1 / 77

Forensic Overview

Forensic Overview. 10:45-11:45 AM Jeffrey Savoy, CISSP GIAC EnCE Information Security Officer University of Wisconsin Madison. Road Map:. Background Digital Preservation Digital Analysis. Background:. Definitions: Digital Investigation Answer questions about digital events

lolita
Download Presentation

Forensic Overview

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Forensic Overview 10:45-11:45 AM Jeffrey Savoy, CISSP GIAC EnCE Information Security Officer University of Wisconsin Madison

  2. Road Map: • Background • Digital Preservation • Digital Analysis

  3. Background: Definitions: Digital Investigation Answer questions about digital events Digital Forensic Investigation Answer questions about digital events so the results are admissible in court

  4. Background: • Sample forensic considerations: • Chain-of-Custody • Prevent cross contamination during exam • Wide acceptance of investigative techniques? • Can the findings be duplicated?

  5. Background: • Examples of digital investigation cases: • Electronic harassment (google, email, etc) • Fraud (spreadsheets, etc) • Illegal pornography • Stolen computer recovery • Assist in identifying owner • Hacking (software)

  6. -> Media Acquisition

  7. -> Media Acquisition -> Answer questions

  8. -> Media Acquisition -> Answer questions -> Ensure answers are correct to the extent possible

  9. Digital Investigation Tools: • A wide variety of tools exist and may operate • at one of more levels of the investigative process, eg Preservation + Analysis *Approximate; plugs-ins, etc

  10. Evidence Preservation • Sample guidelines : • Preserve original evidence and work on copy • of data • Digital data is fragile, obtain with minimal • disturbance • Results should be repeatable • Take good notes!

  11. Evidence Preservation • Traditionally obtain an exact copy of data on media that survives at power down • Higher level of certainty • Possibly capture the state of a live system • Lower level of certainly due to side effects but may lead to more understanding

  12. Evidence Preservation: • Where is the evidence? • Hard drives • USB Thumb drives • CDROMs • Floppy diskettes • Palm Pilot • Memory

  13. Evidence Preservation: • Implement media write blockers during acquisition: • Prevent changes to evidence • Sit between forensic machine and media • SCSI, sATA, IDE, etc

  14. Evidence Preservation: Write Blocker Kit “Ultimate Write Blocker Kit” Full kit approximately $1,800

  15. Evidence Preservation: Implement write blocker bridges: firewire/usb -> IDE

  16. Evidence Preservation: Implement write blocker bridges: firewire/usb -> USB

  17. Evidence Preservation: Switches can be set to allow for writes Can be useful in some cases (after preservation stage) Remember to always confirm Write protection ON.

  18. Evidence Preservation: • Network Acquisition: • Prevent writes to evidence • Sometimes best option, eg RAID array

  19. Evidence Preservation: Raw image Only data from the source media Example: dd Embedded image Includes additional descriptive data, eg hash values, case notes, etc Example: Encase evidence file Review examples…

  20. Evidence Preservation: dd Native to Unix/Linux Available for Windows Copies chunks of data from one file and writes it to another. Only knows about files and not file systems, disks, etc.

  21. Evidence Preservation: dd examples: Create an image of hard drive: dd if=/dev/hda bs=2k of=raw.img Calculate md5 checksum of drive: dd if=/dev/hda bs=2k | md5sum Preserve memory in Windows: dd if=\\.\physicalmemory of=c:memory.dd bs=47 \\.\ windows way to accessing device file

  22. Evidence Preservation: Encase example: • Highlights: • File segment size • Compression

  23. Evidence Preservation: Compare the acquisition hash: To manually calculated hash at any time: Values agree ->

  24. Evidence Preservation: Quick review: Acquire media with hardware write blockers. Examples of dd and Encase Move to Evidence Analysis…

  25. Evidence Analysis:

  26. Evidence Analysis:

  27. Evidence Analysis:

  28. Evidence Analysis: Quick Definitions: Sectors Clusters MBR Allocated vs Unallocated Clusters File Slack

  29. Evidence Analysis: Sectors and Clusters Sectors: The smallest addressable unit on a hard drive, typically 512 bytes Clusters: The smallest allocation unit by the operating system made up of groups of sectors

  30. Evidence Analysis: Master Boot Record (MBR) In PCs boot code exists in first 446 bytes of the first sector. The last bytes contain information on the first four partitions. Boot process gets code from the MBR and then looks for the first bootable partition location and find additional boot code from there.

  31. Evidence Analysis: Allocated vs Unallocated Space File systems like FAT/NTFS reserve clusters for use. As fill with files, the clusters become allocated. As files are removed, the clusters become unallocated and again available for use by the file system. Thus, unallocated space may contain useful information in an investigation.

  32. Evidence Analysis: File Slack: The file system pre-allocates space for individual files (clusters). If a file does not occupy the full space, the end is “slack”. This slack may contain information from the previous file. Similar to recording an hour length show on VHS tape and overwriting with an 30 min show. Note that File Slack is allocated space.

  33. Evidence Analysis: Encase displays file slack as red text: May find tidbits…

  34. Evidence Analysis: Encase view of sample PC media Note: MBR, Allocated/Unallocated clusters

  35. Evidence Analysis: Encase view of Sector 0 containing the MBR

  36. Evidence Analysis: We can “sweep” 64 bytes on sector offset 446 to manually confirm the partition information

  37. Evidence Analysis: Use Encase “Bookmark” to translate to the partition information. Type: Status: 80 is the bootable partition -in this case the NTFS partition

  38. Evidence Analysis: Encase “report” view of same disk confirms the information.

  39. Evidence Analysis: What happens if the partition table is gone (on purpose or otherwise)? The Encase view: Note that no logical volumes shown (C: D:) and all gray clusters

  40. Evidence Analysis: Search for common beginnings of partitions starting at sector 63 MSWIN4.0 -> Windows 98 FAT MSWIN5.0 -> Windows 2000, XP FAT NTFS -> Windows NTFS

  41. Evidence Analysis: Now inform Encase that we believe that this location contains a NTFS partition

  42. Evidence Analysis: The volume now appears -> Can save to Encase “case” to retained after shut down.

  43. Evidence Analysis: In reviewing files, Encase provides the below gui: Note ability to sort columns and files listed out

  44. Evidence Analysis: • Encase GUI provides the ability to filter: • Used to view files based on supplied criteria • Can be used to reduce many thousands of files to • more manageable level Example of listing only Word docs

  45. Evidence Analysis: Searches: Major activity in many investigations Decide on text terms or patterns

  46. Evidence Analysis: • When doing text/pattern searches • usually also run: • File signature verification • Review file headers • Hash computation • Compute hashes • on all files • Review both in moment…

  47. Evidence Analysis: Search hits displayed along with their locations on the media: Note keyword hits in unallocated clusters

  48. Evidence Analysis: File Signature verification: Encase can compare each file header to library of over 220 unique known signatures in order to determine file type, eg .doc, .jpg, etc How is this useful?

  49. Evidence Analysis: Case one: A file header matches a known value but the extension does not match Can assist in finding files with changed extensions For example renaming a .jpg file with a .txt extension: Can do for every file and quick sort to search for inconsistencies

  50. Evidence Analysis: Case two: A file header matches a known value but the file does not have an extension Encase will act consistent with header when file is double clicked, eg launch Excel for a file matching Excel header Encase will act consistent with header when file is viewed, eg Gallery view will display pictures even though no extensions Useful for file systems with Macintosh HFS file system

More Related