Presentation is loading. Please wait.

Presentation is loading. Please wait.

“A GENERAL STRATEGY FOR DIFFERENTIAL FORENSIC ANALYSIS” Presented by: Garrett Leach

Similar presentations


Presentation on theme: "“A GENERAL STRATEGY FOR DIFFERENTIAL FORENSIC ANALYSIS” Presented by: Garrett Leach"— Presentation transcript:

1 “A GENERAL STRATEGY FOR DIFFERENTIAL FORENSIC ANALYSIS” Presented by: Garrett Leach

2 Quick Definitions Image – “A byte stream from any data-carrying device” Feature – Information implied or extracted from image

3 Prior Work (And related) We are already familiar with diff File/Data sync programs Rsync Git Svn Previous timeline reconstruction papers

4 Use cases Malware discovery Discover alterations to system files and registry Insider Threat Detection Discover irregularities in time Generalizable to other areas (Pattern of life) Pre-emptive routine imaging* Discard files that will not be important Windows update files

5 The generalized approach Collect Feature Metadata Location(s) Name(s) Timestamps Create list of changes Locate inconsistencies in time Beware common pitfalls Report

6 Report Generation Intent: Suppress unwanted features Common techniques: Present statistics (instead of enumerating features) Organize features into hierarchies that can be expanded (folder, file/name, metadata) Organize features into timeline

7 Tools created idifference(.py) Reads DFXML (for each image) Outputs filepaths in 1 st image and not second, inodes added to 2 nd, and filepaths added to 2 nd rdifference.py Reads two windows registry files Outputs: new and deleted cells and values (both content and type) and keys with changed mtimes Caveat: Some cells have non-unique paths

8 Tools created bulk_diff.py Compares data (histograms) between runs of bulk_extractor (from another paper) corpus_sync.py Sync program that recognizes renames Not deletion and creatioon flowdiff (in-progress as of publication) Processes pcap files to create DFXML

9


Download ppt "“A GENERAL STRATEGY FOR DIFFERENTIAL FORENSIC ANALYSIS” Presented by: Garrett Leach"

Similar presentations


Ads by Google