CSN11121/CSN11122 System Administration and Forensics Introduction - - PowerPoint PPT Presentation

▶
csn11121 csn11122 system administration and forensics
SMART_READER_LITE
LIVE PREVIEW

CSN11121/CSN11122 System Administration and Forensics Introduction - - PowerPoint PPT Presentation

Jan 08, 2024 370 likes •1.04k views

CSN11121/CSN11122 System Administration and Forensics Introduction to Digital Forensic 20/10/2011 r.ludwiniak@napier.ac.uk Lecture Objectives 1. History and definition of Digital Forensics 2. Context for an investigation 3. An overview of

slide-1
SLIDE 1

CSN11121/CSN11122 System Administration and Forensics

Introduction to Digital Forensic 20/10/2011

r.ludwiniak@napier.ac.uk

slide-2
SLIDE 2

Lecture Objectives

  • 1. History and definition of Digital Forensics
  • 2. Context for an investigation
  • 3. An overview of the main theoretical concepts
  • 4. Storage Devices
  • 5. Partitions
slide-3
SLIDE 3

Recommended Reading

  • 1. B Carrier, File System Forensic Analysis, March 27

2005, Addison-Wesley Professional

  • 2. H Carvey, Windows Forensic Analysis DVD Toolkit,

11th June 2009, Syngress

  • 3. C Pogue, Unix and Linux Forensic Analysis DVD

Toolkit, 30th June 2008, Syngress

  • 4. M.E. Russinovich and D.A. Solomonm, Windows

Internals 5th Edition , 7th January 2009, Microsoft Press (chapter 1 to chapter 3)

  • 5. K.J. Jones, Real Digital Forensics, 3rd October 2005,

Addison-Wesley Professional

slide-4
SLIDE 4

Online Resources

  • Digital Forensic Research Workshop (DFRWS)

– http://www.dfrws.org – Challenges – Projects

  • National institute of Standards and technology (NIST)

– http://www.nist.gov

  • Journal - Digital Investigation

– http://www.sciencedirect.com

  • Forensics Wiki

– http://www.forensicswiki.org

slide-5
SLIDE 5
slide-6
SLIDE 6

DIGITAL FORENSICS

slide-7
SLIDE 7

It is impossible for the criminal to act, especially considering the intensity of a crime, without leaving traces of his presence.

  • Edmond Locard
slide-8
SLIDE 8

With contact between two items, there will be an exchange

  • Locard’s exchange principle
slide-9
SLIDE 9

Computer Forensics

  • 1984

– Scotland Yard: Computer Crime Unit – FBI computer forensics departments

  • 1990

– Computer Misuse Act (CMA)

slide-10
SLIDE 10
slide-11
SLIDE 11
slide-12
SLIDE 12
slide-13
SLIDE 13
slide-14
SLIDE 14

Digital Forensics

The use of scientifically derived and proven methods towards the preservation, collection, validation, identification, analysis, interpretation, documentation, and presentation of digital evidence derived from the digital sources for the purpose

  • f

facilitation

  • r

furthering the reconstruction of events found to be criminal, or helping to anticipate unauthorized actions shown to be disruptive to planned operations.

  • Digital Forensics Research Workshop
slide-15
SLIDE 15

Investigative Context

Primary Objectives Secondary Objectives Environment Law Enforcement Prosecution Post-Mortem Military IW Ops Continuity of Operations Prosecution Real-Time/Post- Mortem Business and Industry Continuity of Service Prosecution Real-Time/Post- Mortem

slide-16
SLIDE 16

Digital Investigation

A digital investigation is a process where we develop and test hypotheses that answer questions about digital events. This is done using the scientific method where we develop a hypothesis using evidence that we find and then test the hypothesis by looking for additional evidence that shows the hypothesis is impossible. Digital Evidence is a digital object that contains reliable information that supports or refutes a hypothesis.

  • B. Carrier, 2006

File System Forensic Analysis,

slide-17
SLIDE 17

Static vs. Live

  • Traditional Static Investigations

– Hard disk or some other form of static resource – Data at a resting state – Able to image, return to original source and conduct further analysis

  • Live investigation

– Occurs when the machine is running

slide-18
SLIDE 18

Volatile Investigations

  • Has impact on device under investigation
  • Not repeatable
  • Does not fit in with classic forensic

investigative models

  • OS must be trusted
  • New questions cannot be asked later
slide-19
SLIDE 19

Investigation Process

  • Acquisition

– Preservation – Collection – Verification

  • Analysis

– Search for evidence – Hypothesis Creation – Confirm or refute hypothesis with evidence

  • Presentation

– Report the findings of the investigation – Objective manner

slide-20
SLIDE 20

Characteristics of Evidence

  • 1. Data can be viewed at different levels of

abstraction

  • 2. Data requires interpretation
  • 3. Data is Fragile
  • 4. Data is Voluminous
  • 5. Data is difficult to associate with reality
slide-21
SLIDE 21

Characteristics of Evidence

  • 1. Data can be viewed at different levels of

abstraction

  • 2. Data requires interpretation
  • 3. Data is Fragile
  • 4. Data is Voluminous
  • 5. Data is difficult to associate with reality
slide-22
SLIDE 22

Characteristics of Evidence

  • 1. Data can be viewed at different levels of

abstraction

  • 2. Data requires interpretation
  • 3. Data is Fragile
  • 4. Data is Voluminous
  • 5. Data is difficult to associate with reality
slide-23
SLIDE 23

Characteristics of Evidence

  • 1. Data can be viewed at different levels of

abstraction

  • 2. Data requires interpretation
  • 3. Data is Fragile
  • 4. Data is Voluminous
  • 5. Data is difficult to associate with reality
slide-24
SLIDE 24

Characteristics of Evidence

  • 1. Data can be viewed at different levels of

abstraction

  • 2. Data requires interpretation
  • 3. Data is Fragile
  • 4. Data is Voluminous
  • 5. Data is difficult to associate with reality
slide-25
SLIDE 25

Best Practice

  • ACPO

– Principle 1 - No action taken by law enforcement or their agents should change data held on an electronic device or media which may subsequently be relied upon in Court. – Principle 2 - In exceptional circumstances where a person finds it necessary to access original data held

  • n an electronic device or media, that person must be

competent to do so, and be able to give evidence explaining the relevance and the implications of their actions.

slide-26
SLIDE 26

Best Practice

  • ACPO

– Principle 3: An audit trail or other record of all processes applied to computer based electronic evidence should be created and preserved. An independent third party should be able to examine those processes and achieve the same result.

slide-27
SLIDE 27

Best Practice

  • ACPO

– Principle 4: The person in charge of the investigation (the case officer) has overall responsibility for ensuring that the law and these principles are adhered to.

slide-28
SLIDE 28

Tools

  • 1st Generation

– Command Line, Task oriented, Act on original data

  • 2nd Generation

– GUI interface, capable of making copies, multi- functional

  • 3rd Generation

– Work on distributed systems and live systems – Live… ?

slide-29
SLIDE 29

Tool Characteristics

  • Verifiable - Can it be shown to behave within certain bounds
  • f behaviour?
  • Reproducibility - Can a tool produce results which are

reproducible?

  • Non-interference - Are the results obtained with a tool that

has open source code, and thus does not contain obfuscated code?

  • Usability - Can the tool help the investigator review and make

decisions about the layer of abstraction being viewed?

  • Comprehensive - Can the tool allow the investigator access

the data output of the tool at any given level of abstraction?

slide-30
SLIDE 30

Future

  • Research Challenges facing the investigation

community

– S.L. Garfinkel, Digital forensics research: The next 10 years, Digital Investigation, vol. 1, no. 7, pp. 64- 73, 2010 – “The coming Digital Forensics Crisis”

slide-31
SLIDE 31

Challenges

  • Size of storage devices
  • Embedded flash devices
  • Proliferation of operating systems and file formats
  • Multi-device analysis
  • Pervasive Encryption
  • Cloud computing
  • RAM-only Malware
  • Legal Challenges decreasing the scope of forensic

investigations

slide-32
SLIDE 32

STORAGE DEVICES & PARTITIONS

slide-33
SLIDE 33

Required Reading

  • D. Byers, N. Shahmehri, “Contagious errors:

Understanding and avoiding issues with imaging drives containing faulty sectors”, Digital Investigation, no. 5,

  • pp. 29 – 33, 2008
  • A. Jones, C. Meyler, “What Evidence is left after disk

cleaners?”, Digital Investigation, no. 1, pp. 183 – 188, 2004 B.J. Nikkel, “Forensic Analysis of GPT disks and GUID partition tables”, Digital Investigation, no.6, pp. 39-47, 2009

slide-34
SLIDE 34

Required Reading

  • M. Belford, “Methods of discovery and exploration of

Host Protected Ares on IDE storage devices that conform the ATAPI-5”, Digital Investigation, no.2, pp. 268-275, 2006

  • K. MacDonald, “To Image a Macintosh”, Digital

Investigation, no. 2, pp. 175 -179, 2006

  • J. R. Lyle, “A strategy for testing hardware write block

devices”, Digital Investigation, no. 3, pp. 3-9, 2006

slide-35
SLIDE 35

Storage Media

  • Hard disks, floppy disk, thumb drives etc.
  • Hard disks are the richest in digital evidence
  • Integrated Disk Electronics (IDE) or Advanced

Technology Attachment (ATA)

  • Higher performance SCSI drives
  • Fireware is an adaptation of SCSI standards that

provides high speed access to a chain of devices

  • All hard drives contain platters made of light, rig-hid

material such aluminum, ceramic or glass

slide-36
SLIDE 36

More on Hard Drives

– Platters have a magnetic coating on both sides and spin between a pair of read/write heads – These heads move like a needle on top of the old LP records but on a cushion of air created by the disk above the surface – The heads can align particles of magnetic media called writing, and can detect how the magnetic particles are assigned – called reading – Particles aligned one way are considered “0” and aligned another way “1”

slide-37
SLIDE 37

Hard Disks

cc by-sa, Cambridge Cat/Anna, flickr.com

Platters Spindle Head Actuator Arm

slide-38
SLIDE 38

Storage

  • Cylinders are the data tracks that the data is being

recorded on

  • Each track/cylinder is divided into sectors that

contain 512 bytes of information

– 512*8 bits of information

  • Location of data can be determined by which cylinder

they are on which head can access them and which sector contains them or CHS addressing

  • Capacity of a hard drive # of C*H*S*512
slide-39
SLIDE 39

Hard Disk Platters

slide-40
SLIDE 40

Tracks and Sectors

Track Sector (512bytes)

slide-41
SLIDE 41

Tracks and Sectors

  • .

/

  • 1

2 3

Track #0 Track #1, Sector #7

slide-42
SLIDE 42

Storage Characteristics

  • Volatility

– Non-Volatile – Volatile

  • Mutability

– Read/Write – Read Only – Slow Write, Fast Read Storage

  • Accessibility

– Random Access – Sequential Access

  • Addressability

– Location – File – Content

slide-43
SLIDE 43

CHS Values

  • 16-bit Cylinder value (C)
  • 4-bit Head Value (H)
  • 8-bit Sector Value (S)
  • Old BIOS:

– 10-bit C – 8-bit H – 6-bit S – Limited to 528MB disk

slide-44
SLIDE 44

Logical Block Address (LBA)

  • LBA address may not be related to physical location of data
  • Overcomes the 8.1 GB Limitation of CHS
  • Plug old CHS values into:

LBA = (((CYLINDER * heads_per_cylinder) * HEAD) * sectors_per_track) + SECTOR -1 E.g. CHS 0,0,1 = LBA 0

slide-45
SLIDE 45

Storage Volume

slide-46
SLIDE 46

Partition 1 Partition 2

Storage Volume

slide-47
SLIDE 47

Partition 1 Partition 2 Partition 1 Partition 2

Storage Volume

slide-48
SLIDE 48

Volume vs Partition

  • Volume

– A selection of addressable sectors that can be used by an OS or application. These sectors do not have to be consecutive

  • Partition

– A selection of addressable sectors that are

  • consecutive. By definition, a partition is a volume
slide-49
SLIDE 49
slide-50
SLIDE 50

Partition Analysis

  • A Partition organises the layout of a volume
  • Sector Addressing

– Physical Address (LBA or CHS) – Logical Disk Volume Address – Logical Partition Volume Address

slide-51
SLIDE 51

Sector Addressing

B Carrier, File System Forensic Analysis, pp75

slide-52
SLIDE 52

Partition Analysis

  • Analyse Partition Tables

– Process them to identify the layout – Can then be used to process partition accordingly – Determine the type of data inside the partition

  • Perform a sanity check to ensure that the

partition table is telling the truth

  • This is important when imaging
slide-53
SLIDE 53

Sanity Check

B Carrier, File System Forensic Analysis, pp76

slide-54
SLIDE 54

DOS Partitions

  • Most commonly found with i386/x86 systems
  • No standard reference
  • Master Boot Record in first sector (1st 512

byte)

– Boot Code – Partition Table – Signature Value

  • MBR Supports a maximum of 4 partitions
slide-55
SLIDE 55

B Carrier, File System Forensic Analysis, pp 83

slide-56
SLIDE 56

Partition Table

  • Starting CHS Address
  • Ending CHS Address
  • Starting LBA Address
  • Number of Sectors in Partition
  • Type of Partition
  • Flags
  • Limitation

– 2 Terabyte Disk Partition Limitation

  • MBR Partition size field is 32 bits
slide-57
SLIDE 57

Extended Partitions

  • Limitation of 4 Primary Partitions
  • Creation of 3 Primary Partitions and 1 primary

extended partition

  • Primary Extended partition uses a similar MBR

layout in order to create a linked list of records, showing where each new extended partitions exists in relation to the start of the last

slide-58
SLIDE 58

B Carrier, File System Forensic Analysis, pp 94

slide-59
SLIDE 59

B Carrier, File System Forensic Analysis, pp 94

slide-60
SLIDE 60

B Carrier, File System Forensic Analysis, pp 94

slide-61
SLIDE 61

B Carrier, File System Forensic Analysis, pp 94

slide-62
SLIDE 62

B Carrier, File System Forensic Analysis, pp 94

slide-63
SLIDE 63

B Carrier, File System Forensic Analysis, pp 94

slide-64
SLIDE 64

B Carrier, File System Forensic Analysis, pp 94

slide-65
SLIDE 65

ANY QUESTIONS?