CSN11121/CSN11122 System Administration and Forensics Introduction to Digital Forensic 20/10/2011 r.ludwiniak@napier.ac.uk
Lecture Objectives 1. History and definition of Digital Forensics 2. Context for an investigation 3. An overview of the main theoretical concepts 4. Storage Devices 5. Partitions
Recommended Reading 1. B Carrier, File System Forensic Analysis , March 27 2005, Addison-Wesley Professional 2. H Carvey, Windows Forensic Analysis DVD Toolkit , 11th June 2009, Syngress 3. C Pogue, Unix and Linux Forensic Analysis DVD Toolkit , 30th June 2008, Syngress 4. M.E. Russinovich and D.A. Solomonm, Windows Internals 5th Edition , 7th January 2009, Microsoft Press (chapter 1 to chapter 3) 5. K.J. Jones, Real Digital Forensics , 3rd October 2005, Addison-Wesley Professional
Online Resources • Digital Forensic Research Workshop (DFRWS) – http://www.dfrws.org – Challenges – Projects • National institute of Standards and technology (NIST) – http://www.nist.gov • Journal - Digital Investigation – http://www.sciencedirect.com • Forensics Wiki – http://www.forensicswiki.org
DIGITAL FORENSICS
It is impossible for the criminal to act, especially considering the intensity of a crime, without leaving traces of his presence. - Edmond Locard
With contact between two items, there will be an exchange - Locard’s exchange principle
Computer Forensics • 1984 – Scotland Yard: Computer Crime Unit – FBI computer forensics departments • 1990 – Computer Misuse Act (CMA)
Digital Forensics The use of scientifically derived and proven methods towards the preservation, collection, validation, identification, analysis, interpretation, documentation, and presentation of digital evidence derived from the digital sources for the purpose of facilitation or furthering the reconstruction of events found to be criminal, or helping to anticipate unauthorized actions shown to be disruptive to planned operations. - Digital Forensics Research Workshop
Investigative Context Primary Secondary Environment Objectives Objectives Law Enforcement Prosecution Post-Mortem Continuity of Real-Time/Post- Military IW Ops Prosecution Operations Mortem Business and Continuity of Real-Time/Post- Prosecution Industry Service Mortem
Digital Investigation A digital investigation is a process where we develop and test hypotheses that answer questions about digital events. This is done using the scientific method where we develop a hypothesis using evidence that we find and then test the hypothesis by looking for additional evidence that shows the hypothesis is impossible. Digital Evidence is a digital object that contains reliable information that supports or refutes a hypothesis. - B. Carrier, 2006 File System Forensic Analysis,
Static vs. Live • Traditional Static Investigations – Hard disk or some other form of static resource – Data at a resting state – Able to image, return to original source and conduct further analysis • Live investigation – Occurs when the machine is running
Volatile Investigations • Has impact on device under investigation • Not repeatable • Does not fit in with classic forensic investigative models • OS must be trusted • New questions cannot be asked later
Investigation Process • Acquisition – Preservation – Collection – Verification • Analysis – Search for evidence – Hypothesis Creation – Confirm or refute hypothesis with evidence • Presentation – Report the findings of the investigation – Objective manner
Characteristics of Evidence 1. Data can be viewed at different levels of abstraction 2. Data requires interpretation 3. Data is Fragile 4. Data is Voluminous 5. Data is difficult to associate with reality
Characteristics of Evidence 1. Data can be viewed at different levels of abstraction 2. Data requires interpretation 3. Data is Fragile 4. Data is Voluminous 5. Data is difficult to associate with reality
Characteristics of Evidence 1. Data can be viewed at different levels of abstraction 2. Data requires interpretation 3. Data is Fragile 4. Data is Voluminous 5. Data is difficult to associate with reality
Characteristics of Evidence 1. Data can be viewed at different levels of abstraction 2. Data requires interpretation 3. Data is Fragile 4. Data is Voluminous 5. Data is difficult to associate with reality
Characteristics of Evidence 1. Data can be viewed at different levels of abstraction 2. Data requires interpretation 3. Data is Fragile 4. Data is Voluminous 5. Data is difficult to associate with reality
Best Practice • ACPO – Principle 1 - No action taken by law enforcement or their agents should change data held on an electronic device or media which may subsequently be relied upon in Court. – Principle 2 - In exceptional circumstances where a person finds it necessary to access original data held on an electronic device or media, that person must be competent to do so, and be able to give evidence explaining the relevance and the implications of their actions.
Best Practice • ACPO – Principle 3: An audit trail or other record of all processes applied to computer based electronic evidence should be created and preserved. An independent third party should be able to examine those processes and achieve the same result.
Best Practice • ACPO – Principle 4: The person in charge of the investigation (the case officer) has overall responsibility for ensuring that the law and these principles are adhered to.
Tools • 1 st Generation – Command Line, Task oriented, Act on original data • 2 nd Generation – GUI interface, capable of making copies, multi- functional • 3 rd Generation – Work on distributed systems and live systems – Live… ?
Tool Characteristics • Verifiable - Can it be shown to behave within certain bounds of behaviour? • Reproducibility - Can a tool produce results which are reproducible? • Non-interference - Are the results obtained with a tool that has open source code, and thus does not contain obfuscated code? • Usability - Can the tool help the investigator review and make decisions about the layer of abstraction being viewed? • Comprehensive - Can the tool allow the investigator access the data output of the tool at any given level of abstraction?
Future • Research Challenges facing the investigation community – S.L. Garfinkel, Digital forensics research: The next 10 years , Digital Investigation, vol. 1, no. 7, pp. 64- 73, 2010 – “The coming Digital Forensics Crisis”
Challenges • Size of storage devices • Embedded flash devices • Proliferation of operating systems and file formats • Multi-device analysis • Pervasive Encryption • Cloud computing • RAM-only Malware • Legal Challenges decreasing the scope of forensic investigations
STORAGE DEVICES & PARTITIONS
Required Reading D. Byers, N. Shahmehri, “Contagious errors: Understanding and avoiding issues with imaging drives containing faulty sectors” , Digital Investigation, no. 5, pp. 29 – 33, 2008 A. Jones, C. Meyler, “What Evidence is left after disk cleaners?” , Digital Investigation, no. 1, pp. 183 – 188, 2004 B.J. Nikkel, “Forensic Analysis of GPT disks and GUID partition tables” , Digital Investigation, no.6, pp. 39-47, 2009
Required Reading M. Belford, “Methods of discovery and exploration of Host Protected Ares on IDE storage devices that conform the ATAPI-5” , Digital Investigation, no.2, pp. 268-275, 2006 K. MacDonald, “To Image a Macintosh”, Digital Investigation, no. 2, pp. 175 -179, 2006 J. R. Lyle, “A strategy for testing hardware write block devices” , Digital Investigation, no. 3, pp. 3-9, 2006
Storage Media • Hard disks, floppy disk, thumb drives etc. • Hard disks are the richest in digital evidence • Integrated Disk Electronics (IDE) or Advanced Technology Attachment (ATA) • Higher performance SCSI drives • Fireware is an adaptation of SCSI standards that provides high speed access to a chain of devices • All hard drives contain platters made of light, rig-hid material such aluminum, ceramic or glass
More on Hard Drives – Platters have a magnetic coating on both sides and spin between a pair of read/write heads – These heads move like a needle on top of the old LP records but on a cushion of air created by the disk above the surface – The heads can align particles of magnetic media called writing, and can detect how the magnetic particles are assigned – called reading – Particles aligned one way are considered “0” and aligned another way “1”
Hard Disks Actuator Arm Spindle Platters Head cc by-sa, Cambridge Cat/Anna, flickr.com
Storage • Cylinders are the data tracks that the data is being recorded on • Each track/cylinder is divided into sectors that contain 512 bytes of information – 512*8 bits of information • Location of data can be determined by which cylinder they are on which head can access them and which sector contains them or CHS addressing • Capacity of a hard drive # of C*H*S*512
Hard Disk Platters
Tracks and Sectors Track Sector (512bytes)
Tracks and Sectors / . Track #0 - 0 3 � 1 2 Track #1, Sector #7
Recommend
More recommend
