Recovering and Examining Computer Forensic Evidence Noblett, Pollit, & Presley Forensic Science Communications October 2000 (Cited by 13 according to Google Scholar) Presentation by Bryan Pass

Significance “Forensic Science Communications is a peer- reviewed forensic science journal published quarterly in January, April, July, and October by FBI Laboratory personnel. It is a means of communication between forensic scientists.” “Forensic Science Communications is a peer- reviewed forensic science journal published quarterly in January, April, July, and October by FBI Laboratory personnel. It is a means of communication between forensic scientists.” An overview of Computer Forensic methods from the forensics authority, the FBI. An overview of Computer Forensic methods from the forensics authority, the FBI. Not really new, more of an overview of current methods and thinking Not really new, more of an overview of current methods and thinking

Outline Significance Significance Open Research Topics Open Research Topics Computer Forensics for Traditional Crimes Computer Forensics for Traditional Crimes Computer Forensics for Computer Crimes Computer Forensics for Computer Crimes Who are we dealing with? Who are we dealing with? Data Recovery Data Recovery BackTracker BackTracker S-TLA + S-TLA +

Open Research Topics Education – How to better educate forensics and computer students about computer security and forensic methods Education – How to better educate forensics and computer students about computer security and forensic methods Honeypots / Honeynets – Setting up networks to attract hackers in order to study how they operate Honeypots / Honeynets – Setting up networks to attract hackers in order to study how they operate Automated log examination – Filtering raw data to lower the amount of information that a human has to review Automated log examination – Filtering raw data to lower the amount of information that a human has to review Data Recovery – Recovering data from physically damage media as well as recovering intentionally deleted information Data Recovery – Recovering data from physically damage media as well as recovering intentionally deleted information

Computer Forensics for Traditional Crimes Computer forensic science is the science of acquiring, preserving, retrieving, and presenting data that has been processed electronically and stored on computer media. Computer forensic science is the science of acquiring, preserving, retrieving, and presenting data that has been processed electronically and stored on computer media. Computer evidence is becoming more and more common place in investigations of traditional crimes. Computer evidence is becoming more and more common place in investigations of traditional crimes. Focus on extracting text, spreadsheets, human readable information Focus on extracting text, spreadsheets, human readable information Computer Forensics relies on extracting only useful information. Unlike traditional forensics which attempts to gather all information from a piece of evidence. Computer Forensics relies on extracting only useful information. Unlike traditional forensics which attempts to gather all information from a piece of evidence. 12 GB of printed text data would create a stack of paper 24 stories high. 12 GB of printed text data would create a stack of paper 24 stories high.

Traditional Crimes (cont.) Constantly adapting to changing technology instead of static techniques Constantly adapting to changing technology instead of static techniques Finger printing, DNA Analysis, etc. Finger printing, DNA Analysis, etc. Set procedures and guidelines are difficult or impossible to follow because of the variation in equipment used Set procedures and guidelines are difficult or impossible to follow because of the variation in equipment used Operating System, File System, Physical Medium, and Application Operating System, File System, Physical Medium, and Application Can make copies of the original evidence Can make copies of the original evidence Verification of copy Verification of copy Privacy / Legality Concerns Privacy / Legality Concerns Attorney’s data protected by confidentiality Attorney’s data protected by confidentiality or File servers with many users or File servers with many users

A Three-Level Hierarchical Model for Developing Guidelines for Computer Forensic Evidence

Computer Forensics for Computer Crimes Focus on analyzing log data from computer systems Focus on analyzing log data from computer systems Often one attack impacts multiple applications, physical systems, and even companies Often one attack impacts multiple applications, physical systems, and even companies Logs from applications on the target machine Logs from applications on the target machine Logs from other affected machines Logs from other affected machines Logs from routers, edge routers, firewalls, etc Logs from routers, edge routers, firewalls, etc

Computer Crimes (cont.) Different crimes could result in very different kinds of evidence Different crimes could result in very different kinds of evidence DDoS could produce router logs and packet captures DDoS could produce router logs and packet captures Defacement could produce application logs, router logs, and more traditional evidence (linguistics, etc) Defacement could produce application logs, router logs, and more traditional evidence (linguistics, etc) Routinely create legal nightmares of crossed borders and innocent participants Routinely create legal nightmares of crossed borders and innocent participants Data recovery techniques Data recovery techniques Encryption schemes and export laws Encryption schemes and export laws

Who are we dealing with? Determining the sophistication of the suspects Determining the sophistication of the suspects Tamper alarms, and traps Tamper alarms, and traps Must appear like a normal user to the device Must appear like a normal user to the device Cutting the power might not be a good idea Cutting the power might not be a good idea Information in volatile memory even the user didn’t know was there Information in volatile memory even the user didn’t know was there

Data Recovery Physical damage Physical damage It might be harder than you think to destroy a medium beyond partial reconstruction It might be harder than you think to destroy a medium beyond partial reconstruction Clean rooms Clean rooms Expensive and time consuming – is it worth it for the crime being investigated? Expensive and time consuming – is it worth it for the crime being investigated? Using Magnetometers to reconstruct disk images Using Magnetometers to reconstruct disk images How to really erase something How to really erase something Overwrite with 0, with random, with patterns, with compliment Overwrite with 0, with random, with patterns, with compliment

BackTracker Backtracking Intrusions Backtracking Intrusions Log access to other processes, files, sockets, etc Log access to other processes, files, sockets, etc Construct a timeline of what happens after the initial intrusion Construct a timeline of what happens after the initial intrusion (filtered dependency graph for bind attack)

S-TLA + A formal logic-based language for computer forensics investigations A formal logic-based language for computer forensics investigations Describes evidence, helps construct and test hypotheses for hacking scenarios Describes evidence, helps construct and test hypotheses for hacking scenarios S-TLAC – automated formal verification tool S-TLAC – automated formal verification tool Doesn’t seem to really be useful at all Doesn’t seem to really be useful at all

References “Recovering and Examining Computer Forensic Evidence.” Noblett et al. Forensic Science Communications. October ( /computer.htm) (Cited by 13). “Recovering and Examining Computer Forensic Evidence.” Noblett et al. Forensic Science Communications. October ( /computer.htm) (Cited by 13). /computer.htmhttp:// /computer.htm “Backtracking Intrusions.” King & Chen. ACM Transactions on Computer Systems. February (Cited by 29). “Backtracking Intrusions.” King & Chen. ACM Transactions on Computer Systems. February (Cited by 29). “A Formal Logic-based Language and an Automated Verification Tool For Computer Forensic Investigation.” Rehkis & Boudriga ACM Symposium on Applied Computing. “A Formal Logic-based Language and an Automated Verification Tool For Computer Forensic Investigation.” Rehkis & Boudriga ACM Symposium on Applied Computing.