Manager

Platform: duckerz | Category: Forensics | Type: Challenge | Difficulty: Easy | OS: Windows | Author: XESXOR | Date: 2026-01-09 | Status: Solved Techniques: evtx_parsing, xml_search, guid_extraction

Summary

Category: Forensics Difficulty: Easy Points: 100 File: manager.evtx

Manager — duckerz CTF

Description

Мы обнаружили подозрительное записывающее устройство "HarddiskVolume4", найдите DriveName и запишите в формате DUCKERZ{volume-id}

Category: Forensics
Difficulty: Easy
Points: 100
File: manager.evtx

Analysis

File Identification

 bash read-only • copy allowed Copy
$ file manager.evtx
manager.evtx: MS Windows Vista Event Log, 6 chunks (no. 5 in use), next record no. 714

The file is a Windows Event Log in EVTX format — a binary log format used in Windows Vista and later. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

EVTX Structure

EVTX files contain:

• File header
• Chunks with event records
• Each record is an XML structure with event data

This file has 6 chunks and 714 event records.

Solution

Step 1: Parsing the EVTX File

Using the python-evtx library to read and analyze events:

 bash read-only • copy allowed Copy
pip install python-evtx

Step 2: Searching for Events with HarddiskVolume4

 python read-only • copy allowed Copy
#!/usr/bin/env python3
from Evtx.Evtx import Evtx
from Evtx.Views import evtx_file_xml_view

with Evtx('manager.evtx') as evtx:
    for xml, record in evtx_file_xml_view(evtx.get_file_header()):
        if 'HarddiskVolume4' in xml:
            print(xml)

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 3: Analyzing Found Events

The script finds NTFS events (EventID 98) from the Microsoft-Windows-Ntfs provider:

 xml read-only • copy allowed Copy
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Ntfs" ... />
    <EventID>98</EventID>
    ...
  </System>
  <EventData>
    <Data Name="DeviceName">\Device\HarddiskVolume4</Data>
    <Data Name="DriveName">\\?\Volume{REDACTED}</Data>
    ...
  </EventData>
</Event>

Step 4: Extracting the Volume GUID

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

From the DriveName field we extract the volume GUID:

• Full path: \\?\Volume{REDACTED}
• Volume GUID: REDACTED

Useful Commands

 bash read-only • copy allowed Copy
# Identify EVTX file
file manager.evtx

# Install python-evtx
pip install python-evtx

# Alternative: evtx_dump for quick viewing
evtx_dump.py manager.evtx | grep -A5 "HarddiskVolume4"

Reference

Windows Event Log (EVTX)

• Windows log format starting from Vista
• Binary XML-based format
• Stores system events, security, applications

Volume GUID

• Unique volume identifier in Windows
• Format: {xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}
• Does not change when drive letter changes ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

EventID 98 (Microsoft-Windows-Ntfs)

• NTFS volume mount event
• Contains DeviceName and DriveName
• Useful for tracking device connections ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍