Forensic Analysis of Encrypted SMB Traffic: Decryption, Client Identification and Event Reconstruction

The Server Message Block (SMB) protocol is the foundation for file sharing in Windows environments. Captured SMB traffic enables the reconstruction of transferred files and file operations, providing valuable forensic evidence. With SMB version 3, optional protocol-level encryption renders existing plaintext-dependent analysis methods inapplicable. This paper investigates which forensically relevant information remains extractable from encrypted SMB traffic. We first examine the prerequisites for decryption and contribute Volatility 3 plugins that automate the recovery of session keys from memory images. When decryption is not feasible, three sources remain. First, the unencrypted session establishment reveals the authenticated user, the target server, the session timeframe, and connection parameters. Second, we extend an existing approach for fingerprinting SMB clients from two to seven features, enabling reliable identification of client implementations and finer version differentiation. Third, we introduce operation signatures, rule-based descriptions of expected packet sequences defined over payload sizes and communication directions, that reconstruct file operations without decryption. We develop an automated framework that generates datasets with reliable ground truth for evaluation. On over 18,000 operations, the signatures reconstruct 99.62 % of operations for smbclient and 96.11 % for PowerShell, including parameters such as file name lengths and transferred data volumes.