host appears on a cookie in Q5 and in the Sent mail, so three artifacts agree. The mask wants the scheme included.

cp places.sqlite* /tmp/tor/ && sqlite3 /tmp/tor/places.sqlite "select url,visit_count from moz_places where url like '%.onion%'"

cookies.sqlite stores lastAccessed in epoch microseconds per cookie. Filter moz_cookies on the marketplace host from Q4 and convert the value. The value is the last time the browser sent that cookie to the site, which is what the question asks for.

sqlite3 /tmp/tor/cookies.sqlite "select host,name,datetime(lastAccessed/1000000,'unixepoch') from moz_cookies where host like '%silkroad%'"

Thunderbird’s calendar lives in local.sqlite. The cal_events table has an entry titled for the boss meeting, and event_start is epoch microseconds. Converting gives the scheduled time; the calendar timezone is Europe/London, which is UTC in December, so no offset applies.

sqlite3 local.sqlite "select title,datetime(event_start/1000000,'unixepoch') from cal_events"

The spreadsheet arrived as an email attachment. Extract the .xlsx from the mbox, unzip it, and read docProps/core.xml. The dcterms:created element holds the creation time in UTC, which is the document’s own metadata and not the time it was received or saved to disk.

unzip -p contacts_due_amounts.xlsx docProps/core.xml | grep -o '<dcterms:created[^<]*<'

Gotcha: The mail header date and the filesystem times describe delivery and extraction. The question wants the creation time inside the document.

Defense Evasion

The USB image is a BitLocker volume, so it first has to be unlocked, and no BitLocker tooling ships with a stock DFIR kit. The recovery key sat in the suspect’s documents folder (Others/Documents in the collection). Mount the E01 with ewfmount, take the partition at sector 128, and decrypt it with a small dissect.fve script using that key, then walk the NTFS MFT with dissect.ntfs. In $RECYCLE.BIN the $I file stores the original path (from byte 28 in the version 2 record layout), and the paired $R file holds the content used in Q10.

ewfmount usb.E01 /tmp/ewf

python3 -I decrypt_usb.py /tmp/ewf/ewf1 --offset 128 --recovery-key KEY /tmp/usb_dec.img

python3 -I dump_recycle.py /tmp/usb_dec.img

Gotcha: An MFT listing built from a loop counter is not the record number. Look records up by number and check the name before trusting them.

From Q9 we know the deleted file is a KML, and the Recycle Bin kept its $R data file. Read the $R KML from the decrypted image and find the Placemark named for the stash. KML stores longitude,latitude in decimal degrees, so swap them and convert to degrees, minutes and seconds.

grep -A3 -i 'Stash Roman' recovered_KML.kml

Gotcha: The seconds come out fractional (42.7). The accepted answer truncates to the whole second; rounding up is wrong.

Attack Summary

Phase	Action
Discovery	Suspect’s GIS software and both mailbox identities recovered from the registry and Thunderbird profile
Collection	Payment wallet identified in outgoing mail
Collection	Tor Browser profile shows the marketplace onion address and last cookie access
Collection	Calendar entry for a meeting with the boss; spreadsheet metadata dates the contact ledger
Defense Evasion	File deleted from the BitLocker-protected USB drive
Collection	Recovery key found on the host, USB decrypted, deleted KML restored with the stash location

IOCs

Type	Value
Email	shadow152535@darkmail[.]htb
Email	shadow152535@hotmail[.]com
Bitcoin address	39tjYdCgsmko1uqW1uiE7sKEZZxhHo2UmK
Onion URL	hxxp[://]silkroadm5oqzuz3yq7pvwvinvyzeg2wnpnw3t4cyrsggrcgqfy2ptid[.]onion
Deleted file	E:\Locations\Item_Dropoff tracking.kml
Document	contacts_due_amounts.xlsx

MITRE ATT&CK

Technique	ID	Description
Software Discovery	T1518	Installed GIS software read from the registry
Email Collection: Local Email Collection	T1114.001	Mailboxes and calendar in the Thunderbird profile
Browser Information Discovery	T1217	Tor history and cookies show marketplace use
Data from Local System	T1005	Spreadsheet and recovery key held on disk
File and Directory Discovery	T1083	Recycle Bin and MFT walk of the USB image
Indicator Removal: File Deletion	T1070.004	Location file deleted from the encrypted drive

Defender Takeaways

A recovery key stored beside the encrypted volume defeats the encryption. The BitLocker key sat in the same user’s documents, so seizing the host also seized the USB. Keep recovery keys in escrow away from the protected data.

Deleting from an NTFS volume does not erase it. The Recycle Bin kept both the original path in $I and the full content in $R. Secure deletion or wiping is needed if removal is the intent; for investigators, always check $RECYCLE.BIN first on an unlocked volume.

Application metadata outlives the activity. Cookie lastAccessed, calendar events and Office core.xml all recorded times the suspect never meant to keep. Each is cheap to parse and independent of filesystem timestamps.

Plan for tooling gaps on encrypted images. Without BitLocker tooling the USB is a dead end. Having dislocker or dissect.fve ready for a recovery-key unlock saves the most valuable evidence.

Conclusion

The suspect’s identities, wallet, marketplace and meeting plans were all recoverable from ordinary application stores, and the one encrypted drive he relied on opened with a key kept on his own machine. The deleted stash file was the payoff, restored from the Recycle Bin.