Digital forensics Andrej Brodnik Andrej Brodnik: Digital Forensics

Digital forensics Andrej Brodnik Andrej Brodnik: Digital Forensics

Computer chapter 15 pre-requisite knowledge: architecture of computers basics (BIOS) operating system secondary memory (disc) and its organization file systems Andrej Brodnik: Digital Forensics

Startup startup steps at start up, BIOS (Basic Input Output System) runs Open Firmware (Mac PowerPC), EFI (Mac Intel), Open Boot PROM (Sun), it performs a POST (Power On Self Test) the operating data are stored in xROM sometimes a password protects the data – password is entered by the user Andrej Brodnik: Digital Forensics

Startup example Moussawi: The computer has been shut down for a very long time and the battery on the motherboard has been emptied Access was possible using the data recovered before power was lost. how the data is encoded ASCII, . Little / big endian What happens if you take disc to another computer Andrej Brodnik: Digital Forensics

File format at the beginning all files have their unique signatures ( www.garykessler.net/library/file sigs.html) jpg: FF D8 FF E0 or FF D8 FF E3 gif: 47 49 46 38 37 61 or 47 49 46 38 39 61 doc: D0 CF 11 E0 A1 B1 1A E1 Andrej Brodnik: Digital Forensics

File format - example jpeg encoded exif (Exchangeable image file format) file Andrej Brodnik: Digital Forensics

File format the file can be embedded in another file find the file it can be labeled and copied (copy-paste) or use dd this procedure is called carving other tools: scalpel (http://www.digitalforensicssolutions.com/Scalpel/ ), DataLifter (http://www.datalifter.com/) EnCase (http://www.guidancesoftware.com/forensic.htm), FTK (Forensic Toolkit, http://accessdata.com/products/computer-forensics/ftk), X-Ways (http://www.x-ways.net/) Andrej Brodnik: Digital Forensics

Cutting in the end, we only get content and not metadata from the directory The other problem is that the data can be scattered through the disk Adroit ( http://digital-assembly.com/products/adroit-photo -forensics/ ) Andrej Brodnik: Digital Forensics

File format - challenge Challenge: Embed one file in the another file and publish that on the forum. The other colleagues should find the embedded file and extract it using tools like dd or some other tools motioned it the previous slides. Challenge: Divide the file into more pieces and insert each one into another file and post it all in the forum. Let your colleagues reconsider your distributed pieces. Andrej Brodnik: Digital Forensics

Data storage and hiding the I / O units are connected to the computer via: a bas (IDE, ATA, SATA; SCSI, firewire) interface (controller) the interfaces can also be smart SMART (Self-Monitoring, Analysis, and Reporting Technology) keep access statistics and other similar data usually are not relevant for forensic research Andrej Brodnik: Digital Forensics

Data storage and hiding usually we store data permanentl y on a disk What does the hard drive look like? Andrej Brodnik: Digital Forensics

Data storage and hiding how is the disk organized? spindle, platter, cylinders, tracks, sectors, cluster at the first sector are control data (MBR, master boot record) size (geometry), weak blocks, partitions, . what organization in SSD looks like? Andrej Brodnik: Digital Forensics

Data storage and hiding Challenge: find anadisk tool and see what it does. Challenge: what is the MBR structure? Build your MBR and post it in the forum. Andrej Brodnik: Digital Forensics

Data storage and hiding look at the Windows 95 boot sector with the Norton Disk Utils tool Andrej Brodnik: Digital Forensics

Data storage and hiding simplified organization of the disk with the FAT file system Andrej Brodnik: Digital Forensics

Data storage and hiding partition, volume, bundle/part inside the file system can also be without the file system Andrej Brodnik: Digital Forensics

Data storage and hiding hiding data due to internal and external fragmentation: hiding within a cluster hiding within the partition (partitions usually begin at the beginning of the trace) hiding partition partition encryption service data: DCO (Drive/device configuration overlay) and HPA (Host/hidden protected area) – http://www.forensicswiki.org/wiki/DCO and HPA Andrej Brodnik: Digital Forensics

Data storage and hiding the virus is hidden in the empty partition volume (volume slack) Andrej Brodnik: Digital Forensics

Data storage and hiding when a file is deleted, the data does not disappear even when we format the disk, the data does not disappear take a look at the tool fdisk the result of both operations is a valid file system and a cluster of empty blocks tools: sleuthkit (http://www.sleuthkit.org/), Norton DiskEdit, Andrej Brodnik: Digital Forensics

Data storage and hiding An example of the reconstruction of files on a freshly formatted disk with the EnCase tool Andrej Brodnik: Digital Forensics

Data storage and hiding Challenge: See what the MBR and boot sector on your computer looks like with an appropriate tool. Report about this on the forum. Challenge: Check the configuration of your drive. Andrej Brodnik: Digital Forensics

Data storage and hiding hiding partitions tool Test Disk (http://www.cgsecurity.org/) at file level hiding files: e.g. MS Windows: attrib H in dir/AH parlament.jpg - test.exe picture in .ppt pres. the latest tools Andrej Brodnik: Digital Forensics

Passwords and encryption tools for breaking and searching passwords Password Recovery Tool – PRTK in Distributed Network Attack – DNA ( http://accessdata.com/products/computer-forensi cs/decryption ) John the Ripper (www.openwall.com/john/) Cain and Abel (www.oxid.it/cain.html) Advanced Archive Password Recovery ( www.elcomsoft.com/azpr.html) Andrej Brodnik: Digital Forensics

Passwords and encryption more about encryption and cryptography later some examples tools caesar, rot13 support for the PGP tool crypt Andrej Brodnik: Digital Forensics

OS Windows chapter 17 file systems data recovery log files registry communication trails Andrej Brodnik: Digital Forensics

OS Windows –file system two basic file systems FAT (File Allocation Table) in NTFS (New Technology File System) FAT developed first for hard disks (floppy disks) FAT12, FAT16, FAT32 Andrej Brodnik: Digital Forensics

File system FAT FATxx is a list of index clusters in which each file is stored xx means the number of bits used for the index 12 212 4096, 16 216 65.536, 32 228 268.435.456 Andrej Brodnik: Digital Forensics

File system FAT view the root of the file system on the hard disk using the X-Ways program keeps the creation time and last changes but only the last access date Andrej Brodnik: Digital Forensics

FAT Andrej Brodnik: Digital Forensics

File system FAT Challenge: See for yourself what the FAT looks like on your disk. Look in particular for those clusters that are empty - they are not part of any file system. Andrej Brodnik: Digital Forensics

File system NTFS a more modern file system everything is in a file the file information is stored in the system file MFT directory is only a file (B tree structure) It is a journaling file system and stores transactions in the system file LogFile supports multiple data streams ACL (Access Control List) better protected, since it stores copies of file system data in multiple locations ( MFTMirr) Andrej Brodnik: Digital Forensics

File system NTFS Andrej Brodnik: Digital Forensics

File system NTFS Challenge: look for clusters in your NTFS cluster that are empty (unused) and then look at their content. Andrej Brodnik: Digital Forensics

NTFS – MFT example of one record in MFT the record consists of attributes, the record is the size of the 1kB if the file is small, it is stored in the record when a “deleted” flag is set the record can be reused Andrej Brodnik: Digital Forensics

NTFS - search for data there is a physical file size (cluster), logical size (directory entry) and the end of the file (EOF) Andrej Brodnik: Digital Forensics

NTFS – MFT record MFT record and the differenc e between sizes Andrej Brodnik: Digital Forensics

NTFS - search for data Multiple files in a directory can have the same name Andrej Brodnik: Digital Forensics

File system NTFS Challenge: Which clusters is your file composed of? Challenge: Find a busy but unused part of your file (on which clusters) and what's in it. Challenge: What happens if we make 1000 files, then we delete 1000 and analyze the data? Andrej Brodnik: Digital Forensics

Time coding for files FAT: 1.1.1980 LLLLLLLM MMMDDDDD hhhhhmmm mmmsssss Andrej Brodnik: Digital Forensics

Time coding for files FILETIME 64 bit record value 1.1.1600 number * 100ns Andrej Brodnik: Digital Forensics

NTFS - tracks files various operations have a different impact on the recorded times in the directory (creation - CR, last access - LA, last change - LC, record changed (NTFS) - RC): moving the file into a folder: it does not affect anything moving the file to another folder: CR, LA, RC copy file (target file): CR, LA, RC copy/paste: LA(*) drag&drop: LA(*) delete: LA, RC special cases: file on a stick, can be via scp/.: CR LC when deleting a directory, file information does not change Andrej Brodnik: Digital Forensics

NTFS - tracks files . the content of office files contains metadata from the directory Save as: if an existing file is picked, the data in the file is overwritten and no new file is created in the directory printing first copies the file to a special directory and then prints it C:\Windows\Spool\Printers, C:\WinNT\System32\ Spool\Printers even when we print online content, etc. Andrej Brodnik: Digital Forensics

NTFS - tracks files . Challenge: Find a file that has a creation time greater than the time of the last change. Challenge: What can you say, is there such a file on the system that has the last access time same at he time of the creation? Challenge: What is the EMF printing method ? What is stored in the print file (spooler)? Andrej Brodnik: Digital Forensics

Data recovery recover deleted files various tools that can run on WinOS tool like SleuthKit combined with Autopsy Browser can even browse through the browser ( http://www.sl euthkit.org/a utopsy/ ) Andrej Brodnik: Digital Forensics

Data recovery Challenge: install sleuthkit and Autopsy Browser and find the lost files. Andrej Brodnik: Digital Forensics

Data recovery searching for lost files from a large unformed mound same as carving files tool DataLifter: is looking for a lost file from two empty spaces and one of the rest of the file system Andrej Brodnik: Digital Forensics

Data recovery if a small file overwrites larger one, we can reconstruct most of the larger files enCase: an example of a shopping cart in the CD Universe, found in the rest of the file space Andrej Brodnik: Digital Forensics

Log files the operating system (depending on the settings) records many access to resources appearance and deletion of resources, errors, etc. saved on %systemroot%\system32\config (c:\ winnt\.) different log entries in different files: Appevent.evt, Secevent.evt, Sysevent.evt Andrej Brodnik: Digital Forensics

Log files Challenge: check the format of the .evt file and check what is in them and when you last logged in to the system. Andrej Brodnik: Digital Forensics

Register In Windows OS, the process environment variables are defined in the registers actually, the data is stored in the files (hives) in the system directory %systemroot%\system32\ config ntuser.dat - each user has their own file files can be viewed with the Windows tool regedit32 (EnCase, FTK, .) Andrej Brodnik: Digital Forensics

Register Challenge: examine the forensic value of the data in the registry. Andrej Brodnik: Digital Forensics

Network tracking sometimes from the system environment when connecting, . mostly comes directly from application browsers, mail agents, . Andrej Brodnik: Digital Forensics

Network Tracking - Browsers history: firefox-3 has been storing history in the sqlite databases Places.sqlite Internet Explorer is storing history in the file index.dat tools that are available to search through these databases: Oddesa (www.odessa.sourceforge.net) local cache cookies Andrej Brodnik: Digital Forensics

Browsers - Cookies example of cookies inspection in CookieView ( www.digitaldetective.co.uk) Andrej Brodnik: Digital Forensics

Browsers Challenge: Find out what leftovers you do have in your cache and check with your browsing history. Challenge: Get a file from your friend's browser history and disassemble it. Challenge: Check out what kind of traces are left behind by the IE browser, what kind by the Mozilla and what kind by the Opera. Andrej Brodnik: Digital Forensics

E-mail Traces depend on the mail agent we use sent and received mails summary of IMAP mailbox content that is interesting text mails only attachments (!) – MIME format Andrej Brodnik: Digital Forensics

Other programs different programs leave different traces network software access to other systems allow other systems to access in our system system programs leave traces in the registry Andrej Brodnik: Digital Forensics

Network access tracking telnet access to acf2.nyu.edu Andrej Brodnik: Digital Forensics