8-> Media Acquisition -> Answer questions-> Ensure answers are correct tothe extent possible
9Digital Investigation Tools: A wide variety of tools exist and may operateat one of more levels of the investigative process, eg Preservation + AnalysisForensic Tool Kit (FTK)P/A$1,000Guidance Software Encase$1,500dd & The Sleuth KitOpen Source*Approximate; plugs-ins, etc
10Evidence Preservation Sample guidelines :Preserve original evidence and work on copyof dataDigital data is fragile, obtain with minimaldisturbanceResults should be repeatableTake good notes!
11Evidence Preservation Traditionally obtain an exact copy of data on media that survives at power downHigher level of certaintyPossibly capture the state of a live systemLower level of certainly due to side effects but may lead to more understanding
12Evidence Preservation: Where is the evidence?Hard drivesUSB Thumb drivesCDROMsFloppy diskettesPalm PilotMemory
13Evidence Preservation: Implement media write blockers during acquisition:Prevent changes to evidenceSit between forensic machine and mediaSCSI, sATA, IDE, etc
15Evidence Preservation: Implement write blocker bridges:firewire/usb -> IDE
16Evidence Preservation: Implement write blocker bridges:firewire/usb -> USB
17Evidence Preservation: Switches can be setto allow for writesCan be useful in some cases(after preservation stage)Remember to always confirmWrite protection ON.
18Evidence Preservation: Network Acquisition:Prevent writes to evidenceSometimes best option, eg RAID array
19Evidence Preservation: Raw imageOnly data from the source mediaExample: ddEmbedded imageIncludes additional descriptive data, eg hash values, case notes, etcExample: Encase evidence fileReview examples…
20Evidence Preservation: ddNative to Unix/LinuxAvailable for WindowsCopies chunks of data from one file and writes it to another. Only knows about files and not file systems, disks, etc.
21Evidence Preservation: dd examples:Create an image of hard drive:dd if=/dev/hda bs=2k of=raw.imgCalculate md5 checksum of drive:dd if=/dev/hda bs=2k | md5sumPreserve memory in Windows:dd if=\\.\physicalmemory of=c:memory.dd bs=47\\.\ windows way to accessing device file
28Evidence Analysis:Quick Definitions:Sectors ClustersMBRAllocated vs Unallocated ClustersFile Slack
29Evidence Analysis:Sectors and ClustersSectors: The smallest addressable unit on ahard drive, typically 512 bytesClusters: The smallest allocation unit by theoperating system made up of groupsof sectors
30Evidence Analysis:Master Boot Record (MBR)In PCs boot code exists in first 446 bytesof the first sector.The last bytes contain information on thefirst four partitions.Boot process gets code from the MBR and thenlooks for the first bootable partition locationand find additional boot code from there.
31Evidence Analysis:Allocated vs Unallocated SpaceFile systems like FAT/NTFS reserveclusters for use. As fill with files, theclusters become allocated.As files are removed, the clusters becomeunallocated and again available for use bythe file system.Thus, unallocated space may contain usefulinformation in an investigation.
32Evidence Analysis:File Slack: The file system pre-allocates space forindividual files (clusters). If a file does not occupy the full space, the end is “slack”. This slack may contain information from the previous file.Similar to recording an hour length show on VHS tapeand overwriting with an 30 min show.Note that File Slack is allocated space.
33Evidence Analysis:Encase displays file slack as red text:May find tidbits…
34Evidence Analysis:Encase view of sample PC mediaNote: MBR, Allocated/Unallocated clusters
35Evidence Analysis:Encase view of Sector 0 containing the MBR
36Evidence Analysis:We can “sweep” 64 bytes on sector offset 446 tomanually confirm the partition information
37Evidence Analysis:Use Encase “Bookmark” to translate to the partitioninformation.Type:Status: 80 is thebootable partition-in this case theNTFS partition
38Evidence Analysis:Encase “report” view of same disk confirms theinformation.
39Evidence Analysis:What happens if the partition table is gone(on purpose or otherwise)?The Encase view:Note that no logical volumes shown (C: D:) and allgray clusters
40Search for common beginnings of partitions starting at sector 63 Evidence Analysis:Search for common beginnings of partitions startingat sector 63MSWIN4.0 -> Windows 98 FATMSWIN5.0 -> Windows 2000, XP FATNTFS -> Windows NTFS
41Evidence Analysis:Now inform Encase that we believe that this locationcontains a NTFS partition
42Evidence Analysis:The volume now appears ->Can save to Encase “case”to retained after shut down.
43Evidence Analysis:In reviewing files, Encase provides the below gui:Note ability to sort columns and files listed out
44Evidence Analysis:Encase GUI provides the ability to filter:Used to view files based on supplied criteriaCan be used to reduce many thousands of files tomore manageable levelExample of listing only Word docs
45Evidence Analysis:Searches:Major activity in many investigationsDecide on text terms or patterns
46Evidence Analysis: When doing text/pattern searches usually also run: File signature verificationReview file headersHash computationCompute hasheson all filesReview both in moment…
47Evidence Analysis:Search hits displayed along with their locations onthe media:Note keyword hits in unallocated clusters
48Encase can compare each file header to library Evidence Analysis:File Signature verification:Encase can compare each file header to libraryof over 220 unique known signatures in orderto determine file type, eg .doc, .jpg, etcHow is this useful?
49Evidence Analysis:Case one:A file header matches a known value but theextension does not matchCan assist in finding files with changed extensionsFor example renaming a .jpg file with a .txtextension:Can do for every file and quick sort to searchfor inconsistencies
50Evidence Analysis:Case two:A file header matches a known value but thefile does not have an extensionEncase will act consistent with header whenfile is double clicked, eg launch Excel fora file matching Excel headerEncase will act consistent with header whenfile is viewed, eg Gallery view will displaypictures even though no extensionsUseful for file systems with MacintoshHFS file system
51Evidence Analysis:Hash computation:Calculate the MD5 hash of every file
52Evidence Analysis:Hash computation:Uses:Find specific fileThird party may provide hashes to searchMalware, illegal images, etcFilter known filesFaster searches! Example…
53Evidence Analysis:Import NIST known OS md5 hashes available on their web site
54Evidence Analysis:Encase now indicates “*known” files (* used forsorting purposes):
55Evidence Analysis:Now use an Encase Filter to remove these files from view and searches:In this case, reduced 21,088 files to 14,78730% less files to search!
56Evidence Analysis:Data Carving within EncaseCan matching headers/footers/file size/etcand search through unallocated space and “carve”out file and save to forensic machine for reviewCommonly search for jpegs, html, etcSince searching through unallocated space, thefiles found may not be competeEncase provides EnScript to do (similar to C++)
60Evidence Analysis: Example of wiping files in software: Encrypt existing folder using Microsoft Encrypting File System (EFS). Note TMP artifact left after conversionUse the cipher command to wipe directory:Result:
61Evidence Analysis:Recycle Bin:Windows 98, NT, 2000, XPThe default process when a file is moved to theRecycling bin.1. New file entry in Recycle Bin2. Additional about the file in a hiddensystem file named INFO2Most important can be thedelete date and time
62Evidence Analysis:Each INFO2 record 800 bytesWhen the file is deleted, the file is remove aswell as the corresponding INFO2 record both ofwhich may be recoverableExample..
63Evidence Analysis:INFO2 file found in the recycler bin:Can sweep 800 bytes:Bookmark to display information:
64Evidence Analysis:Encase allows the ability to export the acquiredfiles as a windows share on forensic machine.How may this be useful?
65Evidence Analysis:This is useful to allow third party tools to analyzethe export share of suspect filesExamples…
66Evidence Analysis:Virus Checking of suspect drive:
70Documents and Settings/USER/ Evidence Analysis:Windows Artifacts:Documents and Settings/USER/Recent/: Recently accessed files, programs, etcStored at this location as link files.Print spoolerPast printouts written to diskSearch for EMF files in unallocated space
71Evidence Analysis:View web cache:View browser history:
72Event reconstruction: Restoring evidenceExport programs to run on forensic machineBoot into suspects driveCommonly use VMware
73Event reconstruction: Encase allows acquired files to beexported as a physical disk
74Event reconstruction: VMware can use Encase embedded image directly andallow virtually booting into suspect drive:
75Event reconstruction: Use software to reset password to allow access: