1 / 18

Digital Forensics

Digital Forensics. Dr. Bhavani Thuraisingham The University of Texas at Dallas Lecture #4 Data Acquisition September 8, 2008. Review of Lectures 103. Lecture 1: Overview of Digital Forensics Lecture 2: Background on Information Security

claus
Download Presentation

Digital Forensics

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Digital Forensics Dr. Bhavani Thuraisingham The University of Texas at Dallas Lecture #4 Data Acquisition September 8, 2008

  2. Review of Lectures 103 • Lecture 1: Overview of Digital Forensics • Lecture 2: Background on Information Security • Lecture 3: Data recovery, Evidence collection, preservation and analysis

  3. Review of Chapters 1-3 of Textbook • Chapter 1: Understanding digital forensics • What is digital forensics, conducting investigation, case law (fourth amendment) • Chapter 2: Understanding investigations • Steps for an investigation: systematic approach • Evidence collections and analysis • Report writing • Chapter 3: Forensics Laboratory • Physical requirements, Workstation requirements, Making a case to build a lab

  4. Data Acquisition: Outline • Types of acquisition • Digital evidence storage formats • Acquisition methods • Contingency planning • Using acquisition tools • Validating data acquisition • RAID acquisition methods • Remote network acquisition tools • Some forensics tools • Reference: Chapter 4 of text book

  5. Types of Acquisition • Static Acquisition • Acquire data from the original media • The data in the original media will not change • Live Acquisition • Acquire data while the system is running • A second live acquisition will not be the same • Will focus on static acquisition

  6. Digital Evidence Storage Formats • Raw formats • Bit by bit copying of the data from the disk • Many tools could be used • Proprietary formats • Vendors have special formats • Standards • XML based formats for digital evidence • Digital Evidence Markup Language (Funded by National Institute of Justice) • Experts have argued that technologies that allow disparate law enforcement jurisdictions to share crime-related information will greatly facilitate fighting crime. One of these technologies is the Global Justice XML Data Model (GJXDM). • http://ncfs.ucf.edu/digital_evd.html

  7. Acquisition Methods • Disk to Image File • Disk to Disk • Logical acquisition • Acquire only certain files if the disk is too large • Sparse acquisition • Similar to logical acquisition but also collects fragments of unallocated (i.e. deleted) data

  8. Compression Methods • Compression methods are used for very large data storage • E.g., Terabytes/Petabytes storage • Lossy vs Lossless compression • Lossless data compression is a class of data compressionalgorithms that allows the exact original data to be reconstructed from the compressed data. The term lossless is in contrast to lossy data compression, which only allows an approximation of the original data to be reconstructed, in exchange for better compression rates.

  9. Contingency Planning • Failure occurs during acquisition • Recovery methods • Make multiple copies • At least 2 copies • Encryption decryption techniques so that the evidence is not corrupted

  10. Storage Area Network Security Systems • High performance networks that connects all the storage systems • After as disaster such as terrorism or natural disaster (9/11 or Katrina), the data has to be availability • Database systems is a special kind of storage system • Benefits include centralized management, scalability reliability, performance • Security attacks on multiple storage devices • Secure storage is being investigated

  11. Network Disaster Recovery Systems • Network disaster recovery is the ability to respond to an interruption in network services by implementing a disaster recovery palm • Policies and procedures have to be defined and subsequently enforced • Which machines to shut down, determine which backup servers to use, When should law enforcement be notified

  12. Using Acquisition Tools • Acquisition tools have been developed for different operating systems including Windows, Linux, Mac • It is important that the evidence drive is write protected • Example acquisition method: • Document the chain of evidence for the drive to be acquired • Remove drive from suspect’s computer • Connect the suspect drive to USB or Firewire write-blocker device (if USB, write protect it via Registry write protect feature) • Create a storage folder on the target drive

  13. Using Acquisition Tools - 2 • Example tools include ProDiscover, Access Data FTK Imager • Click on All programs and click on specific took (e.g., ProDiscover • Perform the commands • E.g. Capture Image • For additional security, use passwords

  14. Validating Data Acquisition • Create hash values • CRC-32 (older methods), MD5, SHA series • Linux validation • Hash algorithms are included and can be executed using special commands • Windows validation • No hash algorithms built in, but works with 3rd party programs

  15. title Newspaper date Frontpage Literary_page Politic_page Sport_page Leading Paragraphs Politic Article news news Author title paragraph topic topic Author title Author title topic topic Author title Author title Author title paragraph Author title Merkle Hash Signature Example MhX(Author)=h(h(Author)||h(Author.value)) MhX(title)=h(h(title)||h(title.value)) MhX(paragraph)=h(h(paragraph)||h(paragraph.content)|| MhX(Author)||MhX(title))

  16. RAID Acquisition Methods • RAID: Redundant array of independent disks • RAID storage is used for large files and to support replication • Data is stored using multiple methods • E.g, Striping • When RAID is acquired, need special tools to be used depending on the way the data is stored

  17. Remote Network Acquisition Tools • Preview suspects file remotely while its being used or powered on • Perform live acquisition while the suspect’s computer ism powered on • Encrypt the connection between the suspect’s computer and the examiner’s computer • Copy the RAM while the computer is powered on • Use stealth mode to hide the remote connection from the suspect’s computer • Variation for the individual tools (ProDiscover, EnCase)

  18. Some Forensics Tools • ProDiscover • http://www.techpathways.com/prodiscoverdft.htm • http://www.techpathways.com/DesktopDefault.aspx • EnCase • http://www.guidancesoftware.com/ • http://www.guidancesoftware.com/products/ef_index.asp • NTI Safeback • http://www.forensics-intl.com/safeback.html

More Related