Technological Innovation in Cyber Security - Week 10: Digital Forensics

Introduction

  • Why Investigate?
    • Rise of various crimes:
      • National Security
      • Information Security
      • Corporate Espionage
      • Child Abuse
      • Traditional Crime
      • Incident Response
      • Employee Monitoring
    • Investigation outcomes:
      • Bring culprits to justice
      • Recover damages/monetary compensation
      • Prevent recurrence

Digital Forensic Science (DFS)

  • Definition: Use of scientifically derived and proven methods for preservation, collection, validation, identification, analysis, interpretation, documentation, and presentation of digital evidence from digital sources.
  • Purpose: Facilitating or furthering the reconstruction of criminal events or anticipating unauthorized actions disruptive to planned operations.
  • Source: Digital Forensic Research Workshop (DFRWS), 2001

Taxonomy

  • Digital Forensics: Broadest category.
  • Computer Forensics: Focuses on computer systems.
  • Mobile Forensics: Focuses on mobile devices.
  • Network Forensics: Focuses on network-related evidence.
  • Database Forensics: Focuses on database systems.
  • Cloud Forensics: Focuses on cloud environments.

ACPO Guidelines

  • Association of Chief Police Officers (ACPO) Crime Committee's Good Practice Guide for Digital Evidence V5 (2012).
  • Primarily for UK law enforcement personnel dealing with digital evidence.
  • Includes:
    • Securing, seizing, and transporting equipment from search scenes.
    • Planning and managing the identification, presentation, and storage of digital evidence.
    • Selecting and managing personnel for recovery, identification, and interpretation of digital evidence.
  • Principles:
    • Principle 1: No action should change data that may be relied upon in court.
    • Principle 2: Access to original data requires competence and the ability to explain actions and their implications.
    • Principle 3: An audit trail of all processes applied to digital evidence should be created and preserved; an independent third party should be able to examine the processes and achieve the same result.
    • Principle 4: The person in charge of the investigation is responsible for ensuring adherence to the law and these principles.

Handling Devices

  • Leave the device in the state (on or off) it was found.
  • If switched off: take photos, label cables, disconnect cables, and prepare for evidence packaging.
  • If switched on:
    • Decide whether to pull the plug, shut down via the operating system interface, or perform live acquisition.

Live Acquisition

  • Reasons for live acquisition:
    • Minimal downtime (e.g., web servers)
    • List of running processes
    • Data only in RAM (e.g., encryption keys, private browsing, open network connections)
  • Implications:
    • Potential evidence contamination/destruction if not handled properly.

Documentation

  • Document the complete journey of the evidence (Chain of Custody).
  • Chain of Custody questions:
    • Who collected what and when?
    • How and where?
    • Who took possession of what?
    • How was something stored and protected in storage?
    • Who took it out of storage and why?
    • When was it returned to the evidence locker and by whom?

Data Storage

  • Definition: Technology consisting of digital components and recording media used to retain digital data.

Data Storage Hierarchy

  • CPU (Register, Cache Level 1, Cache Level 2)
  • RAM (Physical RAM, Virtual Memory)
  • Storage Device Types (ROM/BIOS, Removable Drives, Network Hard Drive)

Hard Disk Drive

  • Uses magnetic storage.
  • Contains platters, tracks, and sectors.
    • Track: At least over 1,000 tracks on a platter.
    • Cylinder: Aggregate of the same track number on every platter.
    • Sector: Divided into 512-byte or 4096-byte long sectors (smallest physical unit).

Location Addressing

  • Cylinder-Head-Sector (CHS): Early method for addressing physical blocks of data.
  • Logical Block Addressing (LBA): Common scheme for specifying the location of blocks of data.
    • Each sector is addressed uniquely using a number.
    • No need to know the hard drive's geometry.

Hard Drive Interfaces

  • ATA/IDE interface (1986): 16, 33, 66, 100, and 133 MB/s
  • ATA/ATAPI 3 (1997): Introduced passwords
  • ATA/ATAPI 4 (2001): Introduced the host protected area (HPA)
  • ATA/ATAPI 6 (2002): Introduced the Disk Configuration Overlay (DCO)
  • Serial ATA (SATA) (2003): 150, 300, and 600 MB/s

Hard Disk Formatting

  • Low-level formatting: Erases all data by writing zeros to the entire drive (time-consuming).
  • High-level formatting:
    • Prepares the disk to use the physical layer using the desired file system.
    • A file system is established on a logical volume.
    • Does not erase all data completely.

Solid-State Drive (SSD)

  • Uses memory "chips" (integrated circuits) to store data.
  • No moving mechanical components.
  • More resistant to physical shock, runs silently, and has lower access time and latency.
  • Used to be very expensive.

Data Pages (SSD)

  • Not divided into 512-byte blocks but rather pages – 2KiB2KiB (i.e., 2048 bytes), 4KiB4KiB (i.e., 4096 bytes).
  • Presented to the OS in blocks.
  • Note 1 Kibibyte = 1.024 Kilobyte
  • Data can only be written if the page is empty/blank.
  • Each page has a limited number of write and erase cycles (1000-10,000).
  • Typically contains 25% more storage than stated (due to wear and tear).
  • Wear leveling can distribute writes evenly across all pages.

Trim and Garbage Collection

  • Quick format can result in data loss within minutes.
  • ATA Secure Erase (SE) command – hardware level.
  • Blocks must be erased before writing (erasing takes time!).
  • Trim command and Garbage collection.

Data Acquisition

  • Acquire an image/copy of the original seized evidence (ensure no alteration).
  • Authenticate that the image is the same and that the original has not been changed.
  • Analyze the data on the copy only.
  • Forensic acquisition should be performed correctly or it will invalidate the results of analysis later on.

Imaging Variables

  • Storage Technology (Spinning Disk, Solid State/Flash, RAM, Cloud Storage)
  • File System (FAT, NTFS, HFS+, ext, exFAT)
  • Connection (Firewire, IDE, SATA, SCSI, USB)
  • Forensic System OS (Linux, Mac OS, Windows)
  • Write Blocker (Hardware, Software)
  • Imaging Method (dd, EnCase, FTK Imager)

Imaging

  • Physical acquisition: Bit-for-bit copy of the original hard drive (preferred and gold standard).
    • Includes slack and unallocated space.
    • Error handling.
  • Logical imaging: Acquires the logical drive.
    • Many logical partitions per physical drive.
    • A logical partition can span many physical drives (useful in RAID configurations for reconstruction).

Acquisition Formats

  • Raw format (e.g., output from dd):
    • Bit-by-bit copy of the drive.
    • Generates the same size image as the original.
  • E01 - Expert Witness Format (Encase format):
    • A container of evidence and metadata (including hash values).
  • AFF - Advanced Forensic Format:
    • A container of evidence and metadata.
  • Ex01 - Format for Encase v7:
    • More extensible than E01.
    • A container of evidence and metadata (including hash values).

Output Data Destination

  • To a disk:
    • What happens when the destination disk is bigger than the source disk?
    • What if the acquisition system mounts the destination disk?
  • To a file:
    • Easy to know the boundaries of data, and operating systems will not try to mount it automatically.
    • Images can be compressed, password protected, and broken into smaller pieces.

RAM Acquisition – Order of Volatility

  • Register, cache
  • Main physical memory
  • Virtual memory
  • Network status
  • Running processes
  • Hard drive
  • External storage media

Why Capture Live Memory?

  • Minimal downtime (mission-critical systems, e.g., web servers for online banking).
  • Provide context for static analysis.
  • Some data is only stored in RAM (e.g., encryption keys, private browsing).
  • Long data lifetime even after days.
  • Evolution of the enterprise network (e.g., logon remotely).
  • Evolution of data storage:
    • Terabytes of data on the hard drive: Requires long time to image.
    • Gigabytes of data in RAM.

Acquisition (Live Forensics)

  • Focuses on collecting the most volatile information first.
  • Two strategies:
    • Collect all and examine later (e.g., using FTK imager to capture main memory).
    • Use various tools (typically command-line-based) to probe different aspects of the running system.
  • Tools are placed on a USB/DVD drive with a second drive used as storage.

Locked Screen

  • Criminal Investigation (low risk):
    • Ask suspect for password/PIN (RIPA 2000 (Regulation of Investigatory Powers Act 2000)).
    • Police have the right to forcefully take fingerprints.
  • Password attacks (high risk)
  • Network attacks (high risk)

Integrity of Evidence

  • Ensuring that the evidence has not been tampered with or altered during the forensic process. Maintaining a clear chain of custody is important in ensuring integrity. Hashing can be used to verify integrity.

Write Blocker

  • Devices that allow acquisition of information on a drive without creating the possibility of accidentally damaging the drive contents.
  • May also provide drive protection by limiting the speed of a drive attached to the blocker.
  • Can be either hardware or software-based.

Hardware-Based Write Blocker

  • A device that sits in the connection between a computer and a storage device.
  • It monitors the commands that are being issued and prevents the computer from writing data to the storage device.

Software Based Write Blocker

  • The software write blockers work by modifying the interrupt table, which is used to locate the code for a given BIOS service.

One-Way Hash Function

  • To ensure integrity: a mechanism is required that can create a "fingerprint" of the data.
  • Hash functions allow us to take a variable-length input and produce a fixed-length output that "uniquely" fingerprints the input.
  • Key characteristics:
    • Given M, it is easy to compute h such that H(M)=hH(M) = h
    • Given h, it is hard to computer M (one-way property)
    • Given M, it is hard to find another input M', such that H(M)=H(M′)H(M) = H(M') (strong collision resistance)

Usage of Hashing

  • Digital forensics:
    • Verify the integrity of images.
    • Data filtering: National Software Reference Library database.
  • Security:
    • Passwords
    • Antivirus

Demo

  • Hash
  • Hash collision
  • Fuzzy hash
  • Use hash to identify/locate a file + case management via Autopsy