Getting errors when I run ParseIR.ps1 due to successful_file_copies.csv not getting created

Question

Getting errors when I run ParseIR.ps1 due to successful_file_copies.csv not getting created

Closed this issue 4 months ago · 13 comments

Greetings,

I ran the retrieveIR collection using tags -sans_triage.

After I got the results I then tried running the parser but now getting this error

2024/08/19 23:26:30 - [!] Starting Evidence Parsing...
2024/08/19 23:26:30 - [+] Using Configuration: C:\Folder\RetrievIR-release\parsing_config.json
2024/08/19 23:26:30 - [+] Using Evidence Directory: C:\Folder\RetrievIR-release\evidence
2024/08/19 23:26:30 - [+] Reading Configuration Data...
2024/08/19 23:26:30 - [!] Configuration Validated!
2024/08/19 23:26:30 - [!] Reading File Copy CSV: C:\Folder\RetrievIR-release\evidence\successful_file_copies.csv
2024/08/19 23:26:30 - [!] Fatal error parsing file copies CSV!

Then I went to my evidence folder but could not find the successful_file_copies.csv csv being generated. I also looked at your documentation and could not find anything related to troubleshooting this issue or describing a way to get that csv generated after RetreivIR.ps1 runs.

Any help resolving this issue will be very much appreciated.

Answer 1 · 2024-08-20T11:25:47.000Z

Did the rest of the results appear to be 'healthy'? Was there actual evidence stored in the expected location? Inside the evidence directory was there a file named 'failed_file_copies.csv'? Just trying to ask some troubleshooting questions here as that is an error I've not experienced before.

"successful_file_copies.csv" should be created if RetrievIR.ps1 runs without any fatal issues and collects files from the target - were there any errors when executing the main script?

I will also look into creating a post-collection generator for this data.

Answer 2 · 2024-08-20T12:59:20.000Z

The rest of the collection appeared healthy to me. Also yes I did see evidence in the expected locations.
I saw the following files for example under evidence>Hostname>Network>TCPconnections.csv.
Also there was no failed_file_copies.csv in the evidence directory.

I did not see any errors in the logs when executing the main script. See below the last lines in the logs:
`2024/08/19 23:13:15 - [*] [XXXXXXXXX] Retrieving Output File:\XXXXXXXXX\C$\Windows\temp\retrievir_registry_output_22_40_09.json

2024/08/19 23:13:15 - [*] [XXXXXXXXX] Retrieved Successfully

2024/08/19 23:13:15 - [+] [XXXXXXXXX] Deleting Shadow

2024/08/19 23:13:15 - [!] Done! Evidence Directory: C:\Folder\RetrievIR-release\evidence
`

Answer 3 · 2024-08-20T13:20:13.000Z

@snolroy Were you operating against a local or remote computer?

Answer 4 · 2024-08-20T15:35:06.000Z

I was operating against a remote computer via EDR

Answer 5 · 2024-08-20T15:53:08.000Z

@snolroy Can you elaborate on how exactly it was executed?

Was it packaged as a script and executed 'remotely' (but actually locally) via EDR console after uploading to target device?

Do you see any actual 'files' copied to disk such as the Event Logs at evidence\Windows\EventLogs?

Answer 6 · 2024-08-20T16:14:08.000Z

I actually ran it just now locally as well and got the same results as the logs look the same. See below:
2024/08/20 11:54:35 - [*] [XXXXXX] Retrieving Output File: \XXXXXX\C$\Windows\temp\retrievir_registry_output_11_48_49.json

2024/08/20 11:54:35 - [*] [XXXXXX] Retrieved Successfully

2024/08/20 11:54:35 - [+] [XXXXXX] Deleting Shadow

2024/08/20 11:54:35 - [!] Done! Evidence Directory: C:\Users\Username\Downloads\RetrievIR-release\evidence

I do see actual Event logs files copied. See below:

As for how it was ran, it was just ran via powershell using the following exact command in powershell:

C:\Users\Username\Downloads\RetrievIR-release\RetrievIR.ps1 -tags "sans_triage"

Answer 7 · 2024-08-20T16:39:38.000Z

Ok - I just tested the version currently inside the release ZIP and it did produce both successful_file_copies.csv and failed_file_copies.csv for me at the expected location inside the evidence directory so I'm really not sure why it's not being produced on your execution run.

Is the target device Windows 10? I'm trying to think of any other differences in execution that may be causing this discrepancy.

Answer 8 · 2024-08-20T17:59:46.000Z

Yes the target is a Windows 10..
Just to make sure I am using the correct one can you share the link to the latest version you used ?

Answer 9 · 2024-08-20T18:04:43.000Z

@snolroy https://github.com/joeavanzato/RetrievIR/releases/download/release/RetrievIR-1.0.rar

Once downloaded, unzip, open cmd window as Administrator, cd into the download directory, launch 'powershell' and invoke as '.\RetrievIR.ps1 -tags "sans_triage"', which is what you did before.

This should result in a directory named 'evidence' inside there - try doing this completely locally first - if this doesn't work then I will have to troubleshoot in more detail - if possible, I'd like to work with you/send you a modified script which will contain more verbose logging statements that you can then send to me for help identifying the issue.

I am doing some additional testing now.

Answer 10 · 2024-08-20T19:00:36.000Z

@snolroy I just tested this again on two fresh devices - one Windows 10 and the other a Windows Server - I ran it both locally and remotely against both and saw the expected outputs inside the evidence directory as shown in my screenshot.

I'm having a difficult time troubleshooting this since I am not experiencing the error that you are - is it possible for you to send me the log file from "RetrievIRAudit.txt"? Should be inside your cwd when running the tool.

Answer 11 · 2024-08-20T21:26:17.000Z

Let me try the latest one you sent and will get back to you if it still gives the same output. It seems I was using the old version.

Answer 12 · 2024-08-20T22:20:49.000Z

I tried with the latest one you shared and it worked! Thank you very much..

One more question...

Since I already have those downloaded now, how can I stop the script from attempting to download these again next time I run this say on a remote system using the same folder I am using currently

Answer 13 · 2024-08-20T22:30:27.000Z

Glad it is working for you now.

If you are executing from the same directory, ParseIR will check if the utility already exists and skip downloading if it does. If you want to specify a custom utility directory just use -utilities_dir to tell ParseIR where the third-party utilities are.

If you are using default settings/directory and not changing anything it should not re-download the binaries. Let me know if you are observing different behavior.