Digital Forensics

1. By Sarah Brule COMP 1631, Winter 2011 February 2nd, 2011 Digital Forensics

2. What is Digital Forensics? • Digital forensics is the examination, analysis and recovery of digital devices such as floppy disks, flash drives, hardrives as evidence during criminal investigation • It is often used for computer crimes or other crime scenes where a computer may of been used.

3. What most people don’t know is a deleted item is only marked, it is still in the memory in form of “slack space” which is leftover bits of old files that can be re-located and put back together. • Digital forensics can be used for other crimes, in order to confirm alibis and statements, to identify motives and other relevant information needed to solve a crime.

4. What do they look for? • Initially, investigators will look for more obvious things such as: • Signs of intrusion - Such as hidden files, directories, logs • Graphic images - Web history, image files • Personal Information - E-mail, documents * After reconstruction, it will also be possible to find deleted items that were stored in the slack space of the data storage

5. How does this work? • First step is to figure out what information may be relevant. It must be in its unaltered state. • The investigator must then make a duplicate image of the information needed and use a write blocking tool in order to prevent any alteration of the original.

6. How does this work? Analysis and imaging • Analysis is the process of using scientific methods of obtaining the information from the digital device in order to reconstruct the evidence. • During analysis, the duplicate is used in order to preserve any data from original form so not to contaminate the evidence. • Types of analysis are : • Text analysis • Image analysis • Video analysis • Executable analysis • File clustering / classification • Password Cracking

7. How does this work?- Bitstream • A bitstream is a time series of bits. These are found in computing devices and are used to create files when stored in data storage • During analysis, the investigator must use a bit stream download in order to copy the files, instead of just copy and paste, in order to preserve the slack space as well as the file. • One change in the bit stream could alter the information that is being reconstructed.

8. How does this work?- Reconstruction • Reconstruction of data is the rebuilding deleted, damaged and lost files in order to find the evidence that is needed. • It can be found in one of three places: • Slack space • Virtual memory • Encrypted Files • The investigator must prove that the information revealed by reconstruction is relevant or inconsistent by using algorithm functions.

9. Is it possible to delete the data? • In order for investigators to recover deleted files, they must use a data-recovery software. • It is almost impossible to delete all forms of data off a computer or other digital device. Even a destructive system restore will leave some files deep in the hardrive. • Formatting does not destroy any files, it just makes the files “hidden”. • The only way to be 100% certain that the files are deleted is to do a forensic wipe-out of your hardrive.

10. The B-Method • The B-Method was created in 1996 . It is a very convenient way to find data inconsistencies in digital evidence. Instead of language like in Java, C++, etc. B uses something called Abstract Machine Notation(AMN) which is a very complex language using calculus and complex algorithms • The B-Method uses complex algorithm functions in order to tell you how the system works. Using algorithm functions, You can find out what always holds true in a system and what is inconsistent. • This is very popular in the forensics field because you can manipulate your program to find information that was made up to seem “normal” in a system.

11. The B-Method • The steps to using the B- Method is to first create a program using algorithm language to specify the properties that always hold true in a system. Once that is done, investigators will then write a program concerning the evidential data in order to find inconsistencies in the system. • The program is there to analyse files stored in the memory but also any inconsistency in the absence of files that seems that they should be there, and where the timestamps on certain logs don’t match up with anything. These tend to be harder to do without algorithmic functions. • Sample of the B-method • “MACHINE FTPServer • DEFINITIONS • MODIFY == 1; • DELETE == 2; • FILESLOT == N ; • TIMESTAMP == N ; • EVENT == N ; • LAST_INDEX(X,Y,Z) == max(dom(log {(XαYαZ)})) • CONSTANTS max_log_size • PROPERTIES max_log_size ∈ N1 • VARIABLES fileStore, clk, log • INVARIANT • fileStore ∈ FILESLOT TIMESTAMP ∧ • clk ∈ N ∧ • log ∈ seq(TIMESTAMP×EVENT×FILESLOT) ∧ • /* Property 0 */ • (∀(slot,mtime,dtime).(slot ∈ TIMESTAMP ∧ mtime ∈ TIMESTAMP ∧ dtime ∈ TIMESTAMP ∧ • (mtime,MODIFY,slot) ∈ ran(log) ∧ • ∀otime.(otime ∈ TIMESTAMP ∧ (otime,MODIFY,slot) ∈ ran(log) ⇒ mtime≥otime) ∧ • dtime>mtime ∧ (dtime,DELETE,slot) ∉ ran(log) • ⇒ fileStore(slot) = mtime)) ∧ • /* Property 1 */ • (∀(slotX,slotY).((slotX ∈ dom(fileStore) ∧ (fileStore(slotX),MODIFY,slotX) ∈ ran(log) ∧ slotY ∈ • dom(fileStore) ∧ (fileStore(slotY),MODIFY,slotY) ∈ ran(log) ∧ (slotX ≠ slotY)) ⇒ • (LAST_INDEX(fileStore(slotX),MODIFY,slotX) < LAST_INDEX(fileStore(slotY),MODIFY,slotY) • ⇒ fileStore(slotX) ≤ fileStore(slotY)))) ∧ • (∀(slotX,slotY).((slotX ∈ dom(fileStore) ∧.” (Gladyshev, Pavel , 20)

12. Branching Off • Digital forensics can be branched off into 4 different categories • Computer Forensics • Mobile Device forensics • Network Forensics • Database Forensics

13. Branching Off- Computer forensics • Computer forensics is one of the 4 branches from digital forensics. It is often associated with computer crimes. It is used to explain the current state of a computing device • It deals with information in computers, embedded systems and static memory. Computer forensics deals with a broad range of information from computer logs and actual files, to lost and deleted files.

14. Branching Off- Mobile device forensics • Mobile device forensics deals with the recovery of information off mobile devices such as cell phones and PDA’s. • The difference between computer and mobile forensics is the investigator will be searching for simple forms of communication (SMS or email) information instead of deleted files. • Mobile device forensics also helps in locating people, as well as information.

15. Branching Off- Network forensics and Database forensics • Network Forensics: Network forensics is the analysis of networks. Investigators often search for signs of intrusion and illegal trafficking. It is used to gather data and information. • Database Forensics : Database forensics is the study of database information. • Investigators use log-files and ram-data to help recover relevant information in a crime.

16. Work Cited • “Bit stream." Wikipedia, The Free Encyclopaedia. Wikimedia Foundation, Inc. 22 July 2004. http://en.wikipedia.org/wiki/Bitstream. January 31st, 2011. • Carrier, Brian. “Defining Digital Forensic Examination & Analysis Tools.” Google Docs . @Stakes , 2002. http://www.dfrws.org/2002/papers/Presentations/Brian_Carrier.ppt. January 31st, 2011. • Carrier, Brian. “A Crash Course in Digital Forensics.” Google Docs. Basis Technology Corporation, June 14, 2006. http://www.basistech.com/knowledge-center/forensics/crash-course-in-digital-forensics.pdf. February 1st, 2011. • "Digital forensics." Wikipedia, The Free Encyclopaedia. Wikimedia Foundation, Inc. 22 July 2004. http://en.wikipedia.org/wiki/Digital_forensics. January 30th, 2011. • Gladyshev, Pavel. “Rigorous Development of Automated Inconsistency Checks for Digital Evidence Using the B Method.” Formal Forensics. Vol. 6 Issue 2. InternationalJournal of Digital Evidence, 2007. www.ijde.org. February 2nd, 2011. • Gleason, BJ. “Digital Forensics.” Google Docs. N.p , N.d . http://www.seoulcc.org/meetings/past_meetings/dig_for.pdf. February 1st, 2011.