Forensics on deleted files on Endpoint

[Noe.ortega]

need to know if XDR has the capability to perform forensics on Endpoint if user deleted any files on computer.  If so, how would you go about performing this task.

[eluis]

Hi @Noe.ortega 

thanks for writing us in LiveCommunity. 

with xdr forensic add-on you can recover files that are in the recycle bin which is one of the artifacts covered. 

Take into account that forensic add-on wont cover:

Information about files that existed on the endpoint and were deleted before the Cortex XDR agent was installed.

Please you can find more information on: 

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Forensic-Da...

I hope this helps, 

Luis 

[Noe.ortega]

i am assuming that users can cover their tracks by clearing the Recycle Bin if they are deleting files on purpose. it would be nice to recover the files but i am really just looking for any logs that would indicate that user maliciously deleted files.  You mentioned an "add-on" that would need to be installed prior to someone doing malicious acts on Endpoint.  Where would i download this "add-on" and is there a cost to this?

[eluis]

Hi @Noe.ortega 

in order to perform forensic analysis in CXDR you need to purchase forensic add-on licenses for your endpoints. 

In the AMcache artifact you have the details of deleted files and you can recover the deleted files that are still in the recycle bin

Please check:

https://www.paloaltonetworks.com/apps/pan/public/downloadResource?pagePath=/content/pan/en_US/resour...

I hope this helps, please feel free to click on like or mark it as a solution

Luis 

[eumbach]

You may also use XQL without the need for additional licenses. 

File [ action type = delete ] AND Host [ host name = [ [WHATEVERHOST] ] AND Time [ [WHATEVERTIME] ]

This will show the hard deletes as well as soft deletes into the RB.