Tools · Forensics tools · 17 / 25
CyberChef: encodings that show up in real evidence
Base64, hex, URL encoding, and UTF-16 are ways a log stores bytes. Recognizing them lets you recover text you were already holding, and the alphabet is a check against a wishful decode.
Base64 is an alphabet, not a file type
Base64 writes bytes as the letters A through Z, a through z, digits, plus and slash, with equals signs as padding. Whitespace and line breaks are common in logs. From Base64 accepts the alphabet and ignores the kind of file you hope it is. After you decode, look at the result. A readable command, a ZIP header, or a short JSON object is a reason to believe the operation. High-entropy garbage means this slice was not Base64, or you included a prefix that was not part of the field.
Windows logs sometimes store UTF-16LE text that was then Base64-encoded. The decode looks like letters separated by null bytes. A second operation that removes nulls, or an operation that decodes UTF-16LE, makes it readable. The recipe has two steps because the artifact had two layers, and you say so. The sample from pid 4812 in this case is plain ASCII under one layer of Base64, so a single From Base64 is the whole chain. If you meet the null-padded form later, you will see it.
Q29weS1JdGVtIC1QYXRoICJDOlxVc2Vyc1xhdmVyeVxEb2N1bWVudHNcUGF5cm9sbC1BcHJpbC54bHN4IiAtRGVzdGluYXRpb24gIiRlbnY6VEVNUFxwNC54bHN4Ig== # From Base64 -> Copy-Item ... Payroll-April.xlsx ... p4.xlsx
Hex is just the bytes, written out
From Hex turns pairs of hex digits into bytes. Spaces, colons, and 0x prefixes show up depending on which tool wrote the field. Strip a prefix only when it is a prefix and not part of the data. A SHA-256 in the Autopsy report is hex, and decoding it as if it were a message produces 32 bytes of digest, which is not a document. Recognize a hash by length and context before you decode it: 32 hex characters is MD5, 40 is SHA-1, 64 is SHA-256. Those are identifiers you already used. Leave them as identifiers.
A hex dump of a small structure is a fair decode. You From Hex, then you look for a header you know, or you hand the bytes to the timestamp lesson if the field is a clock. The length has to match the structure. Eight bytes can be a Windows FILETIME. Four bytes can be a Unix time if you are in the right range. Sixteen bytes is not a hunch. Count them.
URL encoding and lookalikes
URL encoding uses percent signs and two hex digits for a byte that was not left as itself. URL Decode belongs on a query string or a path you took from a browser artifact or a proxy log. It does not belong on a Base64 field that happens to contain a percent sign after a wrong first step. Nested encoding exists: a value that was URL-encoded and then Base64-encoded will need the operations in the reverse order. You learn the order from the context, one layer at a time, and you stop when the result is the URL or the path the rest of the case already talks about.
Quoted-printable and similar mail encodings appear in exported messages. Use the operation that names that encoding, and only on the message part that was encoded. Running it on the whole mailbox file will “decode” ordinary text into nonsense and hide the one attachment header you needed. Slice the input down to the field. Record the slice in the note: “body of the parameter, not the whole CSV line.”
A decode earns its place
Write a one-line check for every layer. “Output starts with Copy-Item and names both case paths.” “Output is 32 bytes and equals the SHA-256 we already had, so this was a hash, not a payload.” “Output is not text and has no header we recognize, so this chain stops.” The check is what you are willing to show a second examiner. Without it, a recipe is a preference.
Keep the original field in the input file untouched. CyberChef’s output is a new buffer. If you overwrite the Sysmon CSV with a decoded column, you have damaged an export. Decode beside the source. The YARA rule can then point at the decoded file and at the original, and the labels content and mention still make sense.
Worked case: one layer, checked against the paths
You paste the Base64 field into the local workbench. From Base64 yields Copy-Item with the Documents path and the Temp path. The check passes: both names match the Autopsy exhibits, and the output does not contain a second encoding. A hex-looking column elsewhere in the CSV is 64 characters and matches the workbook SHA-256 you already computed, so you label it as the hash and you do not From Hex it into a fake file.
The recipe file has one operation. The input file is only the Base64 field, not the entire Sysmon export. You note the slice. The next lesson’s clocks can use a different slice from the same export without mixing the two recipes.
Diagram
Three encodings and the check you run after
What you look for once the operation finishes
- Base64
The alphabet and padding fit, and the output is a format you can name: text, a header, or UTF-16LE that needs a second step.
- Hex
The digit pairs become a counted length. A 32-byte result that matches a report is a SHA-256, so you stop and cite it.
- URL encoding
Percent-bytes turn back into a path or a query. The slice is the field, not the whole log line.
Check yourself
1. A CSV column is 64 hex characters and equals the SHA-256 Autopsy reported for the workbook. Which treatment fits?