1. 1 Virtual Forensics Lab Steve Kim (Client) Marilyn Silva Rajeswari Ian Anu Nagpal Anthony Glover 1

2. 2 Overview Virtual Forensics  CASE STUDY An actual NYPD criminal case helped motivate this work. A person, let's say Sam, was contacted on a Social Network, and decided to go to meet this other person. The other person's intent was to rob Sam. In attempt to escape, Sam ran into the street and killed by on-coming traffic. This then became a homicide case.  SOLUTION Developed security software tools, which can be used within Social Networks, to help in tracking down criminals.  OBJECTIVES Retrieve user’s non-personal-identifiable data, during users Contact via the following Virtual environments:  Social Network Sites  Chat Sessions  E-mail  Website (Developed in Java) 2

3. 3 Topics  Technology Used Chart  Social Network Site  Data Retrieval using - PHP Scripting  Detecting Device Type  Detecting Mobile Device Model  IM Chat Session  E-mail  MAC Address Retrieval – Using Java Applet  Future Enhancements Virtual Forensics 3

4. 4 Technology Chart Data Retrieval Virtual Forensics Virtual Environment Virtual Environment Examples Technology/ Techniques Social Network SiteMySpace FaceBook Hidden PHP scripts into Social Network Page API. SQL for Database storage IM Chat SessionMSN chat session Yahoo chat session Real-time MS-DOS prompt NetStat (Network Statistics) commands. E-mailHotmail email Yahoo email View emailed messages’ source code, to see IP address information. WebsiteCustom developed Java Website, used as an early project phase work-around. Java Java Applets 4

5. 5 Virtual Forensics Social Network Site Data Retrieval  PHP Scripted Web Site: http://www.virtualforensics.net/track.phphttp://www.virtualforensics.net/track.php  Social Network Tracking – SETUP PROCESS  Place the data retrieval PHP web link, into an image source tag syntax  Place above source tag into “Headline” section of your MySpace or FaceBook: 5  Tracks the visitors to website  Can be integrated for use in tracking Social Network Site visitors.  Captures information of visited users  Stores retrieved user data to database  Appends retrieved user data to website for on-screen view

6. 6 Virtual Forensics Social Network Site (cont.) Data Retrieval Visitor entry from database, for viewing on web  The captured user data is stored to a database, and appended to list of visitors already in database.  All tracked visitor information is then retrieved from the database logs, and displayed to following link for on-screen viewing: http://www.virtualforensics.net/  Listing of Social Network Site user’s retrieved data: 6

7. 7 Virtual Forensics Social Network Site Detection of Device Type  PHP Scripted Web Site: http://www.virtualforensics.net/mobiledetect/detect.php 7  Detects the type of device used to login (PC, Mobile, etc)

8. 8 Virtual Forensics Social Network Site (cont.) Detection of Mobile Device Model  PHP Scripted Web Site: http://www.virtualforensics.net/mobiledetect/detectmobile.php 8  Detects the Mobile Model (Blackberry, I-Phone, etc)

9. 9 Virtual Forensics Java Applet MAC Address Retrieval 9  If assigned by the manufacturer, a MAC address (Media Access Control address ) encodes the manufacturer's registered identification number Display of retrieved user’s MAC address retrieved  MAC address

10. 10 Virtual Forensics IM Chat Session Data Retrieval  NetStat IP address of Local Machine and Foreign Machine 10  Is a command which retrieves other person’s IP address & MAC address of person you are chatting with.  MS-DOS prompt type the following command and press enter: NetStat –n 3

11. 11 Virtual Forensics IM Chat Session (cont.) Data Retrieval  IP address on the left hand side, 172.22.45.77 (see Figure 1) represents your IP address. The IP address on the right hand side, 172.22.47.248 (see Figure 1) represents the IP address of foreign machine. The 4 digit value following each IP address represents the port to which it is connected to.  You can connect to the foreign IP address by typing the following command. From the MS-DOS prompt type the following command: C:\>nbtstat -A 172.22.47.248 the output 11

12. 12 Virtual Forensics IM Chat Session (cont.) Data Retrieval  On figure from previous slide (slide 10), the 172.22.47.248 represents the foreign machine’s IP address.  This entered command will output the values of: o Node o IP address o NetBIOS o Remote Machine Table o MAC address of Foreign Machine 12

13. 13 Virtual Forensics E-Mail Data Retrieval  Retrieve email sender’s IP address, by following below steps. Within a yahoo email account do as follows: 13  Go to inbox  Open your email  Click the drop down for Standard Header (see figure 3)  Click Full Header from the Standard Header’s drop down (figure 3 on next slide)  Dialog box with the IP information appears RESULTS: The sender’s IP address will appear in dialogue box. (Continued on next slide to view)

14. 14 Virtual Forensics E-Mail (cont.) Data Retrieval 14

15. 15 E-Mail (cont.) Data Retrieval IP address is 198.105.45.132 Virtual Forensics

16. 16 Virtual Forensics Future Enhancements  Assigning the Java applet used to identify the Mac address of the client to the website  Retrieving the User Name of other user accessing the monitored Social Network page  Expand on fields to be retrieved during email communication. 16

17. 17 Virtual Forensics The End Thank you! 17