Digital Forensics and Demonstration of Basic Forensic Techniques

1. Digital ForensicsandDemonstration of Basic Forensic Techniques Thanks to… Jim Gordon MSc MBCS Worcester University 12th Nov 2012 Digital Infrastructure

2. Format of the Presentation • One hour presentation • Examples • Followed by two hours ‘Hands On’ • Review/Wash up

3. Basic Principles • Association of Chief Police Officers (ACPO) Guidelines on Computer Evidence. • Establish the basic principles of acquiring evidence from computer systems. • These principles accepted by the courts in the United Kingdom.

4. ACPO Principle 1 • No action taken by the Police or their agents should change the data held on a computer or other media. • Where possible computer data must be ‘copied’ and the copy examined.

5. ACPO Principle 2 • In exceptional circumstances it maybe necessary to access the original data held on a target computer. • However it is imperative that the person doing so is competent and can account for their actions.

6. ACPO Principles 3 • An audit trail must exist to show all the processes undertaken when examining computer data • Many forensic tools record logs of processes performed and results obtained

7. ACPO Principle 4 • The onus rests with the person in charge of the case to show that a computer has been correctly examined in accordance with the law and accepted practice

8. Forensic Imaging Process • Make a bit wise image of the contents of digital media • Store the original media and carry out forensic analysis using the copy image • If necessary to switch on suspect machine; • Restore image to another drive and install it in suspects machine • Or mount and start in a Virtual Machine • Retrieve evidence in a readable form

9. Image Hard Disk

10. Check BIOS Settings • Disconnect hard drive(s) and switch on • Check BIOS date and time • Check machine specific settings

11. Image all other Storage Media

12. Mobile Phone and PDA Forensics • Handset, Memory Card and SIM Card Examinations • Handset Examination • Logical Dump • File System Dump • Physical Dump • JTAG Dump • Chip OFF • In certain cases, SIM Cloning a requirement

13. Global Positioning Systems • Previous Destinations • Sometimes a Route or Way Points • Favourite Destinations • Link to mobile phone - Bluetooth • Contacts • Addresses • Phone numbers • Owner Details - Home Address • Unallocated - Previous Owners

14. Forensic Examination Process • Decide on best forensic tool(s) for the job • Expand ALL compound files • Hash ALL File Streams • Perform File Signature Analysis • Perform Entropy Test • Generate Index and/or Thumbnails of Graphics • Carve Data • Carve Meta Data

15. FTK EnCase X-Ways Cellebrite XRY Oxgyen Forensic Tools • Accepted by the court and validated in case law • Non-invasive computer forensic investigative tools • Cater for large volumes of data. • Read FAT, NTFS, HFS, UNIX and LINUX - Proprietary Phone Systems • Integrated environment allows users to perform all functions of a forensic analysis

16. Expand All Compound Files • Archive Files • ZIP • RAR • Complex Files • OLE (Object Linking and Embedding) • Mail Boxes • Outlook.pst • Inbox.dbx • Operating System Files • Thumbs Caches • Internet History

17. Hash All File Streams MD5 (Message Digest 5)Generates a unique 128 Bit value for each file or data stream: Example MD5 HashesMD5 = a08a8cf89436f18ea8084817357a59c1 MD5 = 271979ddf56c38805b7562046984fe40 An MD5 Hash can be used to:Identify Files to be ignored (OS Files).Identify Files of importance (Contraband Files). “This is a small text file.” “This is a small text file”

18. File Signature Analysis • Check file header to determine if file has the correct extension • Highlight files with mismatch for manual checking

19. Entropy Test • Can identify files that may be encrypted or compressed • An automated frequency analysis algorithm is used to determine if file content is encrypted • Files identified are then exported from the image and transferred to specialist decryption software

20. Generate Index • Generate an index of all strings of characters in the disk image • Speed up subsequent searches of suspect image • Index can be used as a dictionary for password cracking

21. GREP (General Regular Expressions) • GREP can be utilised for ‘fuzzy’ searching or pattern matching • Above expression will find credit card numbers \<[456]\d\d\d([\- ]?\d\d\d\d){3}\>

22. Optical Character Recognition Making Text in Pictures Searchable

23. Generate Thumbnails • Pre-generation of thumbnail images assists in graphics based cases when large numbers of suspect images exist

24. Data Carve • Search through all allocated and unallocated data streams for known headers and recreate pointers to files

25. Meta Carve • Search unallocated clusters for folder/sub-directory entries and rebuild if found

26. What happens when a file is deleted? • The Windows operating system tracks files (user data) using either a File Allocation Table or a Master File Table.  • In simple terms, the FAT or MFT tells the computer where the file begins and ends.    • Macintosh uses a similar system known as Nodes.

27. What happens when a file is deleted? • When a file is deleted, the operating system deletes the pointers to the file and in the FAT or MFT the space occupied by the file is mark as available.  • The computer does not delete the actual data that was contained in the file. 

28. Recycle Bin Forensics • Hidden System Folder • Win 95/98 called Recycled • Win2K, NT/XP/2003 called Recycler • Hidden system file named INFO2 • INFO2 contains Original Filename, Deleted Date & Time • Vista/Win7 $Recycle.bin • Original Filename, Deleted Date & Time contained in separate files for each deleted record

29. Examination of the Recycle Bin • Most forensic tools will parse the data from the INFO2 file

30. FDISK • What happens when someone FDisks drive to remove a Partition? • The 16 bytes for the partition entry within the MBR are zeroed • The actual partition including its data are untouched

31. FDISK • Partition recovery is simple • Locate VBR • Forensic Software will recover the Partition including directory structure

32. ReFormat • What happens when you reformat a drive to delete data?

33. Digital ForensicsandDemonstration of Basic Forensic Techniques Jim Gordon MSc MBCS Worcester University 12th Nov 2012 Digital Infrastructure

34. Assignment 1 guidance • Most of the concepts already covered • You will also need to show evidence that you’ve used a forensic disk analysis tool • Winhex has a “free” version • Locate & Download now… and save the zip file to your newly acquired USB stick • you’ll use this in LG022 after the break…