Comprehensive Study Notes: Digital and Network Forensics

FUNDAMENTALS AND OBJECTIVES OF NETWORK FORENSICS

• Primary Objectives of Network Forensics:

  • The central goal is the identification, preservation, collection, and analysis of evidence gathered from network sources—such as network traffic, logs, and captured packets—to reconstruct a sequence of events regarding security incidents or criminal activity.

  • Evidence Identification: Determining what data sources (routers, firewalls, IDS) contain relevant information.

  • Intrusion Detection: Identifying unauthorized access or patterns indicative of a cyberattack.

  • Data Recovery: Reconstructing communication sessions (e.g., emails, file transfers) from fragmented packet data.

  • Attribution: Identifying the source or the origin of an attack to hold perpetrators accountable.

  • Real-time Monitoring: Observing network behavior to detect and mitigate ongoing threats immediately.

• Key Terminology in Forensic Investigations:

  • Digital Forensics: The branch of forensic science encompassing the recovery and investigation of material found in digital devices, frequently in relation to computer crime. It involves the use of scientifically derived and proven methods toward the preservation, collection, validation, identification, analysis, interpretation, documentation, and presentation of digital evidence.

  • Network Evidence: Any data or information related to network communications that can be used in a legal proceeding. This includes packet captures ($PCAP$ files), firewall logs, server logs, network flow data ($NetFlow$), and traffic through proxy servers.

  • Primary Crime Scene: The initial location where a crime was committed or where the most significant physical or digital evidence is located (e.g., the server room where a breach originated).

  • Secondary Crime Scenes: Additional locations related to the crime where evidence may be found, such as the remote laptop used by the attacker or a third-party server used for data exfiltration.

  • Copyright: A legal right that grants the creator of an original work exclusive rights to its use and distribution, usually for a limited time. In forensics, copyright issues often arise in cases of software piracy or intellectual property theft.

  • Trademark: A recognizable sign, design, or expression which identifies products or services of a particular source. Forensic investigators may look for trademark infringement in phishing sites or counterfeit digital products.

CORE PRINCIPLES AND DATA STORAGE MECHANISMS

• The CIA Triad in Cybersecurity and Forensics:

  • Confidentiality: Ensuring that sensitive information is accessible only to those authorized to have access. In forensics, a breach of confidentiality often involves unauthorized data exfiltration.

  • Integrity: Maintaining the consistency, accuracy, and trustworthiness of data over its entire life cycle. Forensic investigators use hashing to ensure the integrity of evidence remains intact ($MD5$, $SHA-256$).

  • Availability: Ensuring that information and resources are available to authorized users when needed. Denial of Service ($DoS$) attacks are primary examples of threats to availability.

• Slack Space in Digital Forensics:

  • Slack space refers to the unused space between the end of a file and the end of the last cluster assigned to that file.

  • Calculation: If a cluster size is $4096\,\text{bytes}$ and a file is only $1000\,\text{bytes}$, the remaining $3096\,\text{bytes}$ is slack space. This area can contain residual data from previously deleted files, making it a valuable target for forensic recovery.

• Allocated vs. Unallocated Space:

  • Allocated Space: Portions of the storage medium that are currently in use and assigned to a specific file by the file system. The file system maintains pointers to these sectors.

  • Unallocated Space: Space on the drive that is not currently assigned to a file. It may be designated as "free" by the file system, but it often contains data from deleted files that have not yet been overwritten. This is the primary area where file carving takes place.

• Chain of Custody:

  • The chain of custody is a chronological documentation or paper trail that records the sequence of custody, control, transfer, analysis, and disposition of physical or electronic evidence.

  • Significance: It is crucial for ensuring the admissibility of evidence in a court of law. Any gap or inconsistency in the documentation can lead to the evidence being suppressed, as its integrity cannot be guaranteed.

ARTIFACT ANALYSIS AND FILE SYSTEM RECOVERY

• File Carving and Evidence Recovery:

  • File carving is the process of reassembling files from raw data (often from unallocated space) without the assistance of file system metadata.

  • Significance: It allows investigators to recover deleted files or fragments of files from drives where the file system structure is damaged or missing. It relies on "Magic Bytes" (headers and footers) to identify file types (e.g., $\text{0xFF D8 FF}$ for a $JPEG$).

• Windows Registry in Investigations:

  • The Registry is a hierarchical database that stores configuration settings and options on Microsoft Windows operating systems.

  • Forensic Value: It contains information about recently accessed files ($MRU$ lists), connected hardware devices, user account activity, installed software, and system boot settings. It is essentially a "log" of user and system behavior.

• Significance of hiberfil.sys:

  • The hiberfil.sys file is created by the system when a computer enters hibernation mode. It contains a snapshot of the entire contents of the $\text{RAM}$ at that moment.

  • Forensic Value: Because it captures the state of the $\text{RAM}$, investigators can find encryption keys, open documents, passwords, and running processes that were present at the time of hibernation, even if the computer is now powered off ($Dead system$).

LIVE VS. DEAD SYSTEMS AND VOLATILE EVIDENCE

• Live vs. Dead Systems:

  • Live System: A computer that is currently powered on and running. Forensics on live systems focuses on volatile data found in $\text{RAM}$ and network connections.

  • Dead System: A computer that is powered off. Forensics focuses on persistent data stored on hard drives, $\text{SSDs}$, and other non-volatile media.

• Challenges in Digital Forensics Investigations:

  • Encryption: Data may be protected by $\text{BitLocker}$, $\text{FileVault}$, or third-party tools, making it unreadable without keys.

  • Anti-forensics: Techniques used by suspects to hide or destroy evidence (e.g., disk wiping, steganography).

  • Data Volume: The sheer amount of data (Terabytes) that must be processed and analyzed index.

  • Legal/Jurisdictional Issues: Data stored in the cloud may reside in different countries with different privacy laws.

• Memory Imaging Tools:

  • FTK Imager: A popular tool used for capturing $\text{RAM}$ on live systems. It creates a physical image of the memory, which can later be analyzed using tools like $\text{Volatility}$.

• Volatile Data and RAM:

  • Volatile Data: Data that is lost when the power to a computer is disconnected. This includes contents of $\text{RAM}$, process tables, and network cache.

  • Why RAM is Critical: It contains a wealth of evidence not found on the hard drive, such as active network connections, decrypted passwords, clipboard data, and malware residing only in memory ($\text{fileless malware}$).

CYBERCRIME CATEGORIES AND INVESTIGATION PROCESSES

• Sex Crimes and Cybersecurity:

  • Definition: Crimes involving illegal sexual acts or content facilitated through digital platforms.

  • Investigation Process:

    1. Identification: Detecting illegal activity or receiving reports.

    2. Preservation: Securing the suspected devices (computers, mobile phones).

    3. Collection: Ensuring images or videos are collected without violating privacy laws surrounding legitimate data.

    4. Analysis: Using specialized tools to find hidden folders, deleted messages, and metadata on images ($EXIF$ data) to determine location and time.

    5. Reporting: Detailed documentation of findings for legal proceedings.

  • Types: Child sexual abuse material ($CSAM$), cyberstalking, online grooming, and non-consensual image sharing (revenge porn).

• Corporate Espionage:

  • Definition: The illegal and unethical theft of trade secrets or intellectual property from a competitor to gain an unfair advantage.

  • Methods:

    • Social Engineering: Phishing or pretexting to gain access to internal networks.

    • Insider Threats: Disgruntled or bribed employees stealing data.

    • Malware: Installing spyware or keyloggers on corporate systems.

    • Physical Theft: Stealing laptops or storage devices.

  • Common Targets: Proprietary formulas, strategic business plans, client lists, and research and development (R&D) data.

DATA TYPES AND NETWORK ATTACKS

• Active vs. Latent Data:

  • Active Data: Information that is readily available and visible to the user (e.g., documents, spreadsheets, system files). Importance: Provides immediate insight into the suspect's activities.

  • Latent Data: Data that is not visible to the average user and requires specialized tools to recover (e.g., deleted files, slack space, swapped files). Importance: Often holds the "smoking gun" evidence that a suspect tried to hide.

• Legacy Data:

  • Definition: Information stored in outdated formats or on obsolete hardware (e.g., floppy disks, magnetic tapes).

  • Challenges: Difficulty in finding working hardware to read the media, software incompatibility, and physical degradation of the media over time.

• DoS vs. DDoS Attacks:

  • Denial of Service (DoS): A single source flooding a target with traffic to overwhelm its resources and make it unavailable.

  • Distributed Denial of Service (DDoS): Multiple sources (often a $\text{botnet}$) attacking a single target simultaneously. This is much harder to mitigate because blocking a single $\text{IP}$ address is ineffective.

• Metadata:

  • Definition: Data about data. It provides context to a file without describing its primary content.

  • Importance: Includes file creation dates, modification times, author names, and even GPS coordinates for photos. It helps establish timelines and ownership.

FORENSIC REPORTING AND MOBILE/PDA DEVICES

• Forensic Reports:

  • Primary Purpose: To present the findings of an investigation in a clear, documented, and professional manner that can be understood by non-technical audiences, such as judges and juries.

• Personal Digital Assistants (PDAs) and Mobile Devices:

  • Evidence Retrieved: Call logs, contacts, calendar entries, notes, and messages.

  • Generic States:

    1. Active State: The device is on and functional.

    2. Locked State: The device requires a PIN, pattern, or biometric to access.

    3. Powered Off State: Data is at rest, and full disk encryption may be active.

  • Minimizing Interaction: On live systems, interaction must be minimized to avoid altering volatile data (like memory-resident malware) or triggering self-destruct mechanisms.

NETWORK ATTACKS AND INVESTIGATION APPROACHES

• Wired vs. Wireless Network Attacks:

  • Wired Attacks: Require physical access to the network infrastructure, such as plugging into an Ethernet port or tapping a cable.

  • Wireless Attacks: Exploiting vulnerabilities in airwave signals (e.g., $\text{Wi-Fi}$ eavesdropping, Man-in-the-Middle attacks on $\text{WPA2/WPA3}$).

• Common Wired Attacks:

  • MAC Spoofing: Impersonating a legitimate device to bypass network access control.

  • ARP Poisoning: Redirecting traffic meant for one device to the attacker's device.

  • VLAN Hopping: Gaining unauthorized access to traffic on other $\text{VLANs}$ on the same switch.

• Investigation Approaches:

  • Traffic Analysis: Examining packet headers and payloads.

  • Log Review: Checking DHCP logs, switch logs, and authentication logs to see which MAC addresses were active and when.

LOGGING, MONITORING, AND THE CYBER KILL CHAIN

• Logs and Monitoring:

  • Logs: Records of events occurring within an organization's systems (e.g., login attempts, file accesses).

  • Logging: The process of generating and storing these records.

  • Log Monitoring: The real-time or periodic review of logs to detect unauthorized activity.

  • Security Monitoring: Important for the early detection of breaches, ensuring compliance, and providing an audit trail for forensic investigations.

• The Cyber Kill Chain:

  • Developed by Lockheed Martin, it describes the stages of a cyberattack:

    1. Reconnaissance: Researching and identifying targets.

    2. Weaponization: Creating a deliverable malicious payload.

    3. Delivery: Transmitting the weapon to the target (e.g., phishing email).

    4. Exploitation: Triggering the malicious code to exploit a vulnerability.

    5. Installation: Installing malware on the victim's system.

    6. Command and Control (C2): Establishing a remote link to manipulate the victim's device.

    7. Actions on Objectives: Finalizing the goal, such as data exfiltration.

ADVANCED TECHNIQUES: STEGANOGRAPHY, HASHING, AND HONEYPOTS

• Steganography:

  • Definition: The practice of hiding information within another non-secret medium (e.g., hiding a text file inside an image).

  • Cybercrime Use: To bypass data loss prevention ($DLP$) systems or communicate secretly between attackers.

  • Steganalysis: The process of detecting and extracting hidden data. Tools look for statistical anomalies in carrier files.

  • Complexity vs. Cryptography: Cryptography is about making a message unreadable (but its presence is known). Steganography is about making the message's very existence invisible.

• Hashing:

  • Definition: A mathematical algorithm that maps data of any size to a bit string of a fixed size. It is a one-way function.

  • Role in Integrity: If even one bit of evidence changes, the hash value will be entirely different. Common algorithms include $MD5$ and $SHA-256$.

  • Hash Collisions: Occur when two different inputs produce the same hash output. While rare, they can be used to question the uniqueness and integrity of evidence in court.

• Honeypots:

  • Definition: Decoy systems designed to lure attackers and study their methods.

  • High-interaction: Simulates a full production system, allowing for deep analysis of attacker behavior.

  • Low-interaction: Simulates only specific services or protocols; easier to deploy but captures less detail.

  • Concerns: Legal issues regarding entrapment and ethical concerns if the honeypot is used as a pivot point to attack others.

ELECTRONIC MAIL AND ANTI-FORENSICS

• Email Forensics:

  • Email Headers: Contain critical metadata such as the sender's $\text{IP}$ address, timestamps, and the mail servers the message passed through.

  • Tracing Spoofing: Examining the "Received" fields to identify the true origin and checking $SPF$, $DKIM$, and $DMARC$ records.

  • Phishing Indicators: Urgent language, mismatched $\text{URLs}$, generic greetings, and suspicious attachments.

• Anti-Forensics:

  • Challenges: Makes the investigator's job harder by hiding, altering, or destroying evidence.

  • Techniques: Data wiping (overwriting data), encryption, and onion routing ($\text{Tor}$) to hide network traffic.

  • Counter-Measures: Using memory forensics (to find keys), hardware-level analysis, and searching for artifacts created by the anti-forensic tools themselves.

MODERN INVESTIGATIONS: CLOUD AND MOBILE FORENSICS

• Cloud Forensics:

  • Challenges: Multi-tenancy (data from multiple users on one server), lack of physical access to hardware, and legal jurisdiction (data may move between countries).

• Mobile Forensics:

  • Significance: Most modern communications occur on smartphones.

  • Data Types: $\text{SMS}$, $\text{GPS}$ locations, app-specific data (WhatsApp, Signal).

  • Limitations: Modern encryption ($\text{APFS}$, File-based encryption) in iOS and Android makes it nearly impossible to extract data without the passcode or biometric access.

• Write Blockers:

  • Definition: Devices that permit read-only access to storage media while preventing any write operations.

  • Hardware vs. Software: Hardware blockers are physical bridges placed between the computer and the evidence drive; they are considered more reliable. Software blockers are drivers that tell the OS not to write to a specific volume.

  • Negative Outcome: Without a write blocker, the simple act of plugging a drive into a computer can alter file metadata (like accessed dates), destroying the original integrity of the evidence.

INCIDENT RESPONSE AND REMEDIATION

• Digital Forensics in Incident Response (IR):

  • Forensics provides the "how" and "why" after an IR team has contained a threat. It helps determine the extent of the damage.

• Root Cause Analysis:

  • Identifying the fundamental vulnerability that allowed the breach to occur (e.g., an unpatched server or a weak password). This prevents future recurrences.

• Post-Breach Remediation:

  • Forensics supports remediation by identifying exactly which systems were compromised, allowing for targeted cleanups rather than wiping the entire network environment.