Forensics – Page 2 – Baker Street Forensics

Streamline Digital Evidence Collection with CyberPipe 5.2

DFIR, Forensic Imaging, Forensics, PowerShell, Triage, USB

I first wrote CyberPipe when I was on the front lines of incident response, driven by the need for more robust and efficient triage collections, whether online or off. Over the years, CyberPipe continues to adapt and improve, addressing the ever-changing challenges faced by incident response practitioners.

CyberPipe (formerly CSIRT-Collect) is a PowerShell script that is designed to streamline the collection of digital evidence using Magnet Response in enterprise environments, ensuring that responders can gather critical data efficiently and effectively. Other features include detection of encrypted drives, BitLocker key recovery, and memory image collection.

The most recent update includes enhancements in three areas: Collection, Capabilities, and Reliability.

🔍 What’s New in 5.2

Intelligent Collection

The script now includes dual disk space validation, checking both the target drive and the system drive with profile-aware thresholds to prevent sudden failures due to insufficient space.
A pre-collection volatile snapshot captures uptime, users, connections, and processes to preserve transient state before heavy operations begin.
Reports virtual environment detection (VMware, Hyper-V, VirtualBox, etc.) to help analysts understand collection limitations.
Real-time progress indicators provide accurate size tracking during the collection, offering responders visibility into the remaining data capture.

Enhanced Capabilities

The new QuickTriage profile allows for rapid collection of volatile and system artifacts when time is ticking.
BitLocker recovery now includes all volumes, not just the C: drive.
A single-file report (CyberPipe-Report.txt) consolidates metadata and a summary of collected artifacts in a human-readable format.
All collected artifacts and logs are hashed using SHA-256 to enhance integrity and chain of custody.
Output compression is available via the -Compress flag, aiding in storage and transfer.
Network collection is simplified with the -Net parameter, eliminating the need for manual network path or configuration edits.

Improved Reliability

Profile-aware space checks alert when free space is insufficient for a chosen profile, preventing silent failures.
The script now validates exit codes from MAGNET Response to detect failures more effectively.
Artifact verification after collection ensures that all expected items were gathered.
Error handling and messaging have been refined to provide clearer feedback to the operator.

What I’m hoping this delivers

CyberPipe 5.2 aims to address some challenges observed in real-world triage and live-response operations:

Resilience in constrained environments — dual drive checks and profile awareness help prevent mid-collection failures.
Better transparency and oversight — real-time progress display and post-collection verification enhance confidence.
Faster response options — the QuickTriage profile is suitable when speed is paramount.
Stronger forensic hygiene — SHA-256 hashing, improved error detection, and full-volume BitLocker key recovery contribute to defensibility.
Easier network deployments — built-in ‘-Net‘ support facilitates smoother remote collection.

As always, CyberPipe is freely available at https://github.com/dwmetz/CyberPipe. Forks and Contributions welcome and appreciated.

Is there a feature you’d like to see? I think next I might work on support for copying output to AWS/Azure. Thoughts?

Cross-Platform DFIR Tools: MalChelaGUI on Windows

Forensics, Malware, Rust

It’s a Trick and a Treat

Sometimes the best breakthroughs are the ones you don’t plan for. After a routine Windows update this week, I launched MalChelaGUI from the Ubuntu terminal on an Ubuntu WSL2 instance — and it simply opened. No X-server, no environment tweaks, no extra packages.

🎉 😱 A Rust native GUI app on Windows, via Ubuntu WSL terminal!

The latest WSL 2.5 + WSLg 1.0.66 update from Microsoft quietly unlocked full Wayland and GPU acceleration for Linux GUI apps on Windows 11 24H2. (Note the latest WSL at the time of this post is 2.61)

The result? MalChelaGUI now runs as a true desktop app on Windows, powered entirely by Ubuntu WSL.

Why This Matters

🧰 No configuration needed — just follow the default instructions at GItHub, and build MalChela as usual. (WSL, Ubuntu 24.04 or later)
🪟 Native windowing — Clipboard, display scaling, and GPU acceleration all handled automatically.
🦀 Cross-platform parity — macOS, Linux, and now Windows (via WSL) all run the same GUI experience.

It’s a small but meaningful proof of concept: cross-platform DFIR tooling can now live comfortably in every environment analysts work in — even Windows, without compromise.

Call for Testers

If you’re running Windows 11 24H2 or newer, update WSL and give it a try:

```powershell
wsl --update

Then from Ubuntu WSL

./target/release/MalChelaGUI

If it launches successfully, drop me a note or tag me — I’d love to hear how it behaves across different hardware and GPU setups.

Enhance Threat Hunting with MITRE Lookup in MalChela 3.0.2

DFIR, Forensics, Malware, MITRE ATT&CK, Rust

Understanding adversary behavior is core to modern forensics and threat hunting. With the release of MalChela 3.0.2, I’ve added a new tool to your investigative belt: MITRE Lookup — a fast, offline way to search the MITRE ATT&CK framework directly from your MalChela workspace.

Whether you’re triaging suspicious strings, analyzing IOCs, or pivoting off YARA hits, MalChela can now help you decode tactics, techniques, and procedures without ever leaving your terminal or GUI. MITRE Lookup is powered by a local JSON snapshot of the ATT&CK framework (Enterprise Matrix), parsed at runtime with support for fuzzy searching and clean terminal formatting. No internet required.

What It Does

The MITRE_lookup tool lets you:

Search by Technique ID (e.g., T1027, T1566.001)
Search by topic or keyword (e.g., ‘RDP’, ‘Wizard Spider’)
Get tactic category, platforms, and detection guidance
Optionally include expanded content with the –full flag
Use from the CLI, MalChela launcher, or GUI modal

Example:

$ ./target/release/MITRE_lookup -- T1059.003

T1059.003 - Windows Command Shell

Tactic(s): execution

Platforms: Windows

Detection: Usage of the Windows command shell may be common on administrator, developer, or power user systems depending on job function. If scripting is restricted for normal users, then any attempt to enable scripts running on a system would be considered suspicious. If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions are suspicious. Scripts should be captured from the file system when possible to determine their actions and intent...

GUI Integration

Select MITRE Lookup in the left-hand Toolbox menu
Use the input field at the top of the modal to enter a keyword or technique ID (e.g., `T1059` or `registry`)
Use the “Full” checkbox for un-truncated output
“Save to Case” option

Saving for Later

You can save MITRE Lookup results directly from the GUI, either as a standalone markdown file to a designated folder, or into the active Case Notes panel for later reference. This makes it easy to preserve investigative context, cite specific TTPs in reports, or build a threat narrative across multiple tools. The saved output uses clean Markdown formatting — readable in any editor or compatible with case management platforms. This feature is already live in v3.0.2 and will evolve further with upcoming case linkage support.

*Markdown view of a **MITRE_lookup** report*

Why MITRE ATT&CK in MalChela?

MalChela already focuses on contextual forensics — understanding not just what an artifact is, but why it matters. By embedding MITRE ATT&CK into your daily toolchain:

You reduce pivot fatigue from switching between tools/web tabs
You boost investigation speed during triage and reporting
You enable a more threat-informed analysis process

Whether you’re tagging findings, crafting YARA rules, or writing case notes, the MITRE integration helps turn technical output into meaningful insight — all from within the MalChela environment.

Toby-Find: Simplifying Command-Line Forensics Tools

DFIR, Forensics, Malware, Memory Analysis, Raspberry Pi, Triage

In digital forensics, we often take a toolbox approach — success hinges on having the right tool for the job. Some tools offer broad functionality, while others are deeply specialized. Distributions like KALI and REMnux do a fantastic job bundling a wide range of forensic and security tools, but keeping track of what’s actually installed can be a challenge.

If you’re using a graphical interface, browsing through available packages is fairly intuitive. But when you’re living in the terminal — as many analysts do — that discoverability disappears. There’s no built-in index of command-line tools or how to invoke them.

The first version of Toby-Find was born out of necessity. I teach a Network Forensics course at the university, using a custom VM loaded with tools like Zeek, Tshark, Suricata, and more. I wanted students to have an easy, searchable way to see what CLI tools were available and how to run them — without needing to memorize commands or dig through man pages.

Later, when I built Toby (a forensic-focused Raspberry Pi rig running a customized KALI install), I updated Toby-Find to include the complete CLI toolset geared toward forensics and malware analysis from the KALI ecosystem.

And because I can’t leave well enough alone, I decided to build a REMnux-compatible version too.

⸻

Once installed, you can launch Toby-Find (via tf, toby-find, or tf-help) from any terminal and instantly search for tools, descriptions, examples, and more.

⸻

📦 Installation

1. Clone the repository:

git clone https://github.com/dwmetz/Toby.git

2. Make the install script executable:

cd Toby
chmod +x install.sh

3. Run the installer:

./install.sh

4. Follow the prompt to choose your environment (KALI or REMnux)
5. Open a new terminal or run:

source ~/.bashrc   # or ~/.zshrc depending on shell

🚀 Usage

tf [keyword]

Examples:

tf yara
tf volatility
tf hash

To view the full list:

tf-help

Whether you’re working from a custom VM, a rugged Pi, or a hardened REMnux box, Toby-Find gives you a fast, terminal-friendly way to surface the tools at your disposal — without breaking focus. It’s lightweight, portable, and easy to extend for your own lab or classroom.

You can grab the full installer from GitHub, and contributions are always welcome. If you find it helpful — or build on it — I’d love to hear about it.