Forensic Investigation Techniques Michael Jones

Overview Purpose People Processes Michael Jones2Digital Forensic Investigations

The (Digital) Forensic Process Photographs Faraday bags Photographs Faraday bags Imaging - forensically sound copying Analyse file system and analyse files Produce Report Scene Store Laboratory Chain of Custody Michael Jones3Digital Forensic Investigations

Review: Logical and Physical Views Logical view – As seen via the file manager Physical view – What is (physically) on the device Questions – What might these be different? – What is ‘striping’? – Is ‘physical’ really physical? Michael Jones4Digital Forensic Investigations

Imaging Low (device) level – Duplicating the bit sequence – Output is a file – Multiple copies may be taken Verification – Applying (hashing) algorithms to device and copy MD5, SHA1 If device and copy hashes match then copy is forensically sound Devices and copies returned to (case) store Michael Jones5Digital Forensic Investigations

Analysing the Image Before: apply hashing algorithms Processes: – Identify file system – Scan for known file types – Compare with logical view – Match logical and physical views and identify deleted files – Deeper analysis After: apply hashing algorithms Michael Jones6Digital Forensic Investigations

Digital Forensics Triage Triage – Quick analysis to identify priorities – Why? Focus on logical view – Plus deleted files Ideal outcomes of triage Michael Jones7Digital Forensic Investigations

Main Analysis That which is actually there – File dates and times – File and directory (folder) names – Metadata That which might require interpretation – Examples encoding and encryption File manipulation (e.g., changing first byte of a jpeg) Michael Jones8Digital Forensic Investigations

Finding Hidden Files In *nix (including OS X) and Windows – Hidden files have names starting with ‘.’ In *nix – Files with names ending in ‘~’ are also hidden Finding hidden files – Via ‘View’ menu – Using the ‘ls –a’ command in the Terminal Michael JonesDigital Forensic Investigations9

Deeper Analysis Can be time consuming Secondary data – Additional processes needed Examples – Encoding and encryption – Steganography E.g., Snow – Use of slack space, unused space Michael Jones10Digital Forensic Investigations

Summary Rigorous processes need to be followed – E.g., ACPO guidelines All investigations produce documentation All documents and artefacts must be labelled and stored appropriately Chain of custody must be unbroken Michael Jones11Digital Forensic Investigations

Conducting a Digital Forensic Investigation

Overview Creating the image – Copying the device to a file – Verifying the copy Creating a logical copy – Drag and drop Carving the image (creating the physical view) – E.g., using foremost Identifying the deleted files Analysing the (logical and physical) files Michael Jones13Digital Forensic Investigations

Assignment 1 Supplied: a zip file – Only the logical view (once extracted) – Physical view not included File carving not relevant Will not be able to identify any deleted files – Why might this not be that important? Michael Jones14Digital Forensic Investigations

Organisation of the Secure Store Secure Analysis Physical Logical Image Michael Jones15Digital Forensic Investigations

Organising the Analysis Identifying the file types – Identifying incorrect extensions Processing order options: – By directory/folder – By file type – By file name Michael JonesDigital Forensic Investigations16

Conducting the Analysis At least 4 windows involved – View of Logical files – View of physical files – Command (terminal) window – Web browser Command window located at secure store – All commands executed from there Michael Jones17Digital Forensic Investigations

Documenting the Analysis Need to document: – Process (e.g., finding comments in HTML) – Source (i.e., the file) – Result – Date and time – Investigator What if nothing was found? Michael JonesDigital Forensic Investigations18

Documenting a Process ‘Finding comments in HTML documents’ – Can be ambiguous Need to specify exact actions: – E.g., ‘open with text editor and search for ‘<!--’ using the Edit/Find menu entry’ These should be included in an appendix to the report Michael JonesDigital Forensic Investigations19

Example Command exiftool Logical/* > Analysis/exiftool_YYYY-MM-DD-HH-MM-SS.txt This will find the metadata of all files in the Logical directory and put then in a file in the Analysis directory Replace ‘YYYY-MM-DD-HH-MM-SS’ with current date and time Repeat command for all subdirectories Michael Jones20Digital Forensic Investigations

Repeating Commands Two main techniques: – Manual Using up arrow to access previous commands Manually edit the commands to apply to another file OK for small datasets – Programmatic Create a program (or shell script) to iterate through a set of files Needed for large datasets Michael Jones21Digital Forensic Investigations

Recording Data Potentially interesting data is recorded – Via the ‘evidence summary’ spreadsheet Do NOT change the column headings In FC assignments: – Each piece of data has 2 elements: Attribute (e.g., First Name 1 of 4) Value (e.g., Fred) Care when inserting data – Make sure all cells are of type ‘text’ Michael JonesDigital Forensic Investigations22

Assignment 1 Tasks Retrieve ‘interesting’ data – Record on ‘data’ sheet Identify pictures (people, buildings, cars, etc.) – Record on ‘images’ sheet Identify sounds – Record on ‘sounds’ sheet Identify files with incorrect extensions – Record on ‘extensions’ sheet Note: ignore ‘bin’ and ‘dat’ extensions Michael JonesDigital Forensic Investigations23

Assignment Submission 2 files – Evidence summary spreadsheet XLSX: Must be readable by Excel (2007 onwards) – Technical report Report structure – Numbered headings and subheadings – Hyperlinked table of contents Processes and findings PDF Michael JonesDigital Forensic Investigations24

Verifying the Analysis Issue: how can we know if the analysis has been tampered with – Or the image, logical, or physical elements? Solution: hashing – But keeping the hashes elsewhere But: cannot hash a directory – So zip the directory then hash the zip file – Use an ‘archive’ directory Michael Jones25Digital Forensic Investigations

Forensic Soundness Some tools may have to be shown to be forensically sound – E.g., websites used to decode base64 All tests should be documented and kept in the secure store – Make sure the dates of the tests are included – Separate directory for each tool Michael Jones26Digital Forensic Investigations

Summary When conducting an investigation – Use a PLAN Step-by-step guide – Follow the plan And document each stage – Question the plan Is it complete, appropriate – Check and verify At the start and end of each session (at least) Michael Jones27Digital Forensic Investigations