1 Determining What Data to Analyze

!  Examining and analyzing digital evidence depends on:

!  Nature of the case
!  Amount of data to process
!  Search warrants and court orders
!  Company policies
Analysis and Validation
!  Scope creep
!  Investigation expands beyond the original description
COMP 2555: Principles of Computer Forensics
Autumn 2014
http://www.cs.du.edu/2555

L11: Analysis and Validation

2 Approaching Computer Forensics Cases
3 Using AccessData Forensic Toolkit

!  Process the data methodically and logically !  Supported file systems: FAT12/16/32, NTFS, Ext2fs, and
!  Basic steps for all computer forensics investigations Ext3fs
!  List all folders and files on the image or drive !  FTK can analyze data from several sources, including
image files from other vendors
!  If possible, examine the contents of all data files in all folders
!  Starting at the root directory of the volume partition
!  FTK produces a case log file
!  For all password-protected files that might be related to the !  Searching for keywords
investigation !  Indexed search
!  Make your best effort to recover file contents !  Live search
!  Identify the function of every executable (binary or .exe) file !  Supports options and advanced searching techniques, such as
that doesn’t match known hash values stemming, phonics, synonyms and fuzzy search
!  Maintain control of all evidence and findings, and document !  Analyzes compressed files
L11: Analysis and Validation

L11: Analysis and Validation

everything as you progress through your examination !  You can generate reports
!  Using bookmarks
4 Validating with Hexadecimal Editors
5 Validating with Forensics Programs

!  Advanced hexadecimal editors offer many features not !  Commercial computer forensics programs have built-in
available in computer forensics tools validation features
!  Such as hashing specific files or sectors !  Using hash values to discriminate data
!  AccessData has a separate database, the Known File Filter
!  Hex Workshop provides several hashing algorithms (KFF)
!  Such as MD5 and SHA-1 !  Filters known program files from view, such as MSWord.exe, and
identifies known illegal files
!  KFF compares known file hash values to files on your
!  Hex Workshop also generates the hash value of selected evidence drive or image files
data sets in a file or sector !  Periodically, AccessData updates these known file hash values
and posts an updated KFF

L11: Analysis and Validation

L11: Analysis and Validation

6 Data Hiding Techniques
7 File Manipulation

!  File manipulation !  Easiest method to hide data on a live file system

!  Filenames and extensions !  Change the name or extension of the file in question
!  Hidden property !  Change the name to a very common one
!  Segmentation !  Many malwares run as svchost.exe, which is a very common
process name in Windows
!  Disk manipulation
!  Change the extension and place in a folder with similar
!  Hidden partitions files
!  Bad clusters !  Name your file as MSODBC32.dll and place in WinNT/
!  Encryption System32
!  Bit shifting !  This folder is full of .dll files
!  Steganography !  Even the very experienced system administrators do not
know the names of all dll files
L11: Analysis and Validation

L11: Analysis and Validation

!  Rootkits !  File signature analysis
!  Identifying a file by looking inside it
8 File Manipulation (contd.)
9 File Manipulation (contd.)

!  Using the hidden property of files !  File segmentation

!  Almost every file system allows a file to be specified as !  Back in the old DOS days, a large file must be split to be able
hidden to carry in floppy diskettes
!  Windows: check box in file properties to specify as hidden !  Split a file into multiple segments of arbitrary size
!  Unix: any file name starting with a dot is hidden !  Store each segment in a separate location
!  Not difficult to detect !  In the disk drive
!  As an alternate data stream
!  Either change system settings to display all files
!  In the registry
!  ls -a
!  …

L11: Analysis and Validation

L11: Analysis and Validation

10 Hiding Partitions
11 Hiding Partitions (contd.)

!  Delete references to a partition using a disk editor

!  Re-create links for accessing it
!  Use disk-partitioning utilities
!  GDisk
!  PartitionMagic
!  System Commander
!  LILO
!  Account for all disk space when analyzing a disk
L11: Analysis and Validation

L11: Analysis and Validation

12 Marking Bad Clusters
13 Bit-shifting

!  Common with FAT systems !  Old technique

!  Place sensitive information on free space !  Shift bit patterns to alter byte values of data
!  Use a disk editor to mark space as a bad cluster !  Make files look like binary executable code
!  To mark a good cluster as bad using Norton Disk Edit !  Tool
!  Type B in the FAT entry corresponding to that cluster !  Hex Workshop
!  WinHex
!  In Linux, associate good blocks with the bad blocks
inode

L11: Analysis and Validation

L11: Analysis and Validation

14 Using Steganography to Hide Data
15 What’s Common Between These?

!  Greek for “hidden writing”

!  Steganography tools were created to protect
copyrighted material
!  By inserting digital watermarks into a file
!  Suspect can hide information on image or text
document files
!  Most steganography programs can insert only small amounts
of data into a file
!  Very hard to spot without prior knowledge
!  Tools: S-Tools, DPEnvelope, jpgx, and tte
L11: Analysis and Validation

L11: Analysis and Validation

16 Both Has This In There!!
17 Rootkits

!  A collection of tools and utilities that masks the presence of

malicious activity in a system
!  An attacker may devote a whole lot of time in compromising a
system
!  Would want to keep the obtained privileges as long as possible
!  Replace system binaries to report that everything is normal
!  Example: listing processes will not show processes created by the
attacker
!  Hook APIs
!  Example: filter the output of common programs
!  Rootkits operating at the kernel level are very dangerous

L11: Analysis and Validation

L11: Analysis and Validation

!  The core functionality of the operating system is questionable

18 Rootkits (contd.)
19 Recovering Passwords

!  Detection involves obtaining multiple perspectives of !  Techniques

the problem and look for inconsistencies !  Dictionary attack
!  Look for known rootkit files !  Brute-force attack
!  Use different tools to obtain running process lists !  Password guessing based on suspect’s profile
!  Different tools generate the lists using different techniques !  Many systems do not directly store passwords, but their
Rootkit processes may show up on one
! 
hashes
!  Analyze installed services (both running and halted) !  Knowing the hash can make recovery attempts faster
!  Analyze registry for errant services
!  Tools
!  Analyze system from a remote system
!  AccessData PRTK
!  Some hooked APIs can be bypassed this way
!  Advanced Password Recovery Software Toolkit
!  Use tools to monitor system files added/deleted
L11: Analysis and Validation

L11: Analysis and Validation

!  John the Ripper
!  Prevention is better than cure!
20 Performing Remote Acquisitions
21 References

!  Remote acquisitions are handy when you need to image !  Ch 9: B. Nelson, A. Phillips and C. Steuart, Guide to
the drive of a computer far away from your location Computer Forensics and Investigations. ISBN:
!  Or when you don’t want a suspect to be aware of an ongoing 978-1-435-49883-9
investigation
!  Remote acquisition software follow a client-server
model to exchange information
!  Server component runs on suspect machine providing a
portal into it
!  Client component talks to the server and pulls the
information to the target machine

L11: Analysis and Validation

L11: Analysis and Validation