Digital forensics

Information Systems 365/765Lecture 8

Digital Forensics

Digital Forensics• Also known as

Computer Forensics• A system in your

enterprise has been compromised

• You want to track down suspicious activity

• Where do you begin?

Digital Forensics• Defined: Pertains to legal

evidence found in computers and digital storage mediums.

• Goal: To explain the current state of a “digital artifact.”

• A digital artifact is a computer system, storage media (such as a hard disk or CD-ROM), an electronic document (e.g. an email message or JPEG image) or even a sequence of packets moving over a computer network.

Digital Forensics

• Can be as simple as retrieving a single piece of data

• Can be as complex as piecing together a trail of many digital artifacts

Why Use Digital Forensics?

• In legal cases, computer forensic techniques are frequently used to analyze computer systems belonging to defendants (in criminal cases) or litigants (in civil cases).

Why Use Digital Forensics?

• To recover data in the event of a hardware or software failure.

• To analyze a computer system after a break-in, for example, to determine how the attacker gained access and what the attacker did.

Why Use Digital Forensics?• To gather evidence against

an employee that an organization wishes to terminate.

• To gain information about how computer systems work for the purpose of debugging, performance optimization, or reverse-engineering.

Chain of Custody• “Chain of Custody”

is a fancy way of saying “The ability to demonstrate who has had access to the digital information being used as evidence”

• Special measures should be taken when conducting a forensic investigation if it is desired for the results to be used in a court of law.

Chain of Custody• One of the most important measures

is to assure that the evidence has been accurately collected and that there is a clear chain of custody from the scene of the crime to the investigator---and ultimately to the court.

5 Steps in Performing Digital Forensics

• Preparation (of the investigator, not the data)

• Collection (the data)

• Examination • Analysis • Reporting

Preparation

• The investigator must be properly trained to perform the specific kind of investigation that is at hand.

• Tools that are used to generate reports for court should be validated. There are many tools to be used in the process. One should determine the proper tool to be used based on the case.

Collecting Digital Evidence

• Digital evidence can be collected from many obvious sources, such as:

• Computers• Cell phones• Digital cameras • Hard drives • CD-ROM • USB storage flash drives

Can You Think of Non-Obvious Sources?

• Non-obvious sources could include:• Settings of digital thermometers• Black boxes inside automobiles• RFID tags• Web pages (which must be

preserved as they are subject to change).

!!BE CAREFUL!!• Special care must be taken when

handling computer evidence: most digital information is easily changed, and once changed it is usually impossible to detect that a change has taken place (or to revert the data back to its original state) unless other measures have been taken.

Create Proof of Non-Alteration

• For this reason it is common practice to calculate a cryptographic hash of an evidence file and to record that hash elsewhere, usually in an investigator's notebook, so that one can establish at a later point in time that the evidence has not been modified since the hash was calculated.

Important Data Handling Practices

• Handle the original evidence as little as possible to avoid changing the data.

• Establish and maintain the chain of custody.

• Documenting everything that has been done.

• Only use tools and methods that have been tested and evaluated to validate their accuracy and reliability.

The Personal Interview• Some of the

most valuable information obtained in the course of a forensic examination will come from the computer user:

• System configuration

• Applications• Encryption keys

Who Performs the Analysis

• Special care must be taken to ensure that the forensic specialist has the legal authority to seize, copy, and examine the data.

• One should not examine digital information unless one has the legal authority to do so.

Live vs. Dead Analysis

• Traditionally computer forensic investigations were performed on data at rest---for example, the content of hard drives. This can be thought of as a dead analysis.

Live vs. Dead Analysis• Investigators were

told to shut down computer systems when they were impounded for fear that digital time-bombs might cause data to be erased.

Live vs. Dead Analysis

• In recent years there has increasingly been an emphasis on performing analysis on live systems

• Why? -- Some attacks leave no trace on the hard drive

• Why? -- Cryptographic storage, with keys only stored in memory!

Live Analysis -- Imaging Electronic Media

• The process of creating an exact duplicate of the original evidenciary media is often called Imaging

• Standalone hard-drive duplicator or software imaging tools ensure the entire hard drive is completely duplicated.

Live Analysis -- Imaging Electronic Media

• During imaging, a write protection device or application is normally used to ensure that no information is introduced onto the evidentiary media during the forensic process.

Collecting Volatile Data

• If the machine is still active, any intelligence which can be gained by examining the applications currently open is recorded.

• If information stored solely in RAM is not recovered before powering down it may be lost.

A Great Tool Which YOU Can Impress People With

• Knoppix• An OS which runs directly from

a CD• Will not alter data on hard disk• Great for grabbing copies of

files from a hard disk!• Can be loaded from a USB

flash drive

Knoppix

• Can also scan RAM and Registry information to show recently accessed web-based email sites and the login/password combination used. Additionally these tools can also yield login/password for recently access local email applications including MS Outlook.

Knoppix

Encase

Freezing Memory• RAM can be analyzed

for prior content after power loss

• Freezing the memory to -60 degrees Celsius helps maintain the memory’s charge (state)

• How practical is this?

Analysis • All digital evidence

must be analyzed to determine the type of information that is stored upon it

• FTK• Encase• Sleuth Kit

Analysis of Data• Comprised of:• Manual review of material on the

media• Reviewing the Windows registry for

suspect information • Discovering and cracking

passwords• Keyword searches for topics

related to the crime• Extracting e-mail and images for

review.

Reporting

• Written• Oral Testimony• Both• Subject matter

area specialists

Examples of Digital Forensics Cases

• Chandra Levy• Washington

D.C. Intern for Representative Gary Condit

• Vanished April 30, 2001

Examples of Digital Forensics Cases

• She had used the web and e-mail to make travel arrangements and communicate with her parents.

• Information found on her computer led police to search most of Rock Creek Park, where her body was eventually found one year later by a man walking his dog.

Examples of Digital Forensics Cases

• BTK Killer• Convicted of a string of

serial killings that occurred over a period of sixteen years

• Towards the end of this period, the killer sent letters to the police on a floppy dsk.

Examples of Digital Forensics Cases

• Metadata is defined as “data about data”

• Metadata within the documents implicated an author named "Dennis" at "Christ Lutheran Church"

• This evidence helped lead to Dennis Rader's arrest.