Guide to Computer Forensics and Investigations, Second Edition

Guide to Computer Forensics and Investigations, Second Edition Chapter 10 Computer Forensics Analysis

Objectives • Understand computer forensics analysis • Use DriveSpy to analyze computer data • Use AccessData’s Forensic Toolkit (FTK) Guide to Computer Forensics and Investigations, 2e

Objectives (continued) • Use EnCase to analyze computer data • Perform a computer forensics analysis • Address data-hiding techniques Guide to Computer Forensics and Investigations, 2e

Understanding Computer Forensics Analysis • Examining and analyzing digital evidence • Nature of the case • Amount of data to process • Search warrants • Court orders • Company policies • Scope creep • Right of full discovery of digital evidence Guide to Computer Forensics and Investigations, 2e

Refining the Investigation Plan • Steps: • Determine the scope of the investigation • Estimate number of hours to complete the case • Determine whether you should collect all information • Plan what to do in case of scope creep • Determine if you have adequate resources • Establish the deadline Guide to Computer Forensics and Investigations, 2e

Refining the Investigation Plan (continued) • After you refine your plan, acquire evidence • Examine evidence • Review the latest changes in technology • Find new places for hiding information • Learn of new methods for storing data • Verify that your tools still work • Determine the suspect’s motive Guide to Computer Forensics and Investigations, 2e

Using DriveSpy to Analyze Computer Data • Files • DriveSpy.exe/ini/hlp • DriveSpy.ini sections • License • File Headers • File Groups • Search Guide to Computer Forensics and Investigations, 2e

Using DriveSpy to Analyze Computer Data (continued) Guide to Computer Forensics and Investigations, 2e

Using DriveSpy to Analyze Computer Data (continued) • File Headers • Hexadecimal numbers • Identify known files even if extension if different • You can add more headers • File Groups • Consolidate similar file types • Search for several header types at one time • You can define your own groups Guide to Computer Forensics and Investigations, 2e

Using DriveSpy to Analyze Computer Data (continued) • Search • Include keywords • Defines level of accuracy • Not case sensitive • Can produce false-positive hits • Use hex values for special characters or keywords Guide to Computer Forensics and Investigations, 2e

DriveSpy Keyword Searching • Search at physical level (Drive mode) or logical level (Partition mode) • Use Output command to create a log • Drive mode supports other file systems • NTFS, HFS, UNIX/Linux • Searches in partition gaps • Cannot analyze archive or encrypted files Guide to Computer Forensics and Investigations, 2e

DriveSpy Scripts • Run predefined commands • Similar to DOS batch files • Use them at all three DriveSpy modes • Creating a script • Use any text editor (Notepad) • Enter each command line by line • Can call other script files Guide to Computer Forensics and Investigations, 2e

DriveSpy Scripts (continued) • Example: Guide to Computer Forensics and Investigations, 2e

DriveSpy Data Integrity Tools • Wipe • Overwrites possible sensitive data that can corrupt output data • Works on sectors, partitions, drives, unallocated space, and MBR • Available in Drive and Partition modes Guide to Computer Forensics and Investigations, 2e

DriveSpy Integrity Tools (continued) • MD5 • RFC-complaint MD5 function • Hashes an entire partition, or specific files • Available in Drive and Partition mode • Dbexport • Creates a text file of all specified data in a file or disk • Works only in Partition mode Guide to Computer Forensics and Investigations, 2e

DriveSpy Residual Data Collection Tools • Recover deleted files and unused space • SaveSlack • Copy slack space from files on a partition • 8.3 filename with .dat as file extension • Works only in Partition mode • SaveFree • Collects all unallocated disk space on a partition • Works only in Partition mode Guide to Computer Forensics and Investigations, 2e

Other Useful DriveSpy Command Tools • Get FAT Entry (GFE) • Chain FAT Entry (CFE) • Chain Directory Entry (CDE) • Trace Directory Cluster (TDC) Guide to Computer Forensics and Investigations, 2e

Other Useful DriveSpy Command Tools (continued) • Cluster • Boot • PartMap • Tables Guide to Computer Forensics and Investigations, 2e

Using Other Digital Intelligence Computer Forensics Tools • Using PDBlock • Prevents data from being written on a disk drive • Can only be used on a true MS-DOS level • Turns off BIOS’s Interrupt 13 • Using PDWipe • Overwrites hard disk drives • For sanitation purposes • Wipe disk at least three to seven times Guide to Computer Forensics and Investigations, 2e

Using AccessData’s Forensic Toolkit • Supported file systems: FAT12/16/32, NTFS, Ext2fs, and Ext3fs • Interacts with other tools • EnCase, SafeBack, SaveSect • Linux or UNIX dd command • Known File Filter (KFF) • Can detect even child pornography evidence • Uses digital hash signatures Guide to Computer Forensics and Investigations, 2e

Using AccessData’s Forensic Toolkit (continued) • Log file • Searching for keywords • Indexed search • Live search • You can specify options • Analyzes compressed and encrypted files • You can generate reports using bookmarks Guide to Computer Forensics and Investigations, 2e

Using AccessData’s Forensic Toolkit (continued) Guide to Computer Forensics and Investigations, 2e

Using Guidance Software’s EnCase • Can access hard drives remotely • Floppy and CD boot disks • Built-in software write-blocker • Built-in search feature • GUI-based application Guide to Computer Forensics and Investigations, 2e

Using Guidance Software’s EnCase (continued) Guide to Computer Forensics and Investigations, 2e

Using Guidance Software’s EnCase (continued) • Options • Bookmarks • File signatures and hash sets • Security identifiers (SIDs) • Keywords • View • Gallery • Mail Guide to Computer Forensics and Investigations, 2e

Using Guidance Software’s EnCase (continued) • Timeline • When items were created, deleted, or modified • Report View • Powerful scripting feature Guide to Computer Forensics and Investigations, 2e

Using Guidance Software’s EnCase (continued) Guide to Computer Forensics and Investigations, 2e

Approaching Computer Forensics Cases • Know exactly what the case requires • Simply follow leads you uncover • Physical evidence • Digital evidence Guide to Computer Forensics and Investigations, 2e

Performing a Computer Forensics Analysis • Steps: • Use recently wiped target disks • Inventory suspect’s hardware • Remove the original disk and check date and time on CMOS • Record data acquisition steps • Process the data methodically and logically • List all directories and files on the copied image Guide to Computer Forensics and Investigations, 2e

Performing a Computer Forensics Analysis (continued) • Steps (continued): • If possible, examine all directories and files starting at root • Recover content of encrypted files • Create a document with directory and file names on the evidence disk • Identify functions of every executable file • Always maintain control of evidence Guide to Computer Forensics and Investigations, 2e

Performing Forensic Analysis on Microsoft File Systems • Recommendations • Use antivirus on bit-stream disk-to-disk copies • Examine all boot files • Recover all deleted files, slack, and unallocated space • FAT disk forensic analysis • Create image volumes and store them on CDs • Be alert for compressed partitions Guide to Computer Forensics and Investigations, 2e

Performing Forensic Analysis on Microsoft File Systems (continued) • NTFS analysis tools • DriveSpy • NTI DiskSearch NT • NTFSDOS • GUI tools • FTK, EnCase, Pro Discover DFT, FactFind, and iLook Guide to Computer Forensics and Investigations, 2e

UNIX and Linux Forensic Analysis • Windows forensics tools • EnCase • FTK • iLook • UNIX and Linux forensics tools • Sleuthkit • Knoppix-STD • Autopsy • TASK Guide to Computer Forensics and Investigations, 2e

Addressing Data-hiding Techniques • File manipulation • File names and extensions • Hidden property • Disk manipulation • Hidden partitions • Bad clusters • Encryption • Bit shifting • Steganography Guide to Computer Forensics and Investigations, 2e

Hiding Partitions • Delete references to a partition • Re-create links for accessing it • Use disk-partitioning utilities • PartitionMagic • System Commander • LILO • Account for all disk space when analyzing a disk Guide to Computer Forensics and Investigations, 2e

Marking Bad Clusters • Place sensitive information on free space • Use a disk editor to mark that space as a bad cluster • Common with FAT systems Guide to Computer Forensics and Investigations, 2e

Bit-shifting • Old technique • Shift bit patterns to alter byte values of data • Make files look like binary executable code • Tool • Hex Workshop Guide to Computer Forensics and Investigations, 2e

Using Steganography • Greek “hidden writing” • Suspect can hide information on image or text document files • Very hard to spot without prior knowledge • Tools • S-Tools • DPEnvelope • jpgx • tte Guide to Computer Forensics and Investigations, 2e

Examining Encrypted Files • Prevent unauthorized access • Password or passphrase • Recovering data is difficult without password • Key escrow • Cracking password • Expert and powerful computers • Persuade suspect to reveal password Guide to Computer Forensics and Investigations, 2e

Recovering Passwords • Dictionary attack • Brute-force attack • Password guessing based on suspect’s profile • Tools • PRTK • Advanced Password Recovery Software Toolkit • @stake’s LC5 (L0phtCrack) Guide to Computer Forensics and Investigations, 2e

Summary • Scope creep • Determine where the digital evidence is most likely stored • DriveSpy.ini comprises four sections • DriveSpy scripting capability • PDBlock and PDWipe tools Guide to Computer Forensics and Investigations, 2e

Summary (continued) • Forensics Toolkit (FTK) • Prepare your target disk • Wipe it at least three to seven times • Check for viruses • UNIX and Linux are used on Web servers • Data hiding occults digital evidence • Stenography as a way to hide information Guide to Computer Forensics and Investigations, 2e

Guide to Computer Forensics and Investigations, Second Edition