digital forensics

digital forensics

process of gathering and submitting computer evidence to trial and interpreting that evidence by providing expert analysis

• they use specialist tools and skills to recover information from computer systems, memory, and storage

forensics procedures - identification

ensure the scene is safe and secure to prevent evidence contamination, and identify the scope evidence

forensics procedures - collection

ensure authorization to collect evidence is obtained, and then document and prove the integrity of evidence as it is collected

forensics procedures - analysis

create a copy of evidence for analysis and use repeatable methods and tools during analysis

forensics procedures - reporting

create a report of the methods and tools used in the investigation and present detailed findings and conclusions based on the analysis

legal hold

process designed to preserve all relevant information when litigation is reasonably expected to occur

forensic analyst code of ethics

1. analysis must be performed without bias

2. analysis methods must be repeatable by third parties

3. evidence must not be changed or manipulated warning - defense attorneys will try to use any deviation from your ethics as a reason to dismiss your findings and analysis

work product retention

contractual method of retaining forensic investigators to protect their analysis from disclosure by the work product doctrine

data acquisition

method and tools used to create a forensically sound copy of data from a source device, such as system memory or a hard disk

order of volatility

1. cpu registers and cache memory(L1/L2/L3/GPU)

2. contents of system memory(RAM), including a routing table, ARP cache, process tables, kernel statistics, and temporary file systems/swap space/virtual memory

3. next, you would move onto the collection of data storage devices like hard drives, SSDs, and flash

• analysts should always follow the order of volatility when collecting evidence

• while most of the windows registry is stored on the disk, some keys(like HKLM\Hardware) are only stored in memory so you should analyze the Registry via a memory dump

digital forensic kit

kit containing the software and hardware tools required to acquire and analyze evidence from system memory dumps and mass storage file systems

EnCase

digital forensics case management product created by Guidance Software with built in pathways or workflow templates that show the key steps in many types of investigations

the forensic toolkit(FTK)

digital forensics investigation suite by AccessData that runs on Windows servers or server clusters for faster searching and analysis due to data indexing when importing evidence

the sleuth kit

open source digital forensics collection of command line tools and programming libraries for disk imaging and file analysis that interfaces with Autopsy as a graphical user front end interface

system memory image acquisition

process that creates an image file of the system memory that can be analyzed to identify the processes that are running, the contents of temporary file systems, registry data, network connections, cryptographic keys, and more

-four most common ways to do this are live acquisition, crash dump, hibernation file, and page file

live acquisition

capturing the contents of memory while the computer is running using a specialist hardware or software tool

-tools used for this include Memoryze from FireEye and F-Response TACTICAL

crash dump

the contents of memory are written to a dump file when windows encounters an unrecoverable kernel error

-results usually comes in a mini dump file that may contain valuable information and potential evidence

hibernation file

file that is written to the disk when the workstation is put into a sleep state

pagefile

file that stores pages of memory in use that eexceed the capacity of the host’s physical RAM modules

disk image acquisition

process that creates an image file of the system’s disks that can be analyzed to identify current, deleted, and hidden files on a given disk

live acquisition

(disk image acquisition)

capturing the contents of the disk drive while the computer is still running

static acquisition by shutting down

(disk image acquisition)

the computer is properly shut down through the operating system and then the disk is acquired

static acquisition by pulling the plug

(disk image acquisition)

the system’s power is disconnected by removing the power plug from the wall socket

• there is a risk of corrupting the data, but it is also likely to preserve the device’s contents

physical acquisition

(disk image acquisition)

bit-by-bit copy of a disk that includes every non-bad sector on the target disk including deleted or hidden data

logical acquisition

copies files and folders from partitions using the file system table stored on the media

• logical is faster to copy, but misses any files marked as deleted

write blockers

forensic tool to prevent the capture or analysis device or workstation from changing data on a target disk or media

• can be either dedicated hardware or a software based solution

imaging utilities

9software utility that conducts the disk imaging of a target

• many image acquisition software will also perform cryptographic hashing of the data during acquisition

• different image acquisition tools use different file formats:

  • .e01- Encase file

  • .aff - advanced forensic format, commonly used by FTK Imager

  • .dd -industry standard, used across the board, open source format (.dd = disk duplication file)

dd

unix/linux/macOS command that can perform disk image acquisition

acquiring a virtual hard drive

it will already be in a vmdk(Vmware), vhd/vhdx(Hyper-V), or vdi(VirtualBox) format

hash

a function that converts an arbitrary length string input to a fixed length string output

• can also be used to prove file integrity of the operating system and application files

secure hash algorithm(SHA)

a cryptographic hashing algorithm created to address possible weaknesses in the older MD5 hashing algorithm

• SHA-1 uses a 160-bit hash digest, but isn’t considered strong

• SHA-2 uses a 256-bit or 512-bit hash digest and is the current version used in modern forensics

message digest algorithm(MD5)

a cryptographic hashing algorithm created in 1990 with the most commonly used variant being MD5

• uses a 128-bit hash digest, but is susceptible to collisions and should only be used as a second factor of integrity checking

certutil

a built in command where a file and algorithm is given such as SHA-1, SHA-256, or SHA-512, then outputs a hash digest

file checksum integrity verifier(FCIV)

a downloadable utility that can be used as an alternative to certutil

tools to calculate the particular algorithms and give the hash digest

md5sum, sha1sum, sha256sum, sha512sum(Linux)

File Integrity Monitoring(FIM)

a type of software that reviews system files to ensure that they have not been tampered with

timeline

a tool that shows the sequence of file system events within a source image in a graphical format

• many forensic tools can generate a timeline based on the evidence

• if the tool doesn’t support it, create a sequence of events within a spreadsheet to serve as a timeline

• HDDs and SSDs are divided into sectors of either

512 bytes(standard) or 4096 bytes(advanced)

block/cluster

the smallest unit the file system can address (default is 4096 bytes)

master file table(MFT)

a table that contains metadata with the location of each file in terms of blocks/clusters for disks formatted as NTFS

• when a user deletes a file, they are actually only deleting the reference in the table which converts that previous location to free (slack) space

file carving

the process of extracting data from a computer when that data has no associated file system metadata

• attempts to piece together data fragments from unallocated and slack space to reconstruct deleted files or at least parts of those files

scalpel

an open source command line tool that is part of the Sleuth Kit that is used to conduct file carving on Linux and Windows systems

chain of custody

the record of evidence history from collection, to presentation in court, to disposal

specialized evidence bags

used for electronic media that ensures they cannot be damaged or corrupted by electrostatic discharge (ESD)