Dark Web Forensics

• Introduction to Dark Web Forensics

  • Focus on digital forensics within the context of the dark web.

  • Understanding and conducting forensic analysis related to activities in the dark web is crucial for technicians.

• Overview of Topics Covered

  1. Understanding the dark web.

  2. Identifying traces of the Tor Browser during investigations.

  3. Tor Browser forensics.

  4. Overview of collecting and analyzing memory dumps.

Understanding the Dark Web

• Purpose and Composition of the Dark Web

  • Established for clandestine communication.

  • Hosts both criminal activities and governmental organizations engaging in covert operations.

• Search Engine Limitations

  • Search engines like Google and DuckDuckGo only provide access to the surface web.

  • Surface web is akin to the tip of an iceberg, representing only a small fraction of total internet content.

• Deep Web vs. Dark Web

  • The deep web contains content that is not indexed by search engines, such as cloud storage accounts (e.g., Dropbox, Street camera logs) which are secured by authentication measures.

  • The dark web is a smaller sub-section of the deep web.

  • It is hidden and requires specific tools or configurations to access.

  • Predominantly accessed via the Tor network, protecting user anonymity.

The Tor Network

• Tor Browser and Its Functions

  • A browser based on Firefox, employing multi-layered encryption through a network that ensures user anonymity.

  • Uses a concept known as The Onion Router (TOR) for its functionality, where data is layered in encryption for privacy.

• Tor Relay Structure

  • Entry Relay: Users connect to the Tor network via entry nodes, which can see the user’s IP address. (connects you and hides what you're searching but can still be found within first node)

  • Middle Relay: Traffic is encrypted here, making it harder to trace.

  • Exit Relay: Exits the Tor network to reach the final destination server.

• Additional Browsers

  • Other browsers can access the dark web but Tor remains the most well-known.

• Navigating the Dark Web

  • Users must ensure anonymity when accessing the dark web to avoid tracking and potential legal issues.

  • Suggested precautionary measures include using a virtual machine (VM) instead of personal devices, running different operating systems (e.g., Ubuntu) for research, and properly configuring Tor installations.

  • While browsing on the internet through TOR if you still have background things running especially if they involve internet, this can also be used to trace back to someone.

• TOR Bridge Node

  • The tor relay nodes are publicly available in the directory list, but the bridge note is different from a relay node

  • Bridge notes act as a proxy to the Tor network which implies that they follow different configuration settings to forward the traffic to the entry node

  • This makes it difficult for organizations or governments to censor the usage of Tor and list the bridge notes on the public directory of Tor nodes

Dark Web Forensics

• Purpose of Dark Web Forensics

  • Explaining the necessity of forensics in tracing illicit activities conducted on the dark web.

  • This can include tracking criminal behaviors and insider threats leading to organizational attacks.

• Forensics Methodology

  1. Utilizing tools like the Tor Browser to investigate and extract information from malicious users.

  2. Collect data from various sources (websites, emails, timestamps) to understand the scope of the threat.

Practical Tools for Investigation

• Command Line Insights

  • Investigating active connections using netstat command in Windows.

  • Identifying connections to specific TCP ports (9150 and 9151) which are associated with Tor activities.

• Registry Artifacts

  • Analyzing registry entries to locate information on the Tor Browser execution and associated data paths.

  • Finding paths under registry keys like for Windows HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher.

  • 
    

• Memory Acquisition Techniques

  • Dumping volatile data from RAM to identify actions performed while the Tor Browser is open.

  • Essential tools for memory acquisition include:

    • FTK Imager

    • Live RAM capture tools.

Challenges of Dark Web Forensics

• Anonymity

  • Anonymity is a fundamental characteristic of the dark web, complicating tracking efforts.

• Encryption Complexity

  • Data encryption in the dark web further complicates forensic analysis.

• Jurisdictional Concerns

  • Criminal activities often span multiple jurisdictions, complicating legal considerations and potential prosecution.

Conclusion

• Emphasis on the importance of familiarizing oneself with dark web concepts and practices, including the Tor Browser and forensic techniques for collecting and analyzing data.

• Encouragement to proceed with caution when performing forensic activities in the dark web environment to mitigate risks and legal implications.

• Next Module Preview

  • The upcoming module will focus on email forensics, continuing the exploration of digital forensic techniques.