CSN11121/CSN11122System Administration and Forensics

Introduction to Digital Forensic20/10/2011

r.ludwiniak@napier.ac.uk

Lecture Objectives

1. History and definition of Digital Forensics2. Context for an investigation3. An overview of the main theoretical concepts 4. Storage Devices5. Partitions

Recommended Reading1. B Carrier, File System Forensic Analysis, March 27 2005,

Addison-Wesley Professional2. H Carvey, Windows Forensic Analysis DVD Toolkit, 11th

June 2009, Syngress3. C Pogue, Unix and Linux Forensic Analysis DVD Toolkit,

30th June 2008, Syngress4. M.E. Russinovich and D.A. Solomonm, Windows Internals

5th Edition , 7th January 2009, Microsoft Press (chapter 1 to chapter 3)

5. K.J. Jones, Real Digital Forensics, 3rd October 2005, Addison-Wesley Professional

Online Resources• Digital Forensic Research Workshop (DFRWS)

– http://www.dfrws.org– Challenges– Projects

• National institute of Standards and technology (NIST)– http://www.nist.gov

• Journal - Digital Investigation– http://www.sciencedirect.com

• Forensics Wiki– http://www.forensicswiki.org

DIGITAL FORENSICS

It is impossible for the criminal to act, especially

considering the intensity of a crime, without

leaving traces of his presence.

- Edmond Locard

With contact between two items, there will be an

exchange- Locard’s exchange principle

Computer Forensics

• 1984 – Scotland Yard: Computer Crime Unit – FBI computer forensics departments

• 1990 – Computer Misuse Act (CMA)

Digital Forensics

The use of scientifically derived and proven methods towards the

preservation, collection, validation, identification, analysis, interpretation,

documentation, and presentation of digital evidence derived from the

digital sources for the purpose of facilitation or furthering the

reconstruction of events found to be criminal, or helping to anticipate

unauthorized actions shown to be disruptive to planned operations.

- Digital Forensics Research Workshop

Investigative Context

Primary Objectives

Secondary Objectives

Environment

Law Enforcement Prosecution Post-Mortem

Military IW Ops Continuity of Operations Prosecution Real-Time/Post-

MortemBusiness and Industry

Continuity of Service Prosecution Real-Time/Post-

Mortem

Digital Investigation

A digital investigation is a process where we develop and test hypotheses

that answer questions about digital events. This is done using the

scientific method where we develop a hypothesis using evidence that we

find and then test the hypothesis by looking for additional evidence that

shows the hypothesis is impossible.

Digital Evidence is a digital object that contains reliable information that

supports or refutes a hypothesis. - B. Carrier, 2006 File System Forensic Analysis,

Static vs. Live

• Traditional Static Investigations– Hard disk or some other form of static resource– Data at a resting state– Able to image, return to original source and

conduct further analysis• Live investigation– Occurs when the machine is running

Volatile Investigations

• Has impact on device under investigation• Not repeatable• Does not fit in with classic forensic

investigative models• OS must be trusted• New questions cannot be asked later

Investigation Process• Acquisition

– Preservation– Collection– Verification

• Analysis– Search for evidence– Hypothesis Creation– Confirm or refute hypothesis with evidence

• Presentation– Report the findings of the investigation– Objective manner

Characteristics of Evidence

1. Data can be viewed at different levels of abstraction

2. Data requires interpretation3. Data is Fragile4. Data is Voluminous5. Data is difficult to associate with reality

Characteristics of Evidence

1. Data can be viewed at different levels of abstraction

2. Data requires interpretation3. Data is Fragile4. Data is Voluminous5. Data is difficult to associate with reality

Characteristics of Evidence

1. Data can be viewed at different levels of abstraction

2. Data requires interpretation3. Data is Fragile4. Data is Voluminous5. Data is difficult to associate with reality

Characteristics of Evidence

1. Data can be viewed at different levels of abstraction

2. Data requires interpretation3. Data is Fragile4. Data is Voluminous5. Data is difficult to associate with reality

Characteristics of Evidence

1. Data can be viewed at different levels of abstraction

2. Data requires interpretation3. Data is Fragile4. Data is Voluminous5. Data is difficult to associate with reality

Best Practice• ACPO– Principle 1 - No action taken by law enforcement or their

agents should change data held on an electronic device or media which may subsequently be relied upon in Court.

– Principle 2 - In exceptional circumstances where a person finds it necessary to access original data held on an electronic device or media, that person must be competent to do so, and be able to give evidence explaining the relevance and the implications of their actions.

Best Practice

• ACPO– Principle 3: An audit trail or other record of all

processes applied to computer based electronic evidence should be created and preserved. An independent third party should be able to examine those processes and achieve the same result.

Best Practice

• ACPO– Principle 4: The person in charge of the

investigation (the case officer) has overall responsibility for ensuring that the law and these principles are adhered to.

Tools

• 1st Generation– Command Line, Task oriented, Act on original data

• 2nd Generation– GUI interface, capable of making copies, multi-

functional• 3rd Generation– Work on distributed systems and live systems– Live… ?

Tool Characteristics• Verifiable - Can it be shown to behave within certain bounds

of behaviour?• Reproducibility - Can a tool produce results which are

reproducible?• Non-interference - Are the results obtained with a tool that

has open source code, and thus does not contain obfuscated code?

• Usability - Can the tool help the investigator review and make decisions about the layer of abstraction being viewed?

• Comprehensive - Can the tool allow the investigator access the data output of the tool at any given level of abstraction?

Future

• Research Challenges facing the investigation community– S.L. Garfinkel, Digital forensics research: The next

10 years, Digital Investigation, vol. 1, no. 7, pp. 64-73, 2010

– “The coming Digital Forensics Crisis”

Challenges• Size of storage devices• Embedded flash devices• Proliferation of operating systems and file formats• Multi-device analysis• Pervasive Encryption• Cloud computing• RAM-only Malware• Legal Challenges decreasing the scope of forensic

investigations

STORAGE DEVICES & PARTITIONS

Required ReadingD. Byers, N. Shahmehri, “Contagious errors: Understanding and

avoiding issues with imaging drives containing faulty sectors”, Digital Investigation, no. 5, pp. 29 – 33, 2008

A. Jones, C. Meyler, “What Evidence is left after disk cleaners?”, Digital Investigation, no. 1, pp. 183 – 188, 2004

B.J. Nikkel, “Forensic Analysis of GPT disks and GUID partition tables”, Digital Investigation, no.6, pp. 39-47, 2009

Required ReadingM. Belford, “Methods of discovery and exploration of Host

Protected Ares on IDE storage devices that conform the ATAPI-5”, Digital Investigation, no.2, pp. 268-275, 2006

K. MacDonald, “To Image a Macintosh”, Digital Investigation, no. 2, pp. 175 -179, 2006

J. R. Lyle, “A strategy for testing hardware write block devices”, Digital Investigation, no. 3, pp. 3-9, 2006

Storage Media• Hard disks, floppy disk, thumb drives etc.• Hard disks are the richest in digital evidence• Integrated Disk Electronics (IDE) or Advanced

Technology Attachment (ATA) • Higher performance SCSI drives• Fireware is an adaptation of SCSI standards that

provides high speed access to a chain of devices• All hard drives contain platters made of light, rig-hid

material such aluminum, ceramic or glass

More on Hard Drives– Platters have a magnetic coating on both sides and spin

between a pair of read/write heads– These heads move like a needle on top of the old LP

records but on a cushion of air created by the disk above the surface

– The heads can align particles of magnetic media called writing, and can detect how the magnetic particles are assigned – called reading

– Particles aligned one way are considered “0” and aligned another way “1”

Hard Disks

cc by-sa, Cambridge Cat/Anna, flickr.com

Platters

Spindle

Head

Actuator Arm

Storage• Cylinders are the data tracks that the data is being

recorded on• Each track/cylinder is divided into sectors that

contain 512 bytes of information– 512*8 bits of information

• Location of data can be determined by which cylinder they are on which head can access them and which sector contains them or CHS addressing

• Capacity of a hard drive # of C*H*S*512

Hard Disk Platters

Tracks and Sectors

Track

Sector (512bytes)

Tracks and Sectors

1

23

4

5

6 7

8

Track #0

Track #1,Sector #7

Storage Characteristics• Volatility

– Non-Volatile– Volatile

• Mutability– Read/Write– Read Only– Slow Write, Fast Read Storage

• Accessibility– Random Access– Sequential Access

• Addressability– Location– File– Content

CHS Values

• 16-bit Cylinder value (C)• 4-bit Head Value (H)• 8-bit Sector Value (S)• Old BIOS:– 10-bit C– 8-bit H– 6-bit S– Limited to 528MB disk

Logical Block Address (LBA)• LBA address may not be related to physical location of data• Overcomes the 8.1 GB Limitation of CHS• Plug old CHS values into:

LBA = (((CYLINDER * heads_per_cylinder) * HEAD) * sectors_per_track) + SECTOR -1

E.g.

CHS 0,0,1 = LBA 0

Storage Volume

Partition 1 Partition 2

Storage Volume

Partition 1 Partition 2

Partition 1 Partition 2

Storage Volume

Volume vs Partition

• Volume– A selection of addressable sectors that can be

used by an OS or application. These sectors do not have to be consecutive

• Partition– A selection of addressable sectors that are

consecutive. By definition, a partition is a volume

Partition 1

Partition3

Partition 2Disk 1

Disk 2Partition 4

C: Volume D: Volume

Partition Analysis

• A Partition organises the layout of a volume• Sector Addressing– Physical Address (LBA or CHS)– Logical Disk Volume Address– Logical Partition Volume Address

Sector Addressing

Physical Address: 100Logical Disk Volume Address: 100

Logical Partition Volume Address: 100

Partition 1Starting Address: 0

Partition 2Starting Address: 864

Physical Address: 569Logical Disk Volume Address: 569

Logical Partition Volume Address: N/A

Physical Address: 964Logical Disk Volume Address: 964

Logical Partition Volume Address: 100

B Carrier, File System Forensic Analysis, pp75

Partition Analysis

• Analyse Partition Tables– Process them to identify the layout– Can then be used to process partition accordingly– Determine the type of data inside the partition

• Perform a sanity check to ensure that the partition table is telling the truth

• This is important when imaging

Sanity CheckPartition 1

Partition 2

Partition 1

Partition 2

Partition 1

Partition 2

Partition 1

Partition 2

Partition 1

Partition 2

B Carrier, File System Forensic Analysis, pp76

DOS Partitions

• Most commonly found with i386/x86 systems• No standard reference• Master Boot Record in first sector (1st 512

byte)– Boot Code– Partition Table– Signature Value

• MBR Supports a maximum of 4 partitions

Partition 1 Partition 2

B Carrier, File System Forensic Analysis, pp 83

Partition Table• Starting CHS Address• Ending CHS Address• Starting LBA Address• Number of Sectors in Partition• Type of Partition• Flags

• Limitation– 2 Terabyte Disk Partition Limitation

• MBR Partition size field is 32 bits

Extended Partitions

• Limitation of 4 Primary Partitions• Creation of 3 Primary Partitions and 1 primary

extended partition• Primary Extended partition uses a similar MBR

layout in order to create a linked list of records, showing where each new extended partitions exists in relation to the start of the last

2GB 4GB

6GB 8GB 10GB 12GB

B Carrier, File System Forensic Analysis, pp 94

B Carrier, File System Forensic Analysis, pp 94

Primary Partition #1 Primary Extended PartitionPrimary Partition

#2Primary Partition

#3

Secondary Partition #1

2GB 4GB

6GB 8GB 10GB 12GB

B Carrier, File System Forensic Analysis, pp 94

Primary Partition #1 Primary Extended PartitionPrimary Partition

#2Primary Partition

#3

Secondary Partition #1

Secondary Extended #1

2GB 4GB

6GB 8GB 10GB 12GB

B Carrier, File System Forensic Analysis, pp 94

B Carrier, File System Forensic Analysis, pp 94

B Carrier, File System Forensic Analysis, pp 94

B Carrier, File System Forensic Analysis, pp 94

ANY QUESTIONS?