Today we will give a beginner-level introduction to The Sleuth Kit from command line. If this video is helpful, I highly recommend reading The Law Enforcement and Forensic Examiner's Introduction to Linux.
Showing posts with label Digital Forensics. Show all posts
Showing posts with label Digital Forensics. Show all posts
2017-01-02
2016-12-19
[How To] Digital Forensic Memory Analysis - Volatility
This week we will begin with a very basic introduction into the memory analysis framework Volatility. We will use volatility to collect information about a memory image, recover the processes that were running in the system at the time of acquisition, and try to find malicious processes within the memory image. We will cover volatility in more depth in a later video.
2016-12-15
What I'm Reading: Robust bootstrapping memory analysis against anti forensics
Today we are talking about 'Robust bootstrapping memory analysis against anti-forensics' by Lee Kyoungho, Hwang Hyunuk, Kim Kibom and Noh BongNam. This paper deals with anti-forensics techniques against memory analysis, as well as using KiInitialPCR as a more tamper-resistant data structure for OS fingerprinting and process list extraction.
K. Lee, H. Hwang, K. Kim, and B. Noh, “Robust bootstrapping memory analysis against anti-forensics,” Digit. Investig., vol. 18, Supplement, pp. S23–S32, Aug. 2016.
Science Direct: http://www.sciencedirect.com/science/article/pii/S1742287616300408
DFRWS Archive: https://www.dfrws.org/file/712/download?token=sWs0HHYB
K. Lee, H. Hwang, K. Kim, and B. Noh, “Robust bootstrapping memory analysis against anti-forensics,” Digit. Investig., vol. 18, Supplement, pp. S23–S32, Aug. 2016.
Science Direct: http://www.sciencedirect.com/science/article/pii/S1742287616300408
DFRWS Archive: https://www.dfrws.org/file/712/download?token=sWs0HHYB
2016-12-12
[How To] Digital Forensic Memory Analysis - strings, grep and photorec
This week we will show how to use basic data processing tools strings, grep and photorec to start an analysis of a Random Access Memory (RAM) image, even if we currently know nothing about the image. These methods are extremely basic types of analysis, but they are also fast and can produce some interesting results.
2016-12-05
[How To] Forensic Memory Acquisition in Linux - LiME
This week we will be using LiME to acquire a memory image in a suspect Linux system. LiME is a loadable kernel module that needs to be compiled based on the specific arch of the suspect device. We show the basics of compiling, and how to load the kernel object to copy a RAW memory image.
2016-11-28
[How To] Forensic Memory Acquisition in Windows - FTK Imager
This week we will show you have to do a very simple Windows Memory acquisition using AccessData's FTK Imager.
2016-11-21
[How To] Forensic Data Recovery in Linux - tsk_recover
This week we will talk about The Sleuth Kit, and specifically the tool tsk_recover. tsk_recover is a useful tool for allocated and unallocated file recovery. tsk_recover is a good quick solution, but in terms of performance, other tools tend to carve data better. I recommend using this in conjunction with other tools in an automated processing chain.
2016-11-14
[How To] Forensic Data Recovery in Windows - Photorec
This week we will show how to use Photorec to recover data form a suspect disk image. Photorec supports the recovery of many different file types, but we will focus on jpg image recovery. Photorec works in Windows, Mac and Linux and is a useful tool for automating data recovery on suspect disk images.
2016-11-10
Warning to Forensic Investigators: USB KILLER
This post is informational for digital forensic investigators and first responders. Be aware of the 'USB Killer'. Very basically, it's a USB device that contains a high-voltage capacitor that charges up from the USB power supply, then releases a large charge directly into the USB data bus potentially destroying the motherboard.
The device itself is made for 'penetration testers' to test the physical security of a system. The device shown is from USB Kill, but such a device would be trivial to create using any USB device and a high-voltage capacitor - like so.
Here are some comments on Reddit about whether a suspect would be liable if the police seize one of these and fry the investigation computer / write blocker.
This device is not to be confused with the USB Kill Switch, that checks if devices are added or removed and shuts the system down. The USB Killer focused on physical damage.
Unfortunately, I've not seen more information on forensic forums about these type of devices. SANS and Forensic Focus have some short articles on it. The device looks like a normal USB stick. Be sure to check any USB devices before imaging.
 |
| USB Killer device from USB Kill [https://www.usbkill.com] |
Here are some comments on Reddit about whether a suspect would be liable if the police seize one of these and fry the investigation computer / write blocker.
This device is not to be confused with the USB Kill Switch, that checks if devices are added or removed and shuts the system down. The USB Killer focused on physical damage.
Unfortunately, I've not seen more information on forensic forums about these type of devices. SANS and Forensic Focus have some short articles on it. The device looks like a normal USB stick. Be sure to check any USB devices before imaging.
2016-11-07
[How To] Forensic Acquisition in Windows - FTK Imager
In this video we show how to do a forensic acquisition of a suspect disk using FTK Imager in Windows.
2016-10-31
[How To] Forensic Acquisition in Linux - Guymager
This video shows how to acquire a forensic disk image of a suspect device in Linux using Guymager. Guymager is an extremely fast digital forensic imaging tool (the fastest in our experiments). It allows for the acquisition of many types of devices to RAW and Expert witness formats.
2016-10-24
[How To] Forensic Acquisition in Linux - DCFLDD
This video shows how to use DCFLDD to acquire a disk image from a suspect device in the Linux command line. DCFLDD is an expanded version of 'dd' that supports additional features that are useful for digital forensic acquisitions.
2016-10-17
[How To] Forensic Data Acquisition - Hardware Write Blockers
In this video we will show external write-blockers and describe how they are used to prevent writing data to suspect devices. We will talk about bottlenecks in the connection and how to make sure your acquisition is as fast as possible.
2016-10-10
[How To] Copy a disk image to a physical hard drive using DD
In this video we show how to copy a disk image to a physical hard drive using DD in Linux. This is useful for working with live disk images (Linux live CDs), or potentially copying suspect data to an external disk for testing.
2016-10-04
[How to] Create and verify a mutli-part disk image with FTK Imager
This video shows how to make a disk image using FTK Imager on a Windows system.
FTK Imager is an easy to use tool for copying data from suspect disks, and has other functions such as verification features and a hex view. It is a simple, stable tool that is a useful part of the beginning of an investigation.
FTK Imager is an easy to use tool for copying data from suspect disks, and has other functions such as verification features and a hex view. It is a simple, stable tool that is a useful part of the beginning of an investigation.
2016-05-10
[How-to] Load a multi-part disk image into FTK Imager
When working with multi-part disk images, it can be confusing to see if your tool has loaded all of the image or just a part. Below is one way to determine if all of your disk image has been loaded, or only the first part in FTK Imager.
Verifying your disk image
When working with your disk image, verification of the data should always be included in your workflow. In the case of a multi-part image, we should have at least two hashes:- A hash for the total disk image
- A hash for each part of the disk image
This is especially true for raw disk images, since they have no built-in checksum like expert witness format.
A hash for the total disk image is normally created by your acquisition tool, and can be found in the acquisition report. FTK Imager does not create a hash for each part of a multi-part image.
In this case, we may need to generate our own hashes using FTK, or another tool.
Why do I need hashes for each part?
If you have a hash value for the overall disk image, then - in terms of court - you will be able to show that the suspect data has not changed from the time that the disk was first acquired. However, having hashes of each part of the image can help in one major way.
The Expert Witness Format that EnCase uses has checksums every 32KB that enables verification of parts of a disk image. If one part of a disk image changes, we can potentially still use the other parts of the image that can be verified with their checksum, even if the overall hash can not be verified.
With a multi-part RAW image, we can get similar functionality by hashing each part. Each part can then be verified, along with the overall hash. If the overall hash is not valid, hashes of each part can be used to determine what part has changed. Other parts that can be verified may still be used.
Loading a multi-part image
When many tools load a multi-part image, they may only show the filename of the first part of the image. If the tool is made 'for forensics', then the tool will likely load the entire image under the first filename. In this case, verify that the tool can:
- Detect the full size of the original disk image
- Can generate the correct hash value for the original image
2016-04-14
Postdoctoral Positions Available at Hallym University, South Korea
Hello everyone! We have an opportunity for postdoctoral research positions. Positions with the Legal Informatics and Forensic Science Institute at Hallym University provide support for up to 5 years. Applicants must have obtained a PhD no more than 5 years ago. A background in criminal justice or computer science is preferred. If you are interested, please email your CV and a short introduction to joshua.i.james@hallym.ac.kr by 20th April, 2016.
Please forward to anyone that may be interested.
Please forward to anyone that may be interested.
2015-12-14
Open Source Tools Accepted in Court
Reply to an email I received:
Is it possible to use Linux live CDs (or open source software) without trouble in court?
The answer is yes, certainly.
First, there is precedent in North America and Europe. See this, relatively old article from Italy [http://nannibassetti.com/digitalforensicsreport2007.pdf].
For a full discussion about open source tools in court, I highly recommend the following paper: http://www.digital-evidence.org/papers/opensrc_legal.pdf
Very basically, to have evidence obtained using open source tools / Linux live CDs accepted in court, you need to prove that the tools give 'correct' results and do not modify potential evidence. Check local court rules for any additional standards that need to be met. If you need any help with tool testing, please contact me.
For example, if your courts already accept EnCase and you want to compare acquisition and hashing, you can do the following:
1) acquire the data with EnCase and create a hash of the data
2) acquire the data with an open source tool and create a hash of the data
3) compare the hashes of the suspect data (should be the same)
4) repeat with 5+ different exhibits to show that the same result is always found
If your courts accept EnCase, and you can demonstrate that an open source tool produces the same result, then the open source tool must also be accepted.
A procedure for tool testing should be created in your unit, if it does not already exist.
You might also be interested in the Open Source Digital Forensics Conference in the U.S.: http://www.osdfcon.org/
Please let me know if you need any help with testing, or if you have any further questions.
2015-11-03
Finding private IP addresses in Email Headers
In some cases it may be necessary or helpful to find the private IP of a suspect. This can be difficult, especially since NAT is common in most networks. However, if a suspect is sending emails from a local client, the private, as well as public, address may be available in the email header.
If gmail is used with a local client (like Thunderbird, Outlook, etc.) then the email header should have the private IP address. Note that it is possible that some of the information is stripped by the client or client network before reaching the SMTP server. Take a look below:
----- Mail sent from Thunderbird using googlemail SMTP -----
Received: from [10.0.0.101] ([211.111.111.111]) <--- here you can see the private (10.0.0.101) and public (211.111.111.111) IP address of the sender connecting to the SMTP server.
by smtp.googlemail.com with ESMTPSA id <-- this line tells you that the message was received by SMTP
for <test@gmail.com>
Mon, 02 Nov 2015 23:01:38 -0800 (PST)
To: Joshua James <test@gmail.com>
From: "Joshua I. James" <test@gmail.com>
If the email is sent from the Gmail web interface (in the browser), the private IP address is NOT available. Google's server only sees the suspect's public IP address access the google web server.
------- Sent from gmail web interface ------
Received: by 10.50.10.233 with HTTP; <---- "with HTTP" means received via web interface on server 10.50.10.233 (google). The sender's IP is not shown.
Date: Tue, 3 Nov 2015 16:08:03 +0900
Subject: test2
From: "Joshua I. James" <test@gmail.com>
To: "Joshua I. James" <test@gmail.com>
If the header is only showing google's address, then the suspect must have been accessing the web interface (check for "with HTTP"). In that case, google will only have the public IP of the suspect.
2015-09-25
ICDF2C 2015 in Seoul, South Korea Final Program Now Available
The 7th EAI International Conference on Digital Forensics & Cyber Crime will be held OCTOBER 6–8, 2015 in SEOUL, SOUTH KOREA.
The final program is now available at http://d-forensics.org/2015/show/program-final
Be sure to register so you don't miss the exiting talks and tutorials!
Keynote speakers include Max Goncharov from Trend Micro, Inc, and Dr. Dave Dampier from Mississippi State University:
Max Goncharov is a senior security Virus Analyst with Trend Micro Inc., and is responsible for cybercrime investigations, security consulting to business partners (internal, external), creation of security frameworks, designing technical security architecture, overseeing the build out of an enterprise incident response process, and creation of the enterprise risk management program.
During his 15 years with Trend Micro Inc, he has participated as a speaker in various conferences and training seminars on the topic of cybercrime and related issues. He has especially focues on cyberterrorism, cybersecurity, underground economy; such as DeepSec, VB, APWG, etc.
Dr. Dave Dampier is a Professor of Computer Science & Engineering at Mississippi State University specializing in Digital Forensics and Information Security. He currently serves as Director of the Distributed Analytics and Security Institute, the university level research center charged with Cyber Security Research. In his current capacity, Dr. Dampier is the university lead for education and research in cyber security. Prior to joining MSU, Dr. Dampier spent 20 years active duty as an Army Automation Officer. He has a B.S. Degree in Mathematics from the University of Texas at El Paso, and M.S. and Ph.D. degrees in Computer Science from the Naval Postgraduate School. His research interests are in Cyber Security, Digital Forensics and Software Engineering.
There will also be three tutorials on investigation, open source hardware for digital investigations and setting up a research environment for mobile malware research:
The final program is now available at http://d-forensics.org/2015/show/program-final
Be sure to register so you don't miss the exiting talks and tutorials!
Keynote speakers include Max Goncharov from Trend Micro, Inc, and Dr. Dave Dampier from Mississippi State University:
Dr. Dave Dampier is a Professor of Computer Science & Engineering at Mississippi State University specializing in Digital Forensics and Information Security. He currently serves as Director of the Distributed Analytics and Security Institute, the university level research center charged with Cyber Security Research. In his current capacity, Dr. Dampier is the university lead for education and research in cyber security. Prior to joining MSU, Dr. Dampier spent 20 years active duty as an Army Automation Officer. He has a B.S. Degree in Mathematics from the University of Texas at El Paso, and M.S. and Ph.D. degrees in Computer Science from the Naval Postgraduate School. His research interests are in Cyber Security, Digital Forensics and Software Engineering.There will also be three tutorials on investigation, open source hardware for digital investigations and setting up a research environment for mobile malware research:
- Tutorial 1: DUZON – Desktop Exercise: Crafting Information from Data
- Tutorial 2: Pavel Gladyshev – FIREBrick; an open forensic device
- Tutorial 3: Nikolay Akatyev – Researching mobile malware
After the first day of the conference we are also holding a special discussion session with Seoul Tech Society called "Safe Cyberspace", with the panel consisting of the winners of the ICDF2C/STS essay contest. Everyone is welcome to join!
I hope to see you at ICDF2C in Seoul, South Korea! Don't miss this exciting opportunity.