REAPER Preview

Project: Rapid Evidence Acquisition Project for Event Reconstruction (REAPER) Preview

Purpose: A forensic boot CD that quickly and automatically extracts a preview of a suspect system

Status: Not active (superseded by the ATOM project)
License: GNU GPLv3

Developer(s): Joshua James

More information:

A proof of concept has been created, but has not been maintained. The source is available via the REAPER Forensics project at Sourceforge.

REAPERPreview is a bootable USB/CD that automatically extracts a preview of images, searches for keywords (based on keyword lists), and conducts hash analysis using the suspect's hardware. The focus of the project was on conducting common digital investigation tasks as fast as possible to help make informed decisions on-scene, at an airport (customs), or even before conducting a time-consuming full analysis in a laboratory.

The functionality of REAPERPreview has been incorporated into the easily-configurable ATOM framework.


Links:

• Presentation in Sleuthkit and Open Source Digital Forensics Conference 2011
• http://www.basistech.com/about-us/events/open-source-forensics-conference/2011/presentations/
• UCD REAPER project page
• REAPER Forensics Sourceforge project page

Read More

Forensic Image and Video Extraction Support (FIVES) Project

While working with the Open Computer Forensics Architecture (OCFA), I came across the Forensic Image and Video Extraction Support (FIVES) project. At the time, REAPER was in the proof of concept stage, and I was thinking more about automated imaging and verification than image and video processing, but with interest in REAPER Preview, image and video detection became more important. Eventually, the developer of Automated Network Triage (ANT) reminded me of FIVES. Taking a closer look, they have some tools, such as face detection and age estimation (using OpenCV) that was exactly what I was looking for. What makes the project even better is the fact that each of the tools are modules that can be plugged into OCFA. I am working on giving REAPER preview a smaller memory footprint, integrating some of the new Sleuth Kit features, and will definitely be trying out some of the FIVES tools.

Read More

Debian Live X Only

Looking for a lighter way to run REAPER Preview, we are looking into an X only kiosk-type implementation, al la:
http://jadoba.net/kiosks/firefox/

Also looking at a lighter httpd - thinking Cherokee
http://www.cherokee-project.com/

Also looking at the speed of the Google Chrome OS start up. I wonder if we can be that fast?

Read More

Profile Based Digital Forensic Preview

The newest build of REAPER Preview (officially Alpha 2) includes quite a few changes, but one that I am especially excited about is Profile Based Preivew. First I will describe the new REAPER Preview process:

REAPER Preview is designed to be highly-automatic preview. When REAPER Preview starts an 'autorun' profile is detected. Any file type filters, hash databases, and keyword lists that an investigator always wants to search for, are automatically scanned. These lists, obviously, need to be pre-set by by an experienced investigator for items that ALWAYS need to be scanned for. This profile should be extremely generic.

While the automatic profile is running in the background, the investigator can choose a specific pre-created profile. A specific profile could be, for example, exploitation, hacking, financial, etc. Each of these profiles would have specific hashes, keywords and preferred file types to search for. By creating a profile you not only control what is automatically searched for, but what and how found items are displayed. For example, in an exploitation case hashes and images might be the most important, where music files may not be relevant. You can choose to remove music as a display option, forcing the first responder to focus on images/hashes (since that is all they have access to). The scanning is automatic so they do not need to do anything except click the link of the profile they would like to view.

I often hear that generic keyword lists make no sense. To my knowledge there has not been a study linking keyword lists to profiling machines. I know investigators that have certain keyword lists in their heads for certain types of cases... why not use these to attempt to profile a system? I do, however, see the need for manual keyword searching since static keyword lists would not include names, etc. Because of this each profile also supports manual keyword searching against file names and full disk.

Essentially REAPER Preview is a tiered system, from highly-generic (autorun profile), to case-type specific (pre-set profiles), to incident specific (manual searching). I believe these three layers of abstraction can help an investigator quickly dig deeply into a system while not missing important information that might be more general.

I welcome you to try REAPER Preview yourself - it can be downloaded from the REAPER Forensics project page: http://sourceforge.net/projects/reaperforensics/

Any and all feedback is most welcome! Want to see a specific feature? Found a problem? Let me know!

Read More

REAPER Preview Alpha 2 changelog

Gearing up for the official Alpha 2 release of REAPER Preview here is the change log and feature list:

Back-end:

• REAPER Preview no longer loop-mounts suspect drives. All data is parsed directly from the raw disk. This not only faster, but we also do not need to worry about the issues talked about here.
• Suspect disks are still set to read-only at the block level
• Back-end is structured in a much more modular way. Programmers could easily insert a certain tool into the work-flow, if necessary
• Preset automatic keyword searching
• Preset automatic hashdb searching

Front-End:

• Whole code re-write. Front-end is now completely modular. Add or remove items with a simple include
• Triage profiles supported! Will explain the concept of triage profiles in the next post
• Greatly-improved Image/video gallery from Dynamic Drive implemented. The automatic image gallery I wrote was not powerful enough, and theirs is very nice. (Video previews are currently not working since the back-end switch).
• Manual file-name and full disk keyword searching now available
• Improved session logging (non-persistent)

Read More

REAPER Preview POC Mentioned

The REAPER Preview Proof of Concept was mentioned on nukeitdotorg!

Also an updated version of REAPERlive that can be imaged directly to any USB hard drive (without using the Debian Live build scripts) will be released soon. More details in the coming days.

Thanks again nukeit.org!

Read More

REAPER SVN Access

Instructions for using SVN to get the newest version of the REAPER Project:

These instructions are for SVN from a Linux command line, and specifically Debian.

The REAPER forensics project hosted at SourceForge is split in to 5 projects. Do not download the the entire SVN tree unless you want the development version of everything included.

To download the entire SVN:

svn co https://reaperforensics.svn.sourceforge.net/svnroot/reaperforensics reaperforensics

To download a particular project from the SVN:

svn co https://reaperforensics.svn.sourceforge.net/svnroot/reaperforensics/%project_name% %project_name%


Where %project_name% is the particular one you want:

• REAPERlive
• REAPERliveDesktop
• REAPERlivePreview
• REAPERview
• Scripts

Explanation of command:

• svn - the program to access the svn repository
• co - "checkout" project
• https://reaperforensics.svn.sourceforge.net/svnroot/reaperforensics - the address of the project (this is the trunk of the project)
• reaperforensics - this is the local directory to download the project to

Read More

REAPER Preview Setup and Configuration

(Command line instructions)
6 Nov. 2010

REAPERlive Preview:
Extracting a working directory
Once you have downloaded the REAPERlivePreview build package
http://sourceforge.net/projects/reaperforensics/files/

Newest release at this time:
http://sourceforge.net/projects/reaperforensics/files/REAPERlivePreview/REAPERPreview_alpha-2_lh_config.tar.gz/download

Extract the package
tar –xvfz REAPERPreview_alpha-2_lh_config.tar.gz

Navigate to the working directory
cd REAPERlivePreview

Type ls
The directory should contain the “makeREAPERlivePreview.sh” script and three directories. This is your working directory.

Configuring the image type
makeREAPERlivePreview.sh is the build configuration script. You can customize REAPER with any software or architecture supported by Debian live, but the most important setting is at like 39 and 40. Here you can set what type of image you want to create, iso or img (cd or hard drive). Simply put a # in front of the type you do not want, and remove the # from the type you do want.
nano makeREAPERlivePreview.sh
use the arrow key to scroll down to line 39/40 where
#MEDIA=”usb-hdd”
MEDIA=”iso”
usb-hdd produces a .img file, and iso produces a .iso file. Put the # in front of the file type you do not want, and make sure to remove the # from the file type you do want.
hit ctrl+o and enter to save
hit ctrl+x to exit

Building the REAPER image
If there is already a folder named iso or usb-hdd (previous build) delete it
rm –r usb-hdd

After configuring makeREAPERlivePreview.sh you can build by typing: ./makeREAPERlivePreview.sh

*Note: you must have a working internet connection

After the script is finished, you wil have a new directory in the working directory titled either “usb-hdd” or “iso” depending on the type of image you specified.
Use cd usb-hdd to change to that directory.
Another folder for the architecture type will be found (usually i386).
cd i386

Now do ls and you will see binary.img or binary.iso (depending on what you specified).

If it is a .img file you can burn it to a usb stick or hard drive using dd. If it is a iso you must use cd burning software.

dd example – make sure you know what you are doing or you might erase your hard drive using dd!!

To image a usb stick:
First type fdisk –l
Note which drive is your usb stick, for example I have /dev/hda and /dev/sda
/dev/sda is my usb stick based on the size and partition tables listed
Unmount any mounted partitions
umount /dev/sda*

dd the image file to the stick – this will erase everything on the stick!!
dd if=binary.img of=/dev/sda

*Note: The created image file is a disk image, not a partition. Do not specify a pre-made partition like /dev/sda1 – it must be the full disk /dev/sda

How to set up previewing profiles
From the working directory, change to user/REAPER/www/profiles
cd user/REAPER/www/profiles

Two profiles are already created, autorun and general.
autorun always runs automatically
general is the template for profiles that can be selected

Copy the general template to our new profile ‘exploitation’
cp –a general exploitation

Move to the new directory
cd exploitation

Type ls and you will see 3 files.
Filetypes: the types of files in a particular category (movie, music, etc.) based on file extension.
General.profile: The current profile settings
keywords: keywords to search for, each on a new line

hashdb: an hfind compatable hash database (md5) can be added with the name hashdb

First rename the General.profile to Exploitation.profile. This is where the profile name gets detected.
mv General.profile Exploitation.profile

From the Exploitation.profile you can change the order or remove entries you are now interested in (the Music section, for example). In this example we will accept the defaults.

For exploitation we are interested in pictures and movies, so we will edit the file types.
nano filetypes

File types must be separated by a | so two entries would look like: \.xls$|\.xlsx$
Capitalization does not matter, but the variations do, jpg and jpeg for example.
Make the modifications as you see fit.

hit ctrl+o and enter to save
hit ctrl+x to exit

Now edit the keywords file
nano keywords

add a list of keywords that (semi-generically) correspond to the type of case you are investigating

hit ctrl+o and enter to save
hit ctrl+x to exit

You can also add a hfind md5 hash database, and it must be named hashdb

That is it. Now you can build a new live cd, and this profile will be automatically detected.

Read More

REAPERlive Preview POC Released

REAPERlive Preview has been released as a proof of concept. The ISO is available for download at sorceforge. Currently only images are displayed, but lists of documents, movies, and music are presented for a quick view. In our tests the entire preview process takes approximately 3 - 5 minutes to scan drives of 80 to 150Gb, after which a preview of pictures, movies, documents and music is available. Thumbnails of images are created in the background while manual previewing can take place.

Automatic imaging is also included in the USB version. The .img file has not been posted yet, but you can download the newest source from the sourceforge svn and build the image using the included makeREAPERlivePreview.sh script (must be run from a Debian machine with live-helper installed).

More updates and documentation coming soon. Please email me with questions, comments and especially test results.

Download Preview ISO here.

Read More

REAPER Preview

Throughout the time I have been developing REAPER, many people in more developed countries have expressed a need for a type of forensic preview ability. Maybe they do not need to take an image of every machine. Fair enough, says I.

Because of this, I have been developing REAPER Preview. It is a live CD based off of Debian Live that automatically generates a preview of the data on the system. Currently I have gallery view of various photo, movie, document, and music formats. The preview is fairly superficial with speed in mind.

Also since REAPER is focused on acquisition the ability to automatically image the local suspect drives is still there.

For this version OCFA has been replaced by the PTK front-end to TSK. It is meant to be a very light collect-and-go with some analysis capability.

As always the goal of REAPER is to be as quick and easy as possible. While Preview is not 100% automatic yet, it is by far the easiest way to preview and image a suspect's machine to an external hard drive.

I will be posting everything I have for this version to the svn either tomorrow or this weekend. Feel free to email me if you would like more information.

Read More

REAPER Logo

Logo design by Laura Small and Joshua James.
Digital artwork by Laura Small.



The REAPER logo by Joshua James is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 License. Based on a work at CybercrimeTech.com.
Permissions beyond the scope of this license may be available at http://CybercrimeTech.com.

---

The non-branded Debian logo is released by the Debian group under the Copyright (c) 1999 Software in the Public Interest. Details can be found here.

Read More