1. Hands-on: Capturing an Image with AccessData FTK Imager
67335_PPT_ch04.ppt : pages 26~32

2. Capturing an Image with AccessData FTK Imager
Included on AccessData Forensic Toolkit
View evidence disks and disk-to-image files
Makes disk-to-image copies of evidence drives
At logical partition and physical drive level
Can segment the image file
Evidence drive must have a hardware write-blocking device
Or the USB write-protection Registry feature enabled
FTK Imager can’t acquire drive’s host protected area
67335_PPT_ch04.ppt : pages 26~32
Guide to Computer Forensics and Investigations

3. Capturing an Image with AccessData FTK Imager (continued)
Guide to Computer Forensics and Investigations

4. Capturing an Image with AccessData FTK Imager (continued)
Steps
Boot to Windows
Connect evidence disk to a write-blocker
Connect target disk to write-blocker
Start FTK Imager
Create Disk Image
Use Physical Drive option
Guide to Computer Forensics and Investigations

5. Capturing an Image with AccessData FTK Imager (continued)
Guide to Computer Forensics and Investigations

6. Capturing an Image with AccessData FTK Imager (continued)
Guide to Computer Forensics and Investigations

7. Capturing an Image with AccessData FTK Imager (continued)
Guide to Computer Forensics and Investigations

8. Capturing an Image with AccessData FTK Imager (continued)
Guide to Computer Forensics and Investigations

9. Creating a Virtual Machine
67335_PTT_ch06.ppt : pages 77~86

10. Understanding Virtual Machines
Allows you to create a representation of another computer on an existing physical computer
A virtual machine is just a few files on your hard drive
Must allocate space to it
A virtual machine recognizes components of the physical machine it’s loaded on
Virtual OS is limited by the physical machine’s OS
Guide to Computer Forensics and Investigations

11. Guide to Computer Forensics and Investigations

12. Understanding Virtual Machines (continued)
In computer forensics
Virtual machines make it possible to restore a suspect drive on your virtual machine
And run nonstandard software the suspect might have loaded
From a network forensics standpoint, you need to be aware of some potential issues, such as:
A virtual machine used to attack another system or network
Guide to Computer Forensics and Investigations

13. Creating a Virtual Machine
Two popular applications for creating virtual machines
VMware and Microsoft Virtual PC
Using Virtual PC
You must download and install Virtual PC first
Guide to Computer Forensics and Investigations

14. Creating a Virtual Machine (continued)
Guide to Computer Forensics and Investigations

15. Creating a Virtual Machine (continued)
Guide to Computer Forensics and Investigations

16. Creating a Virtual Machine (continued)
Guide to Computer Forensics and Investigations

17. Creating a Virtual Machine (continued)
You need an ISO image of an OS
Because no OSs are provided with Virtual PC
Virtual PC creates two files for each virtual machine:
A .vhd file, which is the actual virtual hard disk
A .vmc file, which keeps track of configurations you make to that disk
See what type of physical machine your virtual machine thinks it’s running
Open the Virtual PC Console, and click Settings
Guide to Computer Forensics and Investigations

18. Creating a Virtual Machine (continued)
Guide to Computer Forensics and Investigations

19. Creating a Virtual Machine (continued)
Guide to Computer Forensics and Investigations

20. Current Computer Forensic Tools
Chapter 7

21. Analyze Data
Ch09.ppt : pages 9~13

22. Using AccessData Forensic Toolkit to Analyze Data
Supported file systems: FAT12/16/32, NTFS, Ext2fs, and Ext3fs
FTK can analyze data from several sources, including image files from other vendors
FTK produces a case log file
Searching for keywords
Indexed search
Live search
Supports options and advanced searching techniques, such as stemming
Guide to Computer Forensics and Investigations

23. Using AccessData Forensic Toolkit to Analyze Data (continued)
Guide to Computer Forensics and Investigations

24. Using AccessData Forensic Toolkit to Analyze Data (continued)
Guide to Computer Forensics and Investigations

25. Using AccessData Forensic Toolkit to Analyze Data (continued)
Analyzes compressed files
You can generate reports
Using bookmarks
Guide to Computer Forensics and Investigations

26. Using AccessData Forensic Toolkit to Analyze Data (continued)
Guide to Computer Forensics and Investigations

27. Recovering Password
Ch09.ppt: pages 34~41

28. Recovering Passwords Techniques Tools Dictionary attack
Brute-force attack
Password guessing based on suspect’s profile
Tools
AccessData PRTK
Advanced Password Recovery Software Toolkit
John the Ripper
Guide to Computer Forensics and Investigations

29. Recovering Passwords (continued)
Using AccessData tools with passworded and encrypted files
AccessData offers a tool called Password Recovery Toolkit (PRTK)
Can create possible password lists from many sources
Can create your own custom dictionary based on facts in the case
Can create a suspect profile and use biographical information to generate likely passwords
Guide to Computer Forensics and Investigations

30. Recovering Passwords (continued)
Guide to Computer Forensics and Investigations

31. Recovering Passwords (continued)
Guide to Computer Forensics and Investigations

32. Recovering Passwords (continued)
Guide to Computer Forensics and Investigations

33. Recovering Passwords (continued)
Using AccessData tools with passworded and encrypted files (continued)
FTK can identify known encrypted files and those that seem to be encrypted
And export them
You can then import these files into PRTK and attempt to crack them
Guide to Computer Forensics and Investigations

34. Guide to Computer Forensics and Investigations

35. Recovering Passwords (continued)
Guide to Computer Forensics and Investigations

36. Understanding Steganography
ch10.ppt : pages 53~56

37. Understanding Steganography in Graphics Files (continued)
Substitution
Replaces bits of the host file with bits of data
Usually change the last two LSBs
Detected with steganalysis tools
Usually used with image files
Audio and video options
Hard to detect
Guide to Computer Forensics and Investigations

38. Understanding Steganography in Graphics Files (continued)
Guide to Computer Forensics and Investigations

39. Understanding Steganography in Graphics Files (continued)
Guide to Computer Forensics and Investigations

40. Using Steganalysis Tools
Detect variations of the graphic image
When applied correctly you cannot detect hidden data in most cases
Methods
Compare suspect file to good or bad image versions
Mathematical calculations verify size and palette color
Compare hash values
Guide to Computer Forensics and Investigations

41. Packet Sniffers wireshark lab으로 바꾸기 (passwd sniffing)
Ch11.ppt : pages 22~27

42. Using Packet Sniffers Packet sniffers
Devices or software that monitor network traffic
Most work at layer 2 or 3 of the OSI model
Most tools follow the PCAP format
Some packets can be identified by examining the flags in their TCP headers
Tools
Tcpdump
Tethereal
Guide to Computer Forensics and Investigations

43. Using Packet Sniffers (continued)
Guide to Computer Forensics and Investigations

44. Using Packet Sniffers (continued)
Tools (continued)
Snort
Tcpslice
Tcpreplay
Tcpdstat
Ngrep
Etherape
Netdude
Argus
Ethereal
Guide to Computer Forensics and Investigations

45. Using Packet Sniffers (continued)
Guide to Computer Forensics and Investigations

46. Using Packet Sniffers (continued)
Guide to Computer Forensics and Investigations

47. Using Packet Sniffers (continued)
Guide to Computer Forensics and Investigations

48. Viewing header
Ch12.ppt: pages 12~26

49. Viewing E-mail Headers
Learn how to find headers
GUI clients
Command-line clients
Web-based clients
After you open headers, copy and paste them into a text document
So that you can read them with a text editor
Headers contain useful information
Unique identifying numbers, IP address of sending server, and sending time
Guide to Computer Forensics and Investigations

50. Viewing E-mail Headers (continued)
Outlook
Open the Message Options dialog box
Copy headers
Paste them to any text editor
Outlook Express
Open the message Properties dialog box
Select Message Source
Copy and paste the headers to any text editor
Guide to Computer Forensics and Investigations

51. Viewing E-mail Headers (continued)
Guide to Computer Forensics and Investigations

52. Viewing E-mail Headers (continued)
Guide to Computer Forensics and Investigations

53. Guide to Computer Forensics and Investigations

54. Viewing E-mail Headers (continued)
Novell Evolution
Click View, All Message Headers
Copy and paste the header
Pine and ELM
Check enable-full-headers
AOL headers
Click Action, View Message Source
Copy and paste headers
Guide to Computer Forensics and Investigations

55. Viewing E-mail Headers (continued)
Guide to Computer Forensics and Investigations

56. Viewing E-mail Headers (continued)
Guide to Computer Forensics and Investigations

57. Viewing E-mail Headers (continued)
Guide to Computer Forensics and Investigations

58. Viewing E-mail Headers (continued)
Guide to Computer Forensics and Investigations

59. Viewing E-mail Headers (continued)
Hotmail
Click Options, and then click the Mail Display Settings
Click the Advanced option button under Message Headers
Copy and paste headers
Apple Mail
Click View from the menu, point to Message, and then click Long Header
Guide to Computer Forensics and Investigations

60. Viewing E-mail Headers (continued)
Guide to Computer Forensics and Investigations

61. Viewing E-mail Headers (continued)
Guide to Computer Forensics and Investigations

62. Viewing E-mail Headers (continued)
Yahoo
Click Mail Options
Click General Preferences and Show All headers on incoming messages
Copy and paste headers
Guide to Computer Forensics and Investigations

63. Guide to Computer Forensics and Investigations

64. Recovering
Ch12.ppt: Pages 52~58

65. Using AccessData FTK to Recover E-mail
Can index data on a disk image or an entire drive for faster data retrieval
Filters and finds files specific to clients and servers
To recover from Outlook and Outlook Express
AccessData integrated dtSearch
dtSearch builds a b-tree index of all text data in a drive, an image file, or a group of files
Guide to Computer Forensics and Investigations

66. Guide to Computer Forensics and Investigations

67. Using AccessData FTK to Recover E-mail (continued)
Guide to Computer Forensics and Investigations

68. Guide to Computer Forensics and Investigations

69. Using AccessData FTK to Recover E-mail (continued)
Guide to Computer Forensics and Investigations

70. Using AccessData FTK to Recover E-mail (continued)
Guide to Computer Forensics and Investigations

71. Using AccessData FTK to Recover E-mail (continued)
Guide to Computer Forensics and Investigations