8 -> Media Acquisition -> Answer questions-> Ensure answers are correct tothe extent possible
9 Digital Investigation Tools: A wide variety of tools exist and may operateat one of more levels of the investigative process, eg Preservation + AnalysisForensic Tool Kit (FTK)P/A$1,000Guidance Software Encase$1,500dd & The Sleuth KitOpen Source*Approximate; plugs-ins, etc
10 Evidence Preservation Sample guidelines :Preserve original evidence and work on copyof dataDigital data is fragile, obtain with minimaldisturbanceResults should be repeatableTake good notes!
11 Evidence Preservation Traditionally obtain an exact copy of data on media that survives at power downHigher level of certaintyPossibly capture the state of a live systemLower level of certainly due to side effects but may lead to more understanding
12 Evidence Preservation: Where is the evidence?Hard drivesUSB Thumb drivesCDROMsFloppy diskettesPalm PilotMemory
13 Evidence Preservation: Implement media write blockers during acquisition:Prevent changes to evidenceSit between forensic machine and mediaSCSI, sATA, IDE, etc
15 Evidence Preservation: Implement write blocker bridges:firewire/usb -> IDE
16 Evidence Preservation: Implement write blocker bridges:firewire/usb -> USB
17 Evidence Preservation: Switches can be setto allow for writesCan be useful in some cases(after preservation stage)Remember to always confirmWrite protection ON.
18 Evidence Preservation: Network Acquisition:Prevent writes to evidenceSometimes best option, eg RAID array
19 Evidence Preservation: Raw imageOnly data from the source mediaExample: ddEmbedded imageIncludes additional descriptive data, eg hash values, case notes, etcExample: Encase evidence fileReview examples…
20 Evidence Preservation: ddNative to Unix/LinuxAvailable for WindowsCopies chunks of data from one file and writes it to another. Only knows about files and not file systems, disks, etc.
21 Evidence Preservation: dd examples:Create an image of hard drive:dd if=/dev/hda bs=2k of=raw.imgCalculate md5 checksum of drive:dd if=/dev/hda bs=2k | md5sumPreserve memory in Windows:dd if=\\.\physicalmemory of=c:memory.dd bs=47\\.\ windows way to accessing device file
28 Evidence Analysis:Quick Definitions:Sectors ClustersMBRAllocated vs Unallocated ClustersFile Slack
29 Evidence Analysis:Sectors and ClustersSectors: The smallest addressable unit on ahard drive, typically 512 bytesClusters: The smallest allocation unit by theoperating system made up of groupsof sectors
30 Evidence Analysis:Master Boot Record (MBR)In PCs boot code exists in first 446 bytesof the first sector.The last bytes contain information on thefirst four partitions.Boot process gets code from the MBR and thenlooks for the first bootable partition locationand find additional boot code from there.
31 Evidence Analysis:Allocated vs Unallocated SpaceFile systems like FAT/NTFS reserveclusters for use. As fill with files, theclusters become allocated.As files are removed, the clusters becomeunallocated and again available for use bythe file system.Thus, unallocated space may contain usefulinformation in an investigation.
32 Evidence Analysis:File Slack: The file system pre-allocates space forindividual files (clusters). If a file does not occupy the full space, the end is “slack”. This slack may contain information from the previous file.Similar to recording an hour length show on VHS tapeand overwriting with an 30 min show.Note that File Slack is allocated space.
33 Evidence Analysis:Encase displays file slack as red text:May find tidbits…
34 Evidence Analysis:Encase view of sample PC mediaNote: MBR, Allocated/Unallocated clusters
35 Evidence Analysis:Encase view of Sector 0 containing the MBR
36 Evidence Analysis:We can “sweep” 64 bytes on sector offset 446 tomanually confirm the partition information
37 Evidence Analysis:Use Encase “Bookmark” to translate to the partitioninformation.Type:Status: 80 is thebootable partition-in this case theNTFS partition
38 Evidence Analysis:Encase “report” view of same disk confirms theinformation.
39 Evidence Analysis:What happens if the partition table is gone(on purpose or otherwise)?The Encase view:Note that no logical volumes shown (C: D:) and allgray clusters
40 Search for common beginnings of partitions starting at sector 63 Evidence Analysis:Search for common beginnings of partitions startingat sector 63MSWIN4.0 -> Windows 98 FATMSWIN5.0 -> Windows 2000, XP FATNTFS -> Windows NTFS
41 Evidence Analysis:Now inform Encase that we believe that this locationcontains a NTFS partition
42 Evidence Analysis:The volume now appears ->Can save to Encase “case”to retained after shut down.
43 Evidence Analysis:In reviewing files, Encase provides the below gui:Note ability to sort columns and files listed out
44 Evidence Analysis:Encase GUI provides the ability to filter:Used to view files based on supplied criteriaCan be used to reduce many thousands of files tomore manageable levelExample of listing only Word docs
45 Evidence Analysis:Searches:Major activity in many investigationsDecide on text terms or patterns
46 Evidence Analysis: When doing text/pattern searches usually also run: File signature verificationReview file headersHash computationCompute hasheson all filesReview both in moment…
47 Evidence Analysis:Search hits displayed along with their locations onthe media:Note keyword hits in unallocated clusters
48 Encase can compare each file header to library Evidence Analysis:File Signature verification:Encase can compare each file header to libraryof over 220 unique known signatures in orderto determine file type, eg .doc, .jpg, etcHow is this useful?
49 Evidence Analysis:Case one:A file header matches a known value but theextension does not matchCan assist in finding files with changed extensionsFor example renaming a .jpg file with a .txtextension:Can do for every file and quick sort to searchfor inconsistencies
50 Evidence Analysis:Case two:A file header matches a known value but thefile does not have an extensionEncase will act consistent with header whenfile is double clicked, eg launch Excel fora file matching Excel headerEncase will act consistent with header whenfile is viewed, eg Gallery view will displaypictures even though no extensionsUseful for file systems with MacintoshHFS file system
51 Evidence Analysis:Hash computation:Calculate the MD5 hash of every file
52 Evidence Analysis:Hash computation:Uses:Find specific fileThird party may provide hashes to searchMalware, illegal images, etcFilter known filesFaster searches! Example…
53 Evidence Analysis:Import NIST known OS md5 hashes available on their web site
54 Evidence Analysis:Encase now indicates “*known” files (* used forsorting purposes):
55 Evidence Analysis:Now use an Encase Filter to remove these files from view and searches:In this case, reduced 21,088 files to 14,78730% less files to search!
56 Evidence Analysis:Data Carving within EncaseCan matching headers/footers/file size/etcand search through unallocated space and “carve”out file and save to forensic machine for reviewCommonly search for jpegs, html, etcSince searching through unallocated space, thefiles found may not be competeEncase provides EnScript to do (similar to C++)
60 Evidence Analysis: Example of wiping files in software: Encrypt existing folder using Microsoft Encrypting File System (EFS). Note TMP artifact left after conversionUse the cipher command to wipe directory:Result:
61 Evidence Analysis:Recycle Bin:Windows 98, NT, 2000, XPThe default process when a file is moved to theRecycling bin.1. New file entry in Recycle Bin2. Additional about the file in a hiddensystem file named INFO2Most important can be thedelete date and time
62 Evidence Analysis:Each INFO2 record 800 bytesWhen the file is deleted, the file is remove aswell as the corresponding INFO2 record both ofwhich may be recoverableExample..
63 Evidence Analysis:INFO2 file found in the recycler bin:Can sweep 800 bytes:Bookmark to display information:
64 Evidence Analysis:Encase allows the ability to export the acquiredfiles as a windows share on forensic machine.How may this be useful?
65 Evidence Analysis:This is useful to allow third party tools to analyzethe export share of suspect filesExamples…
66 Evidence Analysis:Virus Checking of suspect drive:
70 Documents and Settings/USER/ Evidence Analysis:Windows Artifacts:Documents and Settings/USER/Recent/: Recently accessed files, programs, etcStored at this location as link files.Print spoolerPast printouts written to diskSearch for EMF files in unallocated space
71 Evidence Analysis:View web cache:View browser history:
72 Event reconstruction: Restoring evidenceExport programs to run on forensic machineBoot into suspects driveCommonly use VMware
73 Event reconstruction: Encase allows acquired files to beexported as a physical disk
74 Event reconstruction: VMware can use Encase embedded image directly andallow virtually booting into suspect drive:
75 Event reconstruction: Use software to reset password to allow access: