1 / 14

Nov 1, 2005

Nov 1, 2005. Computer Forensics (Lab 2 Related). What is Computer Forensics?. Forensics: The use of science and technology to investigate and establish facts in criminal or civil courts of law. Computer Forensics:

pascal
Download Presentation

Nov 1, 2005

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Nov 1, 2005 Computer Forensics (Lab 2 Related) INFSCI 2935: Introduction of Computer Security

  2. What is Computer Forensics? • Forensics: • The use of science and technology to investigate and establish facts in criminal or civil courts of law. • Computer Forensics: • Commonly defined as the collection, preservation, analysis and court presentation of computer-related evidence. • Gathering and analyzing data in a manner as free from distortion or bias as possible to reconstruct data or what has happened in the past on a computer system. INFSCI 2935: Introduction to Computer Security

  3. What is Computer Forensics? • Understand what happened • Proper acquisition and preservation of computer evidence. • Authentication of collected Data for court Presentation • Recovery of all available data, including deleted files • Prevention of future incidents • Often similar problems to AuditBut audit trail may be inadequate! • Audit information incomplete/insufficient • Audit trail damaged • We don’t own the computer INFSCI 2935: Introduction to Computer Security

  4. What is the Challenge? • Audit information incomplete/erased • Reconstruct deleted information • “Acceptable” state of system unknown • Need to identify violation in spite of this • Goal not obvious • Transformations may have been applied to data • Strong burden of proof • Not enough to know what happened • Must be able to prove it INFSCI 2935: Introduction to Computer Security

  5. FBI List of Computer Forensic Services • Content (what type of data) • Comparison (against known data) • Transaction (sequence) • Extraction (of data) • Deleted Data Files (recovery) • Format Conversion • Keyword Searching • Password (decryption) • Limited Source Code (analysis or compare) • Storage Media (many types) INFSCI 2935: Introduction to Computer Security

  6. The Coroner’s Toolkit (TCT) Overview • Collections of tools to assist in a forensic examination of a computer (primarily designed for Unix systems) http://www.porcupine.org/forensics/tct.html • mactimes - report on times of files • ils - list inode info (usually removed files) • icat - copies files by inode number • unrm - copies unallocated data blocks • lazarus - create structure from unstructured data • file - determine file type • pcat - copy process memory • grave-robber - captures forensic data INFSCI 2935: Introduction to Computer Security

  7. Law Enforcement Challenges • Many findings will not be evaluated to be worthy of presentation as evidence • Many findings will need to withstand rigorous examination by another expert witness • The evaluator of evidence may be expected to defend their methods of handling the evidence being presented. INFSCI 2935: Introduction to Computer Security

  8. do not start looking through files start a journal with the date and time, keep detailed notes unplug the system from the network if possible do not back the system up with dump or other backup utilities if possible without rebooting, make byte by byte copies of the physical disk capture network info capture process listings and open files capture configuration information to disk and notes collate mail, DNS and other network service logs to support host data capture exhaustive external TCP and UDP port scans of the host contact security department or CERT/management/police or FBI if possible freeze the system such that the current memory, swap files, and even CPU registers are saved or documented short-term storage packaging/labeling shipping Broader Picture:What to Do INFSCI 2935: Introduction to Computer Security

  9. Well-known ports • A port is a number used to identify a network service on an IP network (the Internet) • A port in the TCP/UDP header directs packets to the appropriate application in the server. • For the complete list of well-known ports and registered ports, visit www.iana.org/assignments/port-numbers • The Internet Assigned Numbers Authority (IANA) registers ports 1024 to 49151 • Port numbers from 49152 to 65535 are private ports • Some well-known ports are HTTP (80), HTTPS (443), FTP (20, 21), FTPS (989, 990), Telnet (23), SSH (22), DNS (53), Kerberos (88), SMTP (25), POP3 (110), IMAP (143), etc. INFSCI 2935: Introduction to Computer Security

  10. Port Redirection • Port restrictions are enforced to prevent attacks on well-known ports • Port redirection is used to overcome port restrictions (shown in the illustration). INFSCI 2935: Introduction to Computer Security

  11. Steganography • Art of hiding information in the midst of irrelevant data • This is NOT cryptography • Useful to hide the existence of secret communication INFSCI 2935: Introduction to Computer Security

  12. Example of Steganography (Text – page 48) Dear George, Greetings to all at Oxford. Many thanks for your letter and for the summer examination package. All entry forms and fees forms should be ready for final dispatch to the syndicate by Friday 20th or at the latest I am told by the 21st. Admin has improved here though there is room for improvement still; just give us all two or three more years and we will really show you! Please don’t let these wretched 16+ proposals destroy your basic O and A pattern. Certainly this sort of change, if implemented immediately, would bring chaos. Sincerely yours, your package ready Friday 21st. room three Please destroy this immediately INFSCI 2935: Introduction to Computer Security

  13. Steganography with Bitmapped image • Steganography is the mechanism to hide relatively small amount of data in other data files that are significantly larger. • Bitmap image (raster image) is representation of a digital image as a matrix of picture elements (pixels). • Examples: JPEG, GIF, BMP and TIFF formats • The color of each pixel is individually defined as images in the RGB color space, for instance, often consist of colored pixels defined by three bytes—one byte each for red, green and blue. INFSCI 2935: Introduction to Computer Security

  14. Data Storage • Tracks • Concentric rings • Sectors • Tracks are divided radially into parts called sectors • Files storage • The minimum space occupied by any file is one sector. • Unused space in the sectors is known as slack space. INFSCI 2935: Introduction to Computer Security

More Related