Digital Forensics Analysis and Validation

Determining What Data to Collect and Analyze

  • Civil investigations are frequently constrained by court orders for discovery, whereas criminal investigations are limited to locating the information specified in the search warrant.

  • Private investigators may be searching for violations of company policy that necessitate the examination of specific items, such as e-mail.

  • When litigation is involved or anticipated in the private sector, the company attorney frequently instructs the investigator to recover as much information as feasible.

  • Scope Creep: An investigation expands beyond the original description because of unexpected evidence you find, prompting the attorney to ask you to examine other areas to recover more evidence.

Approaching Digital Forensics Cases

  • IACIS recommends using recently deleted, virus-checked, and reformatted media for target hard drives.
  • Inventory the components on the suspect's computer and record the computer's condition when it is seized.
  • If possible, remove the original drive from the computer and then examine the CMOS date and time values for static acquisitions.
  • Notate how you obtained data from the suspect device. The instrument you employ should also generate an MD5 or SHA-1 hash for image validation.
  • When scrutinizing the image of the drive's contents, methodically and logically process the data.
  • List every directory and file on the image or device.
  • If feasible, examine the contents of all data files in all folders, beginning with the volume's root directory.
  • Make your best effort to recover the contents of any password-protected files that might be relevant to the investigation.
  • Determine the function of every executable file whose hash value does not match a known value.
  • Maintain control of all evidence and findings, and record everything as your examination progresses.

Using Autopsy to Validate Data

  • Autopsy supports multiple file formats, including raw, Expert Witness, and virtual machine image.
  • Autopsy has an indexed version of the NIST National Software Reference Library (NSRL) of MD5 hashes, and you can incorporate NSRL reference hashes into Autopsy to facilitate searching for and removing known operating system and application files.

Validating Forensic Data

Validating with Hexadecimal Editors

  • Advanced hexadecimal editors have many features that digital forensics tools lack, including the ability to hash specific files or sectors.

  • Learning how to use these tools is essential, particularly if you need to locate a specific file.

  • The recording of hash values allows you to ascertain whether or not data has changed.

  • Using hashes of sectors allows you to search for known file fragments, a procedure known as block-wise hashing.

  • Block Wise Hashing: This process builds a data set of hashes of sectors from the original file, and then examines sectors on the suspect’s drive to see whether any other sectors match.

  • Known File Filter (KFF): Own hashing databases of AccessData that is only available with FTK. It compares known file hash values with files on your evidence drive or image files to see whether they contain suspicious data.

Validating with Digital Forensics Tools

  • The data in image files is hashed using the MD5 and SHA-1 algorithms by commercial digital forensic tools.
  • A second MD5 or SHA-1 hash is performed on the duplicated data and then compared with the original hash value when this picture file is opened in a forensics program to ensure that it is accurate.
  • The forensic program generates an error message indicating that the digital evidence has been corrupted if the hashes don't match.
  • The digital forensics examiner in this situation must produce a fresh forensic image of the original data.
  • The examiner should identify the mismatched hash values in a report that states that the findings might not be correct because the hash values don't match if the original drive is not available, if the image is from a RAM disk, or if the picture is from a system memory dump.

Addressing Data-Hiding Techniques

Hiding Files by Using the OS

  • The earliest method of data concealment was the modification of file extensions.
  • Modern digital forensics equipment To ensure it's accurate, check the file header and compare the file extension.
  • In the event of a discrepancy, the tool marks the file as potentially edited and requiring further investigation.

Hiding Partition

  • Using the Windows disk partitioning tool, diskpart, is one method for hiding partitions.
  • You can make a partition invisible in File Explorer by unassigning its letter using the diskpart delete letter command at the PowerShell line.
  • Use the diskpart assign letter command to reveal the partition.

Marking Bad Clusters

  • Placing delicate or damning data in open or slack space on disk partition clusters is another data-hiding method utilized in FAT file systems.
  • This method calls for the use of outdated tools like Norton DiskEdit.
  • You can designate excellent clusters as bad clusters in Norton DiskEdit's FAT table. The OS then regards these clusters as being useless.
  • These must be converted to good clusters using a disk editor before the OS can access them.

Bit-Shifting

  • Bit-shifting: It changes data from readable code to data that looks like binary executable code.

  • Several home computer users learned how to program in the assembly languages used by computer manufacturers, as well as how to make low-level encryption programs that reorder binary data such that it cannot be read by text editors or word processors.

  • Each byte in a file has its bits rearranged by these applications. These users use an assembler software on the file to jumble the bits in order to secure a file holding confidential or damning data.

  • They use another application to open the file, which puts the scrambled bits back in the correct order.

Understanding Steganalysis Methods

  • Steganography: Hiding messages in such a way that only the intended recipient knows the message is there.

  • Digital watermarking was developed as a way to protect file ownership. The digital watermark used for steganography aren’t usually visible.

  • Using steganography programs, many of which are freeware or shareware, to insert data into a range of files is one technique to conceal data.

  • Cracking the encrypted message is very challenging if you use PGP to encrypt a plaintext file and place the encrypted content into a steganography file, for instance.

  • Steganalysis Methods:

    • Stego-only attack: Used when only the file containing the possible steganography content is available for analysis. This attack is one of the most difficult to perform because all you have to analyze is the suspected steganography file.
    • Known cover attack: Used when the cover-media, the original file with no hidden message, and the stego-media, the converted cover-media file that stores the hidden message, are available for analysis.
    • Known message attack: Used when the hidden message is revealed later, allowing further analysis of new messages.
    • Chosen stego attack: Used when a steganography tool and stego-media were used to hide the message content.
    • Chosen message attack: Used to identify corresponding patterns used in stego-media. This technique creates stego-media and then analyzes them to determine how data is configured in the file.

Examining Encrypted Files

  • Key Escrow: Designed to recover encrypted data if users forget their passphrases or if the user key is corrupted after a system failure.

  • Key escrow is another tool that forensics investigators might employ to try and decrypt data.

  • Although some manufacturers have created key recovery tools, small and medium-sized businesses typically lack the resources required to break encryption methods.

  • If you do come across encrypted material during an investigation, try to convince the suspect to divulge the encryption key.

  • With today's technology, cracking keys with a brute-force attack is practically unfeasible for keys with sizes ranging from 128 to 4096 bits.

  • As quantum computing develops, numerous existing encryption techniques will become outdated.

Recovering Passwords

  • Standalone tools that frequently ask for opening password files or directly accessing the disk or picture file of a suspect:
    • Last Bit
    • AccessData PRTK
    • Ophcrack
    • John the Ripper
    • Passware
  • These tools use a dictionary attack or brute-force attack to crack passwords.
  • Bruteforce attacks use every possible letter, number, and character found on a keyboard.
    • Every password can be cracked using this method, although it may take a long time and a lot of computing power, especially if the password is really long.
  • Hybrid attacks
    • Some programs take into account details like attended schools, pet or relative names, favored colors, and preferred shades of gray.
    • These programs work on the premise that individuals choose to use things they are familiar with, especially when it involves memorizing something private, like a password.
  • Rainbow Table: A file containing the hash values for every possible password that can be generated from a computer’s keyboard.
    • Salting passwords: A new scheme of protecting passwords has been developed that adds extra bits to a password and then hashes it.