FTK Labs – Lab 5: Working with PRTK (Password Recovery Toolkit)
Part I – Exporting Encrypted (i.e., password-protected) Files
Steps to completing lab:
1. Access FTK software, either on an RMU Lab PC or within Amazon AppStream virtual desktop.
2. From the desktop, open This PC icon
3. Browse to Passouts (P:) > davis > FTK Lab Data Files > EVIDENCE FILES.
4. Right-click the Washer.E01 forensic image file and choose Copy
5. Navigate to This PC > Desktop
6. Right-click to Paste the Washer.E01 image file onto the Desktop
7. Open Forensic Toolkit (FTK) software.
8. In the Case Manager screen (main screen), click on Database
9. Uncheck the option “Put each case in its own DB” (VERY IMPORTANT).
10. Choose Case > New
11. Create a new case called “Washer.” Assign “W1” as the Case Number in the Reference: field.
12. Add the Washer.E01 image file as evidence (from your Desktop).
13. Under Time Zone: select Eastern Time with Daylight Saving (US – New York)
14. Click OK
15. Click on the Overview tab and navigate to File Status > Encrypted Files
16. In the File List pane, scroll until you find the file X marks the spot.doc
17. Select X marks the spot.doc (IMPORTANT: select the X marks the spot.doc that has MD5 Hash
starting with “00a69bd . . . “).
Note the information in the File Content pane.
18. Right-click X marks the spot.doc and choose Export…
19. In the Export window, ensure that All Highlighted (1) is checked under Items to Include
20. In Destination base path, click the
icon and select your Desktop.
21. Click OK to export the encrypted file.
22. Ensure that X marks the spot.doc has been exported to your Desktop.
Questions to Answer from Part I:
1. Where can you find encrypted (i.e., password-protected) files in FTK?
2. Can you open the “X marks the spot.doc” file? Why or why not?
Part II – Create a Password Dictionary from Registry Files
Steps to completing lab:
1. In FTK, click on File > Export Word List…
2. The window entitled Select registry files to be included in Word List should appear.
3. In the list, place a checkmark to the left of the SAM, SECURITY, software, and system registry
files. (Note: these 4 files should be toward the bottom of the list).
4. Click OK
5. In the Save As window, select your Desktop as the destination.
6. In the File Name: field, enter “Washer Wordlist”
7. Click Save to create the Word List as a text file.
8. Ensure that Washer Wordlist.txt has been saved to your Desktop.
9. Minimize (don’t close) Forensic Toolkit (FTK)
10. Open PRTK software (found under Start > AccessData > PRTK > PRTK).
11. In PRTK (Password Recovery Toolkit) click on Tools > Dictionary Utility
12. When the Dictionary Utility window appears, click on the Browse… button.
13. Browse to your Desktop. Select the Washer Wordlist.txt file and click the Select Source File
button.
14. In the Dictionary Utility window, click the More Settings button. Note the various settings for
creating a Password Dictionary from Registry files. Keep the default settings.
15. Click the Generate button to create the Password Dictionary.
16. In the Dictionary Utility window, click on Dictionary Tools (upper left of window).
17. Within the Dictionary Tools menu, choose Dictionary Browser…
18. Scroll down the list of dictionaries and note that there are two new dictionaries created from
the Washer Wordlist. (Note: in the dictionary names, “en” means “English Language,” “c”
means “Codepage Format,” and “u” means “Unicode Format”).
Questions to Answer from Part II:
3. What is the purpose of a Password Dictionary?
4. Why were the Registry Files from this forensic image file used to create a Password
Dictionary?
Part III – Create a Biographical Password Dictionary
Steps to completing lab:
1. In PRTK (Password Recovery Toolkit) click on Tools > Dictionary Utility
2. In the Dictionary Utility window, click on Dictionary Tools > Biographical Dictionary
Generator…
3. Within the Biographical Data tab, type “John Washer” in the top left field.
4. In the drop-down menu choose Name (should be default) and click the Add button. Note that
“John Washer <Name>“ is displayed.
5. In the top left field, delete “John Washer” and type “Steelers”
6. In the drop-down menu, choose Word and click the Add button.
7. In the top left field, delete “Steelers” and type “July 8, 1933”
8. In the drop-down menu, choose Date and click the Add button.
9. In the top left field, delete “July 8, 1933” and type “Let’s go Stillers!”
10. In the drop-down menu, choose Phrase and click the Add button.
11. Click on the Generator tab.
12. Click the More Settings button. Note the various settings for creating a Biographical Password
Dictionary from a suspect’s profile. Keep the default settings.
13. Click the Generate button to create the Biographical Password Dictionary.
14. When the Save window appears, enter “Washer BIO” in the File Name: field.
15. Keep the default save location and click Save
16. In the Dictionary Utility window, click on Dictionary Tools (upper left of window).
17. Within the Dictionary Tools menu, choose Dictionary Browser…
18. Scroll down the list of dictionaries and note that there are three new dictionaries created from
the biographical information on John Washer (i.e., Washer BIO.xml, Washer BIO-en-c.adf, and
Washer BIO-en-u.adf).
19. In the list, click on the Washer BIO-en-c.adf dictionary and click the View Entries… button.
20. When the window opens, scroll through the many possible passwords that were created from
John Washer’s biographical information (Note: you may need to expand window).
21. Close the Entries window and close the Dictionary Utility window.
Questions to Answer from Part III:
5. Explain how a suspect’s biographical information can be used to create a (Biographical)
Password Dictionary.
6. What are other biographical items from a suspect that could be used to generate
potential passwords?
Part IV – Create a Password-Recovery Profile in PRTK
Steps to completing lab:
1. In PRTK (Password Recovery Toolkit) click on Edit > Profiles…
2. Note the default profiles listed in the Manage Profiles window
3. In the Manage Profiles window, select the PRTK profile (left side) and then click the Edit…
button.
4. In the Name field (top left), delete “PRTK” and enter “Washer Profile”
5. Note the settings in the Languages and Character Groups panes.
6. In the Dictionaries pane, under the Description tab (bottom left), scroll through the list and put
a checkmark next to all dictionaries that start with “Washer.” There should be a total of three
(3) Washer dictionaries.
7. Click on the Order tab. Move all three (3) “Washer” dictionaries to the top of the list.
8. Click OK to save the new profile. Click Close to close the Manage Profiles window.
Questions to Answer from Part iV:
7. Why were the 3 “Washer” password dictionaries moved to the top of the Order list?
Part V – Use Password Dictionaries to Recover Password
Steps to completing lab:
1. In PRTK (Password Recovery Toolkit) click on File > Add Files…
2. Navigate to your Desktop and select the X marks the spot.doc file.
3. Click the Add button to add the file into PRTK. (Note: you can also drag and drop files into the
PRTK interface).
4. When the Add Job Wizard (Page 1 of 2) window displays, click the drop-down under Profile (top
left).
5. In the drop-down list, select the Washer Profile. Click Next
6. In the Select Modules window, keep all defaults and click OK
7. In the Add Job Wizard (Page 2 of 2) uncheck ALL of the items under Module Options list that
contain the word “(keyspace)” at the end. Click Finish to recover the password.
8. When the recovery process completes, the password should be listed under the Result column.
The password should be recovered in a few minutes. If it does not recover in less than 5
minutes, then you most likely exported the incorrect X marks the spot.doc file in Part I.
9. Once recovered, you can use the password to access the X marks the spot.doc file.
10. Close out of PRTK.
Questions to Answer from Lab Part V:
8. What are the contents of the “X marks the spot.doc” file?
9. What is the difference between a Password Dictionary attack and a Brute Force
(a.k.a., KeySpace) attack?
10. Why was Brute Force/Keyspace not used in this lab?