COEN 252 Computer Forensics

COEN 252 Computer Forensics Data Analysis Techniques for Hard Drives

Data Analysis Techniques • Create forensic duplicate. • Protect original as best evidence. • Review image file (with tools). • Report. • Testify.

Data Analysis Techniques • Need collaboration between forensics investigators and case workers.

Data Analysis Techniques • Sources of Evidence • Existing Files • Deleted Files • Logs • Special system files (registry, cron) • Email archives, printer spools • Administrative settings • Special types of files (lnk, prefetch)

Data Analysis Techniques • File restoration techniques • FAT, NTFS • By hand with a hexeditor • Specialty tools like Norton undelete • Forensics software like encase, FTK • Mount drive on UNIX system and use UNIX tools (Fatback)

Data Analysis Techniques • Unix system • With a hex editor edit the link count in inodes, file will then be linked to Lost&Found • debugfs to relink a file to Lost&Found in ext2

Data Analysis Techniques Deleted files are overwritten if • Drive is wiped (e.g. part of PGP suite) • New files are created on the partition • New software is installed on the partition • Applications running may update the partition

Data Analysis Techniques Deleted files are overwritten if • The partition stores the %systemroot% directory and Windows modifies it for internal housekeeping. • If the partition contains the web browser cache • If the volume contains the TEMP directory • At system shutdown / startup

Data Analysis Techniques Free, slack and unallocated space • Use a hex-editor  • Use a specialty tool that generates a file by appending all slack and free space • Use a forensics tool  Free: Outside of a partition. Slack: Allocated, but unused overhang in the last cluster of a file Unallocated: Not assigned to a current file.

Data Analysis Techniques First Task: • Generate database of all files • Full path. • MAC-dates & -times. • Logical size of file. • MD5 hash (to counteract evidence deterioration).

Data Analysis Techniques • Generate database of all files • Use MD5 hash to exclude well-known files from investigation.

Data Analysis Techniques • Prepare drive for string searches. • Forensics tools do this automatically. • Need to deal with proprietary formats. • Compressed files need to be uncompressed. • Encrypted files need to be unencrypted.

Data Analysis Techniques • Perform string searches • On UNIX, use grep. • Forensics tools preprocess forensic duplicates.

Data Analysis Techniques • Perform String Searches • The “How” is easier than the “What”. • Investigator and analyst need to work together: • “What are we looking for?” • “What information do we need?”

Data Analysis Techniques Example: The hard drive of a robbery suspect contains numerous references to his “little excursions”. To tie the suspect to the computer, establish usage by suspect alone by: • Finding personal pictures (look for jpg). • Restore old emails. • Restore chat sessions. http://www.signonsandiego.com/news/metro/santana/20010312-9999_1n12compute.html

Data Analysis TechniquesWhat to look for Email • Primary Source of Evidence. • Email in transit is protected by the EPCA and other statutes. • Checking email after transition is treated similar to searches of files.

Data Analysis TechniquesWhat to look for • Print Spooler Files. • Typically deleted right after printing • Usually not be overwritten • Not used by modern printers

Data Analysis TechniquesWhat to look for • Web Cache Evidence • All web browsers cache. • Some delete files after session closes. • Ex.: United States v. Tucker: The government introduced Internet conversations taken from Tucker's computer which showed that while he was looking for pictures he stated that he was into "young action" and would "like to start trading (3)27" and introduced a listing of Internet conversations documenting Tucker's trading of such images. United States Court of Appeals, Eleventh Circuit.No. 97-2767

Data Analysis TechniquesWhat to look for • Swap Files / Virtual Memory Files • Can be very large. • Use Forensics Tools like Encase • Alternatively: Hex Editors, Norton Disk Commander (under Windows)

Windows Data Analysis • Perform keyword searches. • Review Logs. • Review Registry. • Review swap files. • Review special application files: • Internet Cache • Recycle Bin • Printer Spool • Email Files

Windows Data Analysis: Text Searches • Raw Data Level • BinText (Foundstone) • Disk Investigator (K. Soloway) • SectorSpyXP (McCamy, Lexun Freeware) • Forensics Tools • Encase • FTK • Mareswares

Windows Data Analysis: Text Searches

Windows Data AnalysisLogs Windows NT, 2000, XP, 2003, 7 maintain log files • System Log • Application Log • Security Log

Windows Data AnalysisLogs Live System: • Use Event Viewer

Windows Data AnalysisLogs Event Log Dump • Use PsLogList (sysinternal) • dumpel (Win2000 Resource Kit)

Windows Data AnalysisLogs From forensics duplicate • secevent.evt • appevent.evt • sysevent.evt

Windows Data AnalysisLogs Drawbacks • Default security logging is “no logging”. • Do not record IP addresses • Application log uses localized settings. (Forensics workstation will not interpret these.)

Windows Data AnalysisLogs Internet Information Services (IIS) has its own set of logs. • Uses W3C standards as a default

Windows Data AnalysisLogs • Need to be enabled. • More important for incidence response than for law enforcement. • Get HTTP status codes.

Windows Data AnalysisLogs • Many other applications log: • Internal firewalls. • Create your own log from the timestamp of files around critical times. • FileList (www.forensics-intl.com) will do this for you.

Windows Data AnalysisReviewing Relevant Files • Recycle Bin • Folder Recycled in Win95/98. • Folder Recycler in WinNT/2000/XP. • Date and Time of Deletion in • System file INFO in Win95 • System file INFO2 in Win98 • Information available in Win2000, WinXP

Windows Data AnalysisReviewing Relevant Files • Windows moves deleted file into the recycle bin. • It deletes from there. • Thus, files can be retrieved from deleted recycle bin entries.

Windows Data AnalysisReviewing Relevant Files • $Logfile entry in the MFT contains the log of all file system transactions • Deletion of a file leaves several entries in $Logfile • Not unusual to find files that are no longer on the disk • Shows that file was used by the system

Windows Data AnalysisReviewing Relevant Files • Shortcuts can contain relevant information. • Stored in the desktop folder. A special agent of the Illinois Attorney General’s Office investigated a case involving child pornography. The agent located a shortcut file in the Windows/Desktop folder whose target was a screensaver program. Upon examining the screensaver program, the agent found that it caused 30 images depicting child pornography to be displayed on the computer’s monitor when the shortcut was activated. Casey, p. 153

Windows Data AnalysisReviewing relevant files • Prefetch files • Give better performance • Used to collect information on what is necessary to run a program • Stored in Windows/prefetch • Various tools to parse prefetch files • Forensic significance: • Suggests that program has been executed • Gives last time application was run • Gives number of runs

Reviewing Relevant Files • Scheduled Tasks • Windows 2000, XP, 2003 in Windows\Tasks • Windows 7 Windows\System32\Tasks • .job files • Scheduled task log SchedLgU.txt in Windows\Tasks

Windows Data AnalysisReviewing Relevant Files • JUMP lists • List of files recently opened in Windows 7 • Appdata\Roaming\Microsoft\Windows\Recent\AutomaticDestinations • First 16 characters of file name identify application • Uses .lnk file format • Gives time stamps • Various analyzers exist

Windows Data AnalysisReviewing Relevant Files • Thumbs.db (System file) • Contains thumbs pictures for folder. • Not perfectly synchronized with folder. • Deleted images might still be available.

Windows Data AnalysisReviewing Relevant Files • Temporary files • Files with extension tmp • Created by many applications • Emails with large attachments: • Attachments are probably stored as temp files. (Depends on email system.) • Look for file extensions .tmp .

Windows Data AnalysisReviewing Relevant Files • Internet Explorer (as well as other browsers) use a cache. • index.dat contains internet explorer cached websites. • Written in binary. • Use Pasco from Foundstone.

Windows Data AnalysisReviewing Relevant Files

Windows Data AnalysisReviewing Relevant Files • Browser Cache • C:\Documents and Settings\ Username\ Local Settings\Temporary Internet Files Or • C:\Program Files\Netscape\Users\ Username\Cache

Windows Data AnalysisReviewing Relevant Files

Windows Data AnalysisReviewing Relevant Files • Cookies can be partially decyphered. • Use galleta from foundstone.

Windows Data AnalysisReviewing Relevant Files • Typically, concatenate all cookies. • Redirect galleta into an excel file. • Investigate the excel file.

Windows Data AnalysisReviewing Relevant Files • Dial-up Networking • rasautou –s gives autodial addresses

Windows Data AnalysisRegistry • Database that stores settings and options for 32b MSWin OS • Contains information and setting for • Hardware • Software • Users • Preferences

COEN 252 Computer Forensics