Teaching digital forensics in a large class Teaching forensics at - - PowerPoint PPT Presentation

▶
teaching digital forensics in a large class
SMART_READER_LITE
LIVE PREVIEW

Teaching digital forensics in a large class Teaching forensics at - - PowerPoint PPT Presentation

Mar 02, 2023 199 likes •451 views

Teaching digital forensics in a large class of students Teaching digital forensics in a large class Teaching forensics at of students UL FRI Generating customized disk images Gaper Fele-or University of Ljubljana, Faculty of

slide-1
SLIDE 1

Teaching digital forensics in a large class of students Teaching forensics at UL FRI

Teaching digital forensics in a large class

  • f students

Generating customized disk images Gašper Fele-Žorž

University of Ljubljana, Faculty of Computer and Information Science polz@fri.uni-lj.si

slide-2
SLIDE 2

Teaching digital forensics in a large class of students Teaching forensics at UL FRI

Forensics in Ljubljana at FRI

◮ approx. 60 students ◮ 6 lectures by the professor (Andrej Brodnik) ◮ 4 lectures by invited speakers ◮ 15-minute student presentations instead of 2 lectures ◮ 14 lab sessions ◮ 2 lab assignments (graded practical homework)

slide-3
SLIDE 3

Teaching digital forensics in a large class of students Teaching forensics at UL FRI

Problem description

◮ Everyone should be graded fairly ◮ Students are cooperative ◮ One person to grade them all

slide-4
SLIDE 4

Teaching digital forensics in a large class of students Teaching forensics at UL FRI

Problem description - goals

◮ Create a disk image ◮ Access the data on a disk ◮ Search for incriminating files ◮ Check file metadata

slide-5
SLIDE 5

Teaching digital forensics in a large class of students Teaching forensics at UL FRI

Image/tool repositories

◮ Computer Forensic Reference Data Sets (CFReDS) ◮ digitalcorpora.org ◮ Lance Mueller’s Practical Exercises ◮ The International Society of Forensic Computer

Examiners R

  • Sample Practical Exercise
slide-6
SLIDE 6

Teaching digital forensics in a large class of students Teaching forensics at UL FRI

Image/tool repositories

◮ Computer Forensic Reference Data Sets (CFReDS) ◮ digitalcorpora.org ◮ Lance Mueller’s Practical Exercises ◮ The International Society of Forensic Computer

Examiners R

  • Sample Practical Exercise

◮ forensicfocus.com/images-and-challenges

slide-7
SLIDE 7

Teaching digital forensics in a large class of students Teaching forensics at UL FRI

D-FET

◮ developed by Institute Josef Stefan ◮ cloud-based ◮ individualized assignments for each pupil ◮ assignments created with input from law enforcement ◮ http://www.d-fet.eu/

slide-8
SLIDE 8

Teaching digital forensics in a large class of students Teaching forensics at UL FRI

Forensic Image Generator

“All the world’s a stage, And all the men and women merely players; They have their exits and their entrances, And one man in his time plays many parts, His acts being seven ages.”

— William Shakespeare, As You Like It

slide-9
SLIDE 9

Teaching digital forensics in a large class of students Teaching forensics at UL FRI

Typical assignment

Find all files containing verses from the King James edition

  • f the Bible on a set of floppy disk images
slide-10
SLIDE 10

Teaching digital forensics in a large class of students Teaching forensics at UL FRI

An alternative

A little girl has lost her pet, Sylvester. We have assembled a list of suspects whose computers we have confiscated. Find the culprit!

slide-11
SLIDE 11

Teaching digital forensics in a large class of students Teaching forensics at UL FRI

Cases

A case involves

◮ People ◮ Evidence ◮ Story (template)

slide-12
SLIDE 12

Teaching digital forensics in a large class of students Teaching forensics at UL FRI

Persons

◮ name, surname ◮ gender ◮ address, birthdate, birthplace, description, e.t.c.

slide-13
SLIDE 13

Teaching digital forensics in a large class of students Teaching forensics at UL FRI

Roles

◮ victim ◮ perpetrator ◮ accomplice ◮ female_accomplice, male_accomplice ◮ all

slide-14
SLIDE 14

Teaching digital forensics in a large class of students Teaching forensics at UL FRI

Files

◮ different sets of files for each role ◮ some files are exclusive to one person, others can be

shared with others

◮ files can be "sent" to other persons

slide-15
SLIDE 15

Teaching digital forensics in a large class of students Teaching forensics at UL FRI

A "perp" file

slide-16
SLIDE 16

Teaching digital forensics in a large class of students Teaching forensics at UL FRI

An "all" file

slide-17
SLIDE 17

Teaching digital forensics in a large class of students Teaching forensics at UL FRI

Metadata

◮ ODT author ◮ ODT modification time ◮ JPEG camera type ◮ JPEG modification date ◮ Other EXIF tags

slide-18
SLIDE 18

Teaching digital forensics in a large class of students Teaching forensics at UL FRI

Story / Case generation

◮ pick a case ◮ assign roles ◮ prepare files ◮ generate disk images ◮ pack images

slide-19
SLIDE 19

Teaching digital forensics in a large class of students Teaching forensics at UL FRI

Metadata preparation

◮ ODT: unzip, modify the XML directly, zip ◮ JPEG: pyexiv2

slide-20
SLIDE 20

Teaching digital forensics in a large class of students Teaching forensics at UL FRI

Disk image generation

◮ kpartx + mount ◮ qemu-nbd ◮ libguestfs

slide-21
SLIDE 21

Teaching digital forensics in a large class of students Teaching forensics at UL FRI

Student reactions

◮ So, who did it? ◮ We want to know the grading criteria in advance ◮ Did I find everything?

slide-22
SLIDE 22

Teaching digital forensics in a large class of students Teaching forensics at UL FRI

Problems / downsides

◮ bus factor of 1 ◮ preparing cases is relatively time-consuming ◮ the motivational improvement is unproven ◮ current cases not based on reality

slide-23
SLIDE 23

Teaching digital forensics in a large class of students Teaching forensics at UL FRI

Future work

◮ get more users ◮ create more cases ◮ use testing automation tools for image creation