Cayman National - Drive Badger case study raw data.xlsx

	A	B	C	D	E	F	G	H	I	J	K	L	M	N	O	P	Q	R
1	READABLE VIRTUAL DRIVE IMAGES	image size [MB]	number of partitions	total space usage [MB]	total space usage [%]	total files	exfiltrated data size [MB]	number of exfiltrated files	exfil % of image size	exfil % of total usage	exfil % of files	raw timing data reported by time-spooler [real/user/sys]		exfiltration time [sec]		exfiltration performance [MB/sec]		SSD to magnetic gain
2												SSD	Seagate	SSD	Seagate	SSD	Seagate
3
4	Athol/Virtual Hard Disks/Athol_C.vhd	71,680	2	61,522	85.83	301,381	17,143	84,157	23.92	27.86	27.92	500.43/19.23/53.39	7036.21/30.42/91.01	500	7036	34.29	2.44	14.05
5	Athol/Virtual Hard Disks/Athol_S.vhd	430,080	1	345,568	80.35	405,639	335,442	405,407	78	97.07	99.94	2152.79/240.08/648.08	37775.51/388.83/1129.16	2153	37776	155.8	8.88	17.55
6	CN-AMLT/CN-AMLT_C.vhdx	51,204	3	24,351	47.56	167,501	5,844	34,926	11.41	24	20.85	293.94/8.61/24.26	2360.42/10.79/30.63	294	2360	19.88	2.48	8.02
7	CN-FS01/CN-FS01_C.vhdx	71,684	3	26,569	37.06	204,568	11,611	62,485	16.2	43.7	30.54	594.33/15.79/44.57	4148.09/19.57/57.05	594	4148	19.55	2.8	6.98
8	CN-PAMLT/CN-PAMLT_C.vhdx	51,204	3	26,015	50.81	169,695	7,734	47,580	15.1	29.73	28.04	353.16/11.00/30.79	2804.54/14.71/39.95	353	2805	21.91	2.76	7.94
9	CN-ProBank/CN-ProBanx_C.vhdx	102,404	3	98,662	96.35	317,480	65,594	96,182	64.05	66.48	30.3	1005.50/61.42/176.00	10571.81/82.20/241.93	1006	10572	65.2	6.2	10.52
10	CN-WEB/CN-WEB_C.vhdx	51,204	3	12,996	25.38	137,013	873	14,935	1.7	6.72	10.9	46.40/2.09/7.23	325.08/2.79/9.21	46	325	18.98	2.69	7.06
11	Hyper-V/Virtual Hard Disks/CaymanUAT_C.vhd	184,320	2	118,982	64.55	200,817	69,685	61,517	37.81	58.57	30.63	408.31/47.39/129.31	4656.69/69.58/192.91	408	4657	170.8	14.96	11.42
12	Hyper-V/Virtual Hard Disks/CN-AMLTS_C.vhdx	92,164	3	81,938	88.9	188,364	56,320	33,703	61.11	68.73	17.89	526.76/41.13/116.88	5684.01/55.57/158.87	527	5684	106.87	9.91	10.78
13	Hyper-V/Virtual Hard Disks/CN-BPM_C.vhdx	40,964	3	38,462	93.89	239,471	17,189	95,752	41.96	44.69	39.98	454.67/20.57/55.20	3919.03/28.08/78.66	455	3919	37.78	4.39	8.61
14	Hyper-V/Virtual Hard Disks/CN-Intranet_C.vhdx	40,964	3	25,609	62.52	224,476	10,056	50,124	24.55	39.27	22.33	293.94/13.04/34.16	11011.94/16.53/47.83	294	11012	34.2	0.91	37.58
15	Hyper-V/Virtual Hard Disks/CN-LFR_C.vhdx	61,444	3	45,628	74.26	200,967	17,444	49,533	28.39	38.23	24.65	471.31/20.95/59.39	986.18/0.65/4.73	471	986	37.04	17.69	2.09
16	Hyper-V/Virtual Hard Disks/CN-LFR_E.vhdx	409,604	1	291,757	71.23	6,467,670	289,086	6,467,620	70.58	99.08	100	6081.87/535.96/1186.11	23809.86/625.08/1450.54	6082	23810	47.53	12.14	3.92
17	Hyper-V/Virtual Hard Disks/CN-LFR_F.vhdx	204,804	1	90,480	44.18	2,206,860	86,529	2,206,860	42.25	95.63	100	2112.60/186.25/425.14	15899.81/239.04/626.54	2113	15900	40.95	5.44	7.53
18	Hyper-V/Virtual Hard Disks/CN-LFRT_C.vhdx	61,444	3	20,720	33.72	161,189	5,366	22,587	8.73	25.9	14.01	168.30/6.28/18.45	2038.82/8.86/26.25	168	2039	31.94	2.63	12.14
19	Hyper-V/Virtual Hard Disks/CN-SQL_C.vhdx	61,444	3	20,295	33.03	119,963	713	3,413	1.16	3.51	2.85	37.75/1.37/5.29	1480.25/0.48/4.65	38	1480	18.76	0.48	39.08
20	Hyper-V/Virtual Hard Disks/CN-SQL_E.vhdx	153,604	1	3,108	2.02	1,648	1,180	417	0.77	37.97	25.3	15.13/1.10/4.26	79.18/1.54/6.27	15	79	78.67	14.94	5.27
21	Primacy/Primacy_C.vhd	104,448	2	91,207	87.32	233,394	42,119	111,703	40.33	46.18	47.86	4692.25/55.06/154.15	24994.62/67.70/190.02	4692	24995	8.98	1.69	5.31
22	Primacy/Primacy_E.vhd	266,240	1	90,596	34.03	25,077	80,383	23,507	30.19	88.73	93.74	419.75/52.76/146.07	3779.28/66.93/197.98	420	3779	191.39	21.27	9
23	Primacy2016_SQL/SQL_C.vhdx	102,404	2	93,453	91.26	369,913	15,190	40,542	14.83	16.25	10.96	625.35/17.13/47.75	7828.01/0.51/4.94	625	7828	24.3	1.94	12.53
24	Primacy2016_SQL/SQL_D.vhdx	307,204	1	230,271	74.96	18,520	229,144	16,866	74.59	99.51	91.07	1374.02/156.14/475.25	11239.77/223.86/711.40	1374	11240	166.77	20.39	8.18
25
26		2,920,512		1,838,189	60.91	12,361,606	1,364,645	9,929,816	32.74	50.37	41.42			22,628	182,430	63.41	7.48	11.69
27		(total MB)		(total MB)	(avg)	(total files)	(total MB)	(total files)						(seconds)	(seconds)	(avg)	(avg)	(avg)
28
29
30
31	BROKEN VIRTUAL DRIVE IMAGES	image size [MB]	number of partitions	total space usage [MB]	total space usage [%]	total files	exfiltrated data size [MB]	number of exfiltrated files	exfil % of image size	comments
32
33	CN-DC1/CN-DC1_C.vhdx - AD domain controller	19,908	?	n/a	n/a	n/a	7,996	n/a	40.16	broken image, compressed using LZ4 instead of exfiltrating contents
34	CN-EX01/CN-EX01_C.vhdx - Exchange 2013 system	71,684	?	n/a	n/a	n/a	32,146	n/a	44.84	broken image, compressed using LZ4 instead of exfiltrating contents
35	CN-EX01/CN-EX01_S.vhdx - Exchange 2013 mail data	440,324	?	n/a	n/a	n/a	332,110	n/a	75.42	broken image, compressed using LZ4 instead of exfiltrating contents
36	CN-FS01/CN-FS01_D.vhdx - file server, documents	204,804	1	148,363	72.44	1	1	0	n/a	exfiltration attempt leads to empty FS (3 dirs, 0 files) - all files unreadable (Input/output error)
37
38	total MB including CN-FS01_D.vhdx	736,720					372,253		50.53
39	total MB without CN-FS01_D.vhdx	531,916					372,252		69.98
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100