Professional Documents
Culture Documents
Digital Forensic by Nilakshi Jain
Digital Forensic by Nilakshi Jain
WILEY
Contents
Preface V
Acknowledgments IX
CONTENTS
xii •
14 r
]. ] 3 Difference between Hacking and Ethical Hacking
14
1.14 Steps of Ethical Hacking
14
1.14.1 Reconnaissance 14
1. 14.2 Scanning 15
1. 14.3 Gaining Access 16
1.14. 4 Maintaining Access 16
1. 14.5 Clearing Tracks 17
1.15 Exploring Some Tools for Ethical Hacking 17
1. 15. 1 Reconnaissance Tools 19
1. 15.2 Scanning tools 19
I. I 6 What to Do if Been Hacked? 20
Summary 20
Key Terms 21
Review Questions
Evidences 23
Chapter 2 Introduction to Digital Forensics and Digital
23
Learning Objectives 23
2.1 Introduction to Digital Forensic 24
2.2 Need of Digital Forensic 25
2.3 Rules of Computer/Digital Forensic 25
2.4 Types of Digital Forensics 26
2.5 Ethical Issues 26
tal Forensic Field
2.5.1 General Ethics Norms for Investigator in Digi 27
ion
2.5.2 Unethical Norms for Digital Forensic Investigat 27
2.6 Digital Forensic Investigations 27
2.7 Introduction to Digital Evidences 28
2. 7.1 The Best Evidence Rule 29
2. 7.2 Original Evidence 29
2.8 Rules of Digital Evidence 30
2.9 Characteristics of Digital evidence 30
2.9.1 Locard's Exchange Principle
30
2.9.2 Digital Stream ofBits
30
2.10 Types of Evidence
31
2.10.1 Illustrative Evidence
31
2. 10.2 Electronic Evidence
31
2.10.3 Documented Evidence
31
2.10. 4 Explainable Evidence (Exculpatory}
2.10. 5 Substantial Evidence
31
2.10. 6 Testimonial 31
Challenges in Evidence Handling
31
2.11
2.11.1 Authentication ofEvidence
32
2.11.2 Chain ofCustody 32
2.11.3 Evidence Validation 33
Summary 34
Key Terms 34
Review Questions 35
CONTEN TS • xiii
l
xiv ___
:,:.:..,_ • ___ ___ ______ ___ ___ ___ __ c0,n1· ~
~
4..3. I Rolr of First Respomlnit
4.3.2 Role oflnvmig111ors r,3
4.J.3 Role of Crime Sane Terhnirit1m 43
r,1
4.4 Live Data Collection
4.4. 1 Live Data Collection from Windows System 61
4.4.2 Cre11ti11g a Response Toolkit G5
r,5
4.4.3 Saving Information Collected During lnitird Respome (17
4.4.4 Obtaining Volatile Data 69
4.4.5 Documenting and Managing the Investigation 6~
4.4.6 Collecting 1emporai Data 7fJ
4.5 Live Data collection from UNIX System 74
4.5. 1 Creating a Response Toolkit 75
4.5.2 Saving Information Obtained at the Time ofInitial R.espome 75
4.5.3 Obtaining Volatile Data before Forensic Duplication 75
Summary 80
Key Terms 80
Review Questions 80
------------ ·- ---
LEARNING OBJECTIVES
A(h·r rc.tding chi, 1.h.1p1n, )OU will he .1 hlc In :
• l 11hk1-.1.1nd the U.llll.Cpl of \.yhcn rimi..: and 11, • l '1hlu\f.111J tht· u111tq11 ot l,.11.k111 :: ,iii I J [ \
dl~·c..t on 1hc Jibi1.1l wotlJ . t'ffnt llll d1pt.1l \\mlJ .
• ln1.:rprct .rnJ ~pply ,l.llH ii )' llll'l h.llli, m, 1111 • Cndn,1 .11hl tlil' 11rnlo, 11f ldm.1! lt.h kiut:·
,·Jrit)U!. n ·bau·imc,. • fn1c1prcr .111,I ,lj'j,l_v ,nurn _r 111,,h.11 11,111 ru
• J. .kntify the Jiffrn:nt type, of l) hnt I imc,. -"<:lltrt' ~) \tl°lll.
The fim Jw lrs drt theirs th,u commit r/,em; the second faults are theirs rht11 pamu thnn.
- Thoma.s Fuller
~,...~
• ~[ « , Introduction to Cybercrime
ltli I
Crimes in India, w,ing computers as the tool, have been on the rise. With the incn:·J.!ling rrc:-nd uf crimC'\
using compurers, rools are being built ro prevent such crimes from happening. In to<lay's world, Internet h.15
become an integral parr of our evt'ryday life. Everyday, hackers or criminals attack our computer\ to sniff
imo our personal dJca or orher confidential dJra.
The rerm t]'btrt'timt rders ru aimcs committed using computer (Figure I. I). Tradicio,ully. ,~h:r..:rimc:
referi. co the crime involving computer and computer necwork.
According ro rhe law enforcement agency, internet-related crimes can be categorized .i~:
I. Advanced cybercrime/high-tech crime: Atucks against computer hardware and sofr\\are;
2. Cyber-enabled crime: Numerous 'traditional' crimes have taken a new turn with chc arri ..·.11 ofimcmcc.
such as crimes against youngsters, monetary crimn. and even acts of terrorism.
Cyhc:rcrimes have an adverse dfecc on governments, businesses, and even ordinary pc.•ople. Fur ex.unrle.
Botner is a nerwork of interner-connect~d computers that arc infected by viruses and comrollcJ .b .a group.
2 •
r~
0;;J Categories of Cybercrimes
Cybe.rcrim es can be broadly di vided into three major categories (Figure 1.2).
Cybercrimes
I Cyber-stalking, Computer
email spoofing, etc. vandalism,
transmitting
viruses, etc.
1.3.1 Hacking
Do not hack, but when you do, it should be ethical!
Eric Raymond, compiler of The New Hacker's Dictionary, defines a hacker as an artless coder. A 'good hack'
may be a clever answer to a programming difficulty and 'hacking' (Figure 1.3) is the act of doing it.
According to Raymond, the following five likely characteristics qualify one as a hacker:
~ lly )
N11
Y0:1
Internet
Thousands of requests are sent to the
bank website simultaneously.
Bank
Bank is flooded with requests
and cannot operate effectively.
Trojan
Infection occurs
-'
,-~ ·)
,
....
IP address
and port
IP address
and port
• I
Connection
1.3. 9 Forgery/Falsification
forgery refers to the action of forging a copy or imitation of~ docu~ent, signature, ?r banknote. 1t is done
to earn a huge profit by selling the forged resource. Forgery 1s nothmg but the creation of a wrong written
document or alteration of an original document with the intention of defraud or deception. Forgery comes
under criminal law, with the penal code as Forgery (Section 463,465, 466,468,469,471,474,476, 477A
IPC). Forgery is a serious crime chat harms any human for his/her personal benefit.
1.3.10 Phishing
Phishing is a fraud type wherein the hacker tries to get personal information, including login credentials or any
bank account information, by pretending to be a genuine entity in email, messages, or other communication
channels. In this type of crime, the victim receives a fake email from a company or organization or a genuine
source. These emails generally include an attachment or an outbound link chat installs harmful malware or virus
on the victim's device or may redirect the victim to a harmful or malicious website, developed to cheat the victim
and get the personal and other financial details or information such as usemame, email-ids, passwords, credit
card or debit card details, etc. Phishing is an attempt to obtain sensitive information from the user or victim.
1h :.~c :11nln1111s, unnnriccahly 1aken from collec1ive acco11111s, add up w a large amount of money. Most people
fail ro report sud, deductions, ofirn lct1i11g it go lwca usc of the amount involved, which could be a fraction of
:1 cl'nt, so as to avoid suspirion from tl1<: u11suspec1ing cw,tomLT. A salami anack is a sin.ill attack that can be
repeated many 1i1rn:s dl1cimrly. Thus, 1he ovnall imparl of I he auack is huge. For exam ple, stealing the round-off
;1111ou111s fnim 1hc i111ncsr in hank acrnums. Even 1hough it is lcss 1han I cent per accoun t, when multiplied by
millions of acrn11111s over many mo111hs, the adver.\ary can rerricve quire a large amount. It is also less likely to be
notio:ahlc since )'O lli' average customer would assume 1hat the amount was rounded down to the nearest cent.
1.3.13 Defamation
Internet is an integral part of our life. It acrs as a medium for interacting with people across the globe.
Defamation implies causing harm to a reputed individual in front of ochers. Harm ca n be inflicted by oral
words, visuals, or any od1er mea ns. Cyber defamation is a new concept, and it involves defamation of a
perso n or individual by a new or virtual medium. Cyber defa mation is considered to be a cybercrime. Cyber
defamation nor only affects the welfare of the community, but also the victim.
1.5.1 Viruses . . .. .
. . . . . . . .. . . I · . .- . , ·) · .. ~ol'iwarl' 1har is clcsignl'd 10 d11pl1 c u, c. md (. I his is
A virus (vllLll 111fr1r111.1111in ll'M)IIH t ,\ 111H t 1 ,\ llj_,t is ,1in· s1ornl .in 1hl' r o111p111u. .. (',omp111 t:1 . . _. . _. •
. • • 1· · .· . . , 1..1111 . tin, v11 uscs ,llt,ich
done by 1'( pli1:a11ng 11.~l' f ll)I() \/;ti ICIIIS P10t, • s_ ' ' ' • I , . I -· · , ' (, , ' , ..1s. •It
H 1, t,1 v m g 111 1.: cuons
0
1.5.2 Worms
A worm (write once read many) is similar to a computer virus by design. It is considered to be a secondary
category of virus. A worm spreads from computer ro computer, but unlike virus it has the capability to travel
wirhout any human action. The main threat with a worm is the capability to replicate itself on our system.
So rather than our computer sending a single worm, it could send hundreds or thousands of copies of itself
and cause a huge devastating effect. For example, a worm sending out a copy of itself to everyone listed in
the address book, then the worm replicates it~elf to each of the receiver's address book and it manifests itself.
Since the worm copies itself and also travels across networks, it consumes more system memory and network
bandwidth, causing web servers and individual computers co stop responding (Figure 1.7).
INTR ODU CTION TO CO MPUIEI~ CRIM E.S A NI ) 1.1111 CA I 11/\ CKIN Ci . 9
Alie;)
dola
--"~
involves an attack on
-data lntegrHy. ~
Integrity, data
canfldentlaffly, ~ y
.,•"'
using the comp~, to
store staren pa8hklrd
lfatt,~lt
or ...UilPfflb,.t.
Ciwn hdow art' imt:111ct'~ whc:rr computer\ are med in l rimt· .,cc11.irins.
l. Wi11w~~l'S c.an view I he s11~pcds pirt un: 1>11 1he ~l rct·n I hrm1gh d1l: use 0 ~- u!mputl'r~. . . .
2. J)NA ll..'~ling GIii bl' pcrl<>lllll'J u.,in~ wmputl·r~. U,in~ I )NA tc~1111g, (flllllllals can be 1dcn11ficd lrolll
pJ~l Lrimc:s :1nJ book1·d.
J. Mini <.ompull'rs and l.1ptop~ arc: ml'd in policl' vl'hidc., 10 Jl'tTrminc the 1...riminal records. The police
c:1r~ arc im1alkJ with wirdl'~S intn11c1 rnnneniom th.1L arl' linked with sa1cllirc:s to perform the work
with greata d'fici<:ncy and in :Ill c:a~icr manna.
4. Fing<'rprinr, <.:HI bt' 1aken 11~ing :1 wmpu1t·r and ir <.an ht' w,cd ro determine whether the person is
linkc:d to any <.a~c in illl' pN.
5. A computer can abo Jc1erminc: how :1 fire was c:1uH·d :111d what an:dcranr was u~ed in the fire. This can
be Jone u~ing the rnmputl·r inw~tigation device:.
6. Compute1 s are al,o U\CJ at traffic jum.1ions to find 1hc vehicle idrntification number (VlN), whether
the car is s1olcn, etc. In ca~c of a nimc, the p<.'rson c;in be arre~tcd immt'<liately.
7. The dJtJh;V,t'\ of criminals arc maimaincd in compurers. With jus1 a push of button, we can obtain all
the informa1ion about the c.:riminal. Also a list can be maimaincd of all citizens with prior tickers, bad
behaviour, and felonie~.
8. Simulations can be crea1cd by the use of computers.
Table 1.1 Year-wise cybercrimes in India (Statistics presented in the Lok Sabha 2018)
$B62,B23
Sl)fflr OnNM
114,000
Scro/lJng lnslagrom
'~l
2.4Mi/llon 481,000
S11a,x Tweets Sen/
CrMltd
~
/
,,, t 184011 \ ..
, Volct-Fint f 111W1 , ~
~ ~
'
t. ~
I
Dfv/cnSltipptd
•-1 ·~ ·
t
~
i ~ Ji
'I
\ .,. c,~a,tdBy:
,,)//, ('Wtl
"# -, Otfl (l(ll/y( /wd, f
·-- . ,___ ..._..,..vi:...--.. .
I. ldt'n rification of exposures through education will help companies and firms meet these challenges.
2. One should avoid disdosing any personal information to strangers, a person whom they do not know,
viJ tmJil or while charting or through any social networking site.
3. One must avoid sending any phowgraph to strangers online, as incidents of misuse or modification of
phowgraphs are on che rise.
-----------------
DIGITAL FORENS IC
12 •
Definition of Hacker
Very ofren,
The one who is curious about the workings of any computer software is termed a hacker.
e systems and
the hackers are a unit of smart programmers. Hackers have advanced knowledge of operativ
and are therefore
programming languages. They need data concerning varied security holes among systems
they need to be
the reasons for such h0les. Hackers perpetually acrempt to increase their data and share what
discovered. Hackers never have dangerous intention like damaging or stealing knowledge.
~ Definition of Crackers
. Crackers cause
People who break into different systems with malicious intentions are referred to as crackers
provided by
issues to victims by an unaut_horiz~d- access, ~esrroying necessary information, stopping services
the server, and more. By their mal1C1ous acttons, crackers are often simply known.
nals while
Hackers try ro do constructive work, while crackers just destroy systems. Hackers are professio
'
crackers are criminals (Figure 1.9).
-
t· ,/'~
>"
A
Definition of Phreakers
Phreaker is the one who gains illegal access co rhe telephone system as shown in Figure 1.10. Phreakers are
corn,idc-rt·d the original computer hackers and they are those who break into rhe telephone network illegaJly,
typically ro make free long distance phone calls or to tap phone lines.
Phreakns are people who specialize in auacks on the tdcphone system. The word, which became popular
in die mid-1980s, is probably a combination of the words phonf' and f,'{'(tk (Phreakers are also known as
"phrc,1ks" or "phone phreaks"). In the early days, phreakcrs whistled or used an instrument to mimic the
tom·s of the phone sysrem and tht·n used to route calls and identif), payment, especially as a way to avoid
p;1ying for an expcmiVt' call. Modern phreaking involves breaking into and manipulating the phone compa-
ny\ computer ~ysrem, making it a specialized kind of hacking.
Recrnr examples of phrcaker from the Web:
In focr, the friends' first business venrure rogerher was marketing blue boxes to aspiring phreakers.
- Laura Yan, Popu/.m Mt'Chanics, "An Early Hacker Used a Cereal
Box Whistle to Take Over Phone Lines," 20 May 2018
Ethical Hacking
I lacking has bt'rn a locality of computing for nl\Hly 5 dt·cades and it is a really broad discipline, which covers
a brge v;1ri('ty of' topics. The primary famed t'\ll'nt of lucking had taken phtce in 1960 at Massadmsetts
ln!.1it11te or 'k chnology and at idenri1::1l 1ime, the tt'rm "Hackd' was originated. Hacking is the act of
ltndi11p, the pos~ihlc entry pninrs that exist in a very ~ysrem or an electronic network and at lase getting
i1110 dwm. Hacking is rypic:1lly done ro achiew unauthorized access to a system or an electronic network,
tit her to hurt tlw sysrems or ro steal St'nsitive data out thm!· on the pc. Hacking is typically lelr-11 as long as
it is hl'ing dnnc to lll'l'k our wt',1knesl!CS in a JX or network system for testing purpose. This type of hacking
is what we have a tendency to dt•cision moral lucking. An expert who does the act of hacking is called a
"I lad,t'r". l L:itkers :trl' people who get informarion to know how systems operate, how they are designed,
and dll'n commit to pby with these ~ystt'.111S.
f
l
f l I ( i I I I\ L I <If.' I f-J ',I('
14 •
f, ·
·~:·i Diffe ren ce between Hacking and Ethical H~ckin_g __________ _
--~-------------- -- - ---- - ------ --- ---- ------- -- ·-
\\~n~,',!~,r b.i,lilf 1,.-t~n- ( , l ~1.:-.,kH~!~ 1111•' ,,,nw- 1 t hi, .11 h.h k_ing rcfrr~ ll) d'.r rnc!hnJ, ilngy
,,1~·\ ~,,:cm iM , -i-,,, . . 1'-'I'" '-\'mm.-r.:i.11f,,1in, . Jl'•'i'tl'J w l11hl l,1,,phnlcs 1n llll 1um.1t1 1rn .,y.q,·m,.
1 11
H.kl,·t~ ..:~,, ~.-,. i;,. . i [,';~;.~. ,, h,) li,._· ,.ui,,,:, h~''L'~
t\' ._·..i:,.- J.u~u;:..:- h-' rnt:,r:n .. ti,,n .in.I J:N'h .
----
~,~~" r.,,\ .m:- u."--J tw t,,th lu,la:- .rn.f nhi..:.il h.1l I.ct\. The 1,nly difkn:rh"(' is th .H h.ll.kcrs w.t· inol.~ to
i !-f-.'.;J \., f , !,._~{;\\\' in~-~n~uli,m. \\ h(·,,.l)o ,·1hi ...1I h.i.:J..(r~ 11., ,· s.ll11l' 10,1ls {() satcp.1.ml !oplrm~ from "hal kC'n
: \\ :(h m.1i :..:i,,t; inc.:-nt~ . hhi ..-.1I h.tJ,inf i~ lq:.1I Jlh l h.1 ...king i~ d,-111<.' \\i th pcrmi~.,ion from the clirnr.
A@l..'::J'T".&SS.8n."e .:s "'-~~ mo.--e l:i t-.e ga;n:r.g access pnase, true In 1he final phase, anackers
r-2-" r"tP ~-~
~~--e
~,~~ ~ .p-ae,
&"\;j ~-~.!:,Y\ O."\ ~
a:-:acks are leve;ed aga,nst the
ta.--ge:s envnerated m the secood 4 anemp1 10 conceal 1he11 success
and avoid derec11on by securily
!A-~~ -;OJ •..rt~ a;:~
2 p~.ase professionals
Scanr.t"g a'1d
Maintaining Access
Ernimera!Jon
1
Ta,e l"",e tn~om-..il!OO you gathered
,r.fa""\'.)lc a:-\0 act,ye>y a;..-iply tool.s
~'\d tecr.f'!QUES to ga:ner more
3 In the fourth phase, hackers
attempt to ensure they have a way
bacil. into the machine or system 5
~~11 r.fcrnia~-on oo the targe!s. they've already compromtsed.
1. 14. 1 Reconnaissance
Re'-·on.naiss.mce i_s th~ phase where che anacker gachers information about a target using active or passive
me.ms as shown ~n Figure 1.12. The _rools ch~t are widely used in this process are NMAP, H ping, Maltego,
and Google Dorks (these Tools are discussed m lacer part of this chapter).
1. 14.2 Scanning
In sca, nnin°.
. t>d· the anacker
. beoins
·. 0 co acme
·, IY pro be a target machine
· or network for vulnerabilities char can
l)e exp 1oHe as s11own m Fwure l 13 The c00 I · ch'ts process are Nessus, Nexpose, Wireshark, an<f
NMAP ( -I d. d~ · · s used m
•·• too s are 1scusse m 1acer part of chis chapter).
INTRODUC TION TO COMPUT ER C RIM ES AND ET HI C A L HA C KIN G 15
•
■ Could be the future point of return , noted for ease of entry for an allack whon
more about the target Is known on a broad scale
Reconnaissance Types
Figure 1. I 2 Reconnaissance.
8
network
·1 ~ .A [ x1rn1plna lncl11d1:J
8 ,--·------------------
altacker lo hide malicious acts
-- - - ---
1 15
·, - '. .2 Google Dorks
. trall1-
\X. hdc 111v e~- t 1. g:11111g
. . :1 Iot Ofc l 'I' secun.ry new b'1es rorger
peo pIe or co mpanies, c .
t l1c 11nporrance of- usmg J•
'-·1\mr'\.,lnlt"; . .md
thrir d.1t.1.
f I
, ,mt' fX'\'td.1r ,,pt'r.H MS ust'\ ,,, ,· . I ' ,1' I)nr k'11 11] · l' 1ll1)\""'
;l l'l' ,IS l ·v.,.
!'Cr ,11 m ',n,,1,, ,.,
1. File-typt: Yo11 ,':Ill use this J,H-k ltl t111d .111y ~ind ,ll" l~k l)'(pcs. t ·t loP ell')
l, Ext: lt .-.in help Yt"'II r,, find (1lt's with s1wc.il1 < l'Xtcn_s,ons t."~" · x ·. · .ti,' ··, .
J. lntCl.i: It <.lll pcrl\)1 lll q11nics ,me! helps,,, Sl':11\:h lor speed,~- ll'.X I 111 .'i ll C:Ill}' p,1gt.
lntitle: It will sc.m--h f,, r .rny sprcit,, wtil\h inside the p,1gc rnl~. .
-4. • • f ·:I
; . Inu.rl: h " ill kh,k out l,,r 11wnt11)1ll't w, H t ~ 1m '-·· .,
' ,le tltl' URI of ,111)' wchs1tc.
, ·
, . . J l , · i , .. l h . -~:w h cn oinl's· however. ilwy :11·c indexed and you c:111 get valu-
l l)g tilt~ ,trt· 1101 ~upp~,M"l.) h' 'l Hh t Xtl ) ~t. l :-, . :. ~
.1b!~ inform .1rion fro m Ihesl' (~nogk Dork~. ;1~ y tHI .,cc 111 hgu1\' 1. 1/ :
filetype :log
np· Search to, English results only. You can specify your search language In Preferences
mogu.log - Picbear
picbear.club/mogu log ... Translate this page
Mar 1:: .::o\6 . C.t'h: Ck mogu @mogu log instagram profile. t 1 ( Hil8 .ti~) *L.iJit,O)~O).'.f
bntishsnorthatr Sapporo Japan
,rJer n.-t· \ 1.tlct'gL), ~-iHl wis! 1 w open .l f1er .1Lcount on rh eir wrb,~itc, Jf1e, th at, y oi1 wi ll laun ch J
1,1
111
,,l.1.:t'tllen! m.H:h~nc' M run ir.m 5!-o rms on rhl' ~argct fro m Assncia1c in Nursing l'XisLing 11nc. Onu: you havr
~ ,~.'. 11 ~ ,,ur
cr.111~f~1 rn1s. ~':!re~u _ ~-rn
app _lwg111 ru,,1ning .di rhc I r:msfc:1m1s f~om M.d1cgo !le~·ver~. !;_in:il_ly,
~{.,let~:,, cJn :.ho" ~L1U rhe n:: sult ~ tor rhc des ired 1.ugcts, such as IP. dom:uns. AS 1111111 ha~. and f;ir adJu1on .d.
i~ nJ is usc-d w s'"-:rn rhe ,·ulner:i bdmes ,rnd pnforms va rious nerwork check,1, as:
1. \ expose is em plo~·ed ~o watch rhe ex posure of vulnerabilities in rime period , acq uaint ilself to new
h.u.irds \\i th re•cent intormario n.
1~ l~ner.1ll~·. most of the n1lne-rabiliry scanners caregorize che risks employing a high or medium or low scale.
j. \ exp0.5c' CLrnsiders rhe .~ge of rhe vulnerabiliry like rhat malware kit is employed in it , whar blessings
Jft'J unir urilized b~· ic t'K ., and fix rhe difficul{)· supporred irs priori ry.
4• :--:c.'l;:pose mc>chJnic:illy derecrs and scans rhe new devices and assesses the vulnerabilities once rhey
acccSS the nerwork.
;. \ expose m:1,· be> inregrared with a Meraspoilr framework.
1.15.2.3 Nessus
\ essu.s is a parenred and branded vulnerabili{)' scanner developed by Tenable Nerwork Security.
I. This tool has been put in and employed by countless users throughout the planet for vulnerability
asses.smenr. configura1ion problems etc.
2. >lessus is emplo~·ed ro forestall the nerworks from rhe penetrations created by hackers by assessing the
Yulnerabilitie:s at the earliest.
3. Nessus suppom wide-range of OS, applications, DBs, and lors of more nerwork devices among cloud
infrastructure, physica l and virrual networks.
4. Nessus is capable of scanning rhe vulnerabilities which permit remote hacking of sensitive information
fro m a sys tem.
I. Cut-off your internet connection: If you rhink that you simply are being hacked, the primary factor
lo trv to do is ro cur-off inremer from your system so as to prevent any more intrusion.
----------------'----~-:-=-:=~~:~=~~
DIGITAL FORENs
Key Terms
• Hor: For 'robor' - a program med for a ,.,pecific • Cookie: Cookies are text files sent from your Web
li111crion such as keeping a pon open or launching browser ro a server, usually to customize informa-
;i flood of packers in a clisrribur cd denial-of-ser- tion from a websire.
vice arrack. • Cracking: To break into a secure computer
• Craddng: Malicious or crimin.11 hacking. system, frequently to do damage or gain finan-
Una111hori:a·d penc1ration of computer systems cially, rhough sometimes in political protest.
and networks, ahusc of privilege, unauthorized • Firewall: A sysrem using hardware, software, or
use of services. both ro prevent unaurhoriz ed access to a system
• Hastcr egg: Undornmcnted, unaurhorizcd program or machine.
funcrions in :1 proJuc:1i~>11 program; a kind ofTrojan • Hash: A hash is a number generated by an algo-
lwr...c. rirhm from a string of characters in a message or
• Identity d1eft: Creating a folse idenriiy using other string.
.,omcone d~e's idenriry, idcnrifying informal ion (e.g., • IRC: Internet relay chat is a protocol used by both
name, soci.1/ ,.,ccuriry numhcr, binhJay) co create groups and for one-on-on e conversations. Often
new cn:di1 cards or c.~1ah/i.\h loan.~which then go into u1 ilizcd by hackers ro communic ate or share files.
drfau/1 and aff~ct 1he original vicrim's credit record. • Malware: A software program designed to hijack,
• Malware: M.1/i cious snfrwarc, including Trojan
damage, or !>teal informatio n from a device or
l111rse.s, viruse.,, worms, logic bombs, exploits, and system.
rime l>on1h.s.
• Packet sniffer: Sniffers are programs designed to
• l..ombie: A progr.,m imerred into a vulnrrabJe
derect and capture certain types of data. Packet
.,y_i;1cu_1 I~ await furrher ins1ruccion~; usually part
sniffers are designed to detect packets rravelliog
of :, d1.s1nlmicd dr11i;1l-of-11ervire (DDoS) arrack. online.
,NJR ODUCfiO N 1 0 C OMP U TE P CRUv1 ES AND ETHICAL H.4.CK IN (j • 21
Roorkit: A roor k11 i\ a set of ~ofrwa re progra ms • Spea.r phishing: A more tocuseJ type of phishing.
• d 10 PJin Jdrn1 n1~traror -levrl ac cess Lo a sys tem targeting a small er group of targers. from J dcp,ut-
u~ ~ hI . I
,,1 ur
,111
malv.a rt', \\, 1 c .,,mu taneou.,Jv ca mou-
J ~- rnent wirhin a co mpam· . or oro:rn1z.:1ti
::,
on down ro
1l.1µ1 n~ 1hl· tJkt'OH' I. an indi vidual.
LEARNING OBJECTIVES
· After read ing 1h1.s chapt er, you will be able 10:
• Undc-tmncl the t t111cept of digit.ti forem ic and • Understand th e concep1 of digital evide nces
iu t"ffrc.t on th t' digital wo rld . and ir.s role.
, Jnrerp rer anJ apply va ri ous digiral foren sic • Apply evidence~handling proce dure ro borh
proce~~ rnodck obtain ed validated evidence.
L'nJ('1 ,tJnd the rulc.s and regul::irions in digita l • ldenri ~· the different challenges in evidence
forem,c~. handling.
It rrr1mr f'S 11 11rry 1 1muJ 1111l 11111/(I to u11dtrt,1l·r rl,r 1111,11)1HS ,frhe ol,1 1ious.
lncrca~ed compurer .111d nernnrk misuse h.1\'t' bl l\l .111 imre.lSl' in lllllljlllll'r-l'Cl.llc~ invrnig:11ions. A
rypical inves1igatio11 includl'S (l'l'l,1in hyp\Hhesi~ l1J' llhscn·.1hlc plw11un1rnn11 th.11 1~vcn '1 ('d liy ~nn1e proof
These developments in inwsriga1in11 h;wc hi Ill auJ11i11g being the key 1n ,11mwn11g qul·~11nns related
10
user acriviry and cyherrrimc. .
The field of digi1al foremio h.1~ m.1dc some r.1pid dcwlllpllll'lllS ovt:r die pas, l:w ye;1r~ due to the
a~~'~llLenwn~ in tools and syst('l11\ 111:11 .dlnw 1mlin.ll\' l l1111plltl'I' ,_,ser~ t1) he nHHl' prnl1c1cnr in pcrforrning
d1!11cult a11d1t tasks. fvlany l1trr.1ture and 1nt n 11et ~e;mhl·~;m• :1v.11L1hk d1;11 g111de a 111v1:il :ind l.'asy llHori~I
user on how 10 perform ~impk t.1sks .1im_cd ,II g;1i11i11µ, .l(Cl'SS (1) any Lll111pL11l'I'. This has l'11.1hl('~I 1hc ordinary
computer user to access :111 ry pt·s of inlor111:11i1111. ~lllh as u1p1cd 11111~1(, pnrnngr.1ph y. co nl1dc111ial docu-
ments, illegal softw.m:- ;111d sn 011 . Th11s, rhcre is .111 i11L re.1scd demand 111 com puter ~ccuriry mechanisnis in
an effort to conrrol such activirics .111d a grnwing 11l'l:d for forl.'nsil tonb 10 g.1rl1l.'r :1Ccura1e digi1al evidl'nce.
According ro Beebe, rhe l.1ck of dig.it.ii forensic st.111d.1rdi1.atio11 and process rt·~tdts in limited prosecution
that is nor acceptJhle in the court of bw.
Numerous foren sic tool~ ;l!T fredy .1v.1ilahk crl'aring a mim rnccption among the common man that
anyone can conduct a computer forl'n~ic inwstigation . The forensic to,lls used h;1w variou~ features that
facilitate digital foremic inve~tigarions (Dfls). In ;1 court of law, the proces~ follownl in ga1hering the digital
evidence and the digital evidence nself is importan1. Unforrunately, rlw court proceedings focus on scruti-
nizing the validiry of the process followed in evidence handling before considning i1s v.1luc.
Numerous procedurt's have been proposed for the collenion of digir:d forensic l.'vidence. Commiuees
such as the Digital Foremic Research Workshop Group (DFRWS) .111d the i\nwriL:111 Society of Digital
foremics and e Discovery (ASDFED) have proposed procc~ses to he followed in the collection of digital
evidence. From this, it follow\ that there is no sra ndard forensi c process in place that can be followed by
digiral foren~it i11vc~1igator~. 11 would be a serious mistake !'or a loren~ic investigator tn ignore the proceduic
of evidence collection in cases where rhe evidcncr aids in proving the u se and leaws no doubt in the minds
of those having to decidr on rhe matter. Where evidence is presented wirhou1 proof of thorough prnce-
dure, the defence may question 1he foremi c procedure followrd to collw 1hc digital evidence. The famous
American rnun case of Simp,on is an C:'xamplc where tlw Forensic process w;1s scru1 ini·Led by rlw defence.
,
In this c 1,;e. the crime scene evidence wa~ L"olkcted . However, .1 rohmt evidcnn· rnlknion process was not
followed, hence, the evidence was invalidated by the ddence. Tools such as Enc he have beLil accepted as
a reliable solution in computer crime invC'~ tiga1ions. Both tlw !Hoce~s followl·d wlwn using Encase and the
resulting digital evidence have been accepted as reliable. 01 her tool~ have abo 11C'cn used suct-esst1dly, such as
FTK and Sleuth Ki,. Some arl' commercially avaibhle while others ;ire open source. tvh ny of rhcsc tools haw
bt'en validared and accepted as reliable by the· Amnican judiciary. However, dw evidence cnlkcrion process
and the digital evidence prt·sen1ation are viral in :111y successf11I pro~cnnion.
Digital forensics un hl' defined as follows:
Digital Forensic is a ~nics of Stl'ps to uncover .111d analy-,,c dl'ct ronic data thruuhh scientific nwthod.
The_major goal of tl11: procC'ss is to duplic rn: original data ;ind presn vc 11 1\;inal l'\'idl·nc,· then
performing the mie5 of' the investig;nion by colhting. identil·ying and valid:11 ing 1he digit:11 infor-
mation for the purpose of reconstructing p,1s1t'Vl'nt~. -
--- -
II )\ 111'1(' \\, Ill' l111 IIH'l\\11 11, .1,l1111111 ~,, 11111 ''1111 I M'Llllll. )' ,c,111I"I nl 11c ·1w111fo·d n1p;111i'l,Hinm 10 pr:Kti cc
I II I · ' . ...11, .111 Lrca~1.11g grc;1tly.
·
1111 •1 l111 1·11 , 1,, ,111, s 11111, 1,11'1' k1111wlL·d hl i · 11 1· 1.,w~, Iiu, ,111.c,1• r:11 e 111 .Lylwr ( f'llll l'~
, ,111q 1 .
I 11 - . ·11
II \'1llll IH ' II\ 11'" I.\ ,Ill .I( l- 1•,I .11111 llll I 11111 ·1 I\ 1 ,,
,lll)I 11 , I It'll go111 rnowl1 •d1• c ,1ho111 wmp111cr lurcn,c,K<, WI
in ill!' 1. 011n . .,
111 Ip ,11111t11 itl1· i·, ,1 I,·111 i · .rnd pn1~('11111· dw ',l.\ L'
· I
· :iccou nt, Il, en Vll;J
. ll.',it .', I); I( II )'. II )'011 lIt) IHll 1:1 I{l' ·II In
l'lir 11 · ' 1H· 111.1111 11., k, ii 1·,111111.1l 111. ,. 1 om 11, 11 L•,· 1·Ol!.'
·r
IH' il n 11111·n l. Nnv 1·'1\\1\· ' li t' I)1.,·,1 h, (I··1 VL' Inp1·1 I 111 pro11 -r1 t·11.\10111er.~ d:ita ; )Ill , 1 ccria111 <In
I I . I. J
n 11 I11. I 1(' 11111',.111 · n I 10 1I1e nrga111·1.:ino11 · s
· . A· s organm· 111on
,, I ,1•11 ·11 , 11111 l'
'PI '' 111 11111k, 11·d . 1h,·11 , n11n It.\ 1,111 Iw .1 %1gn
• 1·1·' 1·,
: .,\/ 1,·.,1)
, · ;1 ~1ng,s
· I.w11ncre · j I
o t1I cy 1ave cvco pe
d d
· 1 1 1\1111' 111 1111111l w1 ,111d illl' I. 1\1' · ' .' 11 l11,,··l,i1.~.111c I cn111ra
1 •" ·
c1or.~1.,:i
.11-r i11< · · ,,
1111111 · , ,·, i, ·11 " · l ),'l \·111,"·111 illl ., h:1v1· de vl'lop n l .~l'c11ril)' dl'vice , /'or dwir nc1work lik e i111rusions
1h,·i1 ,,11 11 ~•
11 1111 1 111 ilH: .,en1ri1y ~,:1111~ ol n1.: 1work of an organiz;Hion .
,lrh" 111• 11,i·,11·111 ' l ).\~ , 1 " ·, , _ n v.tlls whi_d1 1r por1 on
111 11 11 111 ru ngni1.1·, g:i rlwr, pru1 ec1 and l'.xa minc data in
.-;, ,. 11·, li111, .dll', ilw 11 1.11 l', ,il I : "1:lill'I' lnrrnsic~ is 10
,111 h .111·.11 I Ii .II 1;i,,1< ·," iii(' lllll'W Y 1
11 11 1111· cnlb ll'd evidt·11n · 1n use i1 dflc icnily ,111d d fcc rively in a case.
___ _
~ Rules of Computer/Digital For_e_n_si_c_ __ __ __
\\ 'l11k ,,n l1 ll'l l1i1q : .I I )l ·I. ilH · i11 vl·~1ig,11or shn1tld go hy ,he lolklwing rub:
origin ;tl media .
Rulr I. /\11 n .1111i11.11i11n sho1tld 11L·v1·r lw pnl<,r111cd on 1hc
media shoitld always be used if available.
Ruk 2. /\ , 011." i, 111.1d L· 01110 l1H1·11.~ir:1 1ly ~rnilc mcdi:1. New
co py (Somer·im es referred to as a bir-srream
Ruic j, l'l w, Pl' \' of ilw l'vidr nu: m11.~1 hL· an exacr, hi1 -hy-hi1
I llj l\') ,
dw acqui sition of th e media 10 ensure
ll11k 4. 1·1i1• i'11rnp111n .111d lh l' da1a 011 i111111st he pro1cc1cd during
1'1.11 ill<' d.11 .1 i., 11111 11111dilinl (l Jsr a writ
e blocking devi ce when poss ible) .
10 preve n1 an y modifo:a1ion of the
Ruk ';. I 'lit· n, 1111111.11 iu11 11111.,1 IH' n111d11ucd in .~1irh :1 way as
l'V ld l' ll l (' ,
maintained ro provide an :iudir: log of
ltuk I Ill' 1l1.1i11 , d illl· 111~1111.l y of :di i:v idcnce nrnsr he clc:irly
<,,
wh,1111 11111•,111 l1.1 v1· .11,T,.,cd dw rv idn1re and al whar 1in1c.
f Jj Ethical Issues
"Ethics" is derived from the ancient Greek word ethikos, meaning "moral, showing moral character". Ethics
in digiral forensics field can be defined as a set of moral principles that regulate the use of computers; some
common drawbacks of computer forensics include intellectual property resources, privacy concerns, and the
impact of computers on the society. To effectively spor ethical problems, an examiner must be familiar with
the law and professional norms governing the cyber forensics discipline, and this familiarity is one of several
presumptions incorporated into the code of ethics.
With this perspective in mind, ethical decision-making in digital forensics work comprises of one or
more of the following:
1. Honesty toward the investigation.
2. Prudence means carefully handling the digital evidences.
3. Compliance with the law and professional norms.
~~:. - ·. · ·
~
DIGITAL 27
TION TO DI GITAL FO REN SICS AND EV ID ENCES
TROD UC
~
g.
Should contribure to the socie ty and human bein
J. Should avoid harm to ochers.
· h Id be honesr and rrusr.worrhy.·
2, SOU
_are.
:: Should be fair and rake ~-ctlo~ ~1ot to _discrimin
, Should honor property ~ iglu~, mcludmg copy
nght s and parents.
erry.
~- Should give prop er cr_edn to '.ntellecrual prop
· Should respe ct rhe privacy of others.
7 . 1·
s.· Should honor con fid enna 1ty.
11 1 , ., 111 , ,I,,,
·11i 111 <:l'I 1hl· 1eq1111 l'lllc111 \ (JI il11 p1J1 ;11, 1, 1,, ,,1 ) .,11,l 1,, ,~ 1il 1·.1 .11, ,I ' " /.,, ' -1111 ' 11,II , IJ! ''
11
lnlltiw rlw cv id l' lht· h:111Llli11 g llltJt n l111 n . Al,,, 11 1\ 11 , ,, ·· .1 1, 1, 1, 11 ·.111 • 111. 11 ii,, ' nd, '' I, ,1111! 11,1, 1,111 ,
dim·\ d1t,M·11 ., ,c11,ll Ji1r" 1i11 ,,, 1111 11 1, •11,,·11, .,1 1,,,11 ,11 ,•..1111, .11 11 ,11 ,. 11 1, , .111 ·,1111 11 1 1111 1,,, ''"'' .,1 , ',1, ,i ,, 4 , 1
li,r .111 org.111i,.1t11 i11 . l111h1 \ t l1.1p1l·1, wt 1\ ill d1 ·,, 11 -.) d1 t , ,ill , , 11,,11 , 11.111, 1111 11• 1 111 1 . ,,,, 1f" , ,I 11d ,,1111,, 1,, 11111
,111 ,1111)1'opnall· 111.11i1w1. \Xlr will ' d\11, x11I'111 1 ii ,, , II ,, 11 \ t .11 1t l i-11 1, 1, ·111 , ·, Il l• 111 • l1 .111, ll 1111 , , , ,, , , ,l , 11 , , .,I ' iJ , 1,,
11
w11h 1hc gu1Jcl111L'\ l111 1111pl,·111, ·111111 g il 11·\t p1 11, c.!111 , , 111 y,1111• Jlj 1-111111 11.,11 · ·
\X'hilc III Vl'\ II r,P,lllll j'1 ,It t)ll lj)llll 'I \ ( ' I 11 111 \' 11 1, ,d, Ill . \\I ,li t ',til/11 11111 1'\ 1111 ' 111 1· .11111 111 ,I , I ,I / I ,,l l"d,, I ·111
1
1
itL'lll (vi , ., :1 d1ip. lloppl' di \k. l'IL.) , lirnild llt' tti 11·,1d, 11 ,I .I\ .111 , 11d, 11, , 111 .111 111 .1< l11,1t 111 ,1 .11 1 .,,1,1 , 11 ,j 11111
RL' k v.1111 <: vidt'nu· i\ dd11wd .1, "A11111l111111.111,,,1 wl11 , Ii l1 .1·, .1 11,,•,1 11 v, 111 111.11 1 1,11 il1< .1, 11, 111 ' ", IJ J I' ,I •,, 1, I, ., .
rlw i11for111J11u11 \ uppon111 g .111 11 1, 1tl,·111
Uz~Jf,i! ('/l/(l('//11 ' i\ ,Ill )' inltJrlll ,llltlll tll J :11.1 ,if v.d11, .Ill ll lV<", 1114·""'1) 11 1.11 1·, ·,11 11 1d 1,11 /1 '1I l'/1 ,I I,;,,,
ii )
1ra11 smi11 C'd h)' .111 d, ·llruni l LlL1 1u:. II x1 1n" ' ·'l''l "' 1·11 1.,d ,, 11111111 c", .111.J v11I , 11·, .11 ,d IJJI• 11 ,, 1 •1.,11 J,, , ,j/f
\<)tn(' or tlw llHhl llJlllll11Jl1 1yp1 '\ nl d1 g11.il ,·v1d ,·11u·
Ev iden ce L:111 l)l' \ l,H c:d :L, ,111)' 111/o m1,111m1 1h11 11111 hi' 11111/irlt'III 01 u11 1t l'J .1 11,I , .1 11 1,1111, ·.,, 11 1, ,1 1111,1
rel.11rJ to :1 L:t~l' in 1ri:1I , 1h ,1 1 J\, i11dit ,1 1ing il1.11 .1 u ·11.1i11 'i til J'i LIIH ,. <JI, 1,11di111 111 I', 111 1--., JJ I I, 1·. •..;( ,. 1,1 11.1'.·
such informarion a.'i ev1dl'11u · Jur111 g :111 1n vn 11g:1111111. M:i ny 11 w1ni .d·, rH 11hjt-•1 1·, 1;rn lll'lp 11 ·. j11t,•;1 1,u,, ,,·.,
such as documcn1 , dcctro11i c nwdia , ck-c1rnn1 l lil n , pri111nu1 .,, 01 01hn qbjcl l', ,,l 11:1i11ed J11 1111,'. ,11111 1.1,.,
ciga1ion (Fig. 2.1). Thc:y c:111 he 1n::HtJ ;h t v1cltn cc or proof :111J lrn1dl i:d :JLl 'Jrdin g 11, y11111 'lll',-1i,1 , :, 111111.
evidence-handlin g proce~s.
of whether it phys-
I. The proper protocol should be followed for acquisition of the evidence irrespective
the device may be dam-
ical or digital. Cf.'nrle handling should be exercised for those situations where
aged k .g., dropped or ,-vet). '
D l( i ll A I I O RENs1c
30 •
· · r . .. 11 pl , whl'n 1he dev ice i~ acrivel y destr
2. Snecial lw11lling nuv bl.:' lt'q11ircd fo1 ~n1m· ~11ua11om . I·01 tlx.11 c , -1·111· ·I}' to IJre~c.' rVt' th•· "v·1d, oy.
r- · .• r . · , · I he \llll 111w11 1mmec.; l ... ' · cnct·
i1w d:11 a through disk 11)1 mat ung, 11 111 •1Yneu 10 . I 1 I , J , · ., I ·
C' • • . .
On che ocher hand . 111 ~o mc ~1111atu1ns, 11 wo u not H. •
Id I· . ar111ro1rn,1t e (l) ~ llll oown I IC CVICe ~o I 1(1( rh
c
dig-it:il forensic- expert c:111 cx,1111inl' the device's 1cmpor,1ry mc~iwry. _. . , _.
... .. I • .I I/ · 1· ·
3. All .1rut.1c1~. p 1ys1ca ,1nL or c 1g11 .1 s wu L 11 I1hrcolb-icd •
rc1a111 ed,and1ran ~luredus 111gaprcsrrved
chain of custo1lv. d I ·i d I I
4. All. marena · I~ sI1ou
' 111) , ci·itr ,,n,J
t .l ,
· ,. ,r:imiied , idrnrif),itwr, who collcc1e I ie· cvrt cnce ;m r 1e oca tion
• .1 11111 , ~ ,
1. Illustrative evidence
2. Electronic evidence
3. Documented evidence
L FO REN SIC S A N D
NTRODU CTIO N TO DIG ITA DIG ITA L EVIDE NC [S • 31
~
ble cv,dcn c:e
4. b pl.1i1rn
,. Suh s1.rn1i:d evid ence
6. Tes ti111oni:1I
e
2.10.3 Documented Evidenc of is
ons _trati~e evi den ce. Howev er, in documentary evidence, the pro
de~
Documenred e~i~ence _is similar to es, etc. ). It can include any number of
medias. Such docu-
conrra cts, wills, rnv o1e
presen red m wrm ng (viz., emails, ere.).
reco rded and sto red (viz ., pho tographs, recordings, films, printed
mt'ntati on can be
(Exculpatory)
2.10.4 Explainable Evidence partially
use d in crim ina l cases in whi ch it supports the dependent , either
This 1ype of eviden ce is rypica lly ato,y evi dence.
case. Jr is also referred to as exculp
or rou lly removing rhe ir guilr in rhe
1 l1.1111 nl u 1,1od~ ,, ,1I,,1 1Wu ' \\,ll } 11111 111 11 ,1 I1.1, r l)i,1 I1 , 11 w ·1 111d , ktl l 111 v.d1d.11 c you, cv ,d!' nu:
,.
1 l • •
2. 11 . 1 Authentication of Evidence
I'll< l.1w, 11! 111 ,1ny , tdtt 11 1mJ1u i11n , dd111 \' d.11 ,1.1 , "11m11r11-11HJrk/ and "rrrord-keepillg" . Before intro<lucin
1li1.:111 dc,t11mu11 , .111d 11·ui1,bl m.11 cri:d 11111,1 he :i u1lten1 1catcd.
,1' n 1< k-11 u ·,
g
fh l n ·1rl1.: nu·\ 1h.11 ,11 c· , ollet 1u l h, ,lll ) pt·N111 /in vn 1ig;11ur ~liould lit' col! eued_w,ing authenticate
rnc1hod, .ind tcd1111 q111:, bu .111,r d11rlllg Ln11 11 p1nu·1·ding\ 1hc~c will beco me m:11or evid ence~ to
prove th
n imr. In ntli <:1 v, ,,r,h. l11r p1ov1di11g :i p1 rLt of 1:v id1:nu: of the tr~1imo11y, it is n1.:cc~sary ro have an
authen~
ti L.1tcd t"\·1Ju 1n: h~ .1 •,pc·, 1,1101 whc, ha, a 11cr~o 11.il lrn,Jw lcdgc 10 it s origin .
h1r ,111 <:v,Jc-nu' to he ,1Jrrn,\ililc, i1 i, mu~~.,ry 1h:i1 i1 ~hould be aurhe nricared, ot herwise
the informa-
non LJnn n r lw pn:,r11t n l 111 tltt' jmlging hoJ y. The 111,1u cr of record is 1ha1
the eviden ce collect ed by an
pcr\1Jll \ho11ld mcc11he demand of :iu1 hcnt ic.11 ion . The evidences collected must have some sort of
intern;i
Jol unH:n1.11i on th:H rcc(), d\ the man11c1 of collected informarion.
-~--
- -,~,
• 100°/~-~~~ • .,
b_
I . , wlw·h ,\ 'tlll ow1H:d. or have . 11111 's r bl' k,cpt 111 · your sig .
· I11 at all 11111c~)
('l' .l< Clll t . d. -or - propn storage. /\11 l'V l·( It' llCl'/1 S IOU Id llOI
I
. Ii , cv1tkn cl's are (anwd o r sh11m l'd ro l'vi,J , ., .
~ C1ICC LllSIO rans 1
u1111 1 I l . t
d. · · · ·
other , ·d.
than tlw a11point,ttf t:v1 . UlCl' custo 1an, tlit· bes1 l'v1denct' ol your orga n1zat1011
he J(t<. ..~~·ihlc
to ;tll. ,V<llll'
. .
h.111g I)Lit rhc st.oragc art·:1. ·1·h e ev1·dcnce·
b 1 , sroredw1th111
.1.s,deor storagt·ruo111 · "I~"v 1·d,t nu., s,1 ,....
e 1 s not
11111st t ·
.ll~·t·•di.tn~ 111ll.'it nintrol all I he access to the evidence s·i/'c
C V
'' '
CHAIN OF
CUSTODY
Received F10111. _ _ _ _ _ _ _ _ __
Received By· _ _ _ _ _ _ _ __ __
Received From. _ _ _ _ _ _ _ _ __
Received By- _ _ _ _ _ _ _ _ _ __
Received From· _ _ _ _ _ _ _ _ __
Received By: _ _ _ _ _ _ _ _ _ __
Received From: _ _ _ _ _ _ _ _ __
Received By: _ _ _ _ _ _ _ _ _ __
Received From· _ _ _ _ _ _ _ __ _
Received By: _ _ _ _ _ _ _ _ _ __
Received From: _ _ __ _ _ _ _ __
Received By: _ _ __ _ _ _ _ _ __
EJ. Summary
111 thi~ , lu\'t l'L wr d1sc. 1t~,1.'II 111111\l·r,Hb di~i1.1 in dw ltnni 111 i11l;,rn ,,11i1111 11 11111 , 11111p1 - di
I 11 11 ii
lorrn,iL 11wdcb .md h1ghlif_l1tcd tlw ph.1,1 ·, 111 t';1d1 ltll'I\I ~. l'lll ,llb , 111~1.1111 llll'\~,l g1·,, llll l'l lli'I li1 ~1111 l', 11
Ill
mn1kl . l'ad1 1)1•\l tvl tl\l' ' panirnl.11 ,l·rics ol ph.1,c
111 J1 g11.1l frnrn ,,,- l1l'ld . tlwn- ,H l' m.1n1· l1lll'll
,. ll'~t .
. linlll v ll'llllt S d,·< '
1r11111 1 dl' v1, 1' '. , ;11111 11 i, v
,.,,,
,il ,·lfrct ivc. ( :nm111tlL'r 1~ 1n·.11 1:d .,~ ,11111111.11 y ,
11111 11. il
a1,prn .tl he, whi, h l ,\11 h1. 11,r,I li\' dw lll\\', t'1t;,11,H
lll i·viLli·iH r i11 ;tlinmt all L.\\I' \. I )iµ,ll .11, 11 1111 ·11, 1· ,1 , 1
11w1•~ti g.11e 1\w ( N ', 1),git ,d rv1,km c~ on he fo11n< vit.11 rule in di git.ii l,11l'11 ~iL i11vl'~ ll)!,,1t1rn1. 1 11,~ .,
l
Key Terms
• Acquisition: The pn1L1·~, ell' LTl', llin~ .1 dupli catl' • Verification: ;\ term llSl.'ll 10 rd er ,'n 1he h,1.\ lii11
, 1i11y ol dip.it.ii mnli .1 1~11 d,L. pu1 pose ,lf L'X.tl\1 - ~
ol bo1h SlllllH mcd1 ,1and :ll lllllrr d 1m.1~•r to vr,i(y
1nm~ 11 . the .1crnr:1ry nf tlw cupy.
• Computational forensics: Compu1at 1011.il fon:11 ·
- • Hacking: Modifying, a urn1p11tL'r in a w.,y wh,d
~i,, .ll'l' digital foremi c~ wi1 h thl' me or .Hliltcial ,
wa~ mlt origin:illy int en(h l 1n hrnel11 th" h:1rkei\
int ellige nce . goals.
• Digital media: Used within the l,eld5 to n:fcr • Denial-of-service attack: An at1c·mp1 111 prcvc-
to
the phys iu l medium (vil .. ,1 hard drivl'.) or d.tta- 111
legitimate mers of :1 comp111n ~ys1e111 rrom h.1 vin~
srornge device. access to that system's infurmat ion or wrviLc~ .
• E-discovery or Discovery: A common acron ym
• Metadata: Data ahou1 1.l.11;1. Ii can he embnldl'd
for ekc1runic di~l'ove1y. wnhin fib or ,1Uml ex ternall y in .1 ,cpar ,n,, !ill'
• Exhibit: \)i g,i tal media seized for invc~tigation
i, and may co ntain information :1bu11t 1hc Ilk·\
u, 11.tll y rel"crr ed 10 :i, an "ex hi hit ".
author, rorimt, nca tin11 dat l', .,nd so 011 .
• Hashing: Within thl.' lteld. "ha,liing" n:fn, to tliv
ll~( ' 1)r h.1, h I ll11 Ll ion~ (e .g. , CRC
, SHA I or Ml)'))
• Write blocker: A h:ml w:11\' 1.k-viu· Ill' IV.Il l',or,
appli cation which prc·vi-·n ts an y data 1'111111 hei11 h
tn vcril'y tl, at an "im:1 gt:'' i~ ,dcmiLJI to tlH: source
modified or added to th1.· strna gr 111 edi111n lwi11 h
111edi ,1.
cxa minrd .
• Image: A d11pli ca t,· rnpy of ,Ollll.' diµ,i1:1I media
1reat ed .1, pa1t oi' th c i<ll l' mlL process.
0
or
Bit copy: "Bit " is a (llllll':lctiLln the \tr1l\ "hi11.1ry
diµ,11 " and i~ the f1111d.tm cn1al 1111i1 1i!' ~·,1mp111i11g.
• Imaging: Sy11011yrn of "acq ui,iri on".
A bit copy ,Acr, to a ,eq11rn1i:d rnpy llf rvr1y 1111
• Live analysis: i\naly~,s of a piw· of di git.ii med
ia on a s1ora l:.\c medium . whi ch in, lt11k, ,ll'L',1', 111° ilw
lrt11ll w11hin i1 ,elr; nfttn W,L'd Ill acquire data from
medium "invi,ihk" to 1hc u,er.
RAM whrn: tit" wnu ld lw lo,t 11pon shut1in11,
d11w11 die cl ev iLc. • RAM: Rand om Ac, L's~ Memnry. RAM 1, ;1
• Siad< span·: ·I he 11nu, ed sp:tlL' al the rncl of a <.o mput c:1\ temporary wmk span· and i, 1'111.1 ·
1,k 1ik, which 111cam it, co111 1.·n1~ :tl'l' lti.,;t wli l'11 du·
111 .1tile \\'•,1rn1 th~t u~e, l1xi:d-,ize clus1ns (if the 1,le
t\ ,111.1ll c-r tlt.111 dtL'l1 xl:d block si-,.e, tlll'n the unu~e d comput er i~ powered ,ll.
,11,11 1· I\ ,i,npl y kit ). l )ft,·11 Lrnl\.iim dekt ed infor- • Key-logging: Thl'. l"l:'Llll'ding iii k1:yh11;1rd i11p111
111.1111111 i'ri1111 jll l'.v io11s u,c~111' th r block. givin g ilw ahi liry [l1 read ,1 u":r',; typc,I p.1,,wn1,k
• \ teganography: lhe Wlll LI stq>,a 111>graph y Lome email ~. a11d mhu 1"11111,drnti.11 i11l;1rmatio11.
~
1111111 1h,: ( ;,eek name '\1q~.1no," (hiddrn or • Data : Informati on in :111 11\ng Pl Jiµ,i t.il 1111111 1h.11
\\\ r,·1) :,nd "r~r.,phv'' lw ri1111 ~ Ill' dr.1wi 11 b) :l ll LI can lw tr:11vrn1ittl'd or 1n1i1.·1·,,cd ,
111 ,·1.dl v 11 1,·,111, lrn\dcn w rit i110 Stl.'",111ouriphv • Dat:1 extraction: A ph11.l·,, th:1t ide11tif1,·, .,n~
t''
l
11\1 , 11., lu11q11c, 10 u,111111u11i catc i1dort'Im,1t io11t, ' ,' l'l'rnv n ~ 1n fc.H 1ll;Hilln 1ha1 111 :1>" 1101 lic i11rn1r,l1·
in a
.I ,II' I h.11 I\ hidd,·1l. inely .tppa renr.
,N1R1..~DU CT IO N TO DI GITAL FOR ENS ICS AND DIGITAL EV IDEN
CES • 35
Encryption: A pnKt'durc thar co nvcns plain text • Work copy: A copy or duplicate of ,1 recordin g or
the int ended
111ro -.,rnihuls co prt·vc:nr anvo . · nc but da ta 1har Lan he 11s<:cl for ,11hseq11<:nt pn,cc,s ing
r:lipil'llt lrom undcr~tanJ1ng rhe 111ess:1ge. and/or an,tlysis . Ir is also Lalkd an image.
f ilr formal: The strucuire lw which da t:i i~org:i- • Write block/write protect: H::irdw:t1L' and/or
1111c:d 111 a ftk. .,ofrv,a re method s of prevcnr ing mod11ic 1tion of
• Forrnsic wipt•: A vnifohle procedu re fo r sani- cont ent on a media storag<: 11ni1 ~uch a~ ,1 CD or
rii trH~ ,1 dd1ncd ,m -.1 of digir;d medi.1 by over- thumb dri ve.
Mtl t~ig t\tCh lwrc wi th ,l known Yalue; this pro(e.~s • Acquisition of digital evidence: Acqu isition n/'
prn en1, no., \-\'O!lt.1mi n,1t ion of dJ r,1. digital ev idence begi ns when information and/or
, Hash or hash "aJue: Numerical vJ!ues rh:n repre- physical irems are collected or stored for cx:1 mina-
,rnt ,I , tring or fl'XI (~t'cll'Ch term), gene rated bv 1ion. The term "evidence" implie!> rha t rhe collel -
h,1,hine, f1111crinm (.1lgorirh1m). Hash v,1lues ar~ tion of evidence is recogni zed by the courn,. T he
u,cd t,; querr l.1rg,· su m~1)f d:ira such a~ databases process of collectin g is also assumed ro be a legal
, 11 hard dri \'c'~ for specillc terms. l 11 fo rensics,
hash process and is appropriate for ru !cs of evidence
,·.tlt1c, .tr,· al ~o u~ed ro su bsranriate rhe integrity of in rhar locali ry. A data object or physic,1I irem
d1oi1.tl l'Vtdr nn· .ind /or fo r inclusio n and exclu- only becomes evidence when so deemed by a law
" cL1111pari~nm agc1 inst known value sets.
~1011 enforcemenr official or designee.
, Log file: :\ recurd of ,1criom, event~, and related • Data objects: Objects or inform ation of potemi al
d,11,1. probativ e value that are associated with physica l
• Media: Uhjcl t\ on which data can be stored. items. Data objects may occur in differen t fo rmats
In, l11de~ h,1rJ drives, thumb drives, CD/DVD, wi rhout alt ering the original information.
ilnppy di ~c~. Sltvl carJ ~ fro m mobik device~. • Digital Evidence: Jnfo rmation of probative value
111e1mir,· t ,trd~ l~ir L.1nwra~, etc. stored or transmirred in digital fo rm .
• Metada1a: O:ita . freq uently embedded within • PhysicaJ items: Items on which data objects or
1 tile, 1h.n cbcrihe~ ,1 Il le or directory, and ca n info rmation may be stored and/or through which
include I he loc.11 iom where the co111enr is srored, data objecrs are transferred.
d.11c~.rnJ 1inH·, . ;1pplicaci on-spec ific info rm arion, • Original digital evidence: Physica l irems and
.ind pern1is~iom (t'.g. , email header~ and wehsit e dara objects associated wirh such irems at the time
~LlllrL l' u > dc co111ain me1adara). of acquisition or seizure.
• Par1ition U,er-Jd1 ned sect ion of d ec1ronic
: • Duplicate digital evidence: An accurare digital
111edi:1. P.1r1i tio1l\ u 111 be 11seJ 10 ~epa ratc and hide reprodu ction of all data objecrs cont ained on an
111li1rm,ll 10ll 1lll ,1 h:irJ drive. originaJ physica l item.
• Source code: T hl' 111structi o11s wri tren in :i • Copy: An acrnrate reprodu ction of in form:11i on
prog1.1111m111g langu.t!!,I' used 10 build :i compu rer conrain ed on an origi nal physica l irem, indepen-
prngr,1 111. dent of the origi nal physical item.
ai Review Questions
I. \X'lw 1~ digi1:1 I fiJi emic~? 6. What are rhc clullenges in evidence ha ndling?
2, h 1,l.1in thl' p1oc,~~ ,d'J igital k1rcmics. 7. Wh:i t is digital evidence?
3. Wh,11 t·1hilal i,,,LH's :in· i11 vnlvl'd in the d1gi1 al 8. Explain rhe various rypes of evidence. Ex plain
f1ll\'ll.\ lL jlrth ('~, ? the rules of evidence.
4· 1_~1,l.1i11 the hi~tor_v of digi 1.tl forensic field . 9. Describe the· term metadata.
S. \\ 11.11 1., ,111 ev idcrll·e lw 1dlin r.c• ,,rc•ced urc 1
Incidence Response Process
LEARNING OBJECTIVES
Afrer reading this chapter, you will be able to:
• Understand the concept incident and its inci- • Interpret and apply va rious phases of method-
dent response goal. ology on incident.
• Understand rhe proce~s of incident response • Distinguish difference between initial response
process. activity and after detection of an incident.
Bei11g prepared for incident response is likely to be onf ofthf more cost-effective security mfasures any organiZ11-
1io11 c1111 take because well-planned JR reduces the incident impart and costs and bfcausf serurity incidents arf
inevitable.
-Anton Chuvakin
[}.Mi J Introduction
Accordi ng to incidence response (IR) investigator team, they have responded to a gamut of incidents: crim-
inal inciden ts, inciJencs that involved civil litigation, and incidents th at disrupted business but were not
actionable (case~ where criminal or civil action was improbable) . They also have developed incident response
plans for numerous organizations, ranging from financial services insrit mions to companies that produce
mainstream products. During their various responses and progra m development engagemenrs, they sought
111 dr~ign an incident response proce~s that will work with each type of incident you may encounter. They
bdieve that the incident response proces~ rhey introduce in this chaprer meets the needs of any organization
or individual who must respond to compurer security incidents. T hey also believe that law enforcement or
hired invesrigarors should understand all or the phases of rhis methodology, even if they perform actions
during_on ly a portion of the enti re proce~.\ .
Bdore we delve into the speci fi cs of rhe incident respome methodology, there are some basic ques tions
'.,h~t need answers about incident response. Some of them are "What are com puter security incident~",
What are tht" goab of' incident response", anJ ''Who is involved in th e incidenr respome process"?
38 • DI GI TA L ro r(ENs1c
Incident Management
~-==========================
L I_ _ _ __ _ _ A1e_r1s
______ ~I Other Incident Management Serv<es
3. 1. 1 An Incident
In info technology, an occurrence or an incident (arrack) is an event wherever a service or element fails to
produce a fea ture or service ,hat ir had been designed to deliver.
•~etriialak
·-
•
(mfl .
-- ~
•IJe mt11tnm1s
ogrg
•~ o o
We t'rnph;1:,1ze 1he goa ls of co rpora1e sccuriry professionals wit h legitimate business concerns in our inci-
dcn1 re~ponse merhodology. In add i1ion, we also take imo considcrarion 1he concern s of law enforcement
officials. Therefore, we have developed a procedure that promo1e.~ a coordinated, cohesive response ,md
achieve~ 1he follow ing:
I. Prevention 0L1 di!>join1 and non-cohesive response (whi ch could be disasrrous).
2. Occurrence of" incidenr is confirmed or dispelled.
3. Promotes collec1ion of accura1e informarion.
4. Proper retrieval and handling of evidence esrablishmcn1 is controlled.
5. Pro1ection of privacy rights established by law and policy.
6. Minimization of disruption to busin ess and network opera tions.
7. Allowance for criminal or civil act ion aga insr the culprit.
8. Accurate repom and useful reco mmendations are provided.
9. Rapid dc1ec1ion and co n1ainme11t are provided.
10. Minimi·Larion to exposure and cumpromise proprie1ary da1 a.
11. 'IJ·ic~ to protec1 your organization's repu1ation and assets.
12. Educ,11c.~~enior :1dminisrration.
13. Pru11101io11 of rapid dert:ction and/or preven1ion of such incidents in the futu re (via lc~sons learned,
policy Lhanges , ere.).
char crnrrgency pr01.cd urt>) nm ~moo1hl~. l:..a.i.:h a~l~a of 1he comp,rn~· fus unique re,pomibdi 11e~ du ring an
inc1dc:n1 .\1 irs rnre. &n IR 1e-am should lon<1\I ol
1- - I• _
~A 15 calte<J upon when an employee is discovered to be
rnvot1ed with an incident
Identifying and analyzing whal has Eslablishing relationship with local law
happonad during an incident, including enforcement agency, government agencies,
the tmpact end threat key partners, and suppliers
~e lntornu1t1on
_111 lllci,kni : ll'hrrc rlic\' "'led tlw righ1 people wi 1 h Ihe appropriare \kill set: where I hey defi nc 1he crneria
111,le,·l.,rc _111 inlldcni : ·,, hnc thcr ddi 1w rlw righ1 {(1ols 10 h:mdk an i11 cide111 :
where 1hc rc;im defin c:s what
tl1<·i· .11 ,· f.;tll ng 111 1eporr: :ind 111whum i, the 1c.1111 go ing In rn111 m1111ic Ht'. . . .
I Im ,rep i~ 1ruc,.11111cn~11 rc rc,p111hl' ,ll li1111., :ire known .ind 1110rd111.lll'd . l ,und prcparat1nm will help
rhl'lll lm1i1 rl1t· r ,111·111i.d J,111.l~t· h)' L'lhUring q11iLk .111d cfli.'l 1ivc l'('S jlllllSt' ;1ctiom.
3.3.2 Investigation
or
I 11\'l'Slig:mon I.\ Ihe pii.lSL'whn c ll'.1111 j>(' I son nd dctt' l'lll llll' dw priori ry, .\ CO pr, :111d l'l)() ( C.ll!Se rhe incidenl.
l l1 is ql'p i, 11he1c 1hc n-.1111 ,·niflc, ii' .111 rn·1.1 \io11 lw ou urrnl, ~11ppuneJ evcn1 s ohsnva1inn , i11dica rors,
.,ml \C,111.:h lll1 J cvi.11111n~ fit>lll 1r.1di1in11.d 11pcr,uiom .111d liir 111.diciou~ aus or trin 10 and do damage. The
r1t1l l'l'fi1111 1111\ h:1111., 111 in pl.1lt' 1.111 l:1t il11.11 t· 1hl' tc.1111 do111g die idrn1il1c:11io11 . 1111 idl'llt h:111dler tt·:nn will
11" ' dw,r rx pc1i1nu· ru IPnk .11 1hc !,ig11, and 111dio101., . The ll h\crv.11io11 111igh1 occ11r ~ll 11e1work , host. or
,r., 1e111 kvcl. It i\ where dw 1e.1m lever,1g,s rhc .dcm .111d log~ fwm 1n111er~, f1rcwall\, IDS, SIEi\11, AV garc-
11·.11 ., . •1111·1.11i11g w~tt·m. lll' l11 nrk llm\'\, .111d 111<1r1·. \Vhrn di.\ 11 11gui\ hing an nct:t \iun , 1hc I L'Jlll i, compelled
10 •"~1·,., 1hc imp:1u .111d 1101il\ tl1l· ~1111.1hk pt·upk ,11 1·>. 1c111;il p.1r1ir\. If ih n e are rc:i~om ru hdicw rh:11 1hc
or
11 .llll ll'ill r ng.,~,· l. 111 · 1·nl;1ru·mrn1. i1 i~ ll' ill'll' dw fl'.111! l' ll\llfl'\ ( h:1i11 lll ~tndy, 11 is ,Ir rl1i ~ ) l,tg l' Ih,tt ,he
1t·.1n1,H11 l1ne\ dw nex t ,1cp\. ·
3.3.3 Remediation
lfrmc1l 1.11io11 ,~ tlw pm1 111cidrn1 1 •111ir 11 ( 1,.-. ,I · • f.f. ,d
· , ' · · 1u 1t 1 ~1·,1t·m, , w 111111u111(,H11J11 , and imLruc1ion ro a t'tlc::
· · I
p.1r11c·., . .11 ,J .111.d1 ,h d1.1t cn11 l1nm· ilw 1h1t.•11 ILI\ I1eu, 1 cont .11·11n I. 11w dncr111111 :111on of whcd1cr 1 1ere are
A
• 43
. ,,,ul.iri)ry rcq11ircJn L' lll.\, r(_H rq~o n '. ng rhe in:·idcnt (:rnd to whi ch oursid e pani es) will be m:i de at rhi'.> stage
it;-, ·i:tl in11 w1tl 1 ( )( ,( ·· ApLu 1 1ru m ,my formal reports, rhe j)OS L-morrem will be com1Jlcted at rl11S ~t agc
. ,H li K 1· . J .
111 ' n,i\' iinp,Ht ,he H:' lll L' l l:tu on anc1 int erp re rari on of the in cident .
,l ' II I .
33 5
· · Reporting
~\~~:~~~~n, respo nse an ivitic~, wi ll _be_documenred ro incl_ude a_ni'.acts obrai_~~d using methods cons_istent
11 of cusrodv and co nft dentnlnv reciuirements. Inc1denrs will be pno11t1zed and ranked accordmg to
ti\t1.r . ' ' 1 · . '
1
111 a ~~ ~nt1al to disclose restricted data. As an inves riga tion progr~sses, that ranking may change , resulring
invt~ t,1tn or lesse r prioritizati on of resources. ln cid enrs will be reviewed post-mortem to assess whether the
.tigarinnal pnxe~s was successful and effective. Su bsequenr adjustments may be made to methods and
1
111,,, r,li11 n ,111,I hyod11·111,111i, q1.1111 :, 111 i11111111vc iii, i11, 1.l, ·111 Jt''•l'• 111·,1: )" "'' ..,. /\ itd,i, ~,,l,1.011 ·.J d•Jtiii;•, ii.
1
11
,11111,c 111 ,111 i111 ,·,1i1•,1ti,11111t.1)' h,· d, k11·d ,il11 1 d11•, 1111, lm,1111111 tl w111 11• :,111•,, 1,,11 . · ·
tlh1,1 1.111.' d,r p1111 r." , wr 11 y 1,1111.d,I.' illl' I'' 1ln 1 ll,1w, l1.11 t ,111, 1111•,:11111,4,• I w_p 1;1·,1..",, ·,,, 11c JmJCe:,, un '"·
1
.1p11l1l'II 111 d1c 1\\'1111i, l ,,,r, . 11 i~ 'i\lll l' .1, l1.dk11g,· 1c1 l111ill :1 , 11 .111•,l1d1Jrw,1rd u11agc 1I die J!rt >1,.1,":,, wlH•i,,.•
111.1i111.1i11i111,,1 :1 lirl1•1°11I k"rl 111 .11 l 111.1,·1· :1, ,1 n",11 li ,,( di(' i111 idr111 rn p >ll'1l' JH
1 1
J1 1.:·,~ will inv,,l w r,u, 11 ,:, ••
r · ' 'JU•·
v.111.1hlr~ ,llhl l.1, 1,11, d1.11 11LI\'. l1.1w .111 r ll i·, 1 ,11 1it, llnw. 1lnWl'Yl'I', we 11:nd 1 > m·I d1 ~1 Wt 11:nc dcvd ,,1,,.d ~'
1
~·vc111 11·,11111hr 111rd1,1d d1.11 i, ~11 .1iglii1,11 w.11d , 11/lll'l l, :111d :11. 111:il.
: \ 1111pt1ll'I M\ ~1111 )' in, i,k111\ ,II L' lnr_tl1r 1_11,,,1 p.111 , l llllljllil:lf t'd'. lllllli if;iu·ic_J pr il1l1:1m, We u·,c a "bi.t\.h
1
~10~ ·'Pl't"i1.1d1 ~ ,•11h_.lily , t@plrx ('llg111cr n11g prnl,l,·~11 111 ~olw 11 . Wt: d1\~11l,u1c the: lart,tr Jm,bltin ,if
1Jl ltnt. hgw1: 3.
~Ill tll(. 1H 1c:s11l11t 11111 111111 u'.1 111_)1J1J l'lll \ :ind ~11rvry thl' 111p11ts ;111d 011tpu1, of t·ad1 (,..lJJll jJ 2
1ll1btl .ll l'., t)III' .1pprn.11. h 111 llllllk11t ,c:~pnmc.
g
{D:;, lncldont occurs: Point-ln-hmo or ongoing
e:., C
---
/
'
lnvc:;li!)ale the incident
- - /
/
'
Formulate
/
' /
'
Pre•inc1dont Dotection Initial Data Data
prcparntion ·• of lncidonl:; • ro!iponso
f-► response i-.
collection analysis
~ Reporting
stratogy
\. ., \. , \. \.. '- ,
'- '
"'
' i,
'
Resolution
Hecovory
Implement security moa:;ures
\.
{e) 11.> pl·rform incident response in ~uch a m.1nner that it promotes sucC.C.'!)~fu l foren sics, investigations
and rcnwJi;1tion; train yo ur staff or l'rnploycc~. '
Afta :111 i1Kidl'nr occms, you would not want to acquire c~~cn ti.tl rnourccs. Anyhow, you cannot afford
urnwce~sary dd;1ys when ancmpting to resolvt an incident. We: will go inro detail about the hardware
software, docurncntarion, policir~. and training rl'Cp1ire<l 10 prepare your organization and CSIRT before a~
incidnH occurs.
Preparation
Detection
No
Containment
Eradicalion
Recovery
Follow-up
Ir is i111i,,n.mt ll' r,\.\) t\{ .11! dw k1h,wn dri ,·1, 1 1 11111nh,, · : ·11 11 1Il'!1 \ I .1111·11111 ' I1·111. ·1·11 111.1,I c .~111 c
.hcB . " 'l' sw,, · ·c .· - ~.. 11,1 , . · l ' , ,
. - )rd cht rd t, .mr . I1rd11 · · •
.
1\f 1n .111 Ith 11lrn1 1\ dclc llrd
· N , 0 ll1-lll~ ,ll\ 11\lt nl r •
,·.Hl r:\, t·' • t'~ p,,n se l ' ,
t. 1.
· ·; 11! r~s'' l'm " d 1t'\lli,;r "hl't tl l I •1\llll
.. ,
l · I II ' ' , .1hk
•
, 1,,,.11 \h• ' ·t . . ll l
,·
1'l'l lllll\ '
·. - l l 1.,, _s. 1111 1 ,,·l ol wl11· l· Ii l"'ill hl' 1c.11lily rcni r,ni
: •' , ,. r-·IY. .-\ls rc'(w d ch, kn'1 " n f•11..
1
,.
b. •,,,m e l,t the d··11
' • ·
1ls ,, 111· \. l ,lrl' 1' llll1 ,l
·
til l
I I
Ill 1•;
un:,.,,.t.t '
I. Prn 1km n me- .inJ ,I.Ht'.
2. R"['1Jl ll rh.:- in, id<nt ~lt-.:h .ls whl,/wh.n.
3. Pts..-ripti,,n 1)f rlw in,iJ,:nr.
~. ln,·iJent o.:n1m:.'rKt.'.
;. Jn,-., 1\',·ment "' f h.1 rJw .1r1:·/s,,fr\\ .l rt' .
s.
6. J\,inr~ l,f l'l'ntJ.:r t~,r inw1 lwJ hum.m rrsn urrc
· 11l'
. ,K(\'1 I ,I 1·ll'f' L'<l llll' Ir 11ng- · · ·.1 I n·.,pllllSl'
I 1n111
CSI RT sh1,1ild_. ~e J1:ti\ '.1tt· J .rn,{ ' 'l'l'r ,,•1,ri ' 11 t. I'.l~,pl. ~. U)llf
Th, .. ~ .' .• . • .
rl1 c rH·x 1 pli.1sl' of
. .f' .
11 tr,'lm the 111111.tl rcspl111:,c rhcckli:-.1 10 hn:i n
rh.xk11 ~r. Th, ~ rd m " ~ll __~c th~ rntl,rnl.llt,,n C
The response strategy is also important in a large organization because it proviJes future update
for new CS!R~ team to det~rmine technical resources, political considerations, legal constraints, and
business obJeCtlves. The detailed discussion of these factors will be discussed later.
2. Considering appropriate responses: You should be able to arrive at a viable response strategy armed
with the circumstanc~s of the attack and your capacity to respond. It shows some common siruations
with response strategies and potential outcomes. The response strategy determines how you proceed
from an incident to an outcome. As shown in Table 3.1, which explains some examples oflncident and
its response strategy as well as its expected outcome.
,,1, h ' ,,,,, 111 :•.111 1/ ,Jl/1,/j ,,, / i i ,( I, :•JI,- ,, 1111J11 IJ, d 111 LJl, t LI JI J Jlf J t lltJll \~
(,J j•,,!il,, d,.:·1-i-.,w ,,f ii,, 111 , ,, 1,' 1, 1 ,,1 1,I tlw 11i1J1,I' J 111 ,r 1111 d 1, 1JJg.Jni1.i 1i1JJJ\ 1tp11L.lli11J1/bu·>iJ1t:~~.
(/} j 1,,, ,1 1; 1,/ JJ, 11 ii, 1111 ,I ,,,,,,,, 11 y J IJ.j i, ~111111 1j fl.1l 1, 1,1 J1JJ Jtk JJ /l jl:H I,
J, 'L,Ll,,y, :4, ri,,111 /, 11 1J1 i',i 1,1 1,if l'11l w ill,,, , ,j IIJ d1 ~ ipl1 lJ/' .ill < 1Jlj1l11j'I ,. '.ir l•J re ·,p1J'.1d LO J 111 :ilJCi 1JtJ \ au
1
1, ,. 1, ,, 11 ,,,.j, 1 IL, .,, 11, ) 11 , .,1 1 I,, ,, 11 , 11!• ,l w1 d, .i 1 1111111 w l 11 f<·11.Jl. a u vil , 011Jj1b1111 , 1H adniini·,rraiivc
1
, , J,111 1; :,1 1,I •11 1,1 1n l• ;;•· , , 1•11 Jl 11,11 ·1,li, fl il,, 11J1 Jd ·111 J\ w .111 ;1Jfl<"d ., , 1
/4 , f., y,;,I ;,1 1i,w: / 1 ,·. , , 11 ::1 11, 111 I'> 111 , , •, 1i;,,1H J, , 11111i111q ~,,, IJJ i1 y 1111 1d 1·111 d 1J1 , ~ 111 //f)llflhle, <JI" il1a1 U HilJ
I, ..j 1,1 ., I, //'.l ltl ,,, I •1 1: 11 1,11,, , ., ,J11 q~, 11,, · l 'lrl / JJf<r,i,1·, If '/(' l ·1 ~•'' d1<111 I\ :llt ,,, lil t· a Liv,I (.IJlllj1l.i1111 ()f
1
1,, 1,11 1,fl l.,·u , , ,l,11 • • 11111.1 , I :,11 11111,1, , 111 1 111ll1 '11Jl •1c1111111 will 1,dtH ( il it J IJ IIJrJtim y 1h.J1 y<111r orga 11 j.
u1 11 ,i ,J, ,,h ;,11 ,l, JII 11 1, ,d, 111 , ,111d I J I• fill ,!,·ld1 1·1.,11111J d1111Jld 111 1u IH f1 1rC' y,, 11 c·11g:11:l' die: ,1pp11,p11Ji c
1 <
;, 111L,,,11 1, ~ If Y'"'' ,1 1;: 11t11.J lt1,11 Ir, h , 1,111111 lhl 1,1111111/ y d,c· l.,w l' fll1J11 t r1 1rr11 , y o11 l1l :1y WJ11 1 1o J,:.
f 1 11 1:11,, d,, ., ,,,,,,11, 1 ,,/ , fl,,,, J lr•l ,, ',1J1,r,, ~ y,,11 v, .1111 1,, i11 v, ·,1 111 die 11 1v, ',ll i' -ll i()fl bdorc: l11i11gi11~ in J
ltJ ' m 1.,1L•.1.11,11JJ i11 •11 111• 111 , , l, ..J,lr, L,· 1,1,,, ,,1, d 1,1 l.,w rnl,11< 1111! 11111/li, i.1 1\ f;,r dtl' III ,,, ,Ill on?
ff) I J, ,, ~ y111 H 1,11•.-,1,11 .,11,,i, h; 1,11 .11,d h:111· J ·1mil•11,g 11 l.iri1Jtl',l,1p l p,i,,, l1.1i\1J11) with rlu: lolal or
/1 ,!, ,.,I In , 1 ,tf,11 1111111,1 ,,ljj,, n'
'!•J I J, , d 1r j 1,1·.1 I;, r/,,1111 ,1111 1 ~ ,,f 1L,. i11d1,1,l111l Ill \ Ill J IJY h1:,,I ,l<.ti<1 f1 '
11) I /,,If 11111 d,, 1 11
J.1 ;,1 1d ,1 1114111 i11 ·,1,l •,1 J"fll 1,1 11111, 11 r 1111 LIJ', IJir·,) 111 ir1;11iulJ\~
1.,1,I, I 1 · !1' ,:.". ·,' .,, 1~ I ' '·1111 ,,, ,11 ,,, 1 11.111 1,·, J 11 1 1,,, 1111e I" ,1r,11 1 d Jt 111 ,11, dIJI 111Jy lead ro l.iw rnfon.c•
/J JI '" Ill ✓ 1 ,I ,'("" Ill
r..hl• J.2 ( ~,,,,,fl i1 >n V1•1 1.-111<J'; ilnd r,r,t(:11ti,,I 1Jr t1<.1n~
, / q 1t
'"''''"'"
,1 11 f l , , (
,,,,. , J • , 111 ,,1,, ,,1J1 1•1•1111!,
. ·--· ~
Artion
>
n "' ., 11 ,·1111,1
-'"- - - -- --
l1k4y -llfdw
-
1111 , 41 1 ,1 L II ti w ,, 111 1 r 1
I\
· J f' l
h l"llll II"\,
I .
l llll~,llrr 111111fym~
r I f rIu: Jl!Jr Y,r-r
l'lj,11f1i· d11· J t)f,1J \,fr, ' 1
I
1.
I .. ,,,.I/or l<'rntlf~Jlt
I
,
-11,r lulp of rht ~uunr ISP by
i,n:,11111.11,111 l11 .1y J l •.11 ,,, c·~
,,j lu11n ,,( 'i, I"'' r N ,,( tl1c 1111' I,}' rl1t· Jltal ~ .., .
INCI DEN CE RESPONSE PROCESS • 51
5. Administrative action: Currently, more common than initiating civil or criminal actions is disci-
plining or terminating employees via administrative measures. To discipline internal employees, some
admin istrative actions that can be implemented includes:
(a) Letter of reproof.
(b) Immediate discharge.
(c) Leave of absence for a specific length of rime (paid or unpaid) is mandatory.
(d) Job duties should be reassigned (diminished responsibility).
(e) Temporary reduction in pay to interpret for losses/damage.
(f) Public/private apology for actions regulated.
(g) Wi rhdrawal of certain advantages such as network or web access.
Y , r lll.1111111
I . ' II ii ' II I ' V 1111 lllllll , , ·I · I
Il l II 11 111 I I " that ' meet ~ yottr
rnolw tlu· i11Licl,,nt in :1 111:111nL'I
rn1 1',,11 I\ I ., I II' I ii' u:• d I( I I (} II I 'i II.IIII pI·I, I\(,' \/II i I I•·>. imillr :ill tl,e data wlh tt·1 to (' l'1t'Irm1nc 'the who
I
' '
idcnt in ,tlw 1;11\'ll!,k .111:ilym p rn\c, F1g11rc J/4
I
l!",p1ll1\I' i,11 ,111 I·',)' ' 11111 ~,•I : ·, . , , HI .·I · t tll thr int ., .
wli.11 , wl1e·11 , whr1r, ,1111 1nw tll 111111.111011 v,111
illm11.111·\ th,· p,,.,.,tl,1,· \ll'jl\ 1.d,rn d111ing il1L' twn pl1.1,e~11l 111v1·\1tl',:tlt11ll,
I. Y,,11 11111·.1 c11ll qt rl1·L11011ir i111; 11111.11 ion ill .1 forrn,kally Mlltnd mannC'r.
2. You v,·1y 1,f1rn Llllln t 111111t· da1a il1a11 you Lall 1<·ad in your lifrtimc (rnmputa \torag<" capaciry concin-
111 ~ lo 1•,n,w).
J, Ynu 11111•,1li:,ndl,· dll' uillt-w·d da1,1 i11 \11d1 a lll:lllll('f tl1:11 it prortu\ the inrq;riry (evidence handling).
Tl,r•, ~ 11, 111i1rn1rn1\ dl'\(lilw d1.11 \1'<'1 i.11 ~kill\ art· rrquircd to oh1ain redmical c.-vidcnce. During the
1 1
cl,11J , 11n j.,,1 pl1.1•,r, rl,c- i1donua1 i1J1t you oh1;iin ( an be dividt'd into rhrec fundamc.-ntal area: host-based
11 I
i11l1J1111,ili1111 , 1wtwotl1 11:1•,cJ inf111nlJli1111 , a11d orl1rr in!imn,uio 11 ,
I. 1lm,1 •hJstcl i11for111~1ion: ~, lir 1111•,,, rn 1mh, d111.1trnt·1H\, and any otlic-r information thac ii found on 1
,y•,trn1 ,111cl .' '"' ol,1 .1~11nl fru111111·1w,11k-ha ,nl 110,k~;.re indudc:J in host-ba~cd evic1taQa. Fo,.....-plc,
1
11:1•,1 l,.,,.,l'd .111f ,rt11:H101, 111,1y l,l' a \yl.lrni l1:1c kup whid 1 harhon evidence at a spedlc
1 in dJrlC.
( 1.ttlll'rt11g 11111,1111.1111,11 n11wo d1flnt11t 111111ner•
·
/ 1• , 1 L'1 ·
,- 11 , ,,.114 w ,rr
dfi
1um an rJrtns
, .
lw 1111 l11dnl 111 1111•,1-h.1•,nl datJ ,.olll'Lti1,u c·ffort\.
53
.,., RESPONSE PROCESS ----:·~~
- -..: . . - - - - - - - - - - - -
' \'-- ~..... ~l\'-:...: ---------------
. J
, 1 rnt' ..:Js1:'5, "hen the vicrim lrele
vJnt -.,rste m 1s· powen:-d down. rhe evidence 1ha1 1.s rcqum·t to
In _ l .
•· n a1rempr1ng• co un ders1a11 d
, ·r.md .rn
.
mc1d
.
rnt 1s ephemaal (rempor:tn · •
, · g) or Iosc. \\!he
· or LlI ter111
j
tlf. d'S . . . . . · 1
r. "" I1e co II ecr,01
- . ·fhcrerore,
_1. rure ot Jn mc1d enc. this ,·obtile d•m• ca,1 prm.-d I e · · 1J ·ml -orma11on
cm1c t
. _ . II ·
o/·dara co ecuon .
u,e nl · · I ·
· . 1 1.itile mtormat1on from a host . - befor e ch ·-· r. ·
b mrormanon 1s ost 1s the frrsr srep
ot Jn: '~
n shor" of .1 system. You need co record rhe
..\r the nme Y0 ~1 r~s~o <l, ~he Yob iile d.Ha prm·ides a ·'snap
. P1,,in,, vol.wle mtorm.mon:
tt1iil ~
Analysis of Data
~
file system Review data
Create a Search for
collected
working relevant
during
Perform
. Recover Perform file .
-
copy strings
fo1ensic .__ , r-► deleted signature live response
dupl,Cithon
of all
data analysis
evidence
Identify and
media Perform
decrypt
Recover software
Identify encrypted
unallocalod analysis
known files
space system file
Perform Perform
file-by-file specialized
review analysis
_ ~d~>rt. }_"t>_11 brgin to an,drz_e, the datJ forensii: analy~is requires lhal you assemble and prtpart ct.a
cc,lltttu.1. f his prou·dure applil''i 10 the forrnsic explorarion of host-based media and snrcifical'1, ilaad
t111vt·s. .,--
• 55
J,4. 6 Reporting
c-::,Ht r:-pcru th.a:
·1be ,oo·,l J1ffiud1 pk1·,1_: ':f _tl,1· i1,c.i,l,;nr f'.:'.p<m·,.,.. r,r,J:t<.', i~ repr;rr:r:7,. Tl-,! d. '.·.d'~ng:- i ,; rr,
n i!'lt;Cer.. cb~ a:-i v. ;rh;c.u, d
art: u11dcr•,t.inda"1e 1'J ik~,,,l(JrJ rn;JVU;, and wfiid, can dt(.{.Tf~,e 1he dtr.a d~ <J 4
0 ( ),·;'.al ',c.ruuny and 1li;1r art pr,,<lw.c.d in a rimely rnar,n,_r - . ,_. ,
11;t I
,a m•,cf, . , .
,,,,:.ff CSIRT 5
Wi: l,a-,,c: wrni: 11 P wllh ,,,,me t 10 ddmt<i t<J Cn',life that d1c rtprJrtir.g ph:i·,t dr-":s r.rH l/-») ; !'. !:
ncmcd·,:
:, rom co be d1x:u~en ted
J, Docum ent jm~cd i_.t_tdy; It j,, nt<.c·:,ary fr1r ~IJ irwrnigative steps ar,d e<Jr.du
u::ica[ed rr.ort d ~rly
a\ \<1(Jn a.\ }''''>', Jblt. l1J trr,urc _that tht J,;r;.ids <Jf the rn·,,c·,tigatir,n can be wrr,m
w ,1 1htr\ at any rn,Jrn t rH, wm 1ng Yimt:thing dearly and UJnciv.: ly
cr,e mr,rr.tm yr,'..l dj_;.c.c,·.·er e.i denu
a:;,igned co led .:he in-,e5-
~a·, o rirn t: , prr,mc,rc; accura cy, ;ind if ntv-.' ptr~<;nnel beUJme inv0l ved fJT aie
rig.1ti1Jn.
Documenring ir:,·esrig:atr,e
2. Writ e wnciscly and dearly: Try to enf,Jrce the "write it cighr" phi!c,sophy.
~ttp~ rrq11irt c, di ·,<.iplint and CJrganiza.ti(Jn, You 5hould write
e-.·erything do-.vn in a fashion thar i.s U...'1-
ite r.oc:..;.rio n5. i::cor::pfere
drr•,1.inJ,1 hlr t /J Y'JIJ and others. Do nm me shorthand or 5honcuts. Indefin
~w blJling, and c,thtr unclear doc.um,-ntation can lead co redundant efforts,
forced ms..s'.Ario:1 of no;cS.
or orhers.
wnfirmatJnn cl n(Jtt'>, and a failure co comprehend notes made by you r~lf
and st.ick to it. For cr~rir. g rhe
3, LJ..,e a ~tandard format: Dc."Vd()p a particular furmat for your reports
shou'.d be l!Sed. Tiii.s hd?s
pmnanrnt Ja1a mndar d forms, outline~ and templates of incider.t response
in report wriring , ~aves time, and promotes accuracy.
de..-elop re?<)rtS char are
4. u~e editors: ~fo read your foremic reports employ technicaJ edirors. Tiiis helps
:t respome su2~e.gy a:id
wmprchcmiL lc to nonttch nical people who ha ve an im pact on your incider
s leaders ). Cnforrun.ardy,
rc:.olution (<,uc.h as hum an resou rces personnel, legal counsel, and busines
the burden is still on you ro
tdi[(JT\ <.a n inadve n endy change the meaning of criticaJ inform arion, so
rtvicw the final pmducr prior ro submisc,ion.
3.4.7 Resolution
to prevent an incident from
T() irnpltrn cnr ho~t-bascd, network-based, and procedural countermeasures
operational staru.s is the goal of
cau .. ing funhtr damage and to return your organiz.arion ro a secure, healthy
, soh·e rhe problem , anJ rake
rrnilurion phast. Jn 01her word.<i, in resolution phase, you contain the problem
\!eps to prevrnc the prnblem from occurring again.
I( you arc auum ulating evidence for potential civil, crimina
l, or administrati\.·e accion, it is always a
es chat would airer the
g""d iJc:a ro ,.olb .t all evidence before you begin co implement any sccuriry measur
t·vidtnLc cihraintd. If you rapidly secu re a sym"m by changing your
nerwork copol<>g)', implemenr packet
filrtri ng, or insra ll !.rltware on a hose wirhouc proper re\'iew and validation,
good invcsrigativ~ du(S- Such
a.\ thr scare of th e c;ys rcm ar rh~ rime of rhe incide
nt- are often lost!
·nH'. fc,llowing steps are undertaken co resolve a compu
ter securiry incident:
I. ldcnrifi ca rion u( your organization's top priorities, such as which of the followi
ng is the most airical to
~e~c:lvr: n·rurning all ~ym·ms to operarionaJ status, ensuring data diltgiAJ. motain
ing the impact of rhe
1
nudtnr , colleuing t"vidence, or avoiding public disda&wc.
2· In ordc-r ro understand and determine the nature of the · • bow the security
O((u rrrd and what ho~r-ha ..ed and nerwork-bascd 1ena:f rs
addttsstd(lack
----•it.
3. Dt·rc:-rmining if there are undcrlring or systemic aullll-...,--...
uf si,rndard~. noncompliance with standards, etc:.).
F-Qf~f:Nsi
~56~·:__ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ DIGITAL
_ _---.::--:
onse Team
3.6.3 Assembling the Com pute r Security Incident Resp
chat is formed in response to a particular situ-
Responding to incidents, many organizations have a CSIRT
lized team. Therefore, the CSIRT needs to
ation or incident rather than an established and dedicated centra
ization must identify the types of skills and
he staffed in real time after an incident is detected. Your organ
respond to that panicular incident to staff the
re~ources that are required from the rest of the organization to
nt respo.me cfton, a variety of organizational
team properly for a particular incident. To support the incide
man.~ll!llli-t~o f 1!he biggest challenges
are~s contributes hardware, software, technical knowledge, and · that an incident
to incident response is knowing who to contact and when. Hawe
ve
b\c::i4att.
occurred, you do not want to go through notification pr
terviews
3.6.5 Conducting In · _q ses,;ons, when your CS
IRT lean,,
w. Ce r,, z::d ho w d,
, ,y i, '" ::....~ dCc.z ,h ·-,~"- wb-.,, sh n, , ,om , fa cts su rrounding die incid,nr, su
n , fr ,- yo, ro ~mr.: uc , and so on
;,, , ,,, ,,u or J a!!o, ,·e occurred and when
,,(, ,.,;r.::;,d ,c.,'dtct 1)
,-.~,. ~-::ten, ,d □ :o;;uzci,e wn ra ct s, w h. , m ay h.
ion; however, rbe answer
a: CC, hz :« ,n ,,fr,!
rh, ; 'e,- ir •i ll b, for you ro mess w\, sinm 10
o,r.:n. ea
1 k m,,r, an;·.cr; ! •;olbca-:n .. ,.1_1,,~
(.I1•I" J>l, IT:
' ' •". ." ' r;,
~,, o) • ' - ' ' - . ~ .,_._
.,,,.,.,
l,.'f_~r
- :~"
A~ ue :t
Futt1ll
g a rt5ponse stracegy.
figure 3.6 formularin __JII
...-- ] Summary -
----------
__
' [__ .L--------
This ch:ipter highlight ed the bJsics of the incid ent have encountered, all too often, companies that are
respon se process. We discu sst"d the importance of incapable of handling even minor computer secu-
planning with a focus .on_gathering information rity incidents. As attacks beco me craftier and more
about rhe target of your mnd ent response and tech- focused, your CSI Rf will need to be a well-oiled,
niques thar ensur e that you have the staff and equip- capable (with the appropriate breadth of knowl-
ment resources you need on site. Understanding edge), well-mixed (including lawyers, technical sraff,
what a computer secu ri ty incident is, what inci- and perhaps law enforcement personnel), motivated
denr respo nse defines, :ind tht> steps takt>n during team that fully understands the flow of incident
most responses puts yo ur organization in a place response.
to best guard its properties and its standing. We
Key Terms
puter security incident handling: By
Constituency: Implicit in the purpose of a CSIRT • Com
is the existe nce of a constituency. This is the group providing the basic set of services (triage, handling,
of users, si tes, nerworks, or organizations served and request), a team offers a defined constituency
support for responding to computer security inci-
by the team. The team must be recognized by its
dents. In addition to this basic set, an announce-
constituen cy in order to be effective.
ment service might also be offered.
• Security incident: For the purpose of this docu-
• CSIRT: An acronym for "Computer Security
menr , chis term is a synonym of Computer Security
adve rse even t whic h comp romi ses Incident Response Team." This is a team
Incid ent- any
providing services to a defined constituency.
some aspect of computer or nerwork security.
There are several acronyms used to describe teams
• Constituency: A spt>c ific group of people and/or
providing similar types of services (e.g., CSIRC,
organiza tions that have access to specific services
CSRC, CIRC, CIRT, IHT, IRC, lRT, SERT, and
offered by a CS IRT.
is chara cteris tic of a piece of SIRT). We have chosen to use the generic term
• Vuln erabi lity: This
"CSIRT," as it has been widely adopted in the
technology which can be exploited to perpetrate a
computer security community.
secur ity incident. For example, if a program unin-
• Liability: The responsibility of someone for
tentionally allowed ordinary users to execute arbi-
damage or loss.
trary operating system commands in privileged
woul d be vulne rabili ty. • Policy: A set of written statements directing the
mode , chi~ "fea ture"
operation of an organization or community with
• Computer security incident: Any real or
t in relation to the secu- regard to specific topics such as security or dealing
suspe ned adver se even
with the media.
riry of computer systems or computer networks.
even ts are intru sion of comp uter • Procedure: The implementation Qf a policy in the
ples of such
form of work.flows, °"'- • or Jll&!Cbanisms.
Exam
systems via rhe nerwork (often referred to as
"hacking'').
LEARNING OBJECTIVES
--------------- -------
Aha reading this rlupccr, you will be able ro:
• U11dcrs1and live d.1tJ rnlll'ction on Microsoft • I nterprct and apply various tools for data
Windows Systems. collection.
• UnJcn,cand live <lata collcnion on Unix-based • Distinguish different methods for collection in
Systems. the Windows and UNIX sy1item.
• Understand the importance of data collcnion.
Understand what data you hold, how you are using it, and make sure that you are practising good data
hygiene.
-David Mount
[t11'f] Introduction
In Chapter 2, we discussed rhe basic definition, types, and rules of digital evidences. Now, the first ques-
tion rhat comcs to our minds is: "How are these digital evidences collected?" Therefore, in this chapter, we
discuss the r:.icts or evidences that will be used to create the case file to take actions against an offend.er.
As we know, digital evidence is "Information of value to a criminal cai;e that is stored or transmitted in digital
form." The I erm "com purer forensic" involves identification, sunder out, preparation of documents, and storing
information rhar is kept or sent over in electronic or magnetic form basically considered as digital evidence. For
example, in fingerprints, digital evidence is visible as the files are stored on disk that can be easily accessible by
s1andarJ file management tools (like Windows Explorer), or can be hidden using special method or a software.
The main purpose of computer forensic is to find these hidden evidences in order to increase &as value. .•
Different stand;1rds have been created which are used to find out and preserve digital evidences There are
a number of 1he procedures accepted by law. Those are:
1. If evidence is not collected and handled according to the proper stanw
eviden ce inadmissible when it is presented and the jury members will ocve .~ illfate it
or rnrn.iJcr it in making their decision.
2. If Lhe proof is admitted, the opposing lawyer can attack its q
Such an amKk will produce doubt in jury members' minds
trt"at ing dwir decision-and mayhe even taint the quality of the
62 •
specific roles.
person w O is an expert 111 computer foren sic). These people have been assigned wirh
l. (\rndn\°tin~ ,l,c rrimc ~1..cnr ~rard,: Ul11 ll r, ,hnul,I ,crl< .ill d1t· ~) , tr ill \, ." 1iurn d1H urn(' 1ll , ,llJJ
Ill'\.:\. 111,111\l.lk .uhl l,1g lib rel.uni \0 thr ( 11111 (:- lt 11)\()l \'( \ lllllh1k phonn , p11111 c,~, \l,lllll('[ 'i, t,tcrn.,1
J,\ld'' q11:h .1\ lb,h J1iH·,. lurd d1,k,, ( 1), 1)\'l), up, ,, .mJ 111n1 r .
.\. l'rescn·intt intqvity of ,he fa1..1s or nillcnrr~: C'1imin.1h .l~\\ ,I)'\ rl lll-~l\l' ,di die n:idL·1i. n, 1'11is h ihc
l\J\•ll\ l l ' rrl"-1'1'\'(' .111 1hc n'i.lllll\'\ Ill ,mil I (() 1.1kr ,lll 11111\ ·'l~-1111\I l he (II ll lH_
ll r. Il\,\l·~ug._rn, 111 ~hnuld 111,,kr
C\,ld ••'P" ut ,111 d1l· r,·1,k 11l-r,, ii p,,"ihk ,lllll ,h,111ld hr .1hlL· tn ,11ul~1c the lnntp11111, lll .111.1, kcrh nn,in.,l.
fo.,/ J)(J(ripri,m
\ '·\·,ti m l111l II1 I II ' Ilo'\',\ I IH \I\( 111,ltl\ \l\ lluil1 111
'
' I
o> l '•\ 'lll>l ', ll.lllH I
' I '\'' !I Ill h,,
\.1111 ' h111I
I 111111111111h .,till!'\ \ 1il1. I" 1tl111I
1\i1 I.1st tlll!\1111
l I \ I'' l ,,I
'\ ,11,111 , i1,,,I "' ll( .11 c .111 lll-t1p1,·,I d1.1111wl ol· 1111 p://q1 u1 u· l'c11 ~c.: .1w1 /
, 1>I 11 Ill II I111 ,I I ll 111\ pi l> jC.: ll \h rypll, 11
\ 11til111· tt-l\l ,,1 ,lump 1hr tl\ll l l'lll ' of tl1t' cvr111 www.li111nd ,1c ,m·.o lit!
I,'!','
\ ') ,11·m 111nl th.ll d1 , pl.1 ) \ in tnl.1,l' (onfi~ur.11io11 Built in
11 d111111.11 illtl
A 111 i1 11 1, 1'1 .11 u1 lh1, i11 fn rtn .11 1un .1h11 ut th ~ luu l www.founJ~wn c.rnm
.,, •, tc 111 l1utl 1
Pd tic :\ 111tl11 1· 1h.11 ,h ,111 ., fib 1h,11 Jrl' opr11i:J rt·mnt t· ly www.founJswnc:.l.om
l\ 1w111 u' ,\ u1tl11 y 1h.11,h11\\ , infllrtll.llttlll .1hou1 t: urr rnt www.found~tonc.mm
ptou·, ,l., dtrr.1J ,
Jt11!
J111lt1po l A 111tli1 y tJ\nl 1,1 J1,pL1y tht' tllrfl'llt ~l'L urir y :.1t1Jit NTRK
\t' ll lllS'
3. Preparing the response toolkit: We assure that the toolkit will work exactly as intended and it should
not alter th e t.irget system. There arc several stages to prepare toolkit for initial response:
(a) T11g a respome toolkit media: Documenting the collection itself is the first step in evidence collec-
rion prm:ess. CD or floppies should be tagged, co identify that this is your part of investigation. The
tag may co ntain information such as case identification number, time and date of the investigation,
name of I he inwst igaror who created response media, and name of the investigator who used that
res ponse media.
(b) Check the dependencies: le is necc~sary ro identify which files the response tool is to depend on.
him can be used to determine all the files used and affected by each of the utility in the toolkit.
Tllt're should not be a tool which will alter information of the tafFt system, although knowing
wh ich tool ch.mges the access time on files of the target system i s ~ ,
(c) Creating checksum for the respo11se toolkit: There is always a ~ s the checksum of
all the commands. This file is w.ually a text file.
~le c.in
collect a lor of information from the live system at
t 1c11 ' 1 - tm use J c
the ·'vsr · · ·
ror mvcsttg~mun · s1gm
1s • ·r.Kant, whe
powned on ar 1I11s
. moment.
There ar c- four ,,p1i11m ,1v,11l.1l,lc wl1c11 tl,c i11f1Jrrn;11i,,n !1,1', brr.II rriricvcd fr,,rn rl,r li vl' ,y-,r,·111:
It is no, ,1dvi•,ahlr 10 ,avr dw data to 1hr lwJ drive·~ hn.amc i1 ah,·r~ die <,y-,lt llJ. .\ruti 11 1~ die d,rta rn:uiii.
~illy by hallfl is Ill/I r(J~\ihlr a~ the V(Jlume of da1a wulJ ht larger. u :,c of n,'.ppy dt1Vl'\ an: 'If.It lwt:111',(· Ilic
srnragc cap;1Liry of rhc 11,Jppy i, Ir,, c,,n1parc<l trJ rcn.:n1 ,10r:1gi: devr~n wl11d1 ;ire <.11111p:ic I 111 \i1.c ', 11th a\
rr:rnovablc USB Jrivn. Ir i, 1he l,c·,t ,olut ir,n in the pbc.c r,fnoppy drrvt\,
Thr: ~10r;igc ca pabilitic, of 1hr~c wrnpacl dcvict.:~ ;ire fa,cina1 ing. It provide, 1',c r,111gc of V,IJ! ,il ,y1c• h:i·,in
1 1
the c;i patity ()f ~,oring tcH1lkj1 3!> wdl a, the wllrucd d_ata. Thrn: drviL.c', w! II w111k witl1 any torripuit~
having U~B porl s. E.xpcm ~uggc~I d1at one ~hould ,,b1am a few of rlH:\C dcvlll:'> for d"· rc•,p1m ,c 1c,,,lht 1
Even if rhc'>r dt·vict·\ are gc>oJ to store· large amount of inforrnat i()n rel at cJ t<J 311 invc\1 igari,,,,, tht tl' i'> \I ill~
nrl'd of nrtwo1k to ,ave 1hr: information. Nctcar is a widely med wol to tramfrr 1hc data frr ,111 target !•Y'> ltrn
to remote foremil worbtaticms.
0 0 G)
Forensics
limo
$yr.tom ◄
NT Sy:;tom
dato
□
I!.; •• ..;;,~
◄
log9odon
!port
p:;lisl
E1
-
-~::~-=~! .-~~.
• ·---- ~ Nbtslal·C
◄
sic workstation.
Figure 4.3 Serring up the nercat listener on the foren
fer while transferring the files in this manner. We
The Netcat is unaware of completion of data trans sic
on of data transfer by pressing CTRL-C on the foren
need lO disco nnect rhe connection afrer the completi me
m or no growrh of the file size wi!J indicate that
workswio n. The sropp ing of the spine on targer syste
data trJ11sfer is co mplered .
~-- -------------:--::::-:=-::==--~---..........
ernnplc of this form is illu~trated in the following table:
==
~~: ___ ___ :== =-- ~-- --~~~~;--;:.c=-:------
Start Time Command Li11t Trusttd U11tr11sted MD5 Sum of Outp1tt Co111111e111s
in ensuring rhar
Using this form will help us ger information in rhe future references. This method helps
the invesrigarors plan ahead.
Aun fJEI
.Qpen: 1111 3
17 '. i ' I •
OK
I Cancel
J Browse...
I
Figure 4.4 Running the trusted version of cmd.exe.
2 rd st it i, agood idea to
· ~eco i~g ~he sy em time and date: After executing the trusted command shell
~:pture t e. oca! system da_re and time settings. This is important to correlate the•
~ lop, ts wdl
• rtll-tre•J'I"
~f ~~em,ar~ th~ ume~ ar _which_ you perf~rmed your response. The time and datc.+alt
m -~xe apphcanon. Figure 4.5 illustrates the executio n of the date co • 11n•1•
~~:~:t~~o(:>/:::~~dr~ate.txr on rhehfforpy drive. The second command in che
~
e ourpur tot e time command to the dare.rxt file.
• 71
oATA COLLECT IOr'IJ -
-- -- -----------------
Li'. 'f ~ . . : . . - - - - - - - - -
l!!lliJEI
.., \cand exe
·'.-.A
~
J
A:,)ty pe d~te. txt . . .
T~ cur r ent d~te •~ · FrJ U2/H2 /2 "UI
Enter t he n~w cl <1te. (nA- <hl - yy) Th~ 1.urt•f!
nt t.i"1e i-l: 9 : ~!f : •,J. ll
Enter t},e ni>w t 1n":
A:,>.
4
Figur e 4.5 Ohtai ning th <.: d.tre anJ time o( th l' !>ystc11
1.
RliJ El
" ..," A \cad eae
•
A: ,> Jogge don
Lo9!fedOn u1.1 - Lo9on Ser.a io n Dis pl aye1·
vich
Copyr ight (C) 1999 - 201!10 Mc\rk Ru :.sino
Sys I nte rna Ia - \IYW. s ydnt ernd h. coria
I
tly lugga4t1u•ch1uy1rcm.
1-'igure 4.6 Lhr ofl\LoggcJOn to li . . c the us<.·rs thar are rurrcn
Yuu may want to .tllow any alcc:ss to the rargct system while you
1101
4. Record creauon,• access time, and all the modifications made. to the files: I . To gt·c the list of all 1h,e
directory files on the tJrget m:Khine, "dir'' comnund is ust·~- 1t ind_~des c_1e ~1: e, ;ic~es;, and ~!eration
" date snmps
· rtme. The ti' n1e "nd , bernme the endencc, 111hc s1g111hCJ11t
~- intumu11on alLIOUt
an d crca11on
the time frame when an event occurred is identiflt·d. Wind1-..\'S sys1cm per~orms the usk of collecuno
time and date stamps very quickly. ., . . . :i
An exJmple of using "dir" commJnd to g.1in ,iccess. moddicauon, and time of creanon:
dir / t:a / a ! s /c : dc:\ Providt'.s a recursi\'e directory lisring of all the access times on
the C: drive
dir , t :w/ a 1 s /o :dd : \ Pro\'ides a rt'cursive directory listing of a.II 1he modification
rimes on the D: drive
d1r /t :c •a , s ·o :de : \ Provides ,1 recursive dirl'.'ctory lis1ing of J.11 the creation times
on the E: drive
5. Identifying open ports: There are several networking commands available, our of which Nersrar can
be used to determine which ports are open. lt also enlim all listening porr and currents connections
to 1hose pores. Volatile data, such as recencly terminated connections and current connections, can
be recorded using Nerstar. Figure 4.7 illustrates the execution of Nets tat command on NT server
machine. There are several local hosr connections in the ourput. The applications on the local host
127.0.0.1 will always be displayed by Nets tat command.
· ~ A \, md rxr l!I~ £3
A:,>netstat -11n
I
Active Connect ions
Proto Local Addre ss Pore ign Addre ss Sl<\te
TCP 0.0.0 . 0:25 0.0.0.0:0 LISTENING
TCP 0.0 . 0.0:80 0 . 0.0 . 0:0 LIST [ HING
TCP 0.0 . 0.0:13'.i 0.0 . 0.0: 0 LISTENING
TCP 0.0.0.0:135 0.0.0.0:8 LISTFHIHG
TCP 0 . 0 . 0.0:443 0.0.0.0:0 LISTENING
TCP 0.0 . 0 . 0:165 0.8.8.0:0 LISTLlUNG
TCP 0.0 . 0 . 0:1026 0.0.0.0:0 LI SHH ING
TCP 0.0 . 0.0:1028 0.0.0.0 : 0 LISH.HING
TCP 0 . 8 . 0.0:1029 0.0.0 . 0:0 LI SHNJ NG
TCP 0.0. 0.0: 10)1 0.0.0.0:0 LISTDUNG
TCP 0.0.0.0:39?0 0.0.0.0:0 LISHNING
TCP 127.0. 0.I :1025 0.0.0.0:0 LISTENING
TCP 127.0.0.1 :1025 127.0.0.1: 1026
TCP 127. 0.0.1:1026 ESTABLISHED
TCP 127.0.0.1:1025 fS TABLISHI:D
12?. 0.0.t:102? 0.0.0.0:0
TCP 127 . 0.0.1: 102? LISHNJNG
TCP 127. IUl.1 :1029 ESTABLISHED
12·1.0.0.1 :1029 12 ., . 0 . 0. t : 102 7
TCP 12? .0.0.1: 10]0 ESTABLISHED
TCP 0.0 . IUt:0 LISHNJNG
192.168.0.100:137 0.IUl.0:0
TCP 192.168.0.100:tJS 0.0.0.0:0
LISTENING
TCP 192. 168 .0 . 1"0: 139 0.8.0.0:0
LJSTENJNC
! TCP 192.168.0.100:139 LISH.HING
lCP 192.16R . M.20:JW-i1 fSTABLISHED
192.168.0.100:1152 0.0.0.0:0
TCP 192.168.0.100:1152 LISTENING
UDP 0.0.0 . 0: 135 192.168.0.20:139 ESTABLISHED
UDP
UDP
192 . 168.0.100:JJ?
192.168.0.100:138 .
ll; ll
•:•
: ..
1'(1r1,: 1~ he j'lll
. .. ' I . ton 11.,pnrt
11.t 1, .u,cd
· ·
. I'" 1 I'l\lrn111g
to Lil I'""' • r .ill the pn 1<rw·,. I 111111 <' ·I.H , l11 1w,
l,1
1hl' lptll·t ~, Ill.I\ .ll1l II~ l..lll ( ( \jl(llld111 1; Olli pill.
!A:, >
7. List of all running processes: It is necessary co record all the processes that are currently executing on
the system before turning off the target system. Unplugging the power cable will destroy this informa-
tion. The exccutahle code that resides in aJdress space has been created when a process is created on the
Windows system. To manage the process and maintain statistical information about the process, the
kernel ohject is created by che operating system.
8· List of current and recent connections: To know who is connected or who has connccred recently,
the networking commands like Nets tat, ARP, and Nbs tat are useful. ~ ~owsaystcm,
these utilities might be the only way to determine a remote system conn • ~II Id don. Many
experts refer Net stat command co enlist the pons that are opened en ' clis-
cussed, fport lists open ports and application listening to them, IWtdMtlf;,
IP address of remote syscem and current connections of the ad t,
used to map IP address to the MAC address. The utility n
__:•________ ________ _____0_1_G_1T_A1_. 1_:,:0Rt~
!~ ~
Nl.'tBlOS name cache. listing the recent Ne1BIOS co111H'Llions for approxi111a1dy the lil-'l 10 rninu1t1
The t·xampk of Nt·rBIOS is shown in rigurc 4.<J. ·
~!~!:~t
1
,ntld:.t
- an
;nth:.t - f - r
J
/ port
,els
do::lley lhhtot•y
l
Figure 4.10 Use of doskey to record the steps taken during initial response.
ted files in the UN IX ·sy s.1cm becomes , · 1I·nr nce .tn workrng . wJCh. UNIX and
Recovering dele
. . a rna1 or c rere
ond I h .
Windows. In Wmdows, fil es thar corresp ing proces.c, from 1he hard drive cannot be deleted,
s in UN IX , pro gram s files can be d ·I · ~} er unfn d , · .
crea t eteu even 1 · section, we will see
wh UN IX sysrem by .· r le process rs runningI. In this ·
. c data collection from recover mg llles b ,fi . · rir
I t 1e sysr-em, crea11ng
response
I1v . . finall . . ( ore rurn mg o
. olkit, obiarnrng tem por al data , and 1 . .
Y conuuctrng live data .
10
I. Run a rrusrcd sliell: Onr <>f the rwo ~i:rnJno, you get wht n rou rc,pond IO che target system runnina
u:--: IX- the m.1d11ne cxtLUllll~ in comole mode and the machinl' excc.ucing X \\'indows. b
X \\'inJows ~hould be do\~J hc(orc inmacing a rt·,pome, 111 order IO avoid common X Window,.
ba.,cd rnlner,1hil11 it~ thJt allo\1 tht' allJckcr to ltlg keyscroke.s. You should be able ro switch 10 anotht"T
virtual con,olr b~· pre!.s1ng Alf IF2l.
To a.aid ~enm1ing ntrn ork jJmming, log on ar che victim console with ~cot-level privileges. You
netd 10 1mpk-menc your rrustd coolkir and respond wi th the trumd rools. This command-::-1o:ir:: /
d-:: v ,' f d: .'rr.:-, t /f: c,pp y-will mount rl1e trusred toolkj1 on the mounr poim/mnr/floppy. You will
be ah!e ro a.:c~s the Ll'llited files when you change the rurecwry w/mnr/lloppy.
To he certain abour execurion of crusted command shell is the first step in all response. Attacker
a1tacks the UNIX 5hdl ro log all rl1e commands executed on rhe system or ro perform criminal acti\i-
1ies hidden 10 che inve)1igawr This is the reason to run your rrumd own shell. Ba!ih ~hell can be UScd
for chis purpo~e. Ser path environment variable equal to dot (.) after execming your trusted shell. The '
possibiliry of executi ng umrusced commands thar are in tht> target sysrem's PATH will be reduced.
2. Record the time and date of the system: Recording local time and d.ite is necessary for furure refer-
ence. It \\ill also display when }OU WC're on the sy) tem. The following command can be used to capiwe
chis information:
3. Identify who is currently logged on to the system: Ir is easy to idenri~, who is logged on. We jusr
nee<l to execute rhe w command. The user IOs of logged on usm, rhe sysrem they logged on from, and
what they are currenrly executing can be displayed by using 1his w command.
Following shows the example of w command:
[1oot@con2n / r oot)~ w
11 : 39pm up 3: 11 , .,., u:::<::rs , lead a vcr ag~ : 1. 27 ,
1. 43 , 1. 34
USER TTY FPC~-! Lo:rn~ IDLE JCP!J PCFU WHAT
nada ~t:lPO J lt te:r . rahul . r.'3t a: 3C~m 3 : O2;n 1 : 0& O. l~s
telnet b oU·.ost i
bo·.r me tt:;pl she ll I . bothost.b 8: 35pm 3: O2m 1 : 01 0 .1 23 -bash
mandiak ttyp2 ad 3l - 22 5- 75 . pJt~ 11 : 3 8;::rr, O. ODs 0 . 25s O.11s w
root@conan /rcct] ;
. The hc~der line in the output shows the current rime of rhe system, how long the syscem ~
d· d I I d r-1on f/l,
m the runnmg stare,. number of user~ that are currenrly Jogge m, an c1e sy~cem oa ave,'"tl-
pasc I , 5, or 15 mmures.
• 77
Li\lE DATA COL LECTIO N
, • · J I
, alteration,, and access ti me O f eac I1 fil e: )ou h:1ve IO oht.1111 all the t11nt' an ( ,1tc
4· Record creaItion
fil , . , ndows and
t rirne/Jar c st.imps available fnr c.ich fil l' in Wi J I
scamp: on t e c_S)S ~m. l here a_re three
1
J ·i..: • • ) J · (' ·
,.c., lllOl lt' l lJllg t'
m-at1111e (1.e. ·111 C I. e . , mo III C,111011 lime , an r11111e
, access 11me ) ' rnt 1
(.
UNIX syste
, . • . · camt fil e, you G Iil
• 'S for
. 1hc.~c tlllH.
·me) \\'11h the use ot pro1)er comman 11 · .
• L inc argu111ents to ohra,11
ps and
s the demonm,11ion 0 { obt.1ining timc/d.11 e stam
fl ·
use the tru 5 red comman<l ls. Following show
saving rhe outp ut on trusted Aoppy disk:
ls -a l Ru t > / fl opr y/a U me
ls -a l Rc I > / fl oppy /cti me
l s - al R / > / fl opp y / mlime
es you
listing for which it rakes some rime. Sometim
R option in rhe ls rnmmand forces a recursive y drive .
car beca use rhis J ara may nor fir on I. 55 rnb flopp
mar be forced rouse od1er media or cryprc.1t/Ner is Ner -
n port s: The mos t widely used com mand for listing open porrs on a UNIX sysrem
5, Identify ope To view
onsible for the open network sockers are ditficulr.
srar. Determining which applications are resp hose name,
the Net s tat command not to resolve the
all the open ports, use -an command. To tell is used .
reduces the imp act on the system and speed up the execution of che command, -n option
which
[root@cona n / r oot ]# net sta t -a n
ver s and esta bJis hed )
Act ive Int e rn et c onn ecti ons (ser For eign Add r ess Sta t e
Pro to Recv - Q Sen d- Q Loc al Add ress 66.1 92 . 0 . 26: 208 19
t cp O 176 66.1 9 2 . 0.6 6 : 22
ESTABLISHED
0 . 0 . 0.0 :* LIS TEN
tcp 0 0 0 . 0. 0 . 0 : 80 LI STEN
0.0 . 0 . 0:*
tcp 0 0 0 . 0 . 0.0 : 2 1 LI STEN
0 . 0 . 0.0 : *
tcp 0 0 0 . 0 . 0 . 0 : 22
0 . 0 . 0.0 :*
udp 0 0 0 . 0 . 0 . 0 : 69
s ) I ; , r, , 1 I i I
(J : ( [' / U J. 1 )1 , Ij
.·.-J ] 7 : <, I ; Q) I 1: ,, , if I I
(
C. J I ; ',_ ' : fj() /1, 11 , •• •,, •• ,, 1 yr! I
J __ J 'j : ', - () : (: u . ,I' J 1,/1.II, I• l ·,j ' '· hi,1
.,. I) : Ult i' I l ; ·1 I - r.1 (J
• .-( .r. 1. • .,
(' • I J
D: , 0 k l· 1, I
- .. ,' 0 : 0U 1
ll ;} ! /r/ )1 n/. 1tc j
,. ,~ t 11, I
'..' . 1 (. _, ,I
1 . .. ! 0 : "0
i I : '. l
.
C , '
r • .
.,.,I,_ ,,
·' -1 l 7 : J ·, (; : i_l 11 h l, 111/min,7, . t:ty rt
)
•j' I ' !
I , .• C, • j , .r ,j ,
' 1. I '/1, 11 ; '.JJ () : ,_ii) /:.b i11 t m1r1 jl' lt y tt
r ..· - , I J l ' l , : ·' :. Li : u/_1
)~ I t
-1.1 I ' / 1
r,
1_ .
.
I ,
I ' ' .; •; ,) I r:, .l
,
l , : -1 l (I : '.J I J
( ·,
.l - ' . -:; •t
: ·,1
, . • J '
I~
., I
J . l
l
: -1 l
· : ·1 I L : {I; 1
•. l' r
L, h -1
1 l , i.
•• ~ - t (
·I. I
f
; !... 1·1 u, • ) / ../ ; ,J ,J I ::; - ·J . I)(
' •
• h I
hw n dtc ,nap-,hn, '. Wr tan ~.,v r ;11 , J(' lJNIX . . I l11orr rLtnning procc'i~('S ,h:an .. .. .. .
, ,\ wr/J t.lkt· ad\'.~l!r;i •e of 1I 1 ~}~
~Ull l.!S
11 for ... ..
\~.n (I .\, ' I) Jlf, 1,k ,r
° li!dr ni l pro u·, s,·, . Wlwn loo~in
J ,, ll-:, " r~
J.'ruu:-,••n, a \)"- Inn adn1in ~l1vul •' 0 1 ' 011f'.11 ta\ 1I 11/ d1 t, Illl lld
~ ,
I l'l I\ of ,·xt, mi rh• pr cx
fa• ll Hi 1·1, , <i n1111.111J our put I\ ' tnl'lul r:.i lll , J \ .lf\Iio\ ,·,w h· .. I 0
uc:an
,1'· . (n~ l,l~MJrrc.-d.Yu I lll JJ) fO
1wr icd u· \u'
. ·\ll p1i it~ \\l" _\ {!J tfld 1·
ho t1 , .
J1·•· ,..\ . . I
< J _I(; I 111) (' l )('V
, • ~ lll lll 'l.
LIVE DA:.T:..:..A.:..,C_O_L IO_N_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ ___:.•__!_7~9
_L_E_C_T_
----
8.
' : t the current and recent connections•
L,JS
d. It prov1'dcs t I1e •m1ornutton
c .
abom nm
W, h· I .
· ,t' t .aveJ a ,rl'aJy d1srussed about che use of Netsrat com-
_. •
11 111
rnan . f th e • '-' ru:uu connt'ct1011s made ro the sysrem.
Rec ord the ume o e system: D.tte comm J . I I • ·11
9. . ·111 Clll 1 c LlSl'l to record the current systems t1me. Ir w1
I
he p ro know the exact rime frame wht·n )'LH .
1 1 I 1 . .
. . . • tert·u or m.m1pulated the system. It will help to know
hat any mod11icat1ons made outside this time fr une ·trc 11 >t I . . .
c' ak . Th ' · l l 11e to your 111vest1gat1on.
}O. Record the ~teps _t en. _e_c~mm. rnd s thar you have accessed should be recorded. Possibilities can
be: use of sen pr, lmtory, or vi iflive respon se _is !'crlormed from the editor. As you have rerrieved all the
commands from the cru sted shell. the use of history command will make a record of commands that
have been execu ted. Still, ex fens recommend using script command which records the output and the
keymokes made by Y?U. TlllS com man~ should he executed before performing live response.
11 Record cryptographic checksum: Md)surn can be used against all the files in dara directory ro record
· cryptographic checksu m of all collected information:
Summary
Incident resptmse (Juring, early response) is a phas throu
e gh mions such as rebooting or s h ~
of initial infonn;Hion nw.>1 ing rn reguLHl' whether or a
sysrem. When live data collenion is necessa 0\\i~
not illt:~.1I, unntfo:ial, or intolt'r.1bk .l(tivity occurred
, is critical 10 adhere to sound forensic principle ry, 11
and th~ inform,nion gathered during your initia . sand
l '.1ltcr the ~late of the sy~tem a~ lmle
rr~ponse forms the b.1sis for your levd of response. as possible. l'ht
111format1on you obta111 dunng the response
During the ini1i.1I re~ponsc, it nuy be necessary
ro lead to administrative or legal proceedings. Illar
capture live d:ltJ-Yol.nile evidence--beforc it is lost
Review Questions
l. Wh.H arc the different ways to organi'l.c and
dllu nnt nt an tnn·scip,ation? 3. Explain re~ponsc tool kit. How Ji. J8ll ~
2. I fow ell) you ~tol e information obtained durin rl'\ponse tool kit for Windowa.,...r
g
initial rt'\po1hl.' in the UNIX ~r~u·m?
_. .....
, ,
Forensic Duplication
LEARNING OBJECTIVES
After reading this chapter, you will be able to:
• Understand the importance of forensic • Distinguish different types of forensic duplica-
duplication. tion images.
, Interpret and apply various tools for forensic
duplication.
The investigator gets one and only one chance to do it right because digital evidences are fragile.
-R. Rowlingson
Lion. With ,hi, ,n mind, ,hen: :11 (· tw<J kinJ, ,i d11ph1 :1111,m; a m,11;),
d,nwar<l dupl1uJ1J1,n ;,r,d a f,,ru,·.it'
imc. A m.iigJ,,t;1rward d 11 p1K:,11111 i c.,1n,.1•.1 , (,{ ,.1111 ',ll lH. lirig
a rq1lu.,;1,l•.ptt.iftr. _infi,rmati 11n . ~11,c in(,, rr,ij;,
'-MIJ J1k-1c \Y/1111-h<:·,rc:r d~i•,c:, ,,r_diffcrc;, 1
inwrpoi ,Ht ,me file, a W'l'_glr; ,,f fdn, J p,lr!IIJ (JIJ ,111 ;J ll~UJ~l, dri~c:, a
jJJfts of i11frirmaii1JJJ ~,1Jrag1: d(:Vitn a11d d 1ncf1J
11f111r11 ;J11 1) 1l . ~t( r (Jll tl,t:m. A_f11rt rr,,c._ d~plic.ari,m I\
l(; il,e ,_
AwKi.rn· i11 N1mi11 g 1,.l)rm I L<ipy ,if i11f,111na1 i1m tl,,11 ,., utmed wnl,
rl,c g,,,,I ,,f L(;Jng admr•:,Jf,lc: c1\ pri",f
in kg;il prou:cdiJJg\. J-urd11:nn,,r e, wr /,,1·1c a rt nd1:nr.
y 111 ,,url111t f1,rc11·,ic duplic..itir,n a·, a r,1uure ri c.:,u:h
ah11UL.ill inf1,n11ati 1m yuu c.ollccr 41
,J<.(.c•;~ilJlc 1,ir fr"111 tlr<: ~upply mt<lium. We r11u1urJgc yr,u 1 1 11,irik
1
5, :1:hc- wol ~lwuld grntrc1te rt:, ulr , that VjJJiJ rc IIJ<:ii', llrt rtpta1:il1lc
and v:rifial,lc by a third party.
any t mm cnwunicrcd.
6. I he L1J<1I •J1,,ul<l gc·or:r.itt k1~\ rha, dt·1ail tht a,ti,,m rc(jUt', ttd a1Jd
(a) 1111.~ 1s 1101 di t· C l -'t' w11 h mns t od1 n In rim <ii' l'vi drnl l '.
_....\'"'" '
l I
. '.. I • •
Boot Sector
I OEM Partition
,-I....
I
Partition 1 Partition 2
I
,◄ ►, ,◄
~. . , ~
Scope of a Partition Image Scope of a Logical Image
-
. .I
Scope of a Complete Disk Image
~i11 n,11 u;~J,r~l,\11,i the ri;, 1,r 1;k, ltkc 11th\·" '''' \ 1'll 111 ,l\' 11,·nl dw 11 11P11 l(lll\if~ hi h,~ ~,
'•' ll \\\1111 ,1
unJll,ll..1:cJ .1 ",.l. th,-r,·h, rr ,,,11 i ,1\\th'I ,m11'h ,\'!'~ 1'1k, In th, 1sr , .hr , . 1111.1!:1111; i 111 r 111 .I 1111 iii p.1ri
i1i,111,
d'u!J Jl-.1 h: th.'. rnf,, ·t ~-·ltxtll lll.
A lot of transportable version that permits one to image SATA and PATA drjves over USB, Firewire,
and eSATA is formed by WiebeTech. Many of our consultants carry these. lfllllli\ thc field as these are
well made, work nicely in little cases, and allow one to quickly d · ~ -The WiebeTech
. .
for enstc. Ul traDock v4 is shown connected to a su b'Ject's dnve
of these
T~e two samples of hardware write blockers presented a
sure
organizations are terribly active within the community and
th at the write protection theme is powerful and reliable. erto
th e web site of National Institute of Standards and Tt te
blockers.
88 • fW:ll AI f 01-l [N\ir-
l
t
,__ -___J
I lI
I
figure 5.4 i:SATA write bloLkc r h,udwm·.
I
to as "imaging a static drive."
r;;~· -~
I ~H~ i Live System Duplication
The creation of an image of media in a system that is activel y
running is the example of a live system
duplicarion.. This case is nor most popular; however, it is usuall
y the only alternative. The system could
also be a particularly business-crirical system that cannot be taken
down except throughout terribly short
maintenance window~. In different things, you may be rwo-faced
with encrypted drives that might not be
SI C DUPLICATION • 89
FORE N
111 11 · \ ou shnulil .11,o lw aw.1rt· of hnw rhc UNIX r nviro nn1 c11t addr
c., ., c, rl1 c ~ruragc
.in .k fll, tl 111,c~ c,g-.1 '
Jn k,'S. sed
"old srhool " examiners' preference for block-ba
dJrn J_ddlJ.J ,lrc rn _1' s_i ~ il.ir rol,ls. S,1ri~l~ i11g rlw
11 1
ionali1y.
h.1.,Jws, rh,~ ll.' l)I a . lds J :-1gntl 1(;1IH amuunt ol h111n
•! b~n L1 ..;h
, r_ ,·1
• F.b11 ... i 1\L [ ,, 1 ,.l111.\lic ,1 t1 n,J 11.-1r··\ d1 1\'e3 wlt h tM
• ~liL r c•ur ..·,~ l·l'-1\ ' 1l.'1• n.1m,l h,::.1 v
:<·Ut 1.' '-l :0 L.h' ?V ' lkh:'
• S12t l"Ut pu t tilt, n;n'.,' hci '-1
( ' \..l tj'\l t _n:im0 = r.mt ' fu\ 1D_ 1 , lld_ Irr.3']\?
#10
Jd if-=$s ,"'urct1 t s= ld8il cc iw=noe ir or , not rune I tee soutpu t_narn e I rr.d5
llllll~
'-"'cho ·o-:-ne. Verify th~ image with rrd5sum . •
The 10 bl11d,. ~in· for 1his ~.ii pt is st·t ro 16,JS-I brres. This yields the fastest tramfer rare with the
lurJwm~.
E It
,.,. •,...,_:~~~,._,~ I ~
( ) ~ , , ftle:
a10 I
'
ii
I llotd
()(I
IXI lla&-11
' IXI Str ltlf So..ud
I OU~
- I I t'ulin::.$d lm1~ S\cnt rlo1yl11
1
wcl ■
enr.cl ■
ext
Directo ry of A:\
05/11/2 003 20:01 222,390 IO.SYS
05/11/2 003 20:01 68,871 DRVSPACB.BIN
05/11/2 003 20:01 93,880 a»DIAJID.C011
03/20/2 003 17:49 9 NSDOS.SYS
Computer IO.SYS processed the first file. The content i,~..5 YS conains the code in IO.SYS
and starcs to initialize device drivers, tests and reset the a>mmand inccrpreter
96 •
~-=-- - -~FOR[-
-- - - - - - - -- -- - - - - -DIG11AL
l ( )\t\l.\~D.C0.\1. If .i disk, connected to J mJc.hint', u,l.'s t~e rnmpre,~ion :t>ftware at rhe rinil' of
k, 1Jm,~ J~, i..:-e dmw. 5uch a\ DriwSp.Ke or DouhlcSp.1cl.', 10.5) S_lo.,d~ _d,t' DR\ SPACE.BIN driver fil
11,i, ,l;,,uld hJrrl'n "hilc paforming a forrmic duplication._ The dnwr wdl ~ount th e_LOmpressed ~·olurne~
Jnd prol'llt the operJting system "ith an uncomprc5~ed v,_cw of rhe file sptem, as ll loads. During the
m,>untii.g proce~ of comprt'5\l'J volume, ir "ill change the ume/date sramps on the comprcs,ed file, \vhich
,,ill lx· wmidm·d as the altt'ration of an evidence. .
?
You \houlJ emure that tlie loading of rhe DRVSP.-\CE.BIN driv~r file farl 5, v.hcn you 00 t f~om )'our dean
boot disl Jr can he al.'>O Jone by simply remm·ing the file, but IO.SYS ch~cl-5 the root_ direcron~ of all active
pmmonrnf rhe file. To ~top tlieloaJing of OR\'SPACE.BIN, load IO.SYS ,mo a h~x eduor a_nd alter the strin~
m.unullr- '.\unon·s di5k ed.iror can also be med ro do the file ediring: Load the fi_le m hex ednor and perforn, a
ming ~ch for the ke:i,,ord SPACE. Figure 5.10 sho"s the firn-stnng ~rarch h11 located at hex offset 7D93.
.
~. . . ► rtlt -,I Ink IJIAM I nf o ·rw,1 -.
►1
,-~
'
~
,.,
~ '
!Ill YIU
Direc t 1cc111:s:
llo 'r'cs Atfu
Use XBIOS:
QGjuct p•rtl tlon~ : llo f.11 • r. Cua '°"
. d screen.
. F'1g. '; . 13. shows Jrivcr sclectjon fo r SafeBack b physical
. . It · lists the • as ,vcII ~
Tl1e nexr screen Ill
· dl'tected b)' Sa,e
I001·CJI drive~ r Bat-k. As rhl' main 1 h j .1s 10 o .tarn
' n"oal of fo rcnste up ,canon I'
exact
•
dupl·ica
mateh rhe
c rrve spccu1cat 1ons 1
oftith(' origmal
• . media,
. logJCal
• · arc compIetc)'
drives ·
I ignore d· Ensure that. t e . r
· . m'~ BIOS ••1swell
•on that you recovereJ crrom t I1e 5ystC' •
as the 111format1 on ,rom the phys·icaI d1ivee
mformau
itself Record any disu epancies that occur. .
hard drive. SafeBJck ~houlJ be able ro address the complete hard drive.
-
~[Lll'T
..
-t-
-
VIHU
C
-
til
.
11:
18f1
I CYI.I NOJ'I",
-- -
I,1~111
1
81l6
HI Oil<;
- -
g
SH 1011~
·-
b:1
-
SP r.Ct AI.
----,
,,._ . ,,.,...,_
The veri~· oprion is u~eJ to ensure that the created cvidcnrc fi le as .1propl'r rC'prcsent ation of the conrem
of rhe mrdia, and 1ha1 file ca n be re~tored ~uccrnfully. Befort' lc,1ving the ~ite, use l>crify option. Verify 1
the
oprion of EnCase in the WinJows inte1face will verify the con1t·n1s of image file wi1hu111 rdrrring to
original drive.
I
I
]
Series of opriom and 1ex1cn1ry field will be provide~ by E~1Case after ,his, which will be placed in the '
header of 1he qualifieJ foremic duplicate. Following op11ons w ill be asked:
l. Locarion of qualified duplic:ite.
2. Case number.
3. Examiner's name.
4. Description of evidence being acquired.
S. Verification of currenl time/Ja1e.
6. Any orhcr comments tha1you wanl to make.
After collecting the above information, EnCasr will enquire wherher you wish to perform hashing on the
image as shown in Fig. 5. 17. A small amount of 1imr will be added 10 1he loral duplication, which is essential
ro ensure che in1rgriry of the image at a bier da1e. Experts recommend that this should be compulsory for
,JI duplic.11ions in EnCa~r. The next op1ion a~ks if you would like to pro1ect the image fil e with a password.
We nrvcr sci 1his opt ion. le does not truly prorect the dJ1a from unauthorized access, because it is trivial to
orcumvenr.
The total number of swors 10 duplicarc will be asked in the next ~creen. This can be verified from the
BIOS or label on the hard drive itself. In the final option, you will be asked to specify the size of the image
(;le 0n the ~turage J1ive. You will be able to copy the files to any file system, if you keep this size under 2GB.
'r<JU c.1n burn a copy of evidences to many CD-ROMs, if you J rop chis to approximately 640MB.
-- -- -- -- --
Figure 5.18 EnCase's final screen.
[ -- : Sum ma ry
all
format you choose, you need to be familiar with
In thi.~ chapter, we have defined the three types of your
ire. the imag ing and duplication tools avail able for
dupli c.,Hions that you are likel y to create or acqu have a
you the mos t inves tigation. It is not sufficient to simply
A true foren sic duplicate will allow tool.
s- working knowledge of a forensic duplication
flexibility during rhe analysis phase of your inve tool
mali - You should be able to select the duplication
tigation. If rhe original drive was damaged, rve the
sic that is appropriate to the situation and prese
ciously or nor, a successful recovery from a foren the
- evid ence in a manner that ensures its validity in
duplicate is more likely than recovery from a qual
icate evenr it is used in court.
ified forensic duplicate. Regardless of the dupl
• RAJD: Redundanr Array of Independent (redundant) disk drives into a logical unit wh
. . ere
Disks-a technology that provides increased all the disk drives operate as a smg1e unit.
srorage and reliability by combining mulriplc
[ : ] Review Questions
I. What are forensic duplicarion tool requ1re-
menrs? cate of hard drive?
---
5. How do you create a qualified forensic dupli-
2. What is forensic duplication?Why is it needed? 6. Explain restored image and mirror image.
3. How do you create forensic duplication of hard 7. E~plain various duplication tools used for anal-
drive? ysis.
4. Why remove drivespace.bin file while start ing
forensic duplication?
rLl
(o) I Disk and File System Analysis
-~
-------------------------------
LEARNING OBJECTIVES
Afcer reading rhis chapter, you will be able to:
, Understand media anaJysis concepts. • know hashing.
, Under.stand partitioning and disk layouts. • Understand carving.
, Interpret special containers. • Interpret forensic imaging.
1'11t ~imply..1 ,.l,lumc lb--riho .1numhn ,l~l'l 111r~ 1)n .1 ,lisk(~) in .1~i\'l'n ~)'~ll' lll . Figml' (l. 1 ~how~ a sinipli.
lil'\.i d,~rLiy ,if dtl' Jdi1h',1ti,111 b.:t\\ l'l'll .I di.,k .111d H)ht_l:ll'\ pr1·.,cn1fl II I he d,~k. • ,
hem., in., 11k systl'lll l.t)a ind 11 dl· ml't.111.11.1 spl'l'IIK tn .111,I ~nlcly ll~l·J fnr thl' lilt' systt ms opc:ration
ll',~.. hr 2 ~11r.:1 hll)~·k).
◄ ►
Disk
On Unix-deriwd file sysrem~, these data units .ire known as blocks. They are generally some '
power of 2
multiple of the physiCJI sector size of the disk. Previously, the sector size of every di~k was 5 I 2 byres- most
modern fi le systems will use 4096 byres (4K) or larger .1s the smallest addressable data unit. The information
avJibble at darJ unir layer is simple: rhe content of that data unit. lf that data unit is allocated to a JPEG
imJge, the data unit will have a ponion of JPEG data. lf da ta unit was allocated co a text fil e, the data unit
will contain text.
GiYen that the data unit layer holds dJta in a file system, the merndata layer then contains data about
data units. On Unix-derived file sysrems, this metadata units are called inodes. T he content of metadat,1
units depends on rhe actual file system being di~cussed; bur, generally, this layer will at least consist of file
time scamps, file ownership information, and dara units allocared ro rhis metadata unir. The specific artifacts
for each file srstem have been discussed in the relevam sections.
Artifacts 1h:1r are available in this layer vary depending on the file system. Ar the minimum, file names
have a pointer ro their corresponding metadata structure. As this abstraction model is built with the design
of Unix-derived file systems in mind, some of the separations do not map directly ro the designs of file
~y,11:ms fur other platforms. However, a good understanding of this model can lead to truly understanding
the ~ignifii:ance of fi le sysrem arcifom on any file system.
drt ]() nt fs ·
11,r•r,-71 uhunl u: ·/ 1Ll nlfs ,1Uloi1,, tc·1ti :, iyf1n•l • t do:.p
.w u,,1l, t , •1 t.1 1n 11 t f" - ai s k . c1r1
1
Bl11c~ <,j/ ,' : r,l? ()ff:.i 'l : ,10 ', i 1J11r1t11r,~ : S'.,AA
HI ud : 0 ( l
8l11ck: G: ( ➔ 1~3)
81 oc k: %3f1') ( ➔ q, j1?G)
Blo ck: 06190 (1))
This can be compared with mmls output for the same image:
622
· · Redundant Array of Inexpensive Disks
Rcd
11 nd
• ant Array oflnexpensive Disks (RAID) is design
ed to take multiple physical disks and address them
45
a Mngle logical unit. The most commonly used basic RAID levd,
m as follows:
1. ~~D-O: It r~fcrs to~ setup of at least two disks_ that arc_•sui AitiWac:k level. Giv_cn two dis~ 0 and
. o& Aw,11 be wmccn on disk O, block B will be tmrt.m ~liil lllo on. This tau:b to mcrease
~ritel speeds and does. noc slcrih(e any storage s
IDMPIY bf data. as losing a
singed · ,
n,e mean/i los111g half of your blocks.
106 •
2. RAID Ji Ii is the oppo~iic of RAIi) 0- hlocks arc mirrored ~cross pairs of Jrivcs. These increases re~ '
~r1:l'ds and rdiahili1y; hu1 i1 abo rl'd11n·s the a111011nt of av:ulahle ~torage to half of the physical disi
spate. . . . .
j , RAID 51 h nerds ar ka~t dircc di~ks and performs striping across mul11ple disks in a_dduion to crcarin
1
p.1ri1y blocks. Thm· bloLks arc also s1ripcJ across disks and are used 10 remake data ll1 the event a dri}e
.1~ lOSI.
Also, there art· "nrs1cJ" or "hybrid" RAIO sc111ps 1hat combine two of these RAID !evels in sequence ,
For example. a RAIi) 50 or 5+0 ~ct can be a p:iir of RAIDS se1s thar arc subsequently striped. ·
[~ ] Special Containers
Along with ftle systems in volumes on physical media, you may have to deal with file systems in other
containers. One such example is the Macincosh-specific DMG container which has been discussed in
--
the previou~ sec1ion. The other two major containers are Virtual Machine Disk Images and Forensic
Containers.
VMDK by ~pccifying the "afflib" parameter to the image type argument (-i).
_3. .1 EWF/E01 ., .
6 2 \X'itness F~rm.i~ (E\'\ F) •~ t h ~ m o st commo n!?' ust>d fore nsic conta iner fo rmat that is som e rimes
£_,p(rr
rd~rred to as f~t'" EO
1 ~?r~iat afre: us_~efoult _cx ten~1on. G uida nce Softwa re's En Case fo rensic sui te uses
ro che nexr a nd it is nor a n op~n
this fornt:ir. Th•~ ~orn~~u_ h.ts ~h.rn::.-,eJ s lig htly fro m o n~ rele.tse ?f En Case
rd. The L1hE\~ 'F hbrJr) s ur ports all mod e rn va n .mes of 11nage fi les that is genera ted by E n Case an
,tJn dJ f I . . Rosen of AS RDaca, with furth er
·his (ormar. The st ru~rure O r llS f-o rmat h.t! been docum enred by Andy
0 n che LibEW F p roject. T h e EWF
~(l(Untenracion thar IS pe~formcd_ [ Joachin~ Men d uring his work o
(that includ es a n MD5 o r S H A I
forniar supporrs_com_pressio~t. split h ies, a nd it also scores case meradaca
ftrsr segm ent of rhe image fi le.
h..sh of rhe a~quire ~ image) 11~ a hea~ er data strucru re which is found in t he
should referen ce t hese d ocume nts.
[.x.iniiners th,H .tre mrerest ed m rh e rnner wo rkings of th e EWF fo rm ar
6.3.2.2 AFF
cs a nd an y relevan t metad ara.
The Aff is Jn open-s ource fo rmat used fo r sco ring disk images fo r forensi
AFF image files is su pporre d
AFF is implem ented in the LibAF F packag e thar we have installe d p revio usly.
, e ncrypt ed, a nd also d igi rally
hr The Sleulh Kit throug h this library. AFF images can be compressed
tadata stored in the im age fi le are
si.gned. One of the interes ting fon u res of the AFF for m at is that m e
stored directl y in the image fi le in
e:ccnsi ble-arb iuary inform ation w h ich is relevan t to rhe case can be
qm:scion.
AFF images is stored in one of t he fo llowing three method s:
file con rai n ing foren sic data
I. AFF: This is the defuuh fo rmat of a n AFF contain er; Ir is a single image
and ca~e me1aJ.1ra.
into fixed-s ize volumes.
2. AFD: This format contain s m etadata in the image, bur it splits the image file
file system s or m edia.
This c.m be useful when archivi ng images o r tra nsporti ng via size-lim ited
it stores m etad ara in an
3. AFM: This format stores t he im age fi le as a single and solid container, bur
external file.
I,, ~,,h(' d,i~ 1"11,-. h~,,· l\\'111bl11111 h.,, 11 111,lm·nl ti,,. 111,h,ln·p .111d h.1,lt,kcp 111ili1il'S. MdSdc..
• 1 'I I' .
MIi\(' 111 h.1,hinr. 111tl11i,·, \ 11'.lh\l Ill\\'\ lllh' d11,111,:h ,I \l'( 111 1111 111 11 ,·:- Ill' I Ill\ llll ll'~ anu produrl'
J
h~.,l hp1IS· 3
'
. , Ih.,,._ I·1,, ,,11q•111 , .111 I,,. \111111!:1111·,
l,11 111.1,,-.I 1111 11,· .
. ' 1rq1mr11H·11
I r,.1111111l'1, . t I1e nainc, %
t:, ,1111,I 1It·:-p1tl' I
' lll\\· ith h1,k, ,111111.11 111111, d,.11 111111k1111·111, ~\I.\ ' .111,l 111lt,·r h.1,hi11l: ..lgnriil11m. 11.~.,hdrqi i:, ;1111:w lltil't
\k,d,111,\l ,I\,\ 111111,· ,,,\:\1,1 h.,,h .1111li1i111~ ,11 1 11li,.11i,,11. It 1 .111 h,· 11_,l'd 111 t:n11·'.,lll' 11111li1plc ha,.lws (e.g., SIIAi
,\l\d ~\\), h.1,111·,) l111 lib .111d ,.111 \,,. IIM\I t11 :,11h~r,p1rntl~ .11111111hr :,l'I iii h.1,lwd d.11.1. /\lier grner,1tin ,
li.1,1.· ~\.1\1.'. h.1,h1k<'I' '- ·"' 1,·1•, 11 I , n1 111 i"11w,. lib, 111.11, hi ,w•' l1lc.,. It b Ih.11 Ii.I\ 1.· lwl'11111uvcd from one lo,·•it'g , ion~ I
111 .11wtl1n. ,lllll tik, th.11 ,l11\ '"'' ·'l'l'\\H in th1· ,11 i!;in.11 .,l.'t. l
.\, ~t.~t1\l hd~'h', 1h1· fal t d1.11 :' d,.1111:r in ., ~in1:I~· i111 1 111 bi_t will \ h·'"!.\t' 111.111y hits in the final hash I
\'.1h1,· \\ l11d1 h.11 111\•11~ 111 bl' ,111\· 111 thl' llh\\t , .,lu.1hk· k.11111c~ 111 h,1:,h l1111nio11s for purposes of provin I
. I I..111~1,.1\I \1111 " ·"" 1,1 I'"'" ' t I1.11 t\\11 1'11 c:, .m· :,11111. ·1.11 I>ul not I'Jcnrical ~ ,ga /.
h'\l·'~ w111r111 ,,r .111tn·ru,·.\' •
I O51,10•
d.111I h.hhi11i: ·'l'l'''i.1,·h " ill ti1 1t h,·11 1 - -)\111 \\ ill ,,nly b1• .,bk to tdl th.11 two l,b :m: dilli:rclll :111J
1101 how I
llilfo,·m thl'y .Ill.'. k~~l· K,1rnbl11111\ ~,,kcl' " ·'" ,kn·l,11 11\I tn prn\'idl.' this (.1p.1hility, which Jesse refers toas f
"u,ntnt trir-l:rr1\I pi,\l'\\ i~1· h.hho" "ti,11, h.,~hi11~." In si111pk tn@. fuuy h.l\hing breaks the input file
int11 d11111k~. t1,~·11 h.,~h~-~ tl11,~r ..11hl thl'1111,1·s thi" fot 111 l'1>111p.m th1.· :,i111il.11 ity of two rill's.
\'\'c c111 g1·1wr.111• ti,uy l1.1~h,·~1~,r h,ith of d1t· t,b hy running ssdtrp with no Aags:
\\'l• c.m idrntil~· th.11 h,,,h ~l.'.ts n( fu11y h.1,h,·s 111.11d1, hy impt·lli ng dwm visually, ext·rpt for the first
h} tl', \\ hi\ h is whrrr our mo\lilkuion 1K(urrrd. t\ltrrn.11rlr, w1.· 1.-.1n rnn :,sdl.'l'P in Jirl'ctory mode by passing
thl.'. -d tl.i~. "hi, h \\ ill n1mp,Hl' .111 f,b in .1 dirt'(lllry:
,,. •,·--·-'
f ·.,.. j Carving
~ " 1' t" n ..im'.nrr of l~irt·mil· onl'.e s.1iJ "whrn .111 dse fails. Wt' (arve." Extraction of meaningful flJc conrcnr '
1_111111 111 ~rn".' ' nn,tru\.lur~·J ~,ri:.1111~ 1,~· 1!.11;1 !5 .1 sc~rncl' and ,lll art unto itself. This discipline has l,cen ~
1
hi\ 1 , nt multi pk p1c,rr11.1111,n, Jt the l)1 g11.1l hircns1,-s Rl·se.1rch \\'orkshop over theycan, and advance,ntO
~onunm· to Ix- m.,dl.' '.o thi, J,I)'· A, it~ tn1.hl b.1si(, rhc process of carving involves searching l data srrcan1 (or
hi\' h,·.11 lm .11\d ll\;\~1,· V.llUl'\, ,k1r1111inin~ (or gucssin~) ,he file end point, and saving m il~ -
ND FIL E SYSTEM ANALYSIS • 109
01SK A~; _ _ - - - - - - - - - - - - - - - - - - - - - - - _ : - ~
•11110 J (Jf\·cd file · Carvin~• is still
.
an open. problem •111d ·,s... f · · · · 11. 1 •
• .. n art>,I o 011~01110 artl\'e l'Xpcn men1Juon. h Jll}
1
•
,cnt11enr. 1I proorJms
::-
are des1°ned_::-
to 1mplcm"nr
~
s . .·c ·J .~ b • II ·1· ·
· pturJC new I eas m carving, as we J S more uc1 1t an.111
0
I 1~ grarcd 10\\ ard operational use.
proi;r,111 •
6.5.1 foremost
h J filr carvin~ progr:u1:1 wl_1ich was ori~inally writ1t•n hy jl'~se Kornblum and Kris Kend.1ll at the Air Force
Q!lice of Spec1JI lnve5ugat1ons and later upd.11ed by Nir k Mikus of the Naval PostgraJuare School. 1r uses
dt'llned foo ters, heJJers, and knowledge of the internal strucrurcs for supponed file typl's to aid in carving.
A complete list of tl~e _file types Supported na1iw ly by Foremost can be fo und in the program's man page
bul suffices ir to say IC includes the usual suspects: JPEG images, office documents, archive files, and mo re.
foremost can be in~ralkd easi ly using npt-get on Ubunru or by retrieving and compiling the sou rce
(or supplied binaries) f-r~m the ~oremosr project page at SourceForge: hrrp://foremost.sourceforge.net/.
Options that may be part1cul.uly important incl ude:
A basic run of Foremost using the Digital Forensics Research Workshop 2006 carving challenge file as
input can be performed by us. We will use the -v flag ro increase rhe verbosity of the output.
N ote that the bulk o f these extracted files will not be idemicaJ co the original items due co the intentional
fragmentation of this test image. Simson Garfinkel presented research at the Digital Forensics Research
workshop in 2007, which indicated that the majori ty of fil es on any given volume will be contiguous and
chat most fragmented files are simply split into two fragments, with a single block splitting the halves.
T he most common scenario for carving in an actual investigation is the attempted retrieval of deleted
J ara fo r which metadata are no longer present or no longer linked . In these cases, extracting the unallocated
space of che volume into a conriguo us block using blkls h as the potential to remove fragmentation caused
by currently allocated blocks.
-..-----Forensic
- - ---~~....:::!..
Imaging__________ ___~;;;...,....._ ______
___
We arc.- trying to caprure an accurate as possible representation of SOlllllii'ja ·oa of a forensi'
image. This is not unlike the police lines set up at a physical crime put in plact '~
minimiu the amount o f change that occurs in a crime scene, which scene in~
gators the mo~t accurate data possible. Imagine, then, if the crime sc a co(lf
the actual crime scene. In the real world, this is madness, but this is rioP ,J•
forensic image. A good fo rensic imaging process creates an exact dupli 111
duplicare) of the source media undc:r invesrigation. Exact duplicate
ND_;_F~IL_E_S_Y_ST_E_M_A_N_A_L_Y_s_is_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _~•-1.:....:.1~1
~
,kte byre-for-byre'. secror-for-sccror copy of original media. There should be no on-disk information
111l
,0
. cnr on source .media
0
. that docs
. nor •appear in I he 1rorcns1c · • .
image. An ideal . •
imaging process shou 11
l not
.• ,1I media fail to acquire any ponion 0 f
pr r rig111, · · I meu1a,.1· • d:Ha not present on
0 · ' . r. . . ongma nor introduce any
JIte
ce med'13 into the image 11le. A tra<l111onal fiorcmic · ana Iyst exam1111ng
• • a gu n used •in a 11omic1
L • 'd
e works
sourthe origina
· · I· Why docs. not a compurc
. fi · ·
r orcns1c cxammer do die ~amc? Examiners gcncrarc 1orens1 r ·c
on r St:•veral
.1 , acs ror • reasons. .fhe primary reason•· ,·s• 1o prov1'dc an exact copy of ongma
· · I med'ia co test. Tl ic
:;:·::11weapon is the bes_c evidence for the tra~i~ion~I analyst. In the case of digital evidence, we can make 3
d plicate of ~ource media t~ac matches the ong111al 111 every way. Working with original digital evidence ca n
b~ very dange~o~is, he~a.use It can be altered or ?estroyed :'!th relative ease. We minimi1.e our opp~rt~tnitics
to alter the original acc~~entally 67only_ a~cess111g the on~111al media once to generate our foren~1c image.
Anodil'.r benelll of workmg on an image is if w~ make a m1s1akc and somehow end up alrcring the image file
in sorne way, we can generate a new exact duplicate from rhe intact origi nal media.
are not ,Hi!lcn to d1r tfok. They rct.1in \\ h.11nrr d.11.1 \\ CH" l.i,1 Mlltnl in them during thci, j'rl'\inu1
JlloL,lli1l11. Thi, i\ what 1~ knnwn .,~ sl.ll k ~p.1l·c nr tik· ~l.u.:k.
Fi~uH' (d dt'n111mt r.Hl·~ tlw ~cn~r.11 illn ,if Ilk· :-Lil k ll\ing dm·r ~Ill~ l'~,i, l: \'ic":' ,ll" Ihe .,.111,l· ri1:h1hlolk,
on a di,k. Ar IIN, rhe n)w ron~i~,~ of nc-\\-. r111p1~. u11.1ll1h".1tc,I hh k,.1 hcn. Irk t\ '' l ll'.lll'II. h.1, r1gh1 hlnl~ 1
.11luc1tcJ ro 11 , anJ 1ho~e l'igh1 hl,,,k, .ire filhi " ith ,l.11.1. Filr :\ i~ thrn \lrktrd" ,111,I ~1111w1i111t· l.11n tl,l. fir,1
llv<· bll)c ks .ire rralloc.m·J .mJ tn t' f\\ ri11c11 "ith I he 11H1tr111 Ii 1Hn File n.Thi, k.nn thrcr hlnl k, uHtt,tinin
JJta from File A unJlllll,lll',i but 1crn,n.1hll'. ~
A A A A A A A I A]
JS~r~f0rtn~•. ~: ! ~0 r~l~
d,J,F : c' J CSf;::.,•, .,:_
~ r: cJ 2:1 ;(' •,
'>ce , -:.,,~-
f' - ' .-~1:-
- t1.. .......-.. ~ : :-~ s.; : e.: ~,:c Js at s•3q ,.., 0 .. tput
s~1ri~_c:,~ :,1; F~ :: ,~ 1t~·~1~e~ ~·: c~! at ~: o' : C• • i n,t,t
~ s
EM_A_N_A_Lv_s_,_
N, .,D:._:F.:..'L:,.E_ s_v_s_T_ . '. .1~3
- - - - - - - - - - - -- - - ----=-~1
t i nc·e ro make a ~implc done from one dri ve to anorlicr we W ·11
1
· k I I l'k I ·
I III VO C I I(' IOCI , I (" t US;
jlC ' ,
The key items of interest in the console output for the dd command arc "records in" and "records our"
lines. First, they match, which is good; this ind icates that we did not lose any data due to drive failures,
fai lure co write the output file fully, or any other reason. Second, the "60832+0" records indicate th at exacrly
chis many 32K blocks were both read and written. If we had imaged a drive rhat was not an exact multiple
of32K in size, the "+O" would instead show "+I ," indicating chat a partial record was read (and written).
In rhe base dd command, other options of forensic interest that are present are the conv (convert) option.
If imaging a failing or damaged hard drive, the conv=noerror,sync option can be used to ignore read errors,
writing blocks of NULL characters in the output file for every block that was unable to be read. Additionally,
in the case of a dying drive, supplying the iflag=direct option (use direct 1/0, bypassing the kernel drive
cache) and reduci ng the block size ro 512 bytes will ensure that the amount of unrecoverable data is kept
to a mrn1mum.
6.6.4 ddldd
While dd can and has been used ro acquire forensically sound images, versions of dd are available that are
specifically designed for forensic use. The first of these to be examined is dcfldd, created for the Defense
Computer Forensics Laboratory by Nick Harbour. The dcfldd project is forked from GNU dd, so its basic
operation is quite si milar. Some interesting capabilities that dcfldd has are not found in vanilla dd. Most
of the capabilities revolve around hash creation and validation, logging of activity, and splitting the output
file inro fixed-size chunks. The extended dcfldd functions, as well as base dd functions, can be reviewed by
passing the --help flag to the dcfldd command. Unsurprisingly, performing the same image acquisition that
w.15 done wich dd using dcfldd is quite similar. In fact, if we did nor want to take advantage of the additional
fearures of ddldd, we could use rhe exact same arguments as before and would get the same results. In the
code section following, we reimage the same device as previously, but at the same time generate a log of the
md5 and ~ha l hashes generated of each 512-megabyte chunk of the disk:
user@fore nsics :- S sudo dcfidd bss32k if• /dev/sdg of•dcftdd.img
hasrwi ndow=5 12M hash- md5 , shal ha shlog• dcfldd.hashlog
G0672 blocks ( 1896Mb) wr itten .
6~ 932~0 records in
G08 32~0 records out
DIGITAL FORENs1c
114 •
6.6.5 dc3dd
The last dd variant we will examine is dc3dd, a forensically oriented version created by Jesse Kornhlu
for the Department of Defense Cyber Crime Center. dc3dd is <lev: loped as ~ p~tch applied to ~ NU c1~'.
rather than a fork, so dc3dd is able to incorporate changes made tn the m;11nl111e dd more rapidly than
ddldd. dc3dd has all of the same extended features found in <ldldd and has core <ld features current!
absent in the latest dcfldd release. We can provide the same arguments co dc3dd that wne used previous!~ 1
with dcfldd:
user@forensics:-$ sudo dc3dd bs~32k if~/dev/ sdg ofmdc3dd. i mg
hashwindow=512M hash=md5,shal hash logEdc3dd.has hl og
[sudo] password for user:
warning: sector size not probed, assuming 51 2
dc3dd 6.1 2. 3 started at 2010-09 -03 17:34:57 -0700
command line: dc3dd bs=32k if=/dev/ sdg of=dc3dd . img
hashwindow=512M hash=md5 , shal hashlog=dc3dd .hashlog
compiled options: DE FAULT_BLOCKSJZE=32768
sector size: 512 (assumed)
md5 O· 536870912: 07c416f8453933c80319c2d89e5533ad
shal 0- 536870912: a222f5835ed7b7a5lbaaa57c5 f4d 4495blcale79
mdS 536870912- 1073741824: acac88a20c6d6b364714e6174874e4da
shal 536870912- 1073741824:
5b69440al5795592e9el58146e4e458ec8c5b319
md5 1073741824- 1610612736: ed9b57705e7ae68118le0f86366b85e6
sha l 1073741824 - 1610612736:
bc5369977d9a2f788d910b5b0la9ale97432f928
mdS 1610612736- 1993342976: 812c94592ec562Bf749b59ale56cd9ab
shal 1610612736- 1993342976:
bb789315a814159cdf2d2803a7314958Bb5290ee
mdS TOTAL : 58e362af9868562864461385ecf58156
sha l TOTAL: 8eaba llcb49435df271d8bc020eb2b46dll902fe
3893248+0 sectors in
3893248+0 sectors out
1993342976 bytes (l.9 G) copied (??l) , 908.424 s , 2.1 M/s
dc3dd compl eted at 2010-09-03 17:50:06 -0700
Note that hash log to the console as well as writing it out to the file passed in the hashlog= argument
I is produced by dc3dd. Also, it presents the sector count rather than the block count as a summary upon
completion.
Summary
This chapter discussed about the core concepts of we have shown how we can exploit a file system for
disk and file syscem analysis. In addition, it explored artifacts of forensic interest. The succeeding chap-
many of che fundamental concepts of forensic anal- ters will build upon this foundation to examine and
ysis, such as hashing and forensic imaging, dealing analyze higher-level artifacts.
with forensic containers. By using the Sleuth Kie,
01sK,.:,.A~N:.:D:_F:...,I_LE_s_vs_T_E_M_A_N_A_L_v_s1_s_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _:..·___:1:..1:.:5:::
- KeyTerms
• Disk: A disk denotes a phys1~ storage device • Data Unit: Data unit is the smallest available
(e.g., an SCSI or SATA hard drive, or a Secure freestanding unit for data storage that is available
Digital Card from some digital camera). in a given file system.
• Volume: Volumes are created using all or part of • Metadata: Metadata is data about data.
one or more disks. • File Name: The file name layer is operated by
• File System: File system is laid down on a volume humans. This layer has file and folder/directory
and depicts the layout of files and their associated names.
meradata.
Review Questions
t. Explain File system and types of file system. 3. Write short notes on FAT32 and NTFS.
1"l,
2. Explain srorage layers and various types. 4. Explain forensic analysis of file system. 'r
i'
I
1
Data Analysis
LEARNING OBJECTIVES
-- -·- ·-- ---- -- -
After reading rhis chapter, you will be able to:
, Understand the concep t of <lata analysis. • Interpret and apply cools for data analysis.
, Understand the process of data analysis m • Distinguish different methods for data analysis.
Windows and UNIX system.
- Edewede Orjwo h
_, ..
\,a!A 'tw.... l
~ =llo:-·
.....
-~· "'-"-'-'"" C
,_ ,.,~ 500 IIHt!
u....~ ... 4't.ll n
.,_5»<1UT
l-n- -•-..
(Mo_.~ ,C.:.1,C.1 I )
·~~.1'\ 11,1
·--~.,.,..
- 0.--11.-- ,
~ .,
~__. ...o...,
l~i.•- l"lj
• c...
4. ~~- ,~~ . . 1'\A
d
• .A~AL.Y,S·::.,'S: -_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _.:_•_.:1'.,_1:__:9
~
;-:,iW• kt us_set _how to initi.ue a c.1Se in these two surroundings and import the segmented replic4 to get
. ,., Jm1nJC1l.1n.
f(lJr tllr \.>
,. _1 Reviewing Forensic Duplicates in Encase
3
7.:.S ln r-Jsy mt'thod to restore and a~l1rz.e dd fib, Safe B.ick files, and also Encase evidence files, with its
h "suite of 1001s and e.1.sy-to-me interface. A new case must be cre.ued while acquiring an evidence for
stro11:i .
ch( first ume. .
Steps for cre:itmg EnCJsc:
}. {)ownlo.1d [nc.t~e
2. Choose a file
3, New
4, j\ew case
;. ·Create ~ ew" di.1k1g hox will appear
Once a new case is created, file can be added in chat case by the user. Figure 7.2 shows adding a new dd
im.ige file to your ose.
-' er,,t
Sa)!e Al
...
Ctrl-Snft·S
J Ctrl-4>
ptnter Se~.. .
..__ A~Device .. .
Add Ra?! Image...
~Xlt Alt.f4
Ctrl-1 '
1 I·
, oC:~starry~ts~~~
,h As we can see in Fig. 7.3. "an: Add Raw Image" dialog box is being displayed by Encase. when a user
imooo;c_10 dd a raw image. Here, the user needs co select the disk for dd image file that composes the raw
~e in proper order.
C-On.t~ $t'en in Figure 7.4, a powerful Window explorer-type interface. presented by Encase, displays all the
enc of r · l' _ ___i:,_n F ..L!- ___ ...,1_
Qn US( E aw image nle once the dd files are added to the case su~y. mm UU1 sage ODWillW, user
and dl' .nc~ suite of tools to perform almost all the preparation required to analp4; die data in an dJcctivc
ic1ent manner.
DIGITt-L FQf.£ ,,
120 • •I , ,I
,~ ,.
B~ per ~~'.ct
512 II
Pre-smo, E;!t1
~ 0~
\'\A.l"le
0 I
P~t-~t orB~ I
I
ClHlCJ,1
0 I
R.!111 CD~U~
I
SIHI By!.e
0
j w~ 'J ,,
1 J
J
~,cr.ie-~! pd rr;i,e l .:~ 1 0 Foo~ CpenP~.sw:r d, ,tl'l"Y.~1fts -s.,.,'!I
- " Jri,.,-a :pi:t l,o<' .&awot 9 ~. P>ot,,.r,n Cr,e-,P.-&1c,d, ,.,,.,.,.,..,, ~¥.,,.,,~ Af~ f.ro1
, ' 14 j l'I , - . ,of Tll,I(' Aacbtl 9 ,:,, ho~w c:cicn ftw•..,d. PftlTIC'X>"IS ~M,b(,t<J, A8 frcr1
t r,t Ao¼,1 l li,PTo:t,,-,-y,, Q.e,P, ~ . "'Jd, Pt-~.1CnSPtt•,Y.6'd
PC • t"<I'
:_; 15 jDoa.r,,ncJ odf
~ J c.oa,-,,,cJ :,:f T,i,, Ao<borlO, Pr•rz:w, ,..,,....,..P..."°'d, ~( 4(r(1-,C .0,o....
J0,11>-< . . ..
Cue 1•C' ii•·1ut ·ru u, au:hy . ,- ,. .1,t71 r,dt .. 1:1 ": fn'..oC)I
.A.c-1d: •t C ~ Ji ,,.; EJ'M"Cllt1
:nte-::1et1 :ertH 1 Unt i u11o1Cr 1 , ;;:, lr..c"t' /~:,on, tunt.1n7
N:, 1J1cn-.d
• ....J,CWl!N(
:...c,.,~a°"i {ntt • n t UnJ,l'OUCU ~e. l&.J• 1,u.ct:1r 1 Ut(J11•d
l w~4.dl
lie c ... l '; rc•t H t·C u•• . .. o:k.• / , ,-du,J ll ~ ! $ _,,,.,..,
.Ac1ctn I 0
;, t.,~1"•
:,.• ,,-puu.
Op.a h u 1i10,1. h nu a ■ un , J utv::rd , ;-:4 lr.crn,u,:,e
ltu u • fozce • -.1,....,, h:. t 1,1:d1tn9 uquHrf
' "- *'""'-
) C- J(p-w,l~ • ~ • t ~ - 00:f ~ • ~ l.!1~ IS •:513140 '1110!6!1
:;r-1))1) fOO Lf 0)
.. l".A"'_.$:.-·~ . . . : s . . . _ ~ ~ " " . - c - ; .....,••
C .....,.._, .__...__ ~~-~.. .=:._~~- --=~
I. :--:ow, we: look at Rc:c.civing rorcmic Duplicates in FTK. Another powerful applica
tion in your wolkir is dit
a,e sJighdy lJIOlr
FI'K Ly Aw_,\ Data. A\ compJrcd ro Encase, che interface and evidence import process
compli1.,1k·d;.howcvtr: wh<.:n dtaling with e-mail score file and complex srring. it
can outperform En~
2. ~ow to b~gm_a sc1~1on: When you Mart 1hc appliocion, a dialog box
appears. Sd«r •New cast op-
uon from It. I igurt· 7. 5 ~how\ Cl\<: gc-ntr,ttion screen.
AccossData's
Forensic Toolklt™-FTK™
Th~ CompJ\lt~AnolySi$ Tool
.J
I
I'
r
I
. )., •· · E'I
Rcline Ca10 - Oelaull
•~ t ,- ,-... 1,, .. t- ,t
.,.... \ .,... I ,.... ~, I •..,. I ..,.,. I ......., I
,,_ _ --- ..,....., •"I
~'.!.7.!._ J ~".!.~ '"'
,..,...
·~~., ~-- '~
·1 •. ,. ~;: ;:
---
~ "I•_
· -- -- -- - -~-
' • •, . ., . . .. • C' ~ ..... ,, ...., " '.t"I
r;,:;. _;-- ;:,7 .!.,..,...,., ,. !! ! ~ - - •
- - ~ ..
C•uH•O- . 1 I• ,.-lrl-•
"".-:"L,.,1!
f (,,1t t lt.J _, t~ I. I !J..)JJtC ltt •:
_. 1._. . _ ._.,
·;.., . f~t• - . -:1'1, .,, - ··-;..., ~!'!.~
,.,. h tn r ~ •~ - -'~•
..,_, .,~•• 1
I ,..._. .. .,, """ ti'J\ •.!°
. ......
l':A ol
...,,.,s
1~1
....,.,
,,..1 1,
''"
·~:r}r---4· \,
r.-u,•• ► 'lt
1 1- ..._. ••
... ·\)''H ' 'i -~l'- !Ur.-t l
' • · '4.t' ►
h- 11...,.., •t• ••u.u~" '
.. .........
' I
• I I
,I \.,,,,.-.. fa •~• t,..e,.,._
••
Ill ►
,..
fiEE, .,~
1B Eli
... ,.
IM
..
Wlf
,.....
, .... w...1 ..
.
, . • • 1 u•tC•M ~,-b
_,
!rt' I
"' ' )ltl ' .. '-A:):U H I
'WI D+ e
',
I
l
• I I I I t .. 11. ., .. . , . • • u .., .. '
rJ"'J•""'.. tl1MNfUUX ◄ •,1
''""1 .," ~,,..
r,,- "•1 k 1 - ·
...•..
0
lJ~• '• V 1,.t,.,..,11~,,-·
• • . • I • U ~,.. ... .......
0 .h,
,
:: :: .;:~~: ~~: ;: I
' t•11,,,-. 1 u t w llh"►
:,.Jl
I I " ' . .,-....,~•,. ·-,...
h ,,.,.tt. •..
••r w r, ► llf
•~..ua.
~
IWt~ ·
l I "' I I
:c!
J
rc.
Figure 7.8 Sele ctin g an evidence file for expo
, that is, the
ion thar will crea te MD 5 of ima ge (Fig. 7.9) . The opti on is available here
Enable the opc will be kep t in sing le
split into chu nks , whe n the user crea tes a dup lica te image with dd. The ima ge
files are
itio n is larg er eno ugh .
conragious file, if the des tina tion file part to con vert 18G B
can say thar this proc ess is fast eno ugh and thar it rakes app roxi mat ely 12 min
Thu s, we
(Fig. 7.10 ).
Encase image ro a true fore nsic dup lica te
f ~,,1',
1111,~ I LI
\
• II
I
\
~
Recovering Unallocated Space, Free Space, and Slack Space
6 · dup I'icanon
7, 1·e rhe [orens1~ · ~ f me di a an d r~covery of the ~n~1re
· possible file is done, there is s rill <lata lefc
one ·dcnce media that you will want to review. The rema1nmg data is stored in slack place, unallocated
on evi nd free space. So, to unde rs_rand th ese terms, we must first rC'view what an allocation un it or clmter is.
spa'~/,he dara srorcd on hard drive a~e a rranged by the operating system into segm ents called allocaci?n
. lusters. For example, an operanng syst em that uses 32k cluster reads a nd writes that from h a rd drive
11
un or c •me It cannot read or write less than 32k at a rim e to h ard drive T here are very few files that h ave
32k at a ti unt· of data to occupy an e ntire cluster or set of clus ters. T herefore, when an operating system chat
. ·
~ac1
. arno2k clusters to a h ard d nve .
. .is b emg as k·ed to save a 20k Microsoft Word document, there is 12k of
3
wruesd space called file slack. In our example, th ere m ay be remna nts of previous files in I his J 2k of file slack.
unuse
_1_ _1 Slack and Its Types
7 6
4,096 bytes per Allocation Unit
512 bytes per Sector
s s s s s s s s s ss ssss s
t
465 bytes - Ram Slack
Most people refer to rwo different rypes of slack s pace, RAM slack and file slack. Figure 7.11 helps
elucidate what we mean by these terms. The figure demonstrates how an operating system using 4k clusters
would store a file rhar is 5, 167 byres in size.
Many people refer co rwo different types of slack space: file slack and RAM slack.
I. File slack: Everyone is aware chat che file size varies, and char is ok! The fact is that many people are not
aware that cl uster is nothing bur a place to store rhe files. The file system uses fixed sized containers or
blocks of sectors, which the Microsoft operating system w,es to assign disk srorage space.
Cluster and sector: Operating system s arrange all data stored on a hard drive into segments called
· units or clusters.
all ocauon
&le: A 5,000-byte file cakes up 9 sectors; however, the operating system will allocate the file 2
clu 5iers 06 sectors, 2 x 8 secto rs), as it does not fie into 1 sector. Two Sectors is 8 kB (2 >< 4 kB}.
A 2,500-byte file will fie into 5 sectors; however, the operating system will allocate the file I full
1 r (8 sectors), which is 4 kB. A file which is J 0,000 bytes wi~l be allocated 12 kB - 3 sectors.
. ~
2
slack: RAM slack is basically data between the end of a logical file and sector (NOT the duster).
11
r _tJk_es_up to S 12 bye es on a standard hard drive; if file takes up 400 bytes in the last logical sector, the
tlllaining 112 hytcs will be RAM slack. RAM slack contains a amall ponion of random data whose
\vurce i~ wh:never conccncs of RAM char 1s
of
. chosen to fill -L-• ....,.,..
uliAI " 'Y-
. 1s
Ordinara·1y, It . fragmem
. a uny
r./001
<= executable fi le in memory. File slack contam$ dam ~jt.rnlously delc«d files or from the
ctory conJ· . .
Note• lllonmg of the hard drive.
· RAM slack <lot:s not exist on trendy versio M ~ f'or many rimes.
126 • DIG ITAL FORENs1c
Examp le: W 1t. h 512 - byte o f sec tor on NTFS Jrive and 8 secrors per cluster, the size of cluster .
.
4,096 bytes. This means that if che file is 5, 100-byte long, if th cre are 3 , 092 bytes of slacks, this ts
is
·
b ro ken d own into 20 by1es o f RAM slack and 3 ,072 bytes of file slack (or 6 slacks).
~
1 we order every file in the case in as
Fi 1-:un: ..,, . 1-• . . • rypcs. --r
cen d.rng ord er by c.rt 1e creaoon · h"
10 view t 1s
1 . ·t'JJ.itc: ~1,1111p III adJJCent columns, we have also adjusted columns in the file table that Encase has
11
thll'C tllll .
11
(f'l·• ~J. JJitio11.1l analysis a nd reporting, Encase has made it very easy ro export file datato delimited text
},lir ,I . ~ 1 r . . h
• (' ih,lf plll c 1~1 •~•port ro~ a~ app acataon sue as
'
Microsoft Excel. The file that you can select to include
til · port fate 1s shown m Figure 7.l3. You can also use Danny Mares CATALOG a file list if you do
.111 nlll r t'\ r T l fi II . . I
1 e< 0 owmg command lane works on as single partition drive (-p) and recursively
• . Fm:,1se or TTK.
1 0
111111" the:'. fiks loc,1teJ on mount po .int / mm/hardd rive, · an output file called filelisting.txt.
· creaung
.. ill
I11L' •
Q]oc al ho st Mares]# . /CATALOG -p /mnt/harddrive -o filelisting . txt
[r .:>O t \:
2>/dev/null
Rlt.-..,s...
0""'-Als.r.
□,..,_
0Roo<ot--,
ONo1-..
Olil4'11n9t_..
0..._.I.O<_
O"-r~
e
1. F~quent proprietary file formats endorse extra difficuhy when trying to carry out string hunts on the
40
;arters of a hard drive. Files, such as Outlook's ".pst" and .ost,• Outlook Express's •.dbx,• the Win-
ows R~istry files, the Windows event log files, the browser history files, and numerous other files, all
n~d
2. ~ SN>cial
r ·~ too Is 10r c
c correct 1orens1c ·
· exanunanon.·
~~:;;ous comp~essed file fo~mat~ rC'nder traditional string aeudu~ in~vc.. Com~~ ~les
.1 . . tgz, .r-ar, .,ar, .z..gz, .zip, arJ, .lzh, packed 6les. ancl~uduvesareall foil uadinon-
41 Strang h"
3. E ~.ire mg utilities.
:.net\ ~
vo ;pr files or password-protected files caoanc be ftKcd. Tbcrcforc, before
. u Cln lOnJu ·t 11· .
(a.) ld . l
I
e ect1ve, comp etc strmg
.
(h) !Jent'.~' all compressed filc-s and Jccom
ennty all
k) Ide . encrypted files and unC'n
ntify all compressed files in c--mail
DI G ITAL FO REN
128 • sic
Svsiem log records System pr~cesses and .device driver activities. Windows includes device drivers that
t:iil 1~ start properly; ha rd ware failures; duplic~te .JP add~esses; and che starting, pausing, and stopping of
srr-•ict!S are au?Hed by system evem~. T_he Applte~tto~ log 1s populated by Activities related to user programs
ommercial off-the-shelf applteatton. Application events that are audited by Windows include any
anJ c . h 1· .
t at an app. icanon wants . to report · The number of failed logons , amount of di~k
errors Or informa11on .
usage, and other important me.mes can also be included by Application log. In the Security log, we find
S•stem auditing and th~ security p~ocesses used by Windows. Auditing done by Windows for Security
e~ents include changes 111 user privileges, changes in the audit policy, file and directory access, printer
S)1Stem logons and logoffs.
ac11·v1·ry, and
The Security log can he read by administrators only, bur System logs and Applications can be viewed by
anv user. During an incident response, Security log is usually the most useful log. An investigator must be
co~fortable with viewing and filtering the output to these logs to recognize the evidence chat they contain.
.
PL'PUI.u t h.1ru-rJIC
i • tnnre cm ·m•~mtn, C t he 01l , 11 itorin,·:-- .m,l rtY1.ml k,,·1,ing. tlut I.l \\indo\
h
\s S\'St<: ....
. '"
) so • . . . ::, . .· J. ts ., . ·ur 1.lO .l sn!l'nl runmn~ .l Hl:,{• ,bl-d
fire\\"·
· v h" ·3-k t e,·erv umt' ,·our mc1mn . v1.1. •
,11
pt·rforms. 1ou 1t J 1 ~ po • •
•. 1 c • . . _ Sr cnil, for inw:-ti~.1wrs Ill l'll."\'e w~nha tnt"ominl! .i.nJ .. •
Third-party fin-wall sohware pronues r.mr.1~t11.. JU t • , ~ ~ '
outooino network a<.:tivity on a sptem. . . . .
11 1· - _. J
-'lll'J!-\"~lem n~m. tr.lp\tnl~lS, ;rn rro,1_.J e,tnJudit
,
rewl Jpp1,ano.nsre\."'I.,r1uc:·,·en:\\t'~
::, t' . I'
t-.kmpcrsona.ih ., . . . .· . .
. .· .
tr.ul for every known attar k on t he systl.m. This• cert.1mk. nukes re\.'.1.,nscrmcm~ tHnts e.,~ic:r.
I line arguments for each running process, and Fporc shows which processes are listC'nin
But now on a cold system, how can you find rogue processes? T he e.tsiest solution
up-to-date virus scanner on the whole logical volume of evidence. Make sure chat the
read-only, when you choose to run a virus-checking utiliry agai nst the file systtm
\'vithout your knowledge, you would not want the cool to stare moving and delrting
g on which pores.
is to run the most
volume is mounted
of the restored im.ige.
filrs. PestPatrol is an
excellent tool chat identifi~!, Trojans, backdoors, keystroke loggers, an<l other "malwa
rc,"
fi If ihis rnmnund line \\We run at J specific time, someone couJd connec
t to the system using the
olluwin~ comm.ind line: remote le <hosmame> barman5.
phrase to connect.
Th The <h1,srn.une> is 1he NcrRIOS name of the" remote system and barman5 is the key
ill or soon utiliry. Malicious scheduled jobs
t pe~on can now execure anv comm;mds desired using the
:: ~ riC'3.lly s.:-heJuleJ. The at c~mm Jnd, with no command line arguments.
will show any jobs that have
11 5'-hc."\.iull'd.
~13~2~•:__ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
DIGITAL
__ roRENs1c
---.;
___
E x p l i c i.t B
g Explicil I C
Domain A - Trust omain +- Trust Doma n
j
15 _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ ___:•~1~3~7
ANALY~S.:.,:.
~
. Op~ra: 1.52% Proprietary or undotectable: 0.23%
Satan: 4 33 1/o Android browser: o01 %
Other: 0.23%
Chrome: 31 .41 %
· · d d · I 1r.ur1h ermore ' data vanes as per web browsers type. w,or.b
· · ·
rnat1on, 1m·rs1w.111o n is nee e 111 sever J areas. • •
• y, ane
· t-user records on r: d'cr
mere nt serno· n.s·· C"ch
" e records' history recor.ds' cook ies registr
brow sers re1;11n iour
sto re data on operanng sy5terns, are demon~
<luwnloaJeJ files. The locations, which are web browsers that
w.ucd in ·fable 7.2.
system
Table 7.2 File locations in the web browser oper ating
Ope,·ati11g
__ __ __ __ __ __ __ __ _
\~bB rows er Syste
..::_
\Vindows
m File Path
-:-: --:- :::- ---: -::: ---- --
C:\Temporary Intern et Files\Content.ie5
---
Inrerne( Explorer
95/98 (:\Cookies
C: \H istory\History.ie5
Window!\ C:\Documents and Settings\o/o usernameo/o\Local Senings\
2000 /XP Temp orary Internet Files\Conrent.ie5
C:\Documenrs and Settings\o/o usernameo/o\Cookies
C:\Documenrs and Settings\o/ousernameo/o\Local Serrings\
Hi1>ro ry\history.ie5
Windows C:\Users\% username%\App0ata\Loca l\Microsofr\Windows\
Vista, 7 and Temporary Internet Files\
latest version C: \ Users\ o/ousernameo/o \AppData \ Local\M icrosofr\ Windows\
Temporary Internet Files\Low\
te
Firefox Linux /hom e/$USER/ .mozilla/firefox/$PROFILE.defau lt/places.sqli
MacOS-X /Users/$USER/Library/App lica1ion Support/Firefox/
Profil es/$PROFILE.default/places.sqlite
Windows XP C:\Documenrs and Settings\o/o usernameo/o\Applicarion Data\
Mozilla\Firefox\Profiles\%PROFILE% .default\places.sqlite
l
Windows C:\Users\% USERNAME%\AppData\Roaming\Mozilla\Firefox
Vista, 7 and Profiles\ %PROFILE%.defaulr\places.sqli te
latest version
Safari MacOS-X /Users/$USER/Library/Safari/
/Users/$USER/Library/Caches/co m.apple.Safari/
Windows XP C:\Documenrs and Scrrings\%usern amc% \Application Data\
Apple Computer\Safa ri\
C:\Documenrs and Settings\o/o usernameo/o\LocaJ Settings\
Appli cation Data\Apple Compucer\Safari\
Windows 7 C:\Users\%username%\AppDa1a\Roaming \Apple Computer\
Safari\
C:\Users\%username%\App0ara\Local \Apple Computer\
Safari\
ANALYSIS;::__ _ __ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ __:_•~1_:3~9
~
e _2 (Continued)
1
~ Operating
System
1
~,:·1~:._:P.~"'~tl,~ - - -- - - - - - _ ;
\f~b o,ou:-_:s__e_r _ ~ ~ = - - - -11;::::-=-;;;~~:-;---::--_:R
_;--- Linux / home/$USE.R/.opcr.,/
()per.I
M.ic:OS-x /Uscrs/$USER/Li h rary/Opt·ra/
WinJows XP C :\Docu mcnrs and Setti ngs\% 11sername% \Application Dar.,\
Opera\Opcra\
\'v'i ndows C:\Uscrs\%n1sernamc%\AppDa ta\Roam ing\ O pcra\Opcra\
V ista, 7 .mJ
brest version
Linux / ho mc/$USER/.config/google-ch rome/Default/ Prefercnces
Google Chrome
l\bcOS-x /Users/$USER/L ibrary/Application Support/Google/C hrome/
Dcfaul 1/ Preferences
\X' indows XP C :\Docu ments and Sctt ings\%username% \ Local Sett ings\
Application Daca\Google\Chrome\User Data \Default\
Preferences "
\Vindows C :\ Users\ % username%\App Data\ Roaming\ Google\Ch rom e\
Vista, 7 and User Dara \Dcfoult\Preferences
laresr version
As per web brow5ers, system stores data in various folders and locations. In the analysis process, it is
rssential to test data in various folders. Folders should be searched for in four differe nt record types as
mentioned in rhe previous sect ion. Types storing of web browser are listed below. Internet Explorer is a
web browser which computer users generally use. Internet activity records are stored fo r each user ind ivid-
ually under rhe user profile folder. Data srores in Cookies, Cache, Download History, and Hisrory folders
~pmtely under the lolations is showed in Table 7.2. Data scores under folders in index.dat or container.
dat database files. Data is scored in binary format in this file. Safari scores web browser data in fil e which
i~ named Hisrory. plisc in binary format under the web browser data locations. It stores the information of
URL addresses, dace of visit, cime, and the number of visits for each website. Firefox stores web browsers
d~ta in a file called placcuqlite. File uses the SQLit e database format. Opera keeps data in different files
wnh the excen~ion .dat. These files are cookies4 .<lar, d ownload.dat, global_history.dat , search_field_histo ry.
d.31. Google Chrome stores data in che p references file. T here is separate file for each user. There is informa-
tion about user policic..•s, master p references, and local locations data.
-· ~ ~ . . . . . : : ~ - - - - - - - - - - - - - - - - - - - - - - - - - - - . . : . .~
: ,El'
deleted, users will destroy what can be obtained in the examination by using function of browser. There are
rwo ways of deleting records: (i) by overwriting the existing data with the launch of applications, the old
data is lost and (ii) by deleting data from the browser menu or the index by users voluntarily. After the fim
method, accessing old dara is very hard. Bur, after the second method, accessing data is possible by recO\-
ering and disk scratching actions. Choice and access roads allowing the deletion of records by users of mt
browser is given in Table 7.4.
u,cJ for analp.111g Wl Ii lin,w\rn in <ligit:il fi>rrnsics ex.amin:ition,. In . . ~ . ka,ures of sp«ih~ "-di
hrow~rr an..1lr1t: tc)(Jh arr also pn:,c:mr<l.
_,
NALySIS
• 141
~ E
- . . .
vidence Finder)J. . IEF 1s a sofrware with license
. .
b M r ·
· fiee pro u·111ccd y agncc rore11s1cs
J,,ccrncl
. 111 th
Jf:f- ~ Prr~01i;tl comput ~n, arc U!,e c procrs~ 0 : examina tions of smart phones and tablets hy experts.
analysis of
_.,,111r•'.11yJiffrrcnt nwdds,_ti pres_rnt.~ rhc ch~rac1e nsucs, ~uch as examining internet TV series,
fiih 115 . cJ (rorn n,obile appl1can ons. Ii 1s w,cd on \'v'1ndows and MacOs operatin g !>ystems.
tool_. Jr runs on W indow.~NT and later vrn,ions. l1 supporcs
11.,lrs oh.~'. '~,EFA is a free, "'.ch l~~owse r analyze
WEf~: I irff (~ 11 ), McwllJ hrcfox. Apple Sa fa n, Opera, C hromium , Googl<.> C hrome Google C hro me
2~:,:odo
1111l'rn~r [)r.1gon , CoolN~ivo (Chrom e:lus), Swing hrowscrs. For rhcsc brows:rs, \X'EFA offers
image disk. T hese merho<l s include gath-
c:,11i.1r}, ' .. 1 Js ro pt'rform ,ul.ll)'!I IS from an active 1iy1,tc111 or an .
.111 s 1ncu10 . h k. . h"
v,1_n :hc: wrb hrow~er s GIL _r. ~oo _ic_s, m_ rcrn ct .•~Lory, ~ow1_1load h1_story, sc~sio~ da~a, 1e~ pora_ry inter_nc1
(fltlg d rhr rin1csheet d.ll.l rnforma tion. The obtamed da1a can
be displayed 111 tt mc·lme view, H fML view
. I
1·111'),. J!l ,C(t'r-'> view S(',trL lCS. . . .
VRL p,lf,\ll . . 1· exam-
or NctAnalysis: Nc1Analp)t1, ts a ite•~ scd rool develope d by Dig11al Derec-1i ve com pany for digital
. f weh browser.<.. lt 1,uppons M icrosoft . Int ernet Explorer, Mozilla Firefox, Google Chrome, Apple
II I· . f I . . compo-
d Oper,1 bowser.<. . t a O\\S t le exarn m,111on o ntcrnet history, cache, cookies and other
.111 111" O }I
r-_
ga thering evidence acc.ordin g ro user
5.i(.in, JI1\ ;1, a!si) an eflec-1ive reporting fra rure that allows quickly
I · I I
so 1·rware I1a.<. errecttve
nt'll rs._. l\1oreovcr, this • c
tn:- · ana yt1ca too s ro r decodin g and undema nd ing dara. At the
bdi:1v1or. .. SQL queries . .d .fy . .
· 1.. ir has ab1lirr ro u!le to I t'ntJ related evidence. T his sofrware can also be used ro
)tnlt'llll~ ,
· d-letrd web browser• compon ents. . • • • .
(tCO\'l'f t
Exam mer 1 s a licensed 1001 develope d by Foxron Forensic s
Browser Hiscory Examin er: Browser H,srory
Explore r, and Edge
C ipJnv and it ex1rJcts and analyzes web history. Jr supports Chrome, Firefox, Internet
fries. Internet
w:~\ro,~·sers. And it can analyze a lot of data type as downloads, cache data, and visited URL
by using
atiivicies in a specific timeline can be traced with web sire timeline feature. Data can be analyzed
.<.aved in the
various filrers like key word list and time-da te range with advance d filtering feature. Image files
sites stored
hrowscr cJche c.111 be easily shown in thumbn ail galleries with cache image viewer feature. Web
rent time zone
in browser cache can be reconstructed and analyzed with cache web page viewer feature. Diffe
data from
convmiom can be performed with Time Zo ne and DST Configuration feature and all obtained
1h~t' fe.uures are rt'poned.
ffK: FTK is one of the tools developed to analyze sy5tems entirely. It enables ro analyze
web browser
, Firefox, Chrome , Safari,
daia with its features. \Xleb b, owser hisrory is virtualized in detail. Internet Explorer
This software
and Oper.i browsers are suppone d. AJso, deleted web browser data can be recovered by FTK.
.tlso has a fc:arnre to report analysis resulrs.
Encase: Enc.1se system is an analysis rool developed to examine systems eatirely. It
enables ro examine
web browser data with its features. With rhe help of a simple script, all hrowser history,
cookies, and cache
/Chromium,
fib ;lit' copied into a Ille by usi ng 1hird-pJ rry software. Internet explorer, Firefox, Chrome
to recover
Opera Jnd S.1fJri are supported in Windows, UNIX and M.tc operating systems. Also, it enables
deleted internet components. Obtained dara can he analyzed hy filtering according to key
word and time
digital anal-
p~ramctm. \VEFA. NetAn.ilysis, and Hiscory Examiner are developed especially for performing
d examine files and systems. This
Y)ts of \\eb hrowsers . But, FTK and EnCase applications are develope to
software al so h.1s t·eatures as anaI}'1.mg · we b h"1story anJ ho1·ai,nc · anaIys1s. ·
7.4.2 E-mail
;·ndiail has emerged as one of the most widely usl'd communication applicat ion, used for exchange of data
. . . .
n alto c·irrv. ~)ut d Jta transactions. Due co an increased use o f e-ma1')s an e present scenario, us securny
h;u
th
E-in 1; b~~ 0 ~ 1e a _major issue. Nowadays, e-mails are being wed as the prime we-.ipon to conduce
a crime.
of viruses through e-mails
are / phi:,hing, lr.1uds, Sl'Xuc1I predation, sending spam e-mails, and injection
of dat.1
th~ft~mg th e n1Jjor crimes that 1he culprits carry our wich the hdp of e-mails. Also, different types
und of an individu al itself.
rough c.--m.iils nuy adversel y affect an organization's operation or workaro
142 • DIGITAL Fo
~,, ·h....ih.'-.r
. ... .l J'1~1tJ
~
,. I nr C\ hcrcrinH' tomes into existence, the lirsr ~rep taken is consulting dar .
. • • . a 1nve .
t~' N-. Difit.1I imrnig-J1ors c~llcc1. prrserYC, .rnd a1ulp.e e- m.11 1:~ 10 mwst'.~:11e ~ cnme.
For an cfncicn ~t1ga.
Jt'i..l'
. 1mes11r.,m
· · · nn of e-m.1ds ;1 wid· virit'IY of tools and p.1r11cular prou:durc s are med. In the t and
.· c • I . I
ss1i1)n, \\e wiil ~hcd some light nn the prol.°c<lures and vJnous rec rn1qul'S t iat are employed for anupc
• • •
0 .
cft'ng
·m,·'-"'tt~.m
· ·on ol· e-m.11·1s ·in :i parncu · I.1r crime.
· cie,11
tr.I• I J I . ·1 .
ih(n dr:tc.-ctives nuy Sl'tl t 1e t.1c t1c e- ma1 contam mg:
t. embcJJc:J J:n-a Apple t that runs o n rel'.eive r's compu ter or
rl·n·ive r's compu ter and
Active X O hjcc r. both targeti ng to extrac t IP addres s of the
2, HTML p.1gc: "ith
c." -111.1il ir 10 tht.· invc~tig.11ors.
7.4.3. 1 eMailTrackerPro
eMailTrackerPro examines rhe headers of an e-mail to sense the IP address of the computer that directed
the message, so that the source can be chased down. Ir can track numerous e-mails at the same time. The
geographical position of an IP address is important and crucial evidence for defining the risk level or legiti- ,
macy of an e-mail message. This tool can locate the city that the e-mail most probably came from. It rccog-
ni1.es the network provider (or ISP) of the source and offer contact information for further examination.
The real path to the source's IP address is stated in a rouring table, offering additional position information
to help find out the source's correct and accurate position. The misuse reporting feature in it can be used 10 1
make additional examination stress free. It checks the mail against DNS blacklists, like Spamcop, to addi-
tionally defend agai nst junk and mischievous e-mails. It supports Japanese, Russian, and Chinese language 1
junk filters in addition co the English language. A main feature of this tool is misuse reporting thar can
generate a report that can be sent to the ISP of source. The ISP can then take steps to take legal action agains1
the account holder and help put a stop to junk.
I 7.4.3.2 Emai/Tracer
EmailTracer is an Indian effort in cyber forern.ics by the Resource Centre for Cyber Forensics (RCCF), a
leading center for cyber forensics in India. It develops cyber forensic tools grounded on the necessities of
law enforcement agencies. Among numerous other digital forensic tools, it has established an e-mail 1raccr
lOol named EmailTracer. This tool tracks the initiating IP address and other particulars from e-mail header,
produces 1horough HTML report of e-mail header analysis, discovers the city-level particulars of che source,
plots path craccd by rhc mail, and show the initiating geo~raphic position of the e-mail. In addition co chese,
it has keyword s('arching ability on e-mail content together with attachment for its classificacion.
7.4.3.3 Adcomplain ·w
Adcomplain is a tool for rcporring unsuitable marketable e-mails and make use of net postings, along WI
chain letter~ and "make money f.ist" po~tings. It robocically examines the message, composes a misuse ,c~rt~
a_nd mails rhe report Lo the offender's internet service provider by carrying out an effective h~der exami;
t1on. The report ~hows the support preccJing the U.S. Federal Trade Commission.Adcomplam can be
back from the command line or robotically from numerous news and mail readers.
ANALY:;.Sl;,_S_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _:_•_!1~45
~
4 Aid4~~il Forens~c . . .
7,4.3· . f rensic 1s an e-mail mvesugat1on software for fi . I . .
·d4Ma1l O I • ·t I . orensic ana ys1s, e-d1s(overy, and court c;l,c
A• . upPort· c 1s an e-ma1 re ocauon and cranslari I h• h . . .
roeced1ng~ s O tlook (PST, MSG files), Windows L' o.n too ' w ,c suppor_ts various mail formats
P thcr w11h u . ive Mail, Eudora, Thunderbird, and MBOX. It can
,ogt through mail by date, header content, and by message body conte11r M ·1 c Id d r.1 b
lore d' d~ h . . • a1 10 ers an II cs c.an e
~p ed even when isconnecte rom t eir e-mail clienr, together with those storeJ on CO DVD USB
Jfl~nag flash drives, floppie s, portable HDDs, and so on. Aid4Mail Forensic can hunt PST files ~nd all :i,ain-
dnv~, •t c mats by date range and by keywords · h . b J • •
ined ,na1 ,or . . . m l e message o y or m the headers. Extraordinary
t,1 lean operations are ~am~med. le is ~pable to recover the deleted e-mail from MBOX files and can
~ b k deleted e-mail dunng exportation.
bring ac
7.4.3.5 Abu~ePipe . . .
A}JuscPipe examines a~us.e obJcc~ion e-_m~ls and regul~tes which of ESP's clients arc distributing spam
grounded on the marer!al me-mailed .0 bJectJons. It roboucally creates reports recording clients dism,peccing
E.SP's suitable user poli~, so th at arno~ to. c~ose them down can be taken instantaneously. AbusePipe can
be configured t~ robouc~ly answer r~ md 1~1duals reporting abuse. It can support in meeting au thorized
respansibilities like reporting on the clients linked to a given IP address at a specified date and time.
7.4.3.8 FINALeMAIL
~INAL.eMAIL can bring back the e-mail database file and finds lose e-mails that do not h.1ve data position
tnforma1ion related with chem. FINALeMAIL has the ability of reestablishing lost e-mails to their ~oun.:c
s~are, reobcain full e-mail database files even when such files are criticized by viruses or spoiled by uninten-
tional layout. It can recover e-mail messages and attachments t.·mptied from the "Deleted Items PolJcr" in
;-.;l'tscape Mail, ~fo:rosofc Outlook Express, and Eudora.
~
!1.1a,I..mJ hll f ll'K · .1Inng w111
· Jrtc:u1,·l's · I I·lg,1 I Pt<l',l,,111ion
, .
offacrs the powl'r to carry out cont1:nt
3
1 l ·t · 11 All
I f 111 wirc<l or wirclc~s. .nrrworks.•. . . proto n;iJ\ 'I1·
~o Isand \t·rv:
.
llh1 re ,u, J111g ('Ill prrl',ll'lllfCl ntcflll'l r.1w l ,llJ ro .
,~.. muwJ .mJ n:built JI(.' ~hown in l'l',1J.1hlc prrn·nta110n 10 ,he l~Scrs. J he otl1ermd1v1<l11al1ry of the H;'t'\
:lw thi:- imp('lth"I.I r.iw d.tt.l fib l'Jll be: dirndy Jc\cribcJ and rrhutlt. It supports ca\c managcrnrnr funl . 11
0
ihir,,ugh ;nt~,rnlJlilln wgl'thc:r with D.1tt·-1imc, Uc~tin~tio,_1IP, Sou rce IP, Source MAC._WholS, and (;'.' n,,
~bp intl'fr,n 111 n purpo~rs. Ex.unining and rebuilding ol vanou~ Internet_tr,1ffic types which cornpri\c\/glt
\P\)i'.\, ~\ITP, 1~1AJ>). IM or Ch.it (MSN. ICQ_, Y?hoo, QQ,_~~ypc VotCe Call Log, ~T Char Room, c.:::1
IRC Ch.it Room), Webmail (read and \cnt ), file framfer (FI P. P2P), Telnet, HTTP (Content U k,
I
l:.,"n!o.1J. \'"i,ko Streaming, Rcq11c~t), and Othl'rs (SSL) cm he achieved using chis toolkit. ' PoadJ
p:r .- l di
t • at: '! Malware Han ing
Ma..lware Jnalysis is a process to pt'rform analysis of malware and how co study the components a n ~
of mal_wa1e. l_n this se_ct '.on, it will use rwo methods o~ mal~ar~ analysis:.(i) static an_alysis and (ii) dyn::~;
A,,~y~1s. St.me analysis 1s a method of malware analysis which 1s done wHhour running the malware, whil
dynamic analysis is a method of malware analysis, which the malware runs in a secure system. Mal\\are
analysis is important, si nce many malwarcs at this day are nor detectable by anrivirus. Now viruses are mad:
"ith special abiliry to avoid detection from antivirus. On this research, we will focus on implementation of
malware analysis using static analysis and dynamic analysis method.
Stacie analysis is a method of analysis of malware that is done without running rhe malware, and analnis
u~ing this method _is much_more secure rhan _u~ing ~he method of dy.nami~ anal~~is. Mal_ware analysis u;ing
the method of srauc analysis can be further dmded into rwo stages: (1) basic srat1c analysis and (ii) advancrd
~~Jtic analysis. Dynamic malware analysis is a method of analysis of malware by running the malware. To
make it more secure, malware will run inside a virtual machine, so the malware will nor damage your
computer system. Malware analysis using the method of dynamic analysis can be divided into rwo stages:
(1) bl5ic dynamic analysis and (ii) advanced dynamic analysis. Malware analysis method can be seen in Fig. 7.16.
- Basic static
analysis
~
- Static
analysis
_,.
Advanced
4 dynamic ~
Malware analysis Malware
analysis ► ~ analysis
report
Basic
r+ dynamic ~
analysis
~
Dynamic
analysis ~
.... Advanced
dynamic
analysis
..
Figutt 7.16 Malware analysis method.
:-.. • :.1~
.
-------------- ..... 47
~A ::
L:
YS I
~S= = ~ = = ~-----
AAN~
_1 Basic S ta ti c A n a ly si
I ,
s
t . . I .
i.~called as ma ware with
5
7· d .rn starrc a na ysis carried ou rest111g ·1,hga1nhst
. which pr ogram . '
d d ectton of packed or O bfu scated ar
' .
· a
basic merho. . . . ore over also do lllg as Ill
r he e scanning usin g ant1
·ng rh II
v1rus, m
d ·n g an analysis o f th e st . ctureg,oan
ru
et
f p bl e executable which is owned by
A
J01program. s we as con u rn orra
h
re
,he program.
a n c e d S ta tic Analysis
.2 A d v . b h
rther an ayI s1.sw1 11 eundert aken of t e meth od of static analysis.
7.5 hod o fstat ic analysis, fu
. IDA d ' bl
m er.
In rhe advanced
.
met h . gs, 1·mked libraries and fiunction as well as using isasse
. ain st r e st ri n
virh analysis ag .
i
s
namic Analysi
7,5.3 Basic Dy
d
l be bui'Jd · uaI mach'me rh wi.11 be use as a place to do af
wil vm
a . ar x and · · process o
amic analysis '
in dyn I
ysi sa ndbo momcorrng
The basic method In ad di tio n , malware will be an al s using ma ware
. are.
ma/ware analysis ckers data made by malw
ys is pa
ma/ware and an al
.
c e d D yn am ic Analysis d k f dynam1·c analys is
7.5.4 Advan ic analysis, further
b o
analysis wI"ll e un erta en· d s sysrem.
· on a wm ow
nced m et h f
od o ldy n am
the regi stry and do an an aJys1s
adva
In die · is
analys
d
· h d eb uggm g on ma ware,
met ho s w 11
rain a
re A n a ly si s Report analysis method, we will ob
7.5.5 Ma/wa and dynamic
an alysis using static analysis
alware
of m are.
From th e. result s. o n th e charac teri stics o f malw
report o f rnform
arion
aterials
io n's go al an d scope, rhe m
1he investigat ding on rhe
al evidence dep
end e ca sks to perform. Depen
g d ig it needed, an d th ify rour
Examining and
an a lyzi n
amount u m ight have to mod
f rh e in ves tig ation and the evidence you find , yo
on 1he nature o r forensics t.
gin a compute an at some poin
ocess. Y otJ be fines investigation pl
of dara 10 pr es tig atio n plan that de
an in v
case by creating
within your
Network monitori ng software or abnorm al user behavior are two ways to detect an attacker
network, but new ma/war e dubbed "skeleton key" can evade both.
--Sara Peters
2. Presrn•ation: Securing and isolating the stJte of physical and_logical evidences from being altered, \Uch
JS, for example, protection from electromagnetic damage o~ 1'.11erfc~encc. . .
3. Collection: Rt·cording the physic.ti scene and duplicating dtgttal evidence usmg standardized rnciho<l,s
.md procedures.
4. Examination: In-depth srstenuric se.m h of evidcn(e relating ro the ne1wo 1k at~ack. This focuses on
identi~•ing and discovering potential evidence and building detailed documentation for analysis.
5. Analysis: Determine si~nihcance, recomm1n pJckers of network traffic data and draw conclusions
based on evidence found.
6. Presentation: Summ.arize and provide explanation of drawn conclusions.
7. Incident rcspome: The response to attack or inrrusion detected is initiated based on the information
gathered to \'aJidate and assess the incident.
auacker rnmes ro know th.u pa~word comiscs of five alpha characters and three numeric characters, thi:n
he/she can ere.ire guidelines whiLh will, in turn, remicr the attempts conducted by the program which wiU
follow the specified criteria (e.g., apple123, six789, etc.). This strategy constricts the numbrr of possibk
pJmvords and speeds the cracking prol"ess.
Also. p~ssword-crac~ing programs have a genuine use. An employee might leave a company or die unes·
pecrrdly w1tholll revealmg passwords that were used ro safeguard important files, which other employees
now neeJ _to acce~~. Even if they are still around, sometimes employees forget their passwords. PrograJll5
markcteJ tor gcnume purposes are typically called "pa~ord recovery programs."
~ will not be able to know thar a user h as entered the. .precise and accurate password or nor.
.
he sys rem d ' rr ords tn addm o n ro their logon passw ords used for
else r . mos! peop le have_ nume rou~ rnere nr passw
entry to restn cted webs ites, and so on. Rath er than reme mber ing all these secon dary pass-
1,ikewise,
·1 access , users opt to h ave t h e syst em " reme m er tI1e password optio n. Since comp uters have shor t
b "
t-fllal d ·rn a file some wher e. All a cracker has to do
d" d b h
words ' .rnany these "rem em bere passw or s must e ware ouse
In a lot of cases ' passw ords are not ware hous ed in
rnernories'. his/h er impa tient linle hand s o n that file. . a
. o acquire d read , e.xcep t tn case~ in. whic h a .careless user creat es such
1s \:un re:xt file rhar ch~ hack er can open an.
appl1cauons. Typtcally' stored passwords are
aP • rently recor dtng passw ords for vario us services and
file, pers1s
ed or hashed.
encod
8·2-S So · I E · eerm
· g
c,a ngm . of
th e oth er attack types , socia. l engm . g does nor .-acr
. eerm __r. ro a teehno1og1.cal mam. pulauon
Contra
corn srino
does not need much technical skills. As an alterna-
t>
cornrn:ngd•.neering techn iques , is che so-ca lled .-nl.~.skillf./l~.g.. an attr ac~ or influential perso nality or a
n 1no- a h . . r;-.:
Soc·a.1 t>'. ur o ntattv er presence). W,.rmaa. on 1..- f
uy fflog a o hum an comm u-
_.J__
. , eng1n eenn
n1cation v
. g .1s rererred to as acco tll!~ Nl•i ll &act
. iou ca h. k f social t'ng·
n t m·o ..,-,·~• •---...•, llll• d med con pafo rmcn . They gain
---
152 • DIGITAL FORENs1c
users' or allmini!ltrators' trust, and then use this trust to find our user a~co~nt n~me~ and pas~words or hav~
the innoctnt users log them onto the system. As_it is ba~ed on convmcmg a_ ega nerwor u~er to open
the door, social engineerin g can positively get an invader mto a network th at is protected by high-security
me,\Sures.
.
8.3.2 ApP1·•cation
. Exploi ts
Applicatio
· program s. These
n software exploits are those that take benefit o f thc Oaws o f spec•"fjc appt·acanon
f~ulu I
COrnp arc call~ b ugs. s·1m1lar
__ .J use app1·acaoon
· to protoco l exploits. ·mYaUCJ'S · abuses toob tam . 'II
I ega access to
. service
Utt"rs or n erworks or to crash or block up the systcmS to reject . to oth crs.
154 l~ t'3tf .:\ L
•
1. Buffer o,·erflows: Numt·r'-,us nm1u.1l s.1t~·ty dum1's .m: i~1,,111hfl,d l'I\ butl:•r '" nil,,,, ~litdil·:-. 1' .
lWt·rtl1\\\~ ol.'.'-·ur \\hc'n tht' numh--·r nf hnl·s or lh,lr.K{t'f~ int'Ut ~,w:- bl">'''"-1 thl· ll\,l\imun, I\ 111111\-r titll'r
•
.tt:,xpt.thlt' ~y the- prnp .tm. .
2. l'ne~pected input: The u,mputt·r l'fl'~r.ttnmt·r mi~!·, 1\\ll t.tkl· st,·p), ti' '-1~·-.'-nhl· " h.H h.,l'l't'lh if i
11
liJ input is p.b..-;n.l. This mi~ht cmst· the pwt~r.1m hl n .,sh ,,r Pj'l'll ,t " ·•~· ant ,, tlw sy:-trn1 . '-I•
J. Confi~urat:ion bug..-s: Tht':-t' .in.· 1wt tntl\'• bu!._")\ . .-\s ,Ill .1l1t·rn.niH-. t hn·.
, lfl' '-·,,n1..hh t, uf H'nf1 11
,,
,__
r·
Ill•• th
0 •
sofcw.m.." dut lc.•.tH·s ic nilna.1blt' tn cir1..ul.t1inn .Hhl ,ii:-uib11ti,,n. ' c- l'
The overflow of tr.1ffic come-s from the mailing lists ro whid1 the Yictim lus accidentally ht·en ~uhsl.:'ri1't·J
' ' (S· n llrl' ,sOl krt I..,ya) l Ol'\ 1101 l'~\l'llll, 1 y pit VUI
I · II ... r 111 1' ,
•r pr p111 'I link i11111 . . Ii rn1•i11•·
. a jllljH1l.1r ~l'.ll'l • '' 'SSI
un· l1na11,c it i~~l'tllfC.
I'•1'!· of111,111•it1 tlw-muldk .tll ,llk. I hec111111n1i1111 appr.1r., to rlH' vi(lin, 11\rr to lil· ~n
~,'.,~:. ,,,,,lik111 i., th,tt
th t· M'l'ltrl' lllllnl'l rion i, lo a din,:rrnt .,i ll' rl1:111 rlu: ()fl(' thl' viuim think \ "" or ~lie i.~
II
,111ll'llit1 µ Ill,
J, S1.Kk owrllows
2. l k.1p m allows
when a program is run.
Thl' ~t.ll k and till' hl',1p Jr e rwo pam of thC' memory organization 1ha1 arc owC'd
in the heap. A particular
fonl 1io11 l,,lh .m· ~,orl'J in dw st.Ilk and dynamically a~.\igncd variables an· ston·d
,111 rnunt of llll' lllllf)' il, .11loca1ed to the hulfrr. Hacker
s can use buffer overnows in I he hl·ap 10 ovcrwrire a
will be openc<l. If this is an
p.1sswnrd, a lill'n,unc, or other J .11,1. If the fill'llam e is overwrirtt'll, a different file
l'M'rn1.1hk- ltk'. rnJt: will he run that was 1101 planrH'd 10 run.
l. ATCP/IP rnnrwninn is rcrngnized with rhe cargcr IP address using port 139.
2. Thl·n, the progr.1111 sends dara using a Aag called MSG_OOB in the packet header.
,l. lhi~ ~ag instrurrs rhe compurer's Winsock to send data called 00B data.
4. llpon fl'l-ripr of this fl.1~. the targl·ted WinJows server expects a pointer to the position in ll1e pac.ket
the packet created by
wht rr th\:' urgent dat.1 rnd~. with normal data following, but the 00B pointer in
\\'in Nuke poi111s to rhc end of the frame:, wi1h no data following.
156 • DIGITAL Fo
~
8.3.3.2 Router Exploits
M:iny of the new cheap routers intended for broadh:rnd connections come with tkfuult .i<lminis
'f I I . . d tratorpa~.
words that can be used on any of the vendor's devices, 1 t 1e at 1111111~1 rator ocs not change the
This means a hacker with knowledge of the <lcfoulr pJ~sword rnul<l log 0 11 and nuke changes 10 t~a~w~rd. '
table or routcr_configuration. This differs fr~m _mo:,t o~erating sys~e_ms that do nor_n~me with a dcfaul~Uting
wor<l but require the user to ere.He one during 1mtallat1on. In a<ld111011 to the :idm1111mator passw d Pa.is.
. <l r I _,. or , so
routt'r vendors have created special so-c:illed back-door pa~swor s 1or t l l ir systems, proposed to b Ille
the ven<lor's tech ~upport personnel, so that if :in adminimator forgot the ad min password, the vcn;o~sccl by 1
help the administrator get back in. Of course, this system coul<l also he misused hy hackers with kn owed clouJJ
of the secret master p:issword. gc
Internal IDS
~I
~00
I
I
I
• ;¢-.~]
.I •l
,;
Workstations
. As di~nissed in e-arlier chapters, all kinds of cybercriminals committed many diffcttnr types of~-
cnnw, ~nmc of whom have very liccle technical knowledge or skill. Included in this narrow definition~
malicious artalks dc-~igncJ ro crash computers and cong~r network~, even when no acrual "illegal entr)'
c.1ke~ plJce.
Fvc.:n chough incrudns and acrackcrs need not necessarily understand the trcbnicaliries of what they 2JC
doing, it i~ important for cybercrime invrsrigacors, who build ca~es chargingtanh~ aa:esl or &,each
Kf,:.O~R[_N_s_,c_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
_ _~-~1~5 :;_7
Protected switch
A=-?.. : I
__.__
- ~
ner.vork, as ihe~e anacks overload networ~ resource~. to make rhe n:rwork inaccessi~le to _genuine Users. It
is more imponan1 10 be exact while referring 10 prerne compuier ~rime~. When no ,~rrw,ion occurs, Dos
arrackers ~hould nor be referred IO as in1ruders. Similarly, nor a_ll mtruders c~n prernely be categorized
attackers while those who gain access and then abolish information or plant viruses are correctly named:
both names. y
Daemon (or agent) Announces itself co the "masters" that have been predefined
The rea~on for arranging rhe components of this model in pyramid form is char one attacker concrols
manv · turn, contraI various
' ,~ h'ich, 111
. , oth er rnd:'tcrs 1 · other daemons or agents, which makes u · co
· easier
dt\abl~ or deactivate the system attack which is nearer to the top of the pyramid. The ropmost level of me
pyramid_ha~ tht' lea,c syHems to be dealt with. If che masters are deactivated the agents and their guiding
forte ~ohware will not he a0Lie. ro
.
•__ .J •m a py,-mid
t'11_nc 11·011, because t h'1s model's components 'are systemauzcu ....
.
~ rm, '~1th one Jtlackt·r admrnist('nng numerous masters, which in cum control many agentsldaemons, fl
1
l.\. Jbo likely th Jr die agl'nr~ anJ thei r guiding force software will not be able ro function if the masters a,t
disabled. The moM rfticient di!labling technique is to find the arracker, thus disabling die entire strid of
artJck.
Accidental Attacks
s.6.4
·m~, intru5ioru and atw:k.s may real!:, be u::in-:m.ion.~1 We ~o k::cr...,· t~1 r::a:::, T.:-o;,:i r.cr~ 2r.d
So~'11 ~e wrincn to ~pread therrud·.-es by getting into L~e ,·icti.m's adc.r~s book a::d ser:c:ir.g ir.feaed e-:.:.d
,.o,!?U ( d h Th h L_ .L . . __ :,. r , • •
~I the :ic!drcsses roun u.ere. .e ~r w .o appears w nave w.1t u.e Ylrus na e-n-...w u t:eq!l..•·:m:,- a •;.:-1!:n
~ h- aruck hirruelf/her!>df. In numerou s~. huge quantitjes of viffi.S aru.cb are mrrodu~ed a.:.ci:.!;:nt~;y
• CJ ·knowingly. "v;'hen a lov.er stare of obligation is present, some aru ate sti:.J c.cnsicered crir.i_i.r.21.
0
. - d :o an
.
or unle is \·ery impan..a.nr ',or .mv~ugators to be aYlare of uhe lwr'.,_,le '
--•...,,J.. rr:em.aJ state m.at . s~1::~
1s
demenc of each offen.se to be char?e~: 1:1e cri~inal ~ corn:r.on1;,· refers co a d.ei~~c b·el _o[ re:spor.s;b?r: •
t/ilt applies, if no level of mpom1b1lity 15 specified_ Cmmem1onal att..cks can be Jt.5t a.s cr.acal a5 o.u:wm
onc:1, and nerwork security personnel must be just as alen in taking act.ion a.::oairm d:em.
86 6
· · Preventing Unauthorized External Intrusions
~lltn it wm~ to nerwor·k secumv · and a
. .•~ues, execmaJ •muus1ons ---•-- • f
we DUJOr concerns o mmy
~ arr .L_
<.ompanit~. The Web \Crvc.-rs of pr~mincnt organizations, such as \'ahoo! and Microsofi. have bttn h.iclcd_
11~6~2__:•~_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _D_IG_IT_A...:.L..:_:FOR(N
..:. ~
..
Attempts to peneirate sensmve government net.\,orks· ' such as the Pentagon'sdsystems, occur on a regu!
. T I1c r
has1s. . d , b , D00S attaLks when rhey crash servers an prevent lntt'rnet use r :tr
I rant page news 1s ma e ) . . h () I
. . Th e goo d news abour cxrernal intrm1ons is th.n t e area s r 1at must be co11trs rroll\
acc(:ssmg popu Iar sites.
· · I k Tl .
h kr ro 11ed
·ue much more focused than mtema auac s. ,cse a,c · points of
·. entry to t e networ rrom
. the 0 uts1de.
.
· Unaut I,onze • d intrusion
· · can ""lso be J,,c-_
1 11 ed a~ anack.s in which the attacker g.
c ts access into the ·S)•si e1n h
di •· ' • . . .
means of different hacking or crJcking techniques. Thi~ type of activny ~viii be performed by some Otttsid!r
who wants to have access of the system in order to use I t for some negauve purpose.
.
,t ·' " '
h,'" ,I II I\ I II I h l.-1 ' 1h1.111\\ ,h 1 , · , \ I I I \ IIll I 1 1 Ill IIHI 11· I "I I h ' I\\ 1 ,d, ,I Ill I \\ Ii .11 dll' .II I.II l,1 'I
'" · ! .. ~- \ \ , ·" I\ , , I ' I •'
, , ..... ~-. ,\,. 1• :, !' n.",1, ", " d,, 1'\ ,~ .111.1. k,. ~, .11, "1111 1.11111 ~,,, ,, 1,; "r. "" 1,,· .11 "" 1,,, .,"" ,1,,,, i11" a""
:: ... ',',',,,:, . ,,,:\I,' ,,t 1h, \\\,'I,' ',,q,, 11,11, I\ I'•' ,,t' h,h k',111,11 k,, ii1111,:1,11g \II\ 1.11 l'IIJ',i11,·1·1i1q•, .111.11 I,,.
'.·. ,, : !, ,,, .: \\;, .. ,,,,,\ 111 \,lkfll.ll,l .11:,1111\1 1h,• ,111,h k \\l11·11 ''"' h .111• ,I"'"""' 11111l,·1, 1.111,l111r. of hmv
' ' I •,• ,,! ,:,,.t. \,. \\," \\
\ ... . t
:, ,, \ ,, ..1••, ,,,,, 1h, ,, ,l. tkl\'1\1 1111111,11111, ·""' ,111.h k, 1111,, 1l.1\\ili, .,ti,111,:
l. :',• ', , ',,., .Ill h l,_ ,I, II\ 1\1, ,
\ .,\\,\ ~ !,': , .,,, ' I,\.., ,Ill\ ,,,h.-1 t, 1, 11,;, ;,,,,.,ll!\·lli1II\, l'"'\('l\l~ Ill.Ill)' l h.1lk111w~. lhr li, ,1 d,.,1
,Pl,\11 , 1, , 1
., ·;:.: ,, .: ..... ,\ "' 11 ,1:1;, ,l.11.1 ,11,1i;11i: I '.-1 1 , 11.l111i-: ,111 dw th' l\\1111, u111fig111.11i1111 ,111,I ~n 111i1 y 111e-.1,11ll'\
"\, , 1'·, , ,, 11 ),1 ,, ,I, I'I,,,, J . 1h.- ",. ,I 111.11 11111 , ,11 ,, 11 h' .111 ,l,·,i, 1•,l 11.llli,· ,l.11 .1. I; 1 :.ol\'l' this i:.,lll'. I hr IH'I w,11"
.l,:.~ :,,.,.:.,,, ,!1.,,1\,l 11,, 1 'I'·"' I'•'" ,11111,1\\,,1\.. ,k,11,, i11 11111hil'I,· l'l.1,t·:. ,iftlw m·1wu1I,,.
\ \ \,· 1,,! " 11, 1.1,\.. 111 1\;,· lh 1", ,, \.. I,'" 11 '" ,, 1h,· ,l.11 .1, ,1111·1.11 i, 111. I ),11.1 ,·,111 d.11 i1111 r.111 he ridwr \ ,111\,11 or
1
;, ",\'t :~. l,,, 1k· l.11,.1 ' .1,:, llllh ,1.11111 ,h,,111.I 1,,· l, 1~:,·,t .,~\\\·ll.
1, 1
\:\.1;.,1,\.., 11:u, ,·1hl'\'I 1h, 1, .11l,, . 11,11.ilh 11,1111~ .111 SSI \ 'l'N 111111\\'dinn. For .a m·twu1I,, invc:stii~•llm,
,\• ..1.-l.t,,, ,\'hi \"'" .1i-· :-1 111, 1,,t,I<. "''"' ,,·,. d,,. ,l.11.1 ~l h .1111 i, 111H ,l\,1il.1hlc. l\lorc 101~\inl~ ;md ,hl,litinn.,I
,'.-.:.\.·i: ,\i.,,1l,I k 1, ·11,,1m,,l m ,,1,k1 "' ,l.-1,·1111i1w dtl' i11tll11.11,·,I d.11.1.
\ ~,,,h,1 .:.\.In ,,,n.11 , h.1lk11,·,· ,, ,\.-11·1 111i11i1w dtl' M,111, ,· of ,111 .111.1, "• ~inn· ,II\ .au.ad,,·r 111.,y usr ii wmbi<'
1:·~:\1:,-. ,n i111,·11\h\li.11.· h,\\;·1,1 ,-..-11~11111 ,II\ ·.:11.1,k. 1lf ~i1111'lr II\\'~ ;I 1'('11\\ll( plllll,)' M.'IVl'r. This 111,lll·~ i,
,::,,, n'.: I~'' .\ n,'l\'1'1\- "'"·,ik.•"'' 111 t,,ll,"' ,Ii,· .11 1.1,l-.l·•~· 111i1:i11.1I .1,l,lll·'"·
IA ..·~ ,r:,, ,1'\l:-hkl,1111'1; ,h,,,· 11'1l1\"l\l~. the 111.1i11 ..,,k ,if ., 111'1\\\ll" forensio invri.1isJtor i~ h> iltl.lly,c
~.~~11:·~ 1-.1, \..,1 ,·.i,,rn,,-. "'"'"" .,, I\ ' \P t'il,~. h,·111, l''"~l'III in 1wtw,HI-. tr,lllk whkh 11hnulJ he l'x.unincJ
• \, ,;:1- l-.:i ,\I,' 11''1 h111n,,l 1,,: l'n,1,,,,,1, m,,I. 11' .,,Id,,·,~,·~. p,111 l\lllllh,n. tim~t.lnlfU, malidou, r;tt:kru,
1··'._'' 1, :1,,I 1,:,,. l \ ,·1 ,, :,11 h , ., , ,11, .11 i,,n ''"" l't , · \\'1:.i,111:., .111J ''l"-'r,11 ing S)'\ttm "'niuns. This inform.uinn
1 11
.
• d,', I lh'II\
' ... ~ - ' \ 1r\ • 1',ll I'I~ .
, I,lll• ,'t\'1'l I\\"-'' , 1 11
1•~6_:4_:•~_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _D_
IG_IT_A~
l FORE
- ~
f.:.itt Collecting Network-Based Evidence
Th~ wlit.1ry, rno~t cooperative network-based inci<.!en~ m ponse ac'.ivity is 10 sec up com_rut: r systerns
th
do nothing but capture or gather network com mun teauons. Capturin g network communications
. I . . is a . at
anJ essential step when examining su~pcctcd crimes or exp 01tat1ons. . ser1olis
In chis chapter, we demonsrr.ite how to capture network trafGc the <l1sagreeable and hare metal
'W
wi th software like tcpdump and Wi nOump. We also discu5S how to assemble a healthy, safe,
ptot ay,
network-monitoring system, and conduct 1u r 11 content . .ng of networ k tra ffiIC. ected,
monitori
DIG IT AL FOR(~•
•~s,c
\. \.Tr \"\ \'< ~~.i RA\t JnhllllH~ rb.· ~' ~t, m rnnnin~ dh· 11hltlitM 1-h,,11ld he .ll k,ISl ,l l\'11ti1101-c]
·.-., :: ,, .·: .~.\' \ ~:!. ,'i ~~:::h, r. \ \.\~,· ~11r~ th.n the ~~:-t~m h.1~ .11 le.1st 256i\lB nf ll-\i\,t. Ii ·~~1
.. ,:~ , -...: ·:. :·.• •' , ...· :: :·( -~l ~-.•~t r~ h.:tnft ' 1'(\\h \ Hll) X\bh,\:1)1111). ,l RAi\t ,llll()llnt of 512MBt C
·· .' ·: : ~..:-.-.· :..:: ,·.:,:,•-1. l:1 ~!~,, ;1. t ht· m,,r,· R. \\ \ it h.1,. di,· 1',·ttcr the nctworl-. mnnitor will p,·rfor or
: .-.:•:. ~ ~ /~,•w~ ,..: :·.; ~.:::;_(:,,,,J ~-~:-J\\.lt,· ,,,nti~m.ui1,ns th.11 )'tHI c.m 11~e .,.~g11iddincs for your n,(:::
1GB or more
' E .:.:-J .i:i,-:-: ~-:-.~ .:.:::,• .::-.t \,:· h.i.:-J .:rin· sr.1,e y,,ur sysrem requi rt'S depends on the specificity of your
•·:-:. :- : --:- .::~..: ::-:: :_-:~,•:..:-.i '-' I r..:!'\,·Nk tr.utic (ro:.5ing che ohst'r\'t'd segment. Hard drive space is gettino
~-~--: .-~- ,,, ,:· ...::-c:: .:.::3 ~~1 .u l:2Sc J -iOGB driw nn .l bpwp and 80GB drive on a cower. The botto~
-. ., ::::..: , ,::.: /.,.::J :,;~...1 1'\: dri, e. )~~u c.in oYerc<,nH.' mmgt' insufficiencies by repeatedly cransfer-
• : ::. ·, .• • ,.,,:-:.::-: ~.:.~ t...' .:.i e:1.:.:-rn.;.l n1t-diJ. le is !tOL)d prJcti(t' co transfer the binary files to an external
> :...,;.: :_ -;.' '.:.: ,•~ ~.2:-2 ~: :,·.: ~ril~i.:Jlly tor d~pli"'Jtitrn. in CJ.Se of any emergency.
:3 5 .!. :; C'"..=:-s·r~ A_cprcpriate Sofnvare
:'.·:-· ·- .-.. ·: :-::,1.:.:·:~~-....:: .:.!:.:'.~cf~· in J,i::umul.uin~ .l nerwork monitor is choosing its software. Monitoring
: ·,.· · ~ : :- ..: ,·!: .. :,•t cf :::,•~c~. J::J ~ l,...i mif_ht neeli different tools to meet different needs. You will disc0\ er 1
·. - : -.::..-·, ~- ~ ~.,·\ ...·..:,::.:~.: n~rwl, rJ.. rr.1tr'i ( J.\ \\t'II J\, or bmer thJn, their commercial corresponding item.
:-: .., . ~ .:. ,,·:--.:::~r..-:J :,. .,,:~;::..:.::er.iJly lt'J\'t' hehind free milities, when it comes to exJmining and under-
··--..: ·; ::-: -.:.. :2 ::.,,::~.:. E..i.:h 5eni.:e ~et'ms to otter something the ochers do not, so you should know
· ~: , • .! :,-~ :,, ;t: ..., _: l,i ,l1~:- r.,•mork in\'t.·srigJtion sofrw.1re before you obtJin it .
'
•=--:~: •
_:: !::-:.t ~.:::0:-s --
: t.....i.r "-m .1tre.-1" 1· sof,nun: you choose:
h'ch
.,
l \.,..... - _ .... ;,--:.::--1
' . ~--::-: . :.: __.:c,~
. ..
: ' -~-· ~ ...--~~:~
K FORENS IC
~ • 167
the Network Monitor
4 Deploying
B.B.4· ,cnt 0 f the neMork monitor is mayhc the most • . .
111c pl:icen dcvi1..'CS and network technolo l'k . impor~~ltlt 1ss11e in setting 11p an invc~iig.1tion
. ,. Newer nr•"s
gy, 1 c. network switdws, YI.AN.~.•.1111I m11 Itip . .:
· I•c l I.11.i-r.11c.
s)•stcll ks I1JVC er,"ated ·some nt'w ch·1llr
· r .
ior invt·1111gators..
· r1VC1f • I f k. . . ti'
cop1~e 4. The comput~r and the data _on ir mu:~t be protected during the acquisition of 1he media to ensure
data is not mod111ed (Use a wme blocking device when possible). .
1ha1 Ihe .. . . b d . of the
Rule 5, The exammat1on muse e con ucred m such a way as 10 prevent any modiFicauon
. . .
evidence. maintained to provide an audit log of
Rule 6. The chain of the cusc?dy of all evidence must be clearly
ight have accessed the evidence and at what time.
whom m
~ Investigating Routers
investigators as
During various inciden1 s, routers .play many different roles. Routers can be tools used by
nerwork
,heycan be 1argets of artac~, sreppmg sr~nes for ~ttackers. To allow investigators to resolve complex
incidents, routers can provide valuable mformat1on and evidence.
examined in
Rou1ers lack the da1a storage and functionality of many of the other technologies we have
previous chapters, and •~us 1hey are les~ likely to be the uhimace tar~et of att~cks. During network penetra-
rourers, such as
rions, rou1ers are more likely to be springboards for attackers. The mformatron stored on
first step for arcackers
passwords, rou1ing tables, and nerwork block information, makes rourers a valuable
be111 on penetrating internal networks.
asic command, enable, configuration, and interface configuration. The mode, which allows
you to display
11 !_
7~0_:·: .__ _ _ _ _ _ _ _ _ _ __ _ _ _ _ _ _ _ _ _DIGITAL FOR-,
_ _-.::..::
- t ~5,,..
~
. . . . Jb,d f
u 111figu rJt1on ~,·11111~,, Vi b:t\lC mo e an ) e ·111 I1 You arc in that mode.
d You mmt enrer enable rn0 d
• fi · · d ave dwm to
NYRAM -,·1 , c, b,
rntnini; >tn,1blc ro modify co n 1gura110n setungs an s . ierc I\ an enable ;
pa~,wo1J
:\!)~U1.:iJ1cd with rrivik-ged level aCLCSS.
L
~ ~ :- -- -- -- -- -- --__ __ __ __ ____:,___.::._:_:.
• 171
oRK FORENSIC
n Incidents
_11.2 Recovering from Routing Table Manipulatio
8 and reboot the
attacks is si1~pl~: Remove unwanted static routes
Temporary recovery frot~ rouring table
ever, prevencm g th e attacks from occurring. m the future is a bir more difficult · AC u can be
r How d pro_co-
route · . . source addresses. However, because some routing
introduced to ltmir route r up ates to known-goo~ l!sts
ofing AC u can further limit exposure, but th~se
cols are UDP. these addresse~ can be spoofed. Antt-spo n
foolproof. The roun ng proto col chosen should allow for authentication, and the authenr1cauo
are not
should be enabled.
Key Terms
• FI'P account: Used 10 uploaJ and downloaJ files
ro and from your Web site. You have unlimitl'd
e-mail, Wt·b pagt·s, and ima~cs . Sec "Monthly
Traffic,"
access to your account 24 hours a day. You will • C2 att.1ck:
Sometimes wriucn "C2-a1ta"k"
-
need to have FTP client software. Abbrcviat ion for command and control allack
l ,
• Acti'Yc attack: A form of attack in which data is Any action against any dcnwnt of the enemy';
actually modified, corrupted, or demoyl·d. command and control system.
• Adapttr: A device that serves as an interface • C2 counte
rwar: Presumed synonym for
betwee n the system unit and a device attached command and control countcrwar.
to it such as a SCSI adapter. Ofren synony mous • Bootstrap: To load
and initialize rhe operating
with expansion card or board. Can also refer lo a system on a computer. Often abbreviated 10 boot.
special type of connec tor. • Denial of sef'Yicc: Al:t ions Ihat prevent any pan
• Anonymous FTP: Allows visitors to upload or of an automated inform ation system (AIS) from
download predetermined files from designated functioning in accordance with its intended
directories without usernames or pa~swo rds. For purpose. OC'nial of service attacks may include
example, dimihure your bresr softwar e package denying services or processes limited to one host
by allowing visitors to download it 1hro11gh an ma<:hin c.
anonymous ftp. This is differe nt from a H·gular • Firewall: A metaphorical label
for a set of hard-
ftp acco unt, ware and software components protec1ing system
• Bandwidth: lhnJwi<lth is the sum of all the data resourn·s (scrvns, LANs) from exogenous atmk
transfem·d from and to your Web site, including via a rwtwork (from Internet users) by inter•
ctpting and checking network traffic.
- Review Questions
I. 'Wlm is the differtncc hcrwern puhlic and pri- 6. What arc some sniffing tools that can be uscJ
v.atcIP addrt'\~cs? to capture and analyu packets on UNIX net·
2. Explain the attJlks on Nc1work and its preven- works?
tion. 7, \'VhaL is intrusion dtt«tion? Explain.
3, W'ritc a !.hon note on muter exploit s, 8. ExplJin the attacks on network and the prtVcn·
4. Diffcrrnu· hc1wctn viru!., worms, and Trojan. tion from att.icks in detail.
S. Where can I find a Ulmpl<."tc li,t of the wdl- 9, \'«hat are network.based evidence?
known TCP JnJ UDP port,? I 0. Explain the step& in rourcr investigation.
NETWOR K FO RE NS IC
• 17 3
11. What are the goals for nen vo
rk mo nit ori ng? 14. Ho w do you recover routers
12, What are the typ es of net wo from direct com -
rk m oni tor ing ? promise incident?
13, List dow n the nam es of any
fou r net wo rk sur - 15. Ho w do you investigate DO
veillance/ inv est iga tio n too ls. S arrack in rou ter
and recover from it?
Report Writing
~RNINGOBJECTIVES
LEA
d~g this chapter, you will be able to:
:.:-----::---
Afrer rea ,
Understand the_ i1~port~ce_ of documentation • Apply writing skills for completing che report
in digital forensic 111vesugat1on. of forensic.
-R. Michel
matter should be included in chis section in ~hort detail. The following can be done when we use ..
ccutivc summary" .section:
~-
(a) Inc.lude who authorized 1he fo rensic examinacion .
(b) Describe why a forensic examination of computer m_ed1a wcti nec~ary
(c) List what the significant findings were (in short detail)
(d) Include a signature block for the examiner(s) who perfo'.m~d the work
le is nec~y to include the dates of iniciaJ commun_ica11ons ful_l, proper ~ames of all perso
involved in the case and chcir employer and job tirles. We include a high-level view of the signifir, Ill
l f . ·fi
findin~ as part of the "executive summary" section. Here are some examp es o s1gni JCant finding,:
....n,
(a) Employee Xe-mailed nine company confidentiaJ documents co Company B, a competitor, threr
days prior co leaving employment. .
(b) To intcrc.epc.e-mail communications between corporate executives, employee X used a network
monitor program.
(c) The p~word cracking tools, along with "cracked" executive user passwords, were found on his
computer even though employee X did not have authorized access co these documents.
(d) A thorough forensic o:.amination of the contents of the SANJAY did not reveal any evidence char
the user of the system downloaded or intended to download pornographic images.
2. Objectives: Sometimes, there could be a sudden requirement to perform hard drive fo rensic examina-
tion. The goals of your forensic examination can be related to virtually any subject, since any type of
~/action can calr..e place. Sometimes, many instances you may not always perform a full-scale inves-
tigation or "fishing expedition" when reviewing the contents of media; in other words, your forensic
examination of media may include criceria chat focuses and narrows your examination.
We use the "Objectives" section to outline all the tasks that our investigation intended ro accom-
plish. Pnor to any forensic anaJysis, chis task lisc should be discussed and approved by decision makers,
legal counsel, and/or che client.
The ta~k list should aJso include those tasks undertaken by the forensic examiner, the method by
which che examiner undertook each task, and the status of each task at the completion of the report
3. Computer nidtnu anaJyz.ed; The detailed information regarding the assignment of evidence tag
numbers and media seriaJ numbers, as well as descriptions of the evidence, is provided in this section.
While creating the investigative report, all the evidence chat was collected and interpreted are intro-
duced in this ~tion, hence, rhe cide "computer evidence analyzed."
This information is sometimes best communicated using a cable similar to Table 9.1. To create the
inves-tigative report, readers can reference rnch a table to understand the evidence that was considered
or im~rpn:tcd.
Table 9.1 Sample list of computer media analyzed
E,,;Jn,c, N111nbn- Typ, SwiAJ n11n,bn-
Tag 1 Western W2701-Y733 Laptop used by and belonging to SANJAY.
Dig;tal-31302 Referred to throughout the rcpon as the
SANJAY LAPTOP
Quantum 8233981996 One of two hard drives found in the~
fireball CR web server belonging to SANJAY. Refe
to chroughom this report as XYZ WEB
SERVER DISK J
Quantum 35681¾615 One of two lwd driYa found in rhe S~
Fireball CR web server hdoaging m SANJAY. Refe
to throughout .,_ aq,on u XYZ WEB
SERVER DISK 2 ____.,
,.,,,1 I Ill''
~ - ------~ ~ --.,.__....,~~===--.=~
r,,bla q,2 '.J,1111r,I,, 11•,tir, J t,f ,,IJj'1' ti , ,!1;
1
,,,_,--, 'Ji11/;
--- -- ...
·· : ~. 1,-,· '1, Jt•· .1 w111l•11,i 1 (''l'Y (/,,,, 1,ii,
•111~" ' '
. ,, 11) ,,I dw I vid, 111 , .
I •
111 1 .jj.,
I Iill'III . 111
1,.,n,I l,b
l,:11ul nln ''' 11 111 ii h l1~,.J/ tL~, J,r l r, 11 // 1!,A 1,f :;,'.. • ,·11! 1, ,,1 r 1,t
ill,-1,id f,h .
·1a~k /4 1 I), 1rn11 iw ii 11,1111:1lw1il ,,, J1,..1ir•11 ,1,,. l1t1J'lt:I f '11·•1,r; I". ,, , I 11 • ,,., • •,•,1l1 .,,,, / ,, ....
... I ;, ,
~ ,, ,., , . , , . ; ... ;
lrwJ f,k, w1·1 1: di-.111l1111rd ,,, ,,111:Jiw-d f1h 'ill '1/'.,) :J/1'/ \ l,J,.fll f JI' t,, 1! -••·r::.i:,-: 'If!.,...:., , 1,1,# 1 1 ,:
wi1h rlH• i1w111 111 ·.,·II i1 h l1hl1 ,b, J,,. ;,,,,.,,,f,.,t ,,, ,!:~'/::.::.:.·,. >r;,! 1 , : ..,..,. •
f,h
T.i11k 5: C:,,11 d.11 c d.11 :1 fr,1111 J>c:,I ~crn rc Jlr 1i""I/ 111 1 )1r.1
...,• 1'1·:il',,.. ()Jfl"
, _,. 11 1
, , f'''I
1• ,,, ,I,,,,. , •, .(/ •~ ••
1
,.,.., , , . ,- .., , 1 · / lt• r ,.••
l<w,, II) d:tlJ 1111 d,c \A ~JJAY'. I.AJYJ'( )I' 1,11 ~Al iJP,Y\ LfiVI c11' ,h:.t ,.,,r,,,!,;,::., 1·t. rt-; t .;,;,>A
~y~·1·1·.M l1.J•,,1 ';i'.(.. 11((: '' ~.'.,•
'fa11k (,: l.i \t ,11f1 w:m·/1r1:Hni:ih tl1:,1 111:iy l'rvi 1Mt1 tl,I': n,,i,-: u,r,1,;111i ,,I ',f.~:JXI\ 1./-.VJ ( JV ,1,
he l'ir:11ril id1·111ify t1if1·11MC ,, , f,l.,;t. 11.::it ((;:q f.:. I ': l , .1:11 ,,:,•.:.'. t,...tf
wirl, 1, tJt a li,.1."11•1-:, ,,,,,,11:r f1"11f1h~i ,M, F',;;;, vq::.':':.•, 1
:111'1 (///Jf(;
Directories --482
The geometry of the evidence media, as shown in Table 9.4, is also something that should be
described in your report.
~ . ....
. •ve leads: In dm sewon, we outlrne ac11on llems that could be performed to discover addi-
• · h · · . · · If morl' lllne ··
· or add111onal ·
6, 1flvesugau
. r rrnatJOn per11nent to r c mvcmga11on.
h cl'
resources were provided
. nal ,n,o . . I
11° jner or invemgator, t 1c\e are t e ou1stan rng tasks that could be completed. To a law en-
1he eJ<an1 . . . r . . I Ti
ro . officer, rhis section 1s o,ren cmJCa . o generate more compelling evidence to help your case
1t0rccrrtcntalways 1hc goa I of your rorrnsic ana Iy\1
r , . . . . . .
s. 1 hcrcforc, It 1s cm·nual to document further inves-
1.~alrnO\I h h h b d I
.rive ~rep~ rhat, alt oug per aps eyon t 1c ~cope of your foremic report, could genera re actions
11 g3 d 10 rhe 5ucces~ful resolution of the ca.\e.
1h31 1c~ rhe other hand, f?r the hired foremic consultant, this section is also important. "Because you
0
1h
e opportunity co li\t all of 1he tasks you could have performed, but simply did not," therefore I
c . call this 1he "CYA section.
have · · I 'fI your examination Jid not yield substantive conclu-
· " 1"h'1s 1·s criuca
. and your c1·1cm or consumer 1.s ask'rng, "WI1y d'<l
orten I n't you try th'1s~'" or "Wh y don't you know who
s1ons, I I. . h
did rhi\?" To advance t 1e case, t 11s sernon suggests r e additional tasks that could unearth the infor-
mation required. 1
~ -- -- -- -- -- -- -- -- -- -- -- -- -
Incident Response Report
an incidence response process. To develop
. document explains the st~ps which are taken during and precise
fhis 1he steps in the following case must be changed with the contact information
plan, fi · · · f
a qucnce of action or ~our_ 1~srnur1?n. )'k the case, date, name of the investigator, and
sc p ge: This cont:uns 1mor mat1 on 1·e name o
fide \form ation with 1he derailed description of the case.
contact I
fable of Contents:
the grounds dispatch office. List the like-
The individual who realizes the incident will demand
ent. The already known sources must be
J. ly possible sources of the one who may realize the incid
cts. Sources which require the contact
provided with the contact procedure and the list of conta
information could be as follows:
(a) Helpdesk
(b) Intrusion detection monitoring personnel
(c) A syste m administrator
(d) A firewall administrator
(e) A business partner
(0 A manager
(g) The security department or a securiry person
(h) An outside source
the necessary contact information
List all the possible sources and check whether they have
ct one of the 24 X 7 reachable
and the related procedures. Generally, every source will conta
the IT department might have multiple
individual like rhe grounds security office. The ones in
who do not belong to IT deparcmenr.
differenr conract methodologies as compared to the ones
ber of the IT department or any of the
2. If the individual who realizes the incident is the mem
ed to step number 5.
other affected department then they will directly proce
member of the IT department or any oth-
3, If the individual who is realizing the incident is not the
available grounds security department.
er affected department then they will directly caJI 24 X 7
list of contacts or any other affected
4. The grounds security office will refer to the IT emergency
intended numbers in order from the
department's list of contacts and call the designated and
mation:
list. The grounds security office will log the following infor
(a) The name of the caller.
(b) Time of rhe call.
(c) Conract information about the caller.
(d) The n,\ture of the incid ent.
(e) Which equipment or persons were involved?
(f} Location of equipment or persons involved.
(g) How was the incident detected?
chat the incident occurred.
(h) When the event was first noticed that supported the idea
(or realized the incident) will refer to
5. The staff member of IT department who receives the call
cted and incidence response members
the list of contacts for both management staff to be conta
and intended person from the list.
to be contacted. The staff member will call the designated
ger by both e-mail as well as phone
The staff member will contact the incident response mana
and designated and intended man-
messages while being sure other suitable and backup staff
sary information received in the same
agers are contacted. The staff members will log the neces
format as the grounds security office as mentioned un
the previous step. The staff member
could add the following information as listed as follows:
(a) Has the equipment affected business critical?
182 •
~
bers of the team will restore the infected or affect d
, N1em f e sysrem(s) to an u · fiected state. .hey
nm 1
J;, lso do one or many o the following actions to b . h
c:tn a · Id b ring t e system back to normaI cruncr1on- •
.1n"• The actions cou e one or more of the follow·mg..
(a") Reinstall the affected system(s) from scratch and rest d r b
'd b c d .
Preserve ev1 ence erore omg this. ore ata irom ackups if necessary.
(b) Make users change passwords if passwords may have been sniffed.
( ) Be sure the system has been hardened by turning off O • , 11· d .
c · c II r unmsta mg unuse services ·
(d) Be sure the s~stem _is ru y pat~hed.
(e) Be sure real-time virus protect1on and intrusion dctecrioni·s runnmg. ·
. I
(f) Be sure rl~e system 1s ogging t~e corre~t events and to the proper level.
13, Documentat~on_Step: The ~ollowmg derails must be documented in the standard format:
(a) How the mndent was discovered.
(b) The category of the incident.
(c) How the incident occurred, whether through email, firewall, etc.
(d) Where the attack came from, such as IP addresses and other related information about the
attacker.
(e) What was the response plan?
(f) What was done in response?
(g) \xrhether the response was effective.
(h) A separate sub-file should be included with the following points:
Title Page: This page consists of the information like the name of the case, date of incident,
name of the investigator who is investigating this case and the contact information.
Table of Contents (ToC): This is not that important or necessary for short length reports or
for chose which do not have many sections in their respective case. However, if the report is
long and is classified into many different sections which may include ToC which can be huge
help to che end user or reader.
Executive Summary: Specifically, important for long-sized reports, this permits the reader to
obtain high level view of vital findings without having to explore into the specifics of the report.
Objectives: This section is specifically important to include if one was asked to implement a
directed investigation. Ocher information which could be included can be the search terms
which are requested by the client(s).
Evidence Analyzed: This secrion must include the serial numbers, the hash values (like MD5
or SHA or ere.), and che customer related information, if at all it is known. If photos are taken
at the incident scene, then one should include chat as well for the evidence.
Steps Taken: One must be informed in detail. Your outcomes must be reproducible. One must
include sofrware and hardware which were used during the investigation. And last but not the
least, it is important to note the version numbers as well.
Relevant Findings: You can further classify and categorize this section conditioning on the
length of the report. Sub-categories will depend on the examination, but can include things
such as interested documents, activity done on the internet, note of the software used, the
devices connected via USB, etc.
Timeline: Some of the reports may provide the benefit from s~marizing t~e ti_mcline ~bout
all rhe necessary and important events. A good graphic can help m commumcatmg the mfor-
macion in the long run. . . . . .
Conclusion: In this section, you can highlight the vnal issues. ThlS as usually m the form of
numbered or bulleted list of summarizing outcomes.
184 • DIGITAL FQ
~
14. Evidence preservation: Make duplicate copies of the logs, e-mails, or any other com .
tion medium used as evidence. Mail a detailed list of witnesses who witnessed the .rn~nica.
. in_cident.
Keep the evidences, at least, till the final verdict from the court arrives and also keep It, 1n
if an appeal files by the prosecution. case,
15. Notify proper external agencies: Alert the police and other appropriate agenci~s in .
prosecution of intruder is expected. Make a list of such agencies and their respectiv':5e if the
numbers in this section. coniaq
16. Assess damage and cost: Evaluate the damage caused to the organization and estim ate th
. er e
damage cost as well as the containment enorts cost.
17. Review response and update policies: Make a plan and then take the preventive steps s0 h
the intrusion shouldn't happen again in the near future. t at
(a) Consider whether an additional policy could have prevented the intrusion.
(b) Consider whether a procedure or policy was not followed which allowed the intrusion
then consider what couJd be changed to ensure that the procedure or policy is follow~~~~
the future.
(c) Was the incident response appropriate? How could it be improved?
(d) Was every appropriate parry informed in a timely manner?
(e) Were the incident-response procedures detailed and did they cover the entire situaiio n.>
How can they be improved?
(f) Have changes been made to prevent a reinfection ? Have all systems been patched, systems
locked down, passwords changed, anti-virus updated, email policies sec, etc.?
(g) Have changes been made to prevent a new and similar infection?
(b) Should any securiry policies be updated?
(i) What lessons have been learned from this experience?
5. Use consistent jdentifier: There can be confusion created in a report by referring to an item in differ-
ent ways, such as referring to the same computer as a system, PC, box, web server, victim system, and so
on. Developing a consistent, unwavering way co reference each item throughout your report is critical ,
to eliminate such ambiguity or confusion. For your report, it is a good idea to create a unique identifier
or reference tag for each person, place, and thing, which is referred repeatedly. For the remainder of the
report, the label will identify the corresponding item. For example, if the report is a summary of yow
forensic analysis of a laptop system belonging to a suspect named Sanjay, you could reference the items
(using all capital letters) in the following manner:
An employee of ABCD Corporation, "We performed a forensic duplication to the laptop system
belonging to S:mjay. The system was a HP laptop, CND4337DRY, hereafrer referred to as the SANJAY
LAPTOP.
6. Use attachmcnu and appendices: To maintain the Aow of your report, use attachments or appcn~-
ces. Right in the middle of your conclusions, you do not want to inrerrupt your forensic report wllh
15 pagrs of source rode. Any information, files, and file fragments that you point out in youi: report
ovc~ a page long should be included as appendices or attachments. In your report, you ca~~ •_nd:
a brief rcfm:-nce to the appendix. For example, you might say, "A printout of the informauon IS md
ed as Appendix A." Somerimes, i1 is unwieldy or difficult to produce large database files, lengthy_S()UJCt
code files, and ~preadshee1s in printed form. For this rype of reference, we provide an electronic copy
instead of che primed copy and call it an Appendix. . helps
7. Have coworkers read your rcporu: To read your forensic reports, employ other coworkers-~cidd1'
develop reports that are comprehens ihle ro nontechnical personnel, who have an impact on yourm
• 185
,;; ~~
• ,11186 ---- ---- ---- ---- ---- ---- --:. ..:. =
1/ reg)' 211 d re~lu1_ion. \\"rule writ}ng the repon, the coruumer le"·el would ilia be cor..iid-
,M'°r,:C:\~dgc 0 ( y~ur aud1en~ and tediniul apwilit )' _s hould~ be uktn into cor..s]de_r,rion. f~r
~~ .. .. good idea to pr0\1de•a gloss.u-y of terms c...ilomi Snt't"L~o. lly for mac rl'Tlnn
-r-
1..".Suna• 1f
, 1c LS• r-
~p•'· : ding a computer fo rem1cs report to a nomcchnic..l J,...,Jer.
,'\, 11 •rc P~~~bes: \X'hether it is an entire hard dri\'e or specific fib, create
and record the ~f 05 h.uh-
• ()t MD' oof. Performing ~105 h~hes for all evidence provides support to the cla.im
that you are
ti" ( ,•our pr . enu ofrroremIC
he spec1·a1 requ1rem . examination. The ~105 ru.shcs o.lcuuted
~o , d auentive tot
cf;ligl'.'.n_c~ set of data will always remain the ~e. if your evidena is hmdlcd proixriy and rema.ins
for a si;~oof. Your audience, becomes c.onfident that you are handling the data in the appropriate man•
¢11" rding these ~10) values.
net b~recocudata! Record and include the met.ad.au for every file or file fragment cited
in your report.
9. ID~ e :data
0
includes tht' rime/date stamps, full path of the file, the file si~. and the file's ~f05 sum.
~s ~ consumer confidence, this identi~·ing data wiU help to eliminate e\'en the confusion.
About
To -~ files you referena during testimony, those audience that read your report appreciate that you
~,~udc: all the der~ls, and you will likely need th~ details ~o remove any ambiguity. . .
tG The following 1s an example of a t.able we include m our reports
after we rne a specific file.
ifially, it pro\·ides the file mrudata for a Windows IIS Web acccs.s log found on the C: panition
,tw1s~
5
1 \sys1em32\LogFiles\\\ 3SVC3\ex001215.log), as shown in Table 9.5.
7
're oftc:n add a comment field to our file cable.s to provide a quick reference and reminder of why we
cited the file in me: report.
! tme~
1
1 1
th.u other law requi rement offices ought to be brought into the case. They additionally chose
to sceutt the official.
~ unique physical effom to establish safety mu.st be taken instantly
.,
186 •
21,000 individ I
Eumio auon steps: The company had an aggregate populace of more than
n of susp~;l: •
~hich included work~rs , guests,_ and visitors. The o_fficial _could not narrow th_e rundow
horne. Th~
1 hroughout, the official got various spontaneous things via the post office at his office and
U.S. Postal Inspector was reached to help with the case.
The agent
The first demands for the spontaneous things were recovered and penmamhip tests done.
._Roughly a year
comra.Med the specim:n and a larg~ number of notes and r~ports con_,po~ed by workers
things via the posr
lacer, a few representanves commumcated worry over accepting pestenng spontaneous
office.
person. Each
The first drmands were acquired, and it was inferred that they were made by the same
from all the list
worker was asked to give a list of suspects. The agenr found one common suspect name
the penman shi;
given by the workers. The agent had arranged for handwritten records beforehand and
to an investigative
seemed, by all accounts, to be that of the same individual. The data was sent over
ing. The indi-
group from another law requirement organization, who detai ned the person for question
mail. At last, the
vidual denied composing the undermining notes or being in charge of the bothering
office where he
individual yielded and gave the penmanship tests, then came back to his work area at his
ining note were
then composed a suicide note. The note explained why the pestering mail and underm
official or even
sent. The individual additionally clarified in the suicide note that he had never met the
know what he looked like.
Conclu sion taking into account examination: Despite rhe fact that it cannot
be resolved in the evenc
us lessons that
that anything could have changed the result of this disamous occasion, there are numero
can be learnt to avoid future episodes.
Lessons Learned:
Workers were being
1. The company was confronted with overwhelming rivalry and was scaling down.
ess include
requested to accomplish more with less. A few occurrences of work environment viciousn
organizations that are scaling back or that have as of late done as such.
who sub-
2. The representacive was commined and dedicated, and glad for his work. Representatives
mit work environment brutality are not generally underachievers.
they are
3. Ordinarily, best administrators turn into 1he objective of a displeased representative since
seen as the organiz.ation or corpora te picture.
4. Ir is imperative ro effectively seek after imtances of work environment savagery.
activi1ies.
S. Once the individual is discinguished, quick move ought robe made to evaluate his or her
their fami-
6. On the off chance rhar an episode occurs, it is imperative 10 consider all casualcies and
illuminate
lies. Utilize the adminisuations of a minister or ministry. Choose how you are going to
collaborators.
~~--,...·-] Summary
,\fany wmputer SC'curiry investigations require the scrutiny, be unambiguow and not open
co misin·
ed (using paragrap h
nt-c:d co document your findings in a manner than terpretation, be easily referenc
. for
can eJ\ily ht used in a judicial proceeding. Your numbers for the report and dates numbers
informa tion rtquired
foren,ic rcporrs need co be wrinen in a manner so attached documents),contain all
that chcy do chc following: Accurately describe the co explain your condusions, offer valid condusio:
details of an incident, be:- understandable to deci- opinions, or recommendations when needed,
your~ -
sion makers, be able to with~tand a barrage of legal ready in a timely manner and should assist
WRliiNG..._ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _•_1..:..,8.::...:..7
1
~
Key Terms
. . Monitoring resources to determine monitoring the events occurring in a computn
, .5a.seh11 •~g:I.' tion patterns so that signiGeant dcvi- system or network and analyzing them for ~igns of
.1·al uu ,za pos~ible incidents and attempting to stop dem:tcd
l}'P l, 11 be derected.
ario115 ca Security Incident Response Team possible incidents.
puter
, Cof11 T): A capabiliry set up for the purp?se of • Malware: A virus, worm, Trojan horse, or other
(CSI~ . respondinoV to computer secunry-re- code-based malicious entity that succe~~fully
.1st 10g JO infects a host.
ass . 'dents· abo caJled a Computer Incident
ed 1nc1 •
Ial Team (CIRT) or a CIRC (Computer • Precursor: A sign that an attacker may be
Re5ponse C I 'd preparing co cause an incident.
·d r Response Center, omputer nc1 ent
Jnc1 en .. • Profiling: Measuring the characteristics of
onse Capability).
Resp . A "Yobservable occurrence in a network expected activiry so that changes can be more
• Event, rw easily identified.
or sysrem. . . .
, false positive: A~ ~ler_t that m~orrectly md,cates • Signature: A recognizable, distinguishin g pattern
_1 t malicious acuv,ry 1s occurring.
associated with an attack, such as a binary string
uia · · h f · I in a virus or a particular set of keystrokes used to
, Incident: Aviolation or 1mm111ent t reat o vto a-
tion of computer security policies, acceptable use gain unauthorized access to a system.
olicie5, or standard securiry practices. • Social Engineering: An attempt to trick someone
, fncident handling: The mitigation of violations into revealing information (e.g., a password) that
of securiry policies and recommended practices. can b~ used to attack systems or networks.
, Indicator: A sign that an incident may have • Threat: The potential source of an adverse event.
occurred or may be currently occurring. • Vulnerability: A weakness in a system, applica-
, Intrusion Detection and Prevention System tion, or network that is subject co exploitation or
()DPS): Software thar automates the process of misuse.
~RNINGOBJECTIVES
LEA
::.:.--:--d~g chis chaprer, you will be able to:
Afier rea ,
Understand the concept of digital forensic • Interpret and apply digital forensic cools in
real-time scenario.
cools.
I constantly remind people that crime isn't solved by technology, it's solved by people.
-Patricia Cornwell
rm
\ 'U need
Needs of Comput er Forensics Tool
to develop a business plan co rationalize the attainment of computer forensics hardware and sofr-
~~re. ~en researching tools, strive for versatile, flexible, and robust tools that include technical support.
~ e_~bJeciive is to discover che best value for as many features as possible. Some questions to ask when
~ 1ngtool5 · of the following:
comprises
l. On wh·1 h
c OS docs the forensics cool run?
190 • DIGITAL FQ
2. Is the 100\ versJt ile? For example, does it work in \Vindows 98, XP, and Vista, and produ h
~
result,; in all three OS~? ce t e
~me
3. Can the tool analyie more than one file system, ~uch as FAT, NTFS, and Ext2f.~?
4. Can a scripting language be used with the tool to au1omate repetitive functions and tasks?
5. Ooes the tool have any automated features that can help reduce the time needed to anal)'"le da . >
6. \X1hat is the vendor's reputation for providing product support? ta.
As you learn more about computin g investigations, you will have more queries about tools for cond .
these investigations. When you search for tools, keep in mind what file types you will be examininUcting
example, if you need to examine Microsoft Access databases, look for a product intended to read the;·fi~or
If you are examining e-mail messages, look for a forensic tool capable of reading e-mail conten1. 1
es.
When you are picking tools for your lab, keep an open mind, and compare platforms and applic:3 .
for difTerem tasks. Although many detectives are most comfortable using Microsoft platforms, yo~ions
encouraged to check into other options, like Linux and Macintosh platforms. are
~
, Study of Digital Forensic Tools
A number of DigitJI Forensic Tools/suites are availahle for investigators to ronJu~r digital f ~
. d'I . d J• • _, 1r . I n~,c •n\' .
i•J1ion .The sleuth Toolkit EnCase and Fl Kare rea 1}' acqmre urgita1 orens1C too s chat are ernero,n . l'S11.
• h . . Of I115 . s . .
r,
abide with tht increase in demand of forensic cook T e main aim l rrnon 1s to provide an ~ ~ to
· · d' · I r · I I · d O\ef\ r
of· rop 2S digital forensic tools. The follow111g 1gHc1 1orens1C too s arc exp amc : ~-
1 1
1
~lttllllll .. ""
6,
.., \'.111,11•1J\ii ' il)•~is:
•
l',ml's M I\OX form,11 llll'~!>:t1'tll'!>, s11d1
.
:J!>
' .
ThunJ•·rl,·
"
,r•I' .
' ' . . •~ucori,,I: OlllC a di~k im,,gl' has hccn rn:.1tl'd, h:1,l1nl, and write-hlol'krd 10 prcvrnt di 11wcs 1·1 is
11,.~ 11 • I . ·1·1 I · ' ti ' .
h• 1 y 10 i1n•1·s11g.11t· Ill' ,m.igc. iroup, \Out the analy111s prtKt·~,. 1he in vc!>tiPator !>lw11ld look for info
c,'· r I · ·I I Tl · . 1·
1hc c1~1.· win~ romp, n · its 1111 P ics not only trying to find cum·n1 content, on rhe J rivr·
t,
"'' . . 1111
1
1"' ',''.:~.';, .uldiiin11ally l~ioking for ddctnl l,ks, mis!>ing or hiddrn dat.1, and hiJdc·n p.irtiriom which will no;
h1"' ( 11nr~, 1l:111Cl', hl'qucndy, a smpcn c.111 pl.111 to hidt· ,111d dclc1c data as a prt·L:1111 ion. Wl· will be rc·JJy
1
;,)' ,... v,,,1o<l"' l'I Orlwtl\OY. S.,,u111y ' K.ol1u11U• , k , t,Do<i o e•..,1<..,-c,o .....locoa,~•n9
V,>u du not naciJ J~vo !J.:npl to uoo Aulo1-,::y ~nd il 111 n:<."<Jmmandod Lhol 1l be Lui nad otT for :socurily rea::un::.
0..•HC....
a [~ne~~ - - - ~- ' b. j ~ - - - - - -
c I _J l ______
d, ,;__ ---,
,. I f. j
9 I h. I----- -----
:_:_:=======-- - J. '
l r
CANCU Hu.,,
NrwC.ua:
1. Click New Case. The 'Crca re a New Ca~c· page will open. Fill in the 'Case Name', 'Description', and
'lnvrnigJro r Name'. Then 5eJcn 'New Case' near the bouom of the screen.
Ct1:ie: Cas.,OCI
Host: hosU
Ne.• 1mQ;if s hd'✓G l:G&n added to this host yot
S1:,l1.:L ltitt A,Ju lin-10~ F1l•l biJI ton below to ..tdd one
I Aou I M AG& .,,._. I
tCIIU'
- ------- - -- ------ -- -
FU /lcrMrYT.,1 l lHA HUH Ou ....,r.
VIEWNorn
2. Click Add Host on the following pJge. Leave the defaults on che 'Add a New Host' page and sdect
'Add Host' at the borcom of the page.
3. On the following p.1gc, select 'Add Image'. On c.he following page, select 'Add Image File'.
4. 'Jo add the im,1ge file for -1nalysis, enter c.he pach of c.he image file, /root/driveimage. •.The• will select
.1ny file wich an appropriate disk image extension. Since this image drive is from one parcirion, sclccr
thr 'P,11 tit ion' rJJio bu non. Click Next.
• 197
1. l or,11 Ill!\
l'ntcr 1111, r1:ll 11,1th {;:t,1rtm,1 with ,l tC\ tho ini.,Ql' nte.
I( tti-· itnJ<10 1.: r.pllt \1.'lllHT r,1w or Enc.,!;(.'). lhL•n enter·•· for the
,,'l:t ,'n!:ll,n .
:. I\"''
rk,1~,, ~:,,k•c-t tf Un:; 111 '-l\W nlll is for n ct1::;k or a sm,Jlo parl1t1on.
, l"'t~k • l~Jrt ition
J. lmpm I l\h.-lhnd
T,1 .,1~.11~·~0 th(' rn1.:11J0 111\) tl 11\ltsl be located m the evidence locker. It
c;in t,,, uni:-,'rtod !\-om 11.$ ~urront locat1011 usmg a symbolic link. by
,,,r\'ln~ it ('f l'y O\(WtnO it. Note lh,"lt tf n system failure occurs dunno
t!h' r.;c\.:. Uh' n tht> im,,i;w could become corrupt.
• Symlmk Copy ' Move
s. lh~ m·,1 l'·'St' " ill HTi~· dw dlt' rnrrt'l't im.1ge file has bl'rn selected. Click Next.
b. ~rk-t tlw h.,~hinµ O\'tinn on the next p.1ge. This will wrify the integrity of the disk image, and will
.,ll,m· y11u tll d,l·,-k this h.1,h v.1l11c .1g.1ins1 rhe onl's crl'ated in the imaging process. Leave the other
,k{1ul;s as thl'y .ire .uH.I rlil'k Add.
7
· ~h~ ~.ish m.,y t:1ke •1 moment l\) c.tlcul.1te, especially if the disk image file is large. The hash value will
pnntl'd ~)lit. I',· ~urt to n,p)' it a ci.>xr file for comparison. Click OK.
198 DIGITAL FOREN
could take a while)
Calculating MD5 (this
C u r r e n t M D 5 : El3857018A4AB521100AE2364F170E0
OK
3. A new window will open that displays the full contents of the disk image file. Since
there is an
one file on this
partition, it will not take long to display. Note that to make hashing easier, thert i
an option to make an md5 list of all files on the
image file. It is also possible to add a noteatthi
point.
TuANALYa KETWaDANCH FILETTPE JMAGE DEtALS META DATA DATA UNIT HELP Co
Enter a Psrl
regu ar Hle Browsing Mode
expreesicn for
D i r e c t o r yS o s k
dd DrreaEle 00c0 0000
Oo00-00.0O
000000(UTC) 0000 0
r t a rt h m o
dd
20140214 00 1UTC (000.00 UTCI
201402-14 2014 02 14
o l a d i r e c
Want
t o r y
IET stands for SANS Investigation Forensic Toolkit Snapshot as given in Figure 10.1. It is a toolkit with a
comDOsition of various tools that are used in virtual machines as a computer forensic tool. It majorly deals
withdata images, unprocessed images, and numerous fle systems (i.e., NTFSs, HFS, and UFS, and so on).
Key Terms
Acquisition: The process of creating a duplicate National Software Reference Library (NSRL:
A NIST project with the goal of collecting all
image of data: one of the five required functions
of computer forensics tools. known hash values for commercial software and
Brute-force attack: The process of trying every OS files.
combination of characters-letters, numbers, and Password dictionary attack: An attack that
special characters typically found on a keyboard- uses a collection of words or phrases that
might
to find a matching password or passphrase value be passwords for an encrypted file. Password
for an encrypted file. recovery programs can use a password dictionary
Review Questions
1. Explain the evolution of computer forensic tool. 4. Write a short note on comparison of computc
2. How do you perform reconstruction? Explain. forensic tools.
forensie
3. What are the various tasks performed by com- 5. Explain in detail the task of hardware
puter forensic tools? tool.