We have moved. See CybercrimeTech.com
2017-01-25
2017-01-09
[How to] GPG and Signing Data
GNU Privacy Guard (GPG) uses public and private keys to secure communications (public-key cryptography). Many people use it to encrypt their email or other documents. An email encrypted with a user's public key can then only be decrypted with the same user's private key. This provides end-to-end encryption of the message, meaning that it is impractical for anyone that is listening in on the conversation to get the message in transit.
This is, of course, good and bad. For example, Google and other email providers use email text to gain intelligence about the user, sell user information and do better ad targeting. This revenue stream keeps these services free, but users pay for it in terms of 'sold' privacy. Email using end-to-end encryption cannot be analyzed for useful marketing information. Because of this, these providers don't want to make it easy for mass encryption.
On the other hand, criminals also use Cloud-based email services. Making encryption somewhat difficult means that sloppy criminals are less likely to use encryption. If so, they may be easier to detect and catch.
Whether you are paranoid and want all your emails encrypted (good luck), or you are trying to implement a personal or business data classification policy, GPG can help with encryption requirements.
Beyond encryption, GPG is useful for signing data. This is not exactly a signature that you would put on a document. Instead it is a signature that verifies that the data is correct. The video below describes how to sign data.
Signing data lets your contacts know that the data has not been modified from the time it left your possession. Signing is NOT encryption. Everyone could see the contents. Singing just allows your contact to know the data came from you, and it is in it's original state.
2017-01-02
[How to] Beginner Introduction to The Sleuth Kit (command line)
Today we will give a beginner-level introduction to The Sleuth Kit from command line. If this video is helpful, I highly recommend reading The Law Enforcement and Forensic Examiner's Introduction to Linux.
2016-12-26
[How to] Installing and updating Linux in Virtualbox
Today we are going to install and update a Debian-based operating system in VirtualBox as a guest operating system.
The first video goes through creating a virtual machine in VirtualBox, and installing an operating system from an ISO disk image.
The next video uses apt-get to update the software in the system, as well as ifconfig and ping to check if the network is working.
The final video shows how to install VirtualBox Guest Additions to allow multiple features inside the guest operating system.
The first video goes through creating a virtual machine in VirtualBox, and installing an operating system from an ISO disk image.
The next video uses apt-get to update the software in the system, as well as ifconfig and ping to check if the network is working.
The final video shows how to install VirtualBox Guest Additions to allow multiple features inside the guest operating system.
2016-12-19
[How To] Digital Forensic Memory Analysis - Volatility
This week we will begin with a very basic introduction into the memory analysis framework Volatility. We will use volatility to collect information about a memory image, recover the processes that were running in the system at the time of acquisition, and try to find malicious processes within the memory image. We will cover volatility in more depth in a later video.
2016-12-15
What I'm Reading: Robust bootstrapping memory analysis against anti forensics
Today we are talking about 'Robust bootstrapping memory analysis against anti-forensics' by Lee Kyoungho, Hwang Hyunuk, Kim Kibom and Noh BongNam. This paper deals with anti-forensics techniques against memory analysis, as well as using KiInitialPCR as a more tamper-resistant data structure for OS fingerprinting and process list extraction.
K. Lee, H. Hwang, K. Kim, and B. Noh, “Robust bootstrapping memory analysis against anti-forensics,” Digit. Investig., vol. 18, Supplement, pp. S23–S32, Aug. 2016.
Science Direct: http://www.sciencedirect.com/science/article/pii/S1742287616300408
DFRWS Archive: https://www.dfrws.org/file/712/download?token=sWs0HHYB
K. Lee, H. Hwang, K. Kim, and B. Noh, “Robust bootstrapping memory analysis against anti-forensics,” Digit. Investig., vol. 18, Supplement, pp. S23–S32, Aug. 2016.
Science Direct: http://www.sciencedirect.com/science/article/pii/S1742287616300408
DFRWS Archive: https://www.dfrws.org/file/712/download?token=sWs0HHYB
2016-12-12
[How To] Digital Forensic Memory Analysis - strings, grep and photorec
This week we will show how to use basic data processing tools strings, grep and photorec to start an analysis of a Random Access Memory (RAM) image, even if we currently know nothing about the image. These methods are extremely basic types of analysis, but they are also fast and can produce some interesting results.
2016-12-09
What I'm Reading: A functional reference model of passive systems for tracing network traffic
What I'm Reading: Today we are talking about 'A functional reference model of passive systems for tracing network traffic' by Thomas E. Daniels. This paper deals with network traffic origin analysis using passive methods.
T. E. Daniels, “A functional reference model of passive systems for tracing network traffic,” Digit. Investig., vol. 1, no. 1, pp. 69–81, Feb. 2004.
Link: http://www.sciencedirect.com/science/article/pii/S1742287603000045
Audio only:
T. E. Daniels, “A functional reference model of passive systems for tracing network traffic,” Digit. Investig., vol. 1, no. 1, pp. 69–81, Feb. 2004.
Link: http://www.sciencedirect.com/science/article/pii/S1742287603000045
Audio only:
2016-12-05
[How To] Forensic Memory Acquisition in Linux - LiME
This week we will be using LiME to acquire a memory image in a suspect Linux system. LiME is a loadable kernel module that needs to be compiled based on the specific arch of the suspect device. We show the basics of compiling, and how to load the kernel object to copy a RAW memory image.
2016-11-28
[How To] Forensic Memory Acquisition in Windows - FTK Imager
This week we will show you have to do a very simple Windows Memory acquisition using AccessData's FTK Imager.
2016-11-21
[How To] Forensic Data Recovery in Linux - tsk_recover
This week we will talk about The Sleuth Kit, and specifically the tool tsk_recover. tsk_recover is a useful tool for allocated and unallocated file recovery. tsk_recover is a good quick solution, but in terms of performance, other tools tend to carve data better. I recommend using this in conjunction with other tools in an automated processing chain.
2016-11-17
No More Ransom - Detecting and unlocking ransomware without paying
Data is valuable. Ransomware takes advantage of the financial or sentimental value of our data, as well as the fact that most homes and organizations do not have adequate data backup solutions in place.
Once a computer is infected with ransomware, individual files are normally encrypted and users are asked to pay a ransom to unlock their data. If the victim pays, the data may or may not be unlocked. Ransomware started off like most viruses, targeting average computer users opportunistically. Ransomware groups, however, started targeting hospitals, police organizations and others.
Once a computer is infected with ransomware, individual files are normally encrypted and users are asked to pay a ransom to unlock their data. If the victim pays, the data may or may not be unlocked. Ransomware started off like most viruses, targeting average computer users opportunistically. Ransomware groups, however, started targeting hospitals, police organizations and others.
So what can you do if you are infected with ransomware? Internet vendors and law enforcement have come together to create No More Ransom. This website gives users information about current types of ransomware, download unlocking tools (for free), provides prevention information and even has a tool to analyze your encrypted files and recommends which unlocking tool to use.
The Problem
Ransomware is possible because people do not have backups in place.
The Solution
Backups.
If you have an extra hard-drive that you are not using, or even another computer that is often on, CrashPlan is a pretty straightforward backup solution that is free if you save data to your own computers.
Note: DropBox or similar are not good backup solutions because they constantly sync changes. If ransomware infects your systems, the changes may be synced to your cloud storage. With a backup solution like CrashPlan, 1) backup is not instantaneous and 2) CrashPlan keeps track of prior versions of data. So if encrypted files were backed up, you can still restore prior versions. Best of all, CrashPlan provides end-to-end encryption (if enabled).
2016-11-14
[How To] Forensic Data Recovery in Windows - Photorec
This week we will show how to use Photorec to recover data form a suspect disk image. Photorec supports the recovery of many different file types, but we will focus on jpg image recovery. Photorec works in Windows, Mac and Linux and is a useful tool for automating data recovery on suspect disk images.
2016-11-10
Warning to Forensic Investigators: USB KILLER
This post is informational for digital forensic investigators and first responders. Be aware of the 'USB Killer'. Very basically, it's a USB device that contains a high-voltage capacitor that charges up from the USB power supply, then releases a large charge directly into the USB data bus potentially destroying the motherboard.
The device itself is made for 'penetration testers' to test the physical security of a system. The device shown is from USB Kill, but such a device would be trivial to create using any USB device and a high-voltage capacitor - like so.
Here are some comments on Reddit about whether a suspect would be liable if the police seize one of these and fry the investigation computer / write blocker.
This device is not to be confused with the USB Kill Switch, that checks if devices are added or removed and shuts the system down. The USB Killer focused on physical damage.
Unfortunately, I've not seen more information on forensic forums about these type of devices. SANS and Forensic Focus have some short articles on it. The device looks like a normal USB stick. Be sure to check any USB devices before imaging.
 |
| USB Killer device from USB Kill [https://www.usbkill.com] |
Here are some comments on Reddit about whether a suspect would be liable if the police seize one of these and fry the investigation computer / write blocker.
This device is not to be confused with the USB Kill Switch, that checks if devices are added or removed and shuts the system down. The USB Killer focused on physical damage.
Unfortunately, I've not seen more information on forensic forums about these type of devices. SANS and Forensic Focus have some short articles on it. The device looks like a normal USB stick. Be sure to check any USB devices before imaging.
2016-11-07
[How To] Forensic Acquisition in Windows - FTK Imager
In this video we show how to do a forensic acquisition of a suspect disk using FTK Imager in Windows.
2016-11-03
Paid Graduate Positions Available: Digital Investigations in Internet of Things
The
Legal Informatics and Forensic Science (LIFS) Institute in the
College of International Studies at Hallym University, South Korea,
currently has openings for full-time researchers at the Masters,
Ph.D. and Postdoctoral levels.
These
positions deal with Internet of Things (IoT) digital forensic
investigations. The following skills are necessary:
-
Programming skills (any language)
-
Ability to plan and carry out research
-
Ability to work with a team
The
following skills are preferred but not required:
-
Knowledge of embedded systems
-
Embedded system programming experience
-
Computer / Network administration experience
-
Competency in Linux / Unix systems
-
Knowledge of Digital Forensic Investigation techniques (esp. acquisition)
These
positions include a full scholarship as well as a monthly living
stipend. Candidates should be willing to relocate to Chuncheon, South
Korea.
To
apply for the Master’s and Ph.D. positions, please do the
following:
-
Send an email with your CV and links to any research papers you have published to joshua.i.james@hallym.ac.kr with the subject “IoT Graduate Application”.
-
Apply for a graduate position with Hallym University [http://bit.ly/20Fvvi4] by November 10th, 2016.
-
Complete the basic application files
-
Other documents can be provided later (such as passport info, diploma, etc.)
-
No Visa will be issued until certified copies of supporting documents are provided.
To
apply for a Post-doctorate
in Digital Forensic Investigation of IoT Devices, please do the
following:
-
Send an email with your CV and links to any research papers you have published to joshua.i.james@hallym.ac.kr with the subject “IoT Postgraduate Application”.
-
Candidates must have already completed a PhD degree.
2016-11-01
사물인터넷(IoT) 디지털 수사 관련 전액장학금 지원 석/박사 직위 공모
한림대학교
국제학부의 정보법과학전공에서는 현재 석사,
박사,
그리고
박사후과정생을 대상으로 정규직 연구원을 모집하고
있습니다.
해당 직위는 사물인터넷(IoT) 디지털 포렌식 수사에 관련된 연구를 담당하므로, 다음과 같은 자격을 요합니다.
석사 및 박사과정생 직위에 응모하기 위해서는 다음과 같이 지원해주시기 바랍니다.
1. 자신의 이력서 1부, 출판된 연구결과물에 대한 링크를 “IoT Graduate Application”을 제목으로 하여 joshua.i.james@hallym.ac.kr 로 이메일을 보내주시기 바랍니다.
◦ 후보자들은 반드시 박사학위를 취득하였어야 합니다.
해당 직위는 사물인터넷(IoT) 디지털 포렌식 수사에 관련된 연구를 담당하므로, 다음과 같은 자격을 요합니다.
-
프로그래밍
실력 (언어
무관)
-
연구설계
및 실행능력
-
팀워크
능력
-
임베디드
시스템에 대한 지식
-
임베디드
시스템 프로그래밍 경험
-
컴퓨터/네트워크
관리 경험
-
리눅스/유닉스
시스템에 대한 이해
-
디지털
포렌식 기법 (특히
획득기법)에
대한 지식
석사 및 박사과정생 직위에 응모하기 위해서는 다음과 같이 지원해주시기 바랍니다.
-
자신의
이력서 1부,
출판된
연구결과물에 대한 링크를 “IoT
Graduate Application”을
제목으로 하여
joshua.i.james@hallym.ac.kr
로
이메일을 보내주시기 바랍니다.
-
2016년
11월
10일까지
다음 링크 [http://bit.ly/20Fvvi4]로
한림대학교 대학원에 지원해주시기 바랍니다.
◦ 다음 링크 [http://bit.ly/2eWHVSM]를 통해 지원서 파일을 다운받은 후,
◦ 기본 지원서 파일을 작성하시기 바랍니다.
◦ 완성된 지원서 파일을 grad@hallym.ac.kr 로 발송하면서 joshua.i.james@hallym.ac.kr 로 참조를 걸어주시기 바랍니다.
◦ 여권 및 신분증, 학위증명서 등 기타 다른 문서는 나중에 제출하셔도 됩니다.
1. 자신의 이력서 1부, 출판된 연구결과물에 대한 링크를 “IoT Graduate Application”을 제목으로 하여 joshua.i.james@hallym.ac.kr 로 이메일을 보내주시기 바랍니다.
◦ 후보자들은 반드시 박사학위를 취득하였어야 합니다.
2016-10-31
[How To] Forensic Acquisition in Linux - Guymager
This video shows how to acquire a forensic disk image of a suspect device in Linux using Guymager. Guymager is an extremely fast digital forensic imaging tool (the fastest in our experiments). It allows for the acquisition of many types of devices to RAW and Expert witness formats.
2016-10-24
[How To] Forensic Acquisition in Linux - DCFLDD
This video shows how to use DCFLDD to acquire a disk image from a suspect device in the Linux command line. DCFLDD is an expanded version of 'dd' that supports additional features that are useful for digital forensic acquisitions.
2016-10-17
[How To] Forensic Data Acquisition - Hardware Write Blockers
In this video we will show external write-blockers and describe how they are used to prevent writing data to suspect devices. We will talk about bottlenecks in the connection and how to make sure your acquisition is as fast as possible.