101-Concepts

Master Boot Record (MBR)

contained in the boot sector, is used when DOS- or Windows-based computers start up. The MBR contains important information such as a partition table, bootstrap code, and other information.

Identify Crime:An attacker inserts SQL commands into text boxes, often using the username and password text fields on a logon screen.

hacking

An attacker remotely accesses a power plant's computer system and inserts a logic bomb.

hacking non-access computer crime cyberterroris

security log

has both successful and unsuccessful logon events; probably the most important log from a forensic point of view

Ethernet header

has the source and destination MAC address

Transport Layer

he fourth layer of the OSI model. It convert the packets received from network layer into segments and then transfer it to the upper layer. The transport layer ensures that the entire message reaches in order and handles error control and flow control at the source-to-destination level.

live forensic tools: PsLoggedOn

helps you discover users who have logged on both locally and remotely. Of most importance, it tells you who is logged on to shares on the current machine. This is also part of the PsTools suite available from Microsoft TechNet.

Where Recycle Bin is in Win 7 and vista

hidden directory \$Recycle.Bin\%SID, where %SID is the SID of the user that performed the deletion

steganophony

hiding messages in sound files

life span

how long information is valid

The iPhone: Seizing Evidence

iPhone has four-digit pin 10,000 possible combinations of the digits 0-9 Newer phones have six-digit pin and can use passwords as well. Can use automated process to break iPhone passcode, such as XRY Tools specifically for iOS devices: Pwnage Recover My iPod If forensic workstation has iTunes: Plug iPhone (or iPad/iPod) into the workstation Use iTunes to extract information about the device

An attacker dumpster dives to look for a victim's personal information, such as in discarded mail, bills, and bank statements

identify theft

Preserve evidence

important because data can easily be destroyed at a bit-level. Must assume every computer is rigged to destroy evidence.

tracing email

is similar to traditional detective work. Tracing email involves looking at each point through which an email passed and working step by step back to the originating computer and, eventually, the perpetrator. Email header information is typically examined to look for clues about where a message has been. Investigators often use audits or paper trails of email traffic as evidence in court. Many investigators recommend use of the tracert command. However, because of the dynamic nature of the Internet, tracert does not provide reliable, consistent, or accurate routing information for an email. It may also be useful to determine the ownership of the source email server for a message. A number of whois databases are available on the Web that an investigator can use to find out to whom a given IP address is registered.

Global System for Mobile (GSM) communications

is a standard developed by the European Telecommunications Standards Institute (ETSI). Basically, GSM is the 2G network.

file created

is the date the file was "created" on the volume. This does not change when working normally with a file, such as opening, closing, saving, or modifying the file.

Communications Assistance Law Enforcement Act of 1994

is the federal wiretap law for traditional wired telephony. expanded to include wireless, voice over packet, and other forms of electronic communications, including signaling traffic and metadata

live forensic tools: PSInfo

is also from the PsTools suite It can tell you system uptime (time since last reboot), operating system details, and other general information about the system. This is good background information to put into your forensic report.

Universal Disk Format (UDF)

is the file system used by DVD-ROM discs (both video and audio). Like ISO9660, this only guarantees that Mac OS X can read the partition or drive; it does not guarantee that Mac OS X can read the files.

UNIX File System (UFS)

is the file system used by FreeBSD and many other UNIX variants. Being based on FreeBSD, Mac OS X can read UFS volumes.

ISO 96660

is the file system used by compact discs (CDs). ISO9660 is not Macintosh specific, but Apple does have its own set of ISO9660 extensions.

GUID Parition Table (Globally Unique Identifier)

is used primarily with computers that have an Intel-based processor. It requires OS X v10.4 or later. Intel-based Macintosh machines can boot only from drives that use the GUID Partition Table

mv

is used to move a file

Apple Parition Map

is used with any PowerPC-based Mac. Intel-based Macs can mount and use a drive formatted with the Apple Partition Map, but cannot boot from the device. PowerPC-based Macs can both mount and use a drive formatted with the Apple Partition Map, and can also use it as a start-up device.

halts a running process based on the process ID (PID) you provide

kill

collision

occurs when two different inputs to the same hashing algorithm produce the same output (called a hash or digest). Ideally we would like to have no collisions. But the reality is that with a fixed-length output, a collision is possible. The goal is to make it so unlikely as to be something we need not think about.

Email files: .ost

offline outlook storage

Malware

often disguises itself in simliar names to actual important files for example Lsassx.exe instead of Lsass.exe

Tribal Flood Network

one of the most widely used tools to perform DDos attacks. Newer version is TFN2K

Disk Digger

is an easy-to-use tool for Windows. It can be downloaded free of charge and is fully functional. But when recovering files, you have to recover them one at a time. If you pay for the commercial version, you can recover as many files at one time as you want

Computer Security Incidents

is any event that violates an organization's security policies. This includes computer security policies, acceptable use policies, or standard security practices. Includes: denial of service attacks malicious code unauthorized access inappropriate usage

demonstrative evidence

is information that helps explain other evidence, for example a chart that explains a technical concept to the judge and jury.

swapf file/virtual memory

is located in the folder /var/vm/. You can check it with Linux commands like ls (for listing files). The option ls —al gives you a listing of all the files in virtual memory as well as who launched the program and when. You can use the grep search tool to search in the virtual memory folder.

physical analysis

is offline analysis conducted on an evidence disk or forensic duplicate after booting from a CD or another system. includes urls, emails, file formats, damaged sectors, data outside partitions looking for things that may have been overlooked, or are invisible, to the user.

dead drop

one person drops off an item, and then a 2nd person picks it up

Low Orbit Ion Cannon (LOIC)

online tool with GUI used to perpretrate a DoS or DDos attack easily

net sessions command

only shows established network communication sessions, such as someone logging on to that system.

RFC 3227

presents guidelines for evidence collection and archiving. Suggest the following: Volatile data file slack file system registry memory dumps system state backup internet traces

show logging

show router log events

show interfaces

show which interfaces are up

netstat command

shows network statistics and any current connections. Shows even meaningless connections, such as your computer opening a web browser.

file modified

shows there has been a change to the file itself.

carrier

signal or stream or file in which payload is hidden

TRIN00

similar to Tribal Flood Network tool used for denial of service attacks orginally written for UNIX, now available for Windows use trojan horse to infect machines

Network Packet: Payload

the body or information content of a packet Actual content that the packet is delivering to the destination If packet is fixed length, payload may be padded with blank information or a specific pattern to make it the right size

How does cyberstalking affect forensics?

the computer is the vechicle that drives the crime check emails and texts and any devices in suspects posession when arrested

Chain of Custody

the continuity of control of evidence that makes it possible to account for all that has happened to evidence between its original collecting and its appearance in court

Important Windows Files: Ntoskrnl.exe

the core of the operating system

USA Patriot Act

the primary law under which a wide variety of internet and communications info. content and metadata is currently collected. (provisions protect identity and privacy of US citizens)

Steganalysis

the process of analyzing a file or files for hidden content Can show a likelihood that a given file has additional information hidden in it Common method for detecting LSB steganography is to examine close-color pairs

Forensics

the process of using scientific knowledge for collecting, analyzing, and presenting evidence to the courts

Mutation

the process within a genetic algorithm of randomly trying combinations and evaluating the success (or failure) of the outcome

Important Windows Files: Winlogon.exe

the program that logs you on

Data Link Layer

the second layer of the OSI Model. It converts bits received from physical layer into frames and then transfer it to the network layer.

TCP/IP Internet Layer

the second layer of the four layer TCP/IP model. The position of Internet layer is between Network Access Layer and Transport layer. Internet layer pack data into data packets known as IP datagrams, which contain source and destination address (logical address or IP address) information that is used to forward the datagrams between hosts and across networks. The Internet layer is also responsible for routing of IP datagrams. Packet switching network depends upon a connectionless internetwork layer. This layer is known as Internet layer. Its job is to allow hosts to insert packets into any network and have them to deliver independently to the destination. At the destination side data packets may appear in a different order than they were sent. It is the job of the higher layers to rearrange them in order to deliver them to proper network applications operating at the Application layer. The main protocols included at Internet layer are IP (Internet Protocol), ICMP (Internet Control Message Protocol), ARP (Address Resolution Protocol), RARP (Reverse Address Resolution Protocol) and IGMP (Internet Group Management Protoco

Cyberstalking/harassment,

, using electronic communications to harass or threaten another person.

Incremental

- All changes since the last backup of any type

real evidence

- a physical object that someone can touch, hold or directly observe

Anti-forensics

- actions that perpetrators take to hide to conceal their locations, activities or identities, includes data destruction, data hiding, data transformation, file system alteration.

Multipartite

- attack the computer in multiple ways, for example the boot sector and files

documentary evidence

- data stored as written matter, on paper or in electronic files. It includes memory-resident data and computer files

testimonial evidence

- information that forensic specialists use to support or interpret real or documentary evidence.

physical analysis

- looking for things that may have been overlooked, or are Invisible to the user: The swap file/page file - possible to find things here that were live in memory and not stored on the suspect drive Unallocated space -Free space, or the area of a hard drive that has never been allocated for file storage.

steganalysis

- process of analyzing a file or files for hidden content

Cell-phone forensics

- process of searching contents of cell phones

daubert standard

- standard to assess whether the experts testimony is based on reasoning and/or methodology that is scientifically valid and can properly be applied to the facts at issue

Live system forensics

- the process of searching memory in real-time, typically for working with compromised hosts or identify system abuse

Expert Testimony -

- the testimony of an expert witness, one who testifies on the basis of scientific or technical knowledge relevant to a case rather than personal experience.

video steganograpy

Hiding information in video files.

steaganophony

Hiding messages in sound files

Identify Crime: An attacker disseminates a virus from a rogue website that infects many computers

Non-Access Computer Crime

Identify Crime: A denial of service (DoS) attack is an example of this type of this crime.

Non-access computer crime

Prefetch

To speed up the performance of programs, Windows keeps a list of all DLLs a given executable needs. When the executable is launched, all the DLLs are "fetched." \ A side benefit is that the prefetch entry keeps a list of how many times an executable has been run, and the last date/time it was run. Most Windows forensics tools will pull this information for you. OSForensics makes it part of the "Recent Activity."

MP3Stego

Tool used to hide data in MP3 files Combines text with sound file to create new sound file that contains hidden info

Getting Header in Hotmail

Select Inbox from the menu on the left. Right-click the message for which you want to view headers, and select View Message Source. The full headers will appear in a new window.

TCP Header Bits, of Interest:URG (1 bit)—

Traffic is marked as urgent, though this bit is rarely used. It is more common that the IP precedence bits are used for priority when there is a need

How Email Works

Sender uses a mail client to send a message Message travels to multiple mail servers Each mail server sends the message closer to its destination Destination mail server stores the message Receiver uses a mail client to retrieve the message from mail server

HTTP Response Messages 500-599

Server-side errors

Network based firewalls

Span an entire network Filter all traffic passing in and out of network or network segment Incorporate enterprise-grade network services VPN Enterprise-class encryption protocols Enterprise-class security services

Intelligent agent

Special-purpose knowledge-based information system that accomplishes specific tasks on behalf of its users

keyspace

The entire range of values that can be used to construct an individual key.

Creating a Timeline

To reconstruct events that led to corruption of a system, create a timeline Challenges with computers: Clock drift Delayed reporting Different time zones Never change clock on a suspect system Record clock drift and time zone in use

Whaling

a phishing attack that targets high-value individuals

spear fishing

a phishing expedition in which the emails are carefully designed to target a particular person or organization

Cyberterrorism

a politically motivated use of computers and information technology to cause severe disruption or widespread fear in society.

Long Term Evolution (LTE)

a standard for wireless communication of high-speed data for mobile devices. This is what is commonly called 4G.

semi-active state

a state partway between active and quiescent. The state is reached by a timer, which is triggered after a period of inactivity, allowing battery life to be preserved by dimming the display and taking other appropriate actions.

Deep learning (DL)

a subset of machine learning and refers to artificial neural networks that are composed of many layers.

rainbow table

a table of precomputed hashes that contain all possible keystroke combinations that comprise well-known passwords. It is impossible generally to record all combinations due to large size of table. Most attackers limit tables to 8-10 charcters and well known dictionary words. Used to compare hashes to discover passwords. Hashes themselves are one-way functions, meaning they cannot be decrypted only compared.

ophcrack

a tool used to crack local passwords on Windows systems. Intruder must be on local network to use.

How identity theft affects forensics

an investigator should look for spyware and if it exists examine where collected data is being sent. Emails and downloads should also be checked for potential spyware as these are common methods to inject spyware on a victim's computer.

Windows 10

another dramatic change. Features added like Edge Browser, Universal Apps and Cortana changed way user interacted with OS. In some cases changed forensics

EnCase boot disk

boots system to EnCase using DOS mode rather than GUI mode. Copy the suspect drive to a new drive to examine it

Evidence from Cell Phones

call history emails/messages phone information gps information photos videos web history network information

System Memory with OS Forensics

can also capture system memory using OSForensics.

cluster

can be from 1 to 128 sectors

grep

can be used to search for files, contents of files, and just about anything you may want to search for. very flexible and quite popular with Linux users. For example: grep -b 'search-text' /dev/partition > file.txt will search for 'search-text' in a given partition and output the results to file.txt. You can also use this syntax: grep -a -B[size before] -A[size after] 'text' /dev/[your_partition] > file.txt.

Identify Crime: An attacker sends out false emails suggesting the receiver can make a large sum of with very little investment

computer fraud

Neural networks

computing system inspired by biological netural networks. These systems learn to do task by considering examples.

Application Layer

the seventh layer of the OSI model. It provides a means for the user to access information on the network using an application. It also supports services such as electronic mail, remote file access and transfer and shared database management.

Presentation Layer

the sixth layer of the OSI model. This layer deals with syntax and semantics of the data exchanged between two devices. It encrypt data to protect from unauthorized access and also compress to reduce the size of data.

RFC 2822

the standard for email format including headers replaced RFC 822 which was originally designed for text messages over ARPANET, the precursor to the internet allows user to read emails using a variety of programs and operating systems

cryptography

the study of writing secret messages derived from word kryptós, which means hidden, and the verb gráfo, which means write

mobile switching center (MSC)

the switching system for the cellular network. MSCs are used in 1G, 2G, 3G, and Global System for Mobile (GSM) communications networks. You will learn about 3G and GSM networks later in this section. The MSC processes all the connections between mobile devices and between mobile devices and landline phones. The MSC is also responsible for routing calls between base stations and the public switched telephone network (PSTN).

Network Layer

the third layer of the OSI model. It converts the frame received from data link layer into packets and then transfer it to the transport layer.

TCP/IP Transport Layer

the third layer of the four layer TCP/IP model. The position of the Transport layer is between Application layer and Internet layer. The purpose of Transport layer is to permit devices on the source and destination hosts to carry on a conversation. Transport layer defines the level of service and status of the connection used when transporting data. The main protocols included at Transport layer are TCP (Transmission Control Protocol) and UDP (User Datagram Protocol).

TCP/IP: Application Layer

the top most layer of four layer TCP/IP model defines TCP/IP application protocols and how host programs interface with Transport layer services to use the network. includes all the higher-level protocols like DNS (Domain Naming System), HTTP (Hypertext Transfer Protocol), Telnet, SSH, FTP (File Transfer Protocol), TFTP (Trivial File Transfer Protocol), SNMP (Simple Network Management Protocol), SMTP (Simple Mail Transfer Protocol) , DHCP (Dynamic Host Configuration Protocol), X Windows, RDP (Remote Desktop Protocol) etc.

Euler's Totient

the total number of co prime numbers for a number n. Two numbers are considered coprime if they have no common factor's. Used in RSA.

File Slack Searching:

the unused space between the logical end of file and the physical end of file

Computer Forensics

the use of analytical and investigative techniques to identify, collect, examine and preserver evidence/information which is magnetically stored and encoded. Additionally, any device that can store data is potentially a subject for computer forensics

Cyberterrorism

the use of computer and networking technologies against persons or property to intimidate or coerce governments, individuals, or any segment of society to attain political, religious, or ideological goals

Polymorphic

the virus literally changes its form from time to time to avoid detection by antivirus software, a variation is a metamorphic virus which can completely rewrite itself.

dumpster diving

using a person's discarded documents to obtain information about identity or other important information

Social Engineering

using deception to obtain unauthorized access to information resources

Cyberstalking

using electronic communications to harass threaten or track another person

cryptanalysis

using techniques other than brute force to attempt to uncover a key. Frequency Analysis Kasiski examination

Important Windows Files: Hal.dll

an interface for hardware

Email files: .mbx

eudora

encrpytion

obfuscates message so it cannot be read

bourne shell (sh)

This was the original default shell for UNIX. It was first released in 1977.

HTTP Response Messages 200-299

"OK" messages, meaning that whatever the browser requested, the server successfully processed

Slack Space

"The unused space in a disk cluster. The DOS and Windows file systems use fixed-size clusters. Even if the actual data being stored requires less storage than the cluster size, an entire cluster is reserved for the file.

Listing Contents of .Trash

$/. Trash ls -al

Sierra

(Mac OS X v10.12)—The most recent version (as of March 2017). It is meant to be more in synch with the style of other Apple systems, such as iOS and WatchOS

Tiger

(Mac OS X v10.4)—Had built-in support for FireWire, a new dashboard, and updated mail program.

Snow Leopard

(Mac OS X v10.6)—Included mostly performance enhancements, such as support for multicore processors, rather than new features

Neural network

(artificial neural network) a category of AI that attempts to emulate the way the human brain works

Proper Procedure: Handling Evidence- Collecting Data

(in this order) 1. Volatile data a. Swap file b. State of network connections c. State of running processes 2. Temporary data: OS creates and overwrites without user's direct action to save 3. Persistent data

Windows 3.1

(released in 1992) Though earlier versions had been in existence since 1985, this version became widely popular. used Disk Operating System (DOS) used GUI

Technical Information Collection Considerations

Consider the life span of the information Data is volatile Collect information quickly Collect bit-level information

Mathematically Authenticating Data on All Storage Devices

-After imaging drive, create a hash of the original and the copy -Compare the hashes -If they don't match exactly, something was altered -Document hashing algorithm used and results

Shutting Down Computer

-Before you shut the computer down: *Check for running processes In Windows, use Task Manager *Take a picture of the screen for for your records *Check for live connections to system with following cmd's -netstat -net sessions -open files (critical to run)

Preparing System

-For suspect computers: Remove the drive(s) Create an evidence form and/or a chain of custody form -For mobile devices: Remove SIM card, if necessary Some devices let you dock the phone examine it without removing SIM

How to set up a Forensic Lab (slides)

-Identify functions to be performed -Define activities and estimate workload -Determine necessary equipment and software -Determine physcial space requirements -Plan for security

Transporting Computer

-Keep evidence in possession or control at all times -Document movement of evidence between investigators -Secure evidence appropriately so it can't be tampered with or corrupted -Lock in a vehicle -Drive vehicle directly to lab

Gameover ZeuS

-a virus that creates a peer-to-peer botnet -began to spread in 2015 -creates encrypted traffic between infected computer and command and control computer allowing attacker to control infected computers

64-bit

-addresses up to 18,446,744,073,551,616 bytes -referred to as x64

32-bit

-addresses up to 4,294,967,295 bytes -limited to 4GB of RAM -referred to as x86

CopyQM Plus Disk Duplication Software

-also from NTI -turns PC into disk duplicator -useful for specialists who need to preconfigure CD's for specific uses and duplicate them -can create self-extracting executable programs that can be used to duplicate specific disks -can be used to make preconfigured security disk assessment disks -images can be password-protected -supports all DOS formats and many non-DOS formats -does not copy extra sectors that are added to a CD on copy-protected disks; AnaDisk should be used to perform this task

SYN Flood

-attacker would send many SYN packets -would not answer ACK responses from server -eventually server would run out of resources resulting in Denial of Service(DOS)

Rombertik

-began to be seen in 2015 - virus that uses browser to read user credentials to websites -Most often seen as an attachment in an email -can overwrite master boot record making computer unbootable, and/or encrypt users home folders

temporary data

-collected after volatile data -data that an operating system creates and overwrites without the computer user taking a direct action to save this data. afterwards collect persistent data

OS Forensics

-forensic tool widely used since 2010 from Passmark software -less expensive alternative to EnCase FTK -does not have Known File Filter

AnaDisk Disk Analysis Tool

-from New Technologies Incorporated (NTI) -turns a pc into a sophisticated disk analysis tool -originally created to meet needs of U.S. Treasury Dept in 1991 -scans for anomalies that identify odd formats, extra tracks and extra sectors -used to uncover data-hiding technologies -support all DOS formats and many non-DOS formats such as MAC and UNIX TAR

Storage formats

-magnetic media -solid-state drives -digital audio tape (DAT) drives -digital linear tape (DLT) and super DLT -optical media -universial serial bus (USB)

NIST (National Institute of Standaards and Technology) Four Extraction States

-nascent state -active state -semi-active state -quiescent state

Forensic Certifications

-pc hardware: A+ certification basic networking: Network+ or CCNA security:CISSP or Security+ hacking: Offensive Security, Certified Ethical Hacking from EC Council and GIAC Penetration Tester (GPEN) from SANS Encase, Access Data, OS Forensics all offer certifications

Proper Procedure Overview

-shut down computer -transport computer to secure location -prepare system -document the hardware configuration of system -mathematically authenticate data on all storage devices

flame

-targets Windows operating systems -specifically designed for espionage, state-sponsored -first discovered in May 2012 -spyware that can monitor network traffic and take screenshots of infected system -stores data in local database that is heavily encrpyted -able to change behavior based on which antivirus program is running -signed with a fraudulent Microsoft Windows certificate so Windows accepts as legitimate

Forensic Toolkit (FTK)

-widely used forensic analysis tool from Access Data availabe in Windows and Mac -popular with law enforcement -ability to select which hash used to verify suspect copied drive and which features wish to use on drive -especially good at cracking passwords such as password-protected PDF files, excel spreadsheets. -also supplies tools to analyze windows registry and email (which can be arranged in a timeline) -has distributed processing which allows processing and analysis to be distributed across three computers. This lets all three computers to perform three parts of analysis in parallel speeding up forensic process. -Has an Explicit Image Detection add-on that automatically detects pornographic images

Email Server Forensics

. Even if the sender and the recipient have deleted the relevant emails, there is a good chance a copy is still on the email server. Many servers have a retention policy, which may be governed by law in certain industries. There are a variety of email server programs that could be in use. Microsoft Exchange is a very common server. Lotus Notes and Novell GroupWise are also popular email server products.

GroupWise

.db

Exchange Server

.edb

Block Cipher

.literally encrypts the data in groups of bits, also known as blocks . Assuming the actual algorithm is mathematically sound, then the following is true: Larger block sizes increase security. Larger key sizes increase security against brute-force attack methods. If the round function is secure, then more rounds increase security to a point.

Lotus Notes

.nsf

RunLevel 0

/etc/rc.d/r0.d halt

RunLevel1

/etc/rc.d/r1.d single-user mode

RunLevel2

/etc/rc.d/r2.d Not used (user-definied)

RunLevel3

/etc/rc.d/r3.d Full multi-user mode without GUI

RunLevel4

/etc/rc.d/r4.d not used (user-defined)

RunLevel5

/etc/rc.d/r5.d full multi-user mode with GUI

RunLevel6

/etc/rc.d/r6.d reboot

Well-known ports

0-1023

This is a ____AND_____binary operation

1 1 0 1 1 0 0 1 ____________ 1 0 0 1

This is a ______XOR_________ binary operartion (2)

1 1 0 1 1 0 0 1 _____________ 0 1 0 0

This is a ____OR______ binary operation (1)

1 1 0 1 1 0 0 1 _____________ 1 1 0 1

Evidence gathering Measures

1. Avoid changing evidence-take photos, label wires and sockets, transport carefully, avoid touching hard disks and CD's and make exact bit-level copies and store them on write-once CD 2. Determine when evidence was created-create a detailed timeline should mirror chain of custody timeline as well 3. Trust only physical evidence-bit level 4. Search throughout a device 5. Present the evidence well in a logical, compelling, understandable, and persuasive manner

Technical Information Collection Considerations

1. Consider the Life Span of Information 2. Collect Information quickly 3. Collecting Bit-Level Information

How to set up a Forensic Lab

1. Equipment-storage for data, a server with at least RAID 1 redundnacy (mirroring) recommended RAID 5 with backups once a day at minimum. Likely need multiple servers for data storage. Comupters capable of attaching all sorts of drives and usbs as well as all sorts of power connectors for smartphones, laptops, routers, and other digital devices. 2.Security-computers and servers used should not be connected to internet, and is separate from working network. Lab room should be shielded from any electromagnetic interference such as from wireless or cellular signals. Physical security should limit access to lab and be able to account for access (swipe-cards or biometric readers are ideal); room should be difficult to forcibly access; an evidence safe that is fire-resistant should also be used.

Forensic Imaging

1. Forensically wipe the target drive (drive you are copying suspect drive to) a. Use linux dd command: dd if=/dev/zero of=/dev/hdb1 bs=2048 b. Or: fdisk -l to list the partitions of the system 2. Use netcat on the forensic server in prep for data from suspect computer 3. On suspect computer, use the dd command to read the first partition Imaging with Encase Imaging with FTK Imaging with OS Forensics

Forensic Methodologies

1. Handle original data as little as possible 2. Comply with rules of evidence 3. Avoid exceeding your knowledge 4. Create an analysis plan

Example order of volatility:

1. Registers and cache 2. Routing tables 3. ARP cache 4. Process table 5. Kernel stats and modules 6. Main memory 7. Temp file systems 8. Secondary memory 9. Router config 10. Network topology

Recovering Information from Damaged Media: Overview

1. Remove drive/connect to test system 2. Boot test system If the drive is not recognized perform repair and image drive content 3. Copy files from drive to test system

Storing a File in Windows (FAT/FAT32)

1. The cluster number of the next cluster for this file is recorded. 2. If this cluster is the end of a chain, then it has a special end of cluster chain (EOC) entry. 3. Bad clusters have a special entry in the file allocation table. 4. Reserved clusters have a special entry in the file allocation table. 5. Open, or available, clusters are also marked in the file allocation table.

Important iOS items to document if using ITunes extraction technique

1. The iOS version number 2. The phone number (redacted in this figure) 3. The serial number (redacted in this figure)

Ways identity theft is perpetrated

1. phishing 2. spyware 3. discarded information

Order of Volitality From High to Low

1. registers and cache 2. routing tables 3. ARP cache 4. Process table 5. Kernel statistics and modules 6. Main memory 7. Temporary file systems 8. Secondary memory 9. Router configurations 10. Network topology

Roles a computer can play in a crime

1. target of crime 2. instrument of crime 3. an evidence repository that stores valuable information about the crime. In some cases, a computer can have multiple roles. It can be the instrument of a crime and also serve as a file cabinet that stores critical evidence.

Evidence -Handling tasks

1.Find evidence 2. Preserve evidence 3. Prepare evidence

3 criteria for cyberstalking

1.Is it possible? Is threat credible and possible to carry out 2.How frequently does behavior occur; mustbe repetitive 3.How serious? Specific and detailed plans cause alarm more than generalizations Not all 3 need to be present to constitute a crime

Registered ports

1024-49151

The Computer Security Act of 1987

1987 was passed to improve the security and privacy of sensitive information in federal computer systems. The law requires the establishment of minimum acceptable security practices, creation of computer security plans, and training of system users or owners of facilities that house sensitive information.

Windows Mobile Operating systems

1996: Windows CE 2008: Windows Phone; not compatible with many of the previous Windows Mobile apps 2010: Windows Phone 7 2012: Windows 8 2015: Windows 10 Mobile Windows 10 (Windows 10 Mobile) is shipped on PCs, laptops, phones, and tablets. This means that once you are comfortable with the operating system on one device, you are going to be able to conduct forensic examinations on other devices running Windows 8 or Windows 10.

iMac

1998

iphone

2007

HEXIDECIMAL VALUES: PDF

25 50

pdf

25 50

What happened to 2DES?

2DES basically does DES two times Was not much more secure than DES Took more time and computer resources to implement Not widely used

Advanced Format

4096-byte sectors used by modern hard drives

HEXIDECIMAL VALUES: BMP

42 4D

bmp

42 4D

GIF

47 49

HEXIDECIMAL VALUES: GIF

47 49

HEXIDECIMAL VALUES: MP3

49 44

MP3

49 44

Dynamic ports

49152-65535

HEXIDECIMAL VALUES: EXE

4D 5A

exe

4D 5A

HEXIDECIMAL VALUES: ZIP

50 4B

zip

50 4B

HEXIDECIMAL VALUES: AVI

52 49

HEXIDECIMAL VALUES: WAV

52 49

WAV, AVI

52 49

HEXIDECIMAL VALUES: PNG

89 50

png

89 50

Functions of Data Link Layer

: Framing - The physical layer delivers raw bits from the Source to destination. During transmission, the value of the bits can change. It is also possible that the number of bits received by the receiver may be different from the number of bits sent by the Sender. To resolve this problem, the data link layer organizes the bits into manageable data units called as frames. Physical Addressing - Data link Layer adds header to the frame which contains the physical address of the sender (MAC Address)or receiver. Flow Control - It may happen that the speed at which the sending and receiving nodes operate may differ. The sending node may transmit data at a faster rate but the receiving node may receive it at a slower rate. The rate of data transmission between two nodes should be controlled to keep both the nodes in synchronization. This process is called flow control. Error Control - Another function of the Data Link layer is error control. Error control detects and corrects errors. During transmission, if a frame is lost or corrupted, the data link layer re transmits that frame. It also prevents duplication of frames.

1991

: Linus Torvalds begins creating Linux

ROT13 cipher

A permutation of the Caesar cipher All characters are rotated 13 characters through the alphabet A CAT becomes N PNG

Virus

A piece of code that is capable of copying itself and typically has a detrimental effect, such as corrupting the system or destroying data

volatile memory: Heap (H)

A process may use a memory allocator such as malloc to request dynamic memory. When this happens, the address space of the process expands. The data in the heap area can exist between function calls. The memory allocator may reuse memory that has been released by the process. Therefore, heap data is less stable than the data in the data segment.

Important Windows Files: Smss.exe

A program that handles services on your system

Important Windows Files: Ntdetect.com

A program that queries the computer for basic device/config data like time/date from CMOS, system bus types, disk drives, ports, and so on

iXImager

A proprietary file format used by the iLook tool Tool was developed by the U.S. Internal Revenue Service (IRS) and is restricted to law enforcement and government use only

Certified Cyber Forensics Professional (CCFP)

A certification from ISC2 for completing the education and work experience and passing the exam

Encase file format

A proprietary format defined by Guidance Software for use in its EnCase tool to store hard drive images and individual files Includes a hash of the file to ensure nothing was changed when it was copied from the source

Android

A Linux-based operating system that is completely open source. Android source code: http://source.android.com/ First released in 2003 Versions of Android named after sweets, such as Version 4.1-4.2 Jelly Bean and Version 7.0 Nougat Differences from version to version usually involved adding new features. If you are comfortable with version 1.6 (Donut), you will be able to do forensic examination on version 4.2 (Jelly Bean). Samsung Galaxy and many other mobile devices run Android Similarity across versions Can perform similar forensic examinations on different versions

logic bomb

A computer program or part of a program that lies dormant until it is triggered by a specific logical event. such as a date and time; often perpertrated by disgruntled employees

consistency checking problems

A consistency check can fail if the file system is highly damaged. The repair program may crash, or it may believe the drive has an invalid file system. The chkdsk utility might automatically delete data files if the files are out of place or unexplainable. The utility does this to ensure that the operating system can run properly. However, the deleted files may be important and irreplaceable user files. The same type of problem occurs with system restore disks that restore the operating system by removing the previous installation. Avoid this problem by installing the operating system on a separate partition from the user data.

Diffie-Hellmen

A cryptographic protocol that allows two parties to establish a shared key over an insecure channel Often used to allow parties to exchange a symmetric key through some insecure medium, such as the Internet Enabled all secure communications between parties that did not have a pre-established relationship, such as e-commerce Groundbreaking research provided the foundation for secure transactions across the Internet E-commerce sites like Amazon.com and Staples.com can provide secure electronic communications, thanks in great part to Diffie and Hellman

Kerchoff Principle

A cryptographic system should be secure even if everything about the system, except the key, is public knowledge.

action:a

A keyword indicating the action that init is to take on the process

The Digital Forensic Research Workshop Framework (DFRWS)

A matrix with 6 classes, Identification, preservation, collection, examination, analysis, and presentation

Digital Forensics Research Workshop Foundation Framework

A matrix with the following six classes: -Identification -Preservation -Collection -Examination -Analysis -Presentation

Maximum Tolerable Downtime (MTD)

A measure of how long a system or systems can be down before it is impossible for the organization to recover Related to: Mean time to repair (MTTR) Mean time to failure (MTTF)

Alternate Data Streams (ADS)

A method of attaching one file to another file, using the NTFS file system A feature of NTFS that contains metadata for locating a specific file by some criterion, like title may be used by clever criminals to hide things on the target computer. are essentially a method of attaching one file to another file, using the NTFS file system. A number of tools are available that will detect whether files are attached via alternate data streams. One of the most widely known is List Alternate Data Streams (a free download).

Kasiski method

A method of attacking polyalphabetic substitution ciphers, such as Vigenère Can be used to deduce the length of the keyword used in a polyalphabetic substitution cipher When length of keyword is discovered, ciphertext is lined up in n columns, where n is keyword length Each column Treated as a monoalphabetic substitution cipher Can be cracked with frequency analysis Involves looking for repeated strings in the ciphertext

High Tech Crime Network (HTCN)

A national organization that provides certification for computer crime investigators and computer forensics technicians.

Ports

A number that identifies a channel in which communication can occur 65,635 possible ports Knowing what port a packet was destined for (or coming from) tells you what protocol it was using

John the Ripper

A password cracker popular with network administrators and hackers Enables user to select text files of word lists to attempt cracking a password Command-line based, no Windows interface thus less convenient to use but been around a long time and is well regarded by both security and hacking communities

OS Forensics

A robust forensics tool that also provides for undeletion Undelete from a mounted image or from a live system

Windows Swap File

A special place on the hard disk where items from memory can be temporarily stored for fast retrieval Used to end in a .swp extension; since Windows XP, called pagefile.sys Typically found in Windows root directory Often referred to as virtual memory

Important Windows Files: Ntbootdd.sys

A storage controller device driver

Business Impact Analysis (BIA)

A study that identifies the effects a disaster would have on business and IT functions Studies include interviews, surveys, meetings, and so on Identifies the priority of different critical systems Considers maximum tolerable downtime (MTD)

three-way handshake

A three-step process in which Transport layer protocols establish a connection between nodes. The three steps are: Node A issues a SYN packet to node B, node B responds with SYN-ACK, and node A responds with ACK.

label

A unique identification label of up to four characters.

Telephony denial of service (TDoS)

A variation of denial of service (DoS) attacks, but launched against traditional and packet-based (VoIP)telephone systems. disrupts an organization's use of its telephone system through a variety of methods.

polymorphic virus

A virus that can change its own code or periodically rewrites itself to avoid detection

Graphical User Interface (GUI)

A visual display on a computer's screen that allows you to interact with your computer more easily by clicking graphical elements.

American Society of Crime Laboratory Directors

ASCLD; accredits crime labs in the US

$I Structure

Always exactly 544 Bytes long Bytes 0-7 file header-always set to 01 followed by 7 sets of 00 Bytes 8-15 Original file size stored in hex in little-endian Bytes 16-23 Deleted date/time stamp represented in number of seconds sincde midnight January 1, 1601. Use a program such as Decode to assist with figuring out exact date and time if do not want to do the math Bytes 24-543-Original file path/name

HKEY_USERS (HKU)

This hive is very critical to forensic investigations. It has profiles for all the users, including their settings.

volatile memory analysis : Step One

Acquire a physical memory dump of the compromised system and transmit it to the data collection system for analysis. VMware allows you to simply suspend the virtual machine and use the .vmem file as a memory image.

File Formats

Advanced Forensic Format (AFF) Encase Generic Forensic Zip (Gfzip) iXImager

file formats

Advanced Forensic Format (AFF) with variations: AFF: stores all data and metadata in single file AFM: stores data and metadata in separate files AFD: stores data and metadata in multiple small files EnCase Generic Forensic Zip IXimager

Mathematically Authentication Data on All Storage Devices

After imaging drive, create a hash of the original and the copy Compare the hashes If they don't match exactly, something was altered Document hashing algorithm used and results

The Post-Recovery Follow-Up

After recovery, find out what happened and why (involves forensics): Was disaster caused by some weakness in the system? Negligence by an individual? A gap in policy? An intentional act?

Differential backup

All changes since the last full backup

logical volume manager (LVM)

An abstraction layer that provides volume management for the Linux kernel On a single system (like a single desktop or server), primary role is to allow: The resizing of partitions The creation of backups by taking snapshots of the logical volumes

Collecting Data

All the traffic going through a firewall is part of a connection. A connection consists of two IP addresses communicating with each other and two port numbers that identify the protocol or service. Attempts on same set of ports from many different Internet sources are usually due to decoy scans Carefully check firewall logs for any sort of connections or attempted connections on those ports Use protocol analysis to determine who attacker is

volatile memory Stack (S)

Allocated based on the last-in, first-out (LIFO) principle. When the program is running, program variables use the memory allocated to the stack area again and again. This segment is the most dynamic area of the memory process. The data within this segment is discrepant and influenced by the program's various function calls.

Nmap/ZenMap

Allows the user to map out what ports are open on a target system and what services are running Is a command-line tool, but has a Windows interface called Zenmap Popular with hackers because it can be configured to operate stealthily and determine all open ports on an individual machine, or for all machines in an entire range of IP addresses Popular with administrators because of its ability to discover open ports on the network

Imaging with OS Forensics

Allows you to mount images created with other tools Also allows you to create an image

Berkley Fast File System

Also known as UNIX File System Developed at UC-Berkeley for Linux Uses a bitmap to track free clusters, indicating availability

Advanced Encryption Standard (AES)

Also known as the Rijndael block cipher Can have three different key sizes: 128, 192, or 256 bits Referred to as AES 128, AES 192, and AES 256

brute force attack

An attack on passwords or encryption that tries every possible password or encryption key.

Smurf Attack

An attack that broadcasts a ping request to computers yet changes the address so that all responses are sent to the victim.

Ping Flood

An attack that uses the Internet Control Message Protocol (ICMP) to flood a victim with packets.

Distributed Denial of Service (DDoS)

An attack where a firm's computer systems are flooded with thousands of seemingly legitimate requests, the sheer volume of which will slow or shut down the site's use. DDoS attacks are often performed via botnets.

Preserving Evidence

An event: Is any observable occurrence within a system or network Includes network activity, such as when a user accesses files on a server or when a firewall blocks network traffic Adverse events have negative results or negative consequences Example: An attack on a system Recovery often performed at the expense of preserving forensic evidence Failure to preserve forensic information: Prevents IT team from effectively evaluating cause of incident Makes it difficult to modify company policies and procedures to reduce risk Forensic data is key to preventing future incidents

Forensic Imaging

An image is an exact bit-by-bit copy of a disk Used for evidence collection without altering original

Advanced Forensic Format (AFF)

An open file standard with three variations: AFF, AFM, and AFD AFF variation stores all data and metadata in a single file AFM variation stores data and metadata in separate files AFD variation stores data and metadata in multiple small files

hard link

An inode that links directly to a specific file. The operating system keeps a count of references to this link. When the reference count reaches zero, the file is deleted. In other words, you can have any number of names referencing a file, but if that number of references reaches zero (i.e., there is no name that references that file), then the file is deleted.

volatile memory analysis: Step Three

Analyze the evidence on the collection system. Unlike live response, you don't need any additional evidence from the compromised system.

Historical Steganography

Ancient Chinese wrapped notes in wax and swallowed them for transport In ancient Greece, message written on slave's shaved head, then hair allowed to grow back During World War II, French Resistance sent messages written on the backs of couriers using invisible ink

1987

Andrew S. Tanenbaum creates Minix, another UNIX variant

Digital Linear tape (DLT)

Another type of magnetic tape storage Relies on a linear recording method Tape as either 128 or 208 total tracks Used primarily to store archived data

"valid" emails

Appears as through mail is from trusted source Message content is suspicious Content may contain URL that points to malicious site

OSI Model

Application Presentation Session Transport Network Data Link Physical

TCP/IP Model

Application Transport Internet Network access

/var/log/apport.log

Application crashes

digital audio tape (DAT) drives

Are among most common type of tape drives Use 4-mm magnetic tape enclosed in a protective plastic shell Tapes wear out just like audio tapes Will most likely contain archived/backup data that you need to analyze Forensically wipe target drive first so you can be sure that there is no residual data on that drive Ten restore it to target hard drive (magnetic or solid state) in order to analyze it

steganography

Art and science of writing hidden messages Most common today: Hide messages in pictures LSB (Least Significant Bit): capacity is 5-15% of vessel data

Denial of Service (DoS)

Attempts to prevent system from performing normal functions usually by flooding a website with fake connections that prevent legitimate connections from forming Cyber equivalent of vandalism

Device Seizure

Available from Paraben Software. There is a license fee associated with this product. Paraben makes a number of forensic products

Evidence-Gathering Measures

Avoid changing evidence Determine when evidence was created Search throughout a device Determine information about encrypted and steganized files Present evidence well

Evidence-Gathering Measures (5)

Avoid changing the evidence: Copy it and study the copy Hash the copy: allows checking for changes Each time you touch digital data, there is some chance of altering it. Determine when evidence was created Trust only physical evidence: the 1s and 0s Search throughout a device: at the 1s and 0s level Present the evidence well Logical Compelling Persuasive

HTTP Commands: UNLINK

Breaks an existing connection between two resources

Linux Boot Process

BIOS-POST MBR: Grub LILO Kernel: Initializes devices and moves from real mode to protected mode Init RunLevels

54320/54321 Important Intruder Ports

BO2K (malware)

31337 Important Intruder Ports

Back Orifice (malware)

Blackberry 10

Based on QRNX operating system Supports major features similar to other mobile phones Drag and drop Gestures

6666Important Intruder Ports

Beast(malware)

TCP Connection Termination

Because a TCP connection is two-way, it needs to be "torn down" in both directions uses four packets. The first system sends a TCP packet with the ACK and FIN flags set requesting termination. The second system sends an ACK response. The second system then sends a packet with ACK and FIN flags set. The first system returns an ACK response.

Documenting Hardware Configuration of System

Before dismantling the computer: Take pictures of computer from all angles Record BIOS system time and date in chain of custody form After restoring power: Eject all removable media and fill out a separate chain of custody form for each

Documenting the Hardware Configuration of the System

Before dismantling the computer: Take pictures of computer from all angles Record BIOS system time and date in chain of custody form After restoring power: Eject all removable media and fill out a separate chain of custody form for each

Linux File System Blocks

Blocks are divided into groups. Each group uses one block as a bitmap to keep track of which block inside that group is allocated (used); thus, there can be at most 4,096 * 8 = 32,768 normal blocks per group. Another block is used as a bitmap for the number of allocated inodes. Inodes are data structures of 128 bytes that are stored in a table, (4,096 / 128 = 32 inodes per block) in each group.

Windows Boot Process: Step Five

Boot sector loads NTLDR (the NT loader). It is the first part of the Windows operating system and responsible for preparing and loading the rest of the operating system.

raid aquisitions

Both FTK and EnCase provide built-in tools for acquiring RAID arrays Okay to acquire RAID 1 disks separately RAID 0, 3, 4, 5 and 6 - data striping: make a forensic image of the entire RAID array

Optical media

CD-ROMs use high and low polarization to set the bits of data; however, CDs have reflective pits that represent the low bit If pit is nonexistent, data is a 1; if pit exists, it's a 0 Laser mechanism detects the distance the light beam has traveled in order to detect the presence or absence of a pit; this is why scratches can be problematic for optical media DVDs and Blu-ray discs are enhancements to original compact discs Still utilize same optical process but have larger capacity Should be forensically copied to a clean, forensically wiped drive for analysis

Functions of Transport Layer

Connection Control: Transport layer provides either connection-oriented or connection-less service. Flow Control - Data link layer provides flow control of data across a single link. Error Control - Transport layer also performs error checking. It confirms that data reached to the destination without an error.

usb drives

Connective (not storage) technology Place in read-only mode to avoid altering data

HTTP Commands: LINK

Connects two existing resources

iOS elements in data partition

Calendar entries Contacts entries Note entries iPod_control directory (hidden) iTunes configuration iTunes music

How cross-site scripting affects forensics

Can be complex to uncover. Look for scripts that are unaccounted for by website programmers. This may be unsuccessful as a sophisticated hacker will remove malicious code in an attempt to cover tracks. A more efficient method is to look in webserver logs for any redirect traffic.(Http messages in the 300 range) and determine if any of these redirects cannot be accounted for via legitimate webcoding.

file carving

Can use file carving on a file that's only partially recovered Works on any file system Is often used to recover data from a disk where there has been some damage or where the file itself is corrupt File carving utilities look for file headers and/or footers, and then pull out data s found between the two boundaries One popular file carving tool is Scalpel

Memory Forensics

Capture the memory from a live machine. Can use: Dump-it, RAM Capturer from Belkasoft, OSForensics, other tools Analyze the captured memory Can use: Volatility, Pslist, Pstree, Psscan, Svcscan, other tools

LSB Method (Least Significant Bit)

Consider 11111111 Change last digit to 0 11111110 = 254 in decimal The last bit or least significant bit is used to store data Colored pixels in a computer stored in bits In Windows, for example, 24 bit is the normal color resolution. If you examine the Windows color palette, you'll find that you define a color by selecting three values between 0 and 255 in the Red, Green, and Blue text boxes. Windows color changed by one bit. If you change the least significant bit in a pixel, the image still looks the same. But a picture is made up of thousands—sometimes millions—of pixels. So by changing the least significant bit of many pixels, you can store data that is hidden in an image. This is the basis for modern image steganography

Windows Directories and Folders

Certain directories in Windows are more likely than others to contain evidence. Although there are many directories on a computer, the following are the most forensically interesting: C:\Windows documents and settings—This folder is the default location to save documents. Even though a criminal can save documents anywhere on the computer, it is a good idea to check this folder. C:\users—This includes user profile information, documents, pictures, and more for all users, not just the one currently logged on. C:\Program Files—By default, programs are installed in subdirectories of this directory. C:\Program Files (x86)—In 64-bit systems, 32-bit programs are installed here. C:\Users\username\Documents—The current user's Documents folder. This is a very important place to look for evidence. It is important to complete a general search of the entire suspect drive—not just these specific folders and directories.

Functions of Physical Layer:

Characteristics of media - Defines the characteristics of the interface which is used for connecting the devices. It also defines the type of the transmission media such as copper wires or fiber optic cables. Encoding - Defines the encoding type. Encoding means changing bit stream. Before transmission, physical layer encodes the signal into electrical or optical form depending upon the media. Transmission Rate - Defines the transmission rate of bits. This provides number of bits transmitted per second. It defines how long will the duration of a bit be. Transmission Mode - Defines the transmission mode between two devices. Transmission mode specifies the direction of signal flow. The different types of transmission modes are simplex, half duplex and full duplex. Topology - It is a pattern which defines how devices are get connected in a network. Different types of network topology are: Single Node, Ring, Bus, Mesh, Tree and Hybrid Topology

Invisible Secrets

Choose whether you want to hide a file or extract a hidden file. For this example, suppose you want to hide a file. You select your chosen option in the Invisible Secrets Select Action dialog box. Select an image you want to use as the carrier file Select the file you want to hide. It can be a text file or another image file. You can also choose to encrypt as well as hide. Select a password for your hidden file. Pick a name for the resulting file that contains your hidden file. That's it!

Recovering Info from Damaged Media

Clean Room Test System

HTTP Response Messages 400-499

Client errors

RAID 6 (Striped Disks with Dual Parity)

Combines four or more disks in a way that protects data against loss of any two disks.

Application filter

Combines stateful packet inspection with scanning for specific application issues Example: Web Application Firewall (WAF) scans for typical web attacks such as SQL injection and cross-site scripting

RAID 3 or 4 (Striped Disks with Dedicated Parity)

Combines three or more disks in a way that protects data against loss of any one disk. Fault tolerance is achieved by adding an extra disk to the array and dedicating it to storing parity information. The storage capacity of the array is reduced by one disk.

RAID 5 (Striped Disks with Distributed Parity)

Combines three or more disks in a way that protects data against the loss of any one disk. It is similar to RAID 3, but the parity is not stored on one dedicated drive; instead, parity information is interspersed across the drive array. The storage capacity of the array is a function of the number of drives minus the space needed to store parity.

volatile memory analysis : Step Two

Compute the hash after you complete the memory capture. You don't need to calculate a hash before data acquisition. Due to the volatile nature of running memory, the imaging process involves taking a snapshot of a "moving target."

Documentation of Methodologies and Findings

Computer evidence processing methodology includes strong evidence-processing documentation and good chain-of-custody procedures

Windows Boot Process: Step Two

Computer reads the master boot record (MBR) and partition table

Expert system

Computerized advisory programs that imitate the reasoning processes of experts in solving difficult problems

Equipment

Computers Server should have RAID 1 at a minimum Hard drives and storage USB, SCSI, etc. Legacy and state-of-the-art Peripherals Networking equipment Cables, adapters, and converters Write blockers Tools

Windows 2000

Considered a major improvement in the Windows line. Rather than separate NT and Windows lines, there were simply different editions of Windows 2000, including those for home users, for professional users, and for servers. The differences among the editions were primarily in the features available and the capacity, such as how much random access memory (RAM) could be addressed. Microsoft began to recommend NTFS over FAT32 as a file system.

Logical Damage Recovery

Consistency Checking Problems Failure Deletion

Incident Response

Containment Eradicatoin Recovery Follow-up

/var

Contains data that is changed during system operation This directory is only useful on a live system. Once you shut down the system, the contents of this directory will be different the next time the system is booted up.

/dev

Contains device files Interfaces to devices All devices should have a device file in /dev Device naming conventions: hd = hard drive fd = floppy drive cd = CD Example: Main hard drive can be /dev/hd0

Network Packet: Trailer

Contains error-checking data to detect errors that occur during transmission May be part of the Ethernet or Point-to-Point Protocol (PPP) frame or other Layer 2 protocol The TCP (OSI model Layer 4) and IP (OSI model Layer 3) portions of a unit of information transfer contain only a header and payload. However, if the Layer 2 portion of a unit of information transfer is analyzed, then in addition to a header and payload, there is also a part at the end called the trailer.

/boot

Contains files critical for booting Boot loader (LILO or GRUB) looks in this directory Kernel images commonly located in /boot

/Volumes

Contains information about mounted devices Includes data regarding: Hard disks External disks CDs Digital video discs (DVDs) Virtual machines (VMs)

/usr

Contains subdirectories for individual users

The payload

Contains the content (data) (variable)

NIST 800-34

Contingency Planning Guide for Information Technology Systems This contains a seven-step process for BCP and DRP projects from the U.S. National Institute for Standards and Technology (NIST).

iOS Four Layers

Core OS layer: The heart of the operating system Core Services layer: Where applications interact with the iOS Media layer: Is responsible for music, video, and so on Cocoa Touch layer: Responds to gestures

Target Disk Mode

Create a forensically sound copy of disk contents -dd and netcat -Imaging tools within EnCase or Forensic Toolkit Begin in Target Disk Mode -Cannot write to disk -No chance of altering source disk -Connect to the suspect computer with via USB or FireWire and image the disk allows you to preview the computer on-site, so you can do a quick inspection before disconnecting and transporting the computer to a forensic lab. This is important because you will want to check running systems' processes before shutting the machine down. You simply have to reboot the machine in Target Disk Mode

Proper Procedure: Mathematically Authenticating Data on All Storage Devices

Create hash of original and copy drives & compare Document hashing algorithms used SHA1 most common SHA2 used increasingly Linux: md5sum /dev/<your partition>

Undeleting data

Criminals who are not very technically savvy think that deleting a file will keep authorities from discovering it Expect that evidence will frequently be deleted from computers you examine

Breaking Encryption

Cryptanalysis is using techniques other than brute force to attempt to uncover a key Also referred to as academic or knowledge-based code breaking Cryptographic techniques may be used to test the efficacy of a cryptographic algorithm Such as to test hash algorithms for collisions

Asymmetric cryptogrpahy

Cryptography wherein two keys are used: One to encrypt the message Another to decrypt it

Windows XP/Windows Server 2003

Marked a return to having a separate server and desktop system. The interface was not very different, but there were structural improvements.

paraben's email examiner

Exclusively for email forensics Works like the more complete forensic suites (Forensic Toolkit and EnCase) in that evidence is grouped by case

Presenting has two forms -

Expert Report and Expert Testimony

Teardrop Attack

Exploits the reassembly of fragmented IP packets in the fragment offset field that indicates the starting position, or offset, of the data contained in a fragmented packet relative to the data of the original unfragmented packet.

live forensic tools

PsList - processes PsInfo - operating system details ListDLLs - loaded DLLs PsLoggedOn - login information netstat - network connections

Linux Files Systems

Extended File System (ext) Current version is 4 ext4 supports volumes up to 1 exabyte and single files up to 16 terabytes ext3 and ext4 support three types of journaling: journal (most secure) ordered writeback (least secure) Reiser FS Berkely Fast File system

DoD forensic standards

DC3 sets standards for digital evidence processing, analysis, and diagnostics.

Issues Pertinent to Forensics

Does the Windows version in question support 64-bit processing? Does it have a firewall? If so, is the firewall automatically on? Does the version of Windows support the Encrypted File System (EFS)?

23476/23477Important Intruder Ports

Donald Dick (malware)

Seizing evidence from a Blackberry

Download and install BlackBerry Desktop Manager Steps to create complete backup image: Open BlackBerry's Desktop Manager. Click Options then Connection Settings. If the Desktop Manager hasn't already done so, select USB-PIN: Device # for connection type. Click OK. Select Backup and Restore. Click the Back Up button for a full backup of the device or use the Advanced section for specific data. Select your destination (such as workstation) and save the .ipd file. Examine data and perform a forensic analysis

Business continuity plan (BCP)

Focuses on keeping an organization functioning as well as possible until a full recovery can be made concerned with maintaining at least minimal operations until organization can be returned to full functionality

Data Encryption Standard (DES)

Data is divided into 64-bit blocks . Data is manipulated by 16 separate steps of encryption involving substitutions, bit-shifting, and logical operations using a 56-bit key. Data is then further scrambled using a swapping algorithm. Data is transposed one last time The idea is to continually scramble the underlying message to make it appear as random as possible. No longer secure

Forensic Certifications

Demonstrates baseline of competence Know the following areas: PC hardware Basic networking Security hacking

Formal Forensic Approaches

Department of Defense Forensic Standards (D3) Digital Foresnic Research Workshop Framework(DFRWS) The Scientific Working Group on Digital Evidence Framework(SWGDE) Event-based digitial forensic investigation framework

iOS

Derived from OS X Interface based on touch and gestures In normal operations, iOS uses HFS+ file system Can use FAT32 when communicating with a PC Originally released in 2007 for the iPod Touch and the iPhone

RSA

Described in 1977 by Ron Rivest, Adi Shamir, and Leonard Adleman at MIT Perhaps the most widely used public key cryptography algorithm today Is based on relationships of prime numbers Security of RSA derives from fact that it is difficult to factor a large integer composed of two or more large prime factors

Routers in Detail

Determine where to send information from one computer to another Are specialized computers that send your messages and those of every other Internet user to their destinations along thousands of pathways Maintain a routing table to keep track of routes Some routes are programmed manually, many are "learned" automatically by route

initdefault

Determines which run level to enter initially, using the highest number in the run_level field. If there is no initdefault entry in inittab, then init requests an initial run level from the user at boot time.

Functions of Session Layer:

Dialog Control - The session layer is responsible for setting up sessions between devices. It allows two devices to enter into dialog (communication process). These dialogs can take place either in half-duplex or full duplex mode. Synchronization - At the session layer, checkpoints (synchronization bits) are added into a stream of data to synchronize the sessions. For example, if a device is sending a file of 1000 pages, then you can insert checkpoints after every 100 pages to ensure that these 100 pages are received without an error and acknowledged independently. If an error occurs while transmitting page 631, the only pages that should be retransmitted are from 601 to 631. Previous pages need not be resent.

Operating systems

Different operating systems have different file structures. Linux distributions vary and are generally updated more frequently than Windows or Mac OS.

Handling Evidence

Digital forensics specialist is responsible for finding, preserving, and preparing evidence The specialist must: -Collect data -Document filenames, dates, and times -Identify any file, program, and storage anomalies -Gather evidence

Handling Evidence

Digital forensics specialist is responsible for finding, preserving, and preparing evidence The specialist must: Collect data Document filenames, dates, and times Identify any file, program, and storage anomalies Gather evidence

Windows Tools for recovering data files:

DiskDigger WinUndelete FreeUndelete OSForensics

RAID-0 (Disk Striping)

Distributes data across multiple disks in a way that improves data retrieval speed.

List 4 formal forensic approaches

DoD forensic standards The Digital Forensic Research Workshop Framework (DFRWS The Scientific Working Group on Digital Evidence Framework (SWGDE) Event based Digital Forensics Investigation Framework

Documentation of Methodologies and Findings

Documentation of forensic processing is critical to effectively presenting findings and the court allowing evidence into admission The following areas should be completely understood by forensic specialist 1. Disk Structure 2. File Slack Searching

Why 4DES Was Never Implemented

Early simulations indicated it was too scrambled Blocks of original plaintext appeared in the final ciphertext One of the driving factors behind searching for a new algorithm not in the DES line

What an email review can reveal

Email messages related to the investigation Email addresses related to the investigation Sender and recipient information Information about those copied on the email Content of the communications Internet Protocol (IP) addresses Date and time information User information Attachments Passwords Application logs that show evidence of spoofing

FORENSIC SOFTWARE TOOLS

EnCase Forensic Toolkit (FTK) OSForensics Helix Kali Linux AnaDisk disk analysis tool CopyQM Plus disk duplication software The Sleuth Kit Disk Investigator

Common Forensic Software Programs

EnCase Widely used by law enforcement Prevents accidental changes to suspect machine Analyzes header, checksum and data blocks Forensic Toolkit Widely used by law enforcement Password cracking Search and analyze Windows Registry

Forensic Specfic Certifications

Encase Certified Examiner Certification Access Data Certified Examiner OS Forensics ISC2 Certified Cyber Forensics Professional (CCFP) EC-Council Certified Hacking Forensic Investigator (CHFI) High Tech Crime Network certifications SANS Global Information Assurance Certification (GIAC)

Proper Procedure: Identifying File, Program, and Storage Anomalies

Encrypted, compressed, and graphics files store data in binary format. Therefore, they require manual evaluation.

Functions of Presentation Layer

Encryption - Presentation Layer encrypt the data before it passes to the session layer. Encryption is a process of converting a readable data into unreadable format so that it can protects the information from unauthorized access. On the receiver side, presentation layer is going to decrypt data in the readable format and passes it to the application layer. Compression - Presentation layer compress data in less number of bits (reduce the size of data) So that, it can travel in the network fast with consuming less space. It is important while transmitting multimedia information such as text, audio and video.

Scytale Cipher

Encrypts messages by wrapping a leather strip around a cylinder or baton, and writing across the leather Turning cylinder produced different ciphertexts Message decrypted by reading the message once placed over the same leather "key" wrapped around the same size cylinder

How to Set Up a Forensic Lab

Equipment Storage RAID 5 is recommended Back up at least 1x/day Security is paramount Lab Limit access to lab Physical security Fire resistant evidence safe Working network For email and internet use Outside of the lab

stateful packet inspection (SPI) firewall

Examines each and every packet, denying or permitting based on not only the current packet, but also considering previous packets in the conversation Firewall is aware of the context in which a specific packet was sent Are far less susceptible to ping floods, SYN floods, and spoofing

Windows

FAT16 and FAT32 used in pre-Windows 2000 versions NTFS file system in use since Windows 2000 Uses a table to map files to specific clusters where they are stored on the disk

windows

FAT32 (before WIN2000) Deleted files not removed from drive, FAT is updated to reflect the clusters are no longer in use and will be overwritten NTFS (starting with WIN20000 Deleted files not removed from drive,clusters marked as deleted (moved to the Recycle bin) and marked with a special character. Windows XP used INFO2 file Windows 7/Vista use $I structure Clusters and Slack Space - understand this

Hexidecimal values: JPEG

FF D8

Jpeg

FF D8 PDF: 25 50 BMP: 42 4D ZIP: 50 4B EXE: 4D 5A PNG: 89 50 GIF: 47 49 WAV, AVI: 52 49 MP3: 49 44

MAC refers to three critical properties

File modified File accessed File created These date/time stamps can be important forensically. For example, if the modified date for an image is later than the created date, then that image has been edited.

mac

File systems HFS and HFS+

Documenting Filenames, Dates, and Times

Filenames, creation dates, and last modified dates and times can be relevant as evidence Catalog all allocated and "erased" files Sort files based on filename, file size, file content, creation date, and last modified date and time Sorting provides a timeline of computer usage

Dcoumenting Filenames, Dates and Times

Filenames, creation dates, and last modified dates and times can be relevant as evidence Catalog all allocated and "erased" files Sort files based on filename, file size, file content, creation date, and last modified date and time Sorting provides a timeline of computer usage

Unallocated/slack space

Files stored on disk (archives, files, folders, etc.) Host protected area (HPA) or vendor-specific drive space (recovery volumes, etc.) Master boot record (MBR) where empty drive sectors remain Boot sectors in nonbootable partitions To find relevant data only in the unallocated space, search the unallocated space for keywords. Tools such as AccessData's Forensic Toolkit (FTK) allow an investigator to take an entire image and try to identify all of the documents in the file system, including the unallocated space. To search the entire disk many times over, tools such as FTK can help you build a full-text index. Full-text indexing allows you to build a binary tree-based dictionary of all the words that exist in an image, and you can search the entire image for those words in seconds.

Windows Log Files

Files that contain information about events and other activities that occur in Windows Event Viewer used to view log files All versions of Windows support logging, although the method to get to the log can vary from one version to another. With Windows 10 and Windows Server 2012, you find the logs as follows: Click on the Start button in the lower-left corner of the desktop. Click the Control Panel. Select Administrative Tools. Select Event Viewer.

How to fake an email

Find a free public Wi-Fi in an area at least one hour from your home. Spoof both your IP address and MAC address. Send the email through an anonymous email account set up for that purpose. It is, however, very common for criminals to actually send emails from their own computers without even bothering to spoof their IP address or MAC address. Even computer-savvy criminals, who think to spoof their IP addresses, might not think to spoof the MAC address.

Evidence-Handling Tasks (3)

Find evidence Preserve evidence Prepare evidence

Getting Headers for Yahoo Email

First open the message. On the lower right, there is a link named Full Headers. Clicking on that link allows you to see the headers for that email.

Eradication

Fix vulnerabilities Example: Remove the malware Perform comprehensive examination of what occurred and how far it reached Ensure that the issue was completely addressed Forensics begins at this stage

Disaster Recovery Plan (DRP)

Focuses on executing a full recovery to normal operations Sometimes referred to as an incident response plan (IRP) focuses on returning to full functionality

1983

Richard Stallman creates GNU (GNU's Not UNIX

Preparing the System

For suspect computers: Remove the drive(s) Create an evidence form and/or a chain of custody form For mobile devices: Remove SIM card, if necessary Some devices let you dock the phone examine it without removing SIM

Present evidence well

Forensic examiners must present computer evidence in a logical, compelling, and persuasive manner. The evidence should be solid enough that a defense counsel cannot rebut it. A forensic specialist must create a step-by-step reconstruction of actions, with documented dates and times. The specialist's testimony must explain simply and clearly what a suspect did or did not do.

Search throughout a device

Forensic specialists must search at the bit level across a wide range of areas inside a computer, including: Email and temporary files in the operating system and in databases Swap files that hold data temporarily, logical file structures, and slack and free space on the hard drive Software settings and script files that perform preset activities Web browser data caches, bookmarks and history, and session logs that record patterns of usage

Determine when evidence was created

Forensic specialists should not trust a computer's internal clock or activity logs. Before logs disappear, an investigator should capture: The time a document was created The last time it was opened The last time it was changed Trust only physical evidence—The physical level of magnetic materials is where the 1s and 0s of data are recorded. In system forensics, only this physical level is real. A forensic specialist should consider everything else untrustworthy

Imaging with dd and netcat

Forensically wipe the drive: dd if=/dev/zero of=/dev/hdb1 bs=2048 Use netcat to set up the forensic server to listen: # nc -l -p 8888 > evidence.dd Use the dd command to read the first partition: # dd if=/dev/hda1 | nc 192.168.0.2 8888 -w 3

Follow-up

Forensics plays a critical role in this stage as well. The IT team must determine how this incident occurred and what steps can be taken to prevent the incident from reoccurring. Obviously, the results of the forensic examination are instrumental to the follow-up stage

Expert Reports

Format Thoroughness Back up everything you say

Kali Linux

Has a number of forensics tools Can use as quality control tool to complement OSForensics, FTK, or Encase Includes Autopsy, a web-based graphical user interface for the command-line tool Sleuth Kit

Cryptographic Hashes

Hashing is a type of cryptographic algorithm with some specific characteristics It is one-way, not reversible It is a fixed-length output no matter what input is given The algorithm must be collision resistant

Kali Linux

Formerly known as BackTrack Includes a variety of tools and has an easy-to-use KDE interface

invisisble secrets

Free tool that can be used to hide or extract a hidden file.

Linux GUI's

GNOME (GNU Network Object Model Environment) KDE (K Desktop Environment) Plasma Common Desktop Environment (CDE) Originally developed in 1994 for UNIX systems Based on HP's Visual User Environment (VUE) Enlightenment Relatively new Designed for graphics developers

2007

General release of Windows Vista

Email Message Components

Header Addressing information Source and destination Body Contents of the message Attachments External data that travels along with each message

Windows Registry Hives

HKEY_CLASSES_ROOT (HKCR) HKEY_CURRENT_USER (HKCU) HKEY_LOCAL_MACHINE (HKLM) HKEY_USERS (HKU) HKEY_CURRENT_CONFIG (HCU)

Windows Vista and Windows 7

Had feature changes and additional capabilities over XP, but essentially the interface was moderately tweaked with each version. The same can be said of Windows Server 2008. Someone comfortable with Windows Server 2003 would have no problem working with Windows Server 2008.

What are 4 basic principles to consider when dealing with forensic evidence?

Handle the original data as little as possible - you should instead make a bit level copy and do all forensic analysis on that. Comply with the rules of evidence - follow the chain of custody and Daubert principle, and other Rules of evidence (example, Federal Rules of Evidence) Avoid exceeding your knowledge - if you exceed your listed expertise you could miss vital information or at the very lease the other lawyer could claim you have. Create an analysis plan - you should create an standard analysis plan that is customizable by situation, which should include how you will collect evidence, concerns about evidence being changed or destroyed, what tools are appropriate for the specific investigation, type of case, admissibility rules.

magnetic media

Hard drives and floppy drives Data is stored magnetically; drives are susceptible to magnetic interference If drive is demagnetized, there is no way to recover data Transport suspect drives in special transit bags that reduce electrostatic interference to decrease the chance of inadvertent loss of data Magnetic drives have moving parts

Event based Digital Forensics Investigation Framework

Has 5 primary phases, readiness, deployment, physical crime scene investigation, digital crime scene investigation, and presentation

/bin directory

Holds binary or compiled files used by ordinary users Can include malware

/root

Home directory for the root user Contains data for the administrator Linux root user is equivalent to Windows Administrator

both magnetic and solid state drives

Host protected area (HPA) Master boot record (MBR) Volume slack Good blocks marked as bad File slack

Magentic and Solid State Drives

Host protected area (HPA) or vendor-specific drive space Master boot record (MBR) where empty drive sectors remain Volume slack Unallocated space Good blocks marked as bad File slack Files stored on disk (archives, files, folders, etc.) Host protected area (HPA) or vendor-specific drive space (recovery volumes, etc.) Master boot record (MBR) where empty drive sectors remain Boot sectors in non-bootable partitions

2017

Hundreds of Linux distributions are available

Adding Forensics to Incident Response

Identify forensic resources the organization can use in case of an incident Identify an outside party that can respond to incidents with forensically trained personnel Weave forensic methodology into organization's incident response policy Provide appropriate training to staff for preserving evidence

Name 6 types of computer based crime

Identify theft hacking systems for data cyberstalking/harrassment internet fraud non-access computer crimes cyberterrorism

Identify Crime:A criminal uses phishing to trick a victim into giving up personal information

Identity theft

Electronic Communications Privacy Act (ECPA)

If an Internet service provider (ISP) or any other communications network stores an email, retrieval of that evidence must be analyzed under the Electronic Communications Privacy Act (ECPA). The ECPA creates statutory restrictions on government access to such evidence from ISPs or other electronic communications service providers. Requires different Legal processes to obtain specific types of information: Basic subscriber information—This information includes name, address, billing information, telephone number, etc. An investigator can obtain this type of information with a subpoena, court order, or search warrant. Transactional information—This information includes websites visited, email addresses of others with whom the subscriber exchanged email, and buddy lists. An investigator can obtain this type of information with a court order or search warrant. Content information—An investigator who has a search warrant can obtain content information from retrieved email messages and also acquire unretrieved stored emails. Real-time access—To intercept traffic as it is sent or received, an investigator needs to obtain a wiretap order.

How ophcrac affects forensics

If occurs on Windows server 2003 2008 2012 reboot will show in log. If log shows a reboot after a successful logon this can indicate ophcrack or similiar tool used A forensic investigator can also check physical security such as security cameras maybe helpful Finally if user assigned to acct is not present this can also be an indication

Windows Registry: Passwords

If the user tells Internet Explorer to remember passwords, then those passwords are stored in the Registry and you can retrieve them. The following key holds these values: HKCU\Software\Microsoft\Internet Explorer\IntelliForms\SPW

Seizing Evidence from an iPhone

If you have imaged the phone and you then search for information, you may have to look more closely to find some data: Library_CallHistory_call_history.db has the entire call history. If you cannot view that directly on the phone itself, the database file has all call information. Cookies are in the file Library_Cookies_Cookies.plist. This can give you a history of the phone user's Internet activities. These, and other files, are actually copied to a PC during synchronization. Here are a few of those files: Library_Preferences_com.apple.mobileipod.plist Library_Preferences_com.apple.mobileemail.plist Library_Preferences_com.apple.mobilevpn.plist The mobileemail.plist file gives you information about email sent and received from the phone. The mobilevpn.plist file can indicate if the user has used the phone to communicate over a VPN. Deleted files When a file is deleted on iPhone/iPad/iPod, moved to.Trashes\501 folder Data exists until overwritten

Rules For Seizing Evidence from a Mobile Device

If you plug device into a computer, make sure device does not synchronize with the computer Touch evidence as little as possible Document what you do to the device Don't accidentally write data to the mobile device

Multialphabet substitution example

If you select three substitution alphabets (+2, -2, +3) A CAT becomes C ADV

file slack searching

If you write a 1-kilobyte (KB) file to a disk that has a cluster size of 4 KB, the last 3 KB of the cluster are wasted This unused space between the logical end of file and the physical end of file is known as file slack or slack space File slack is a source of potential security leaks involving passwords, network logons, email, database entries, images, and word processing documents

Apple 1

In 1975, Steve Wozniak and Steve Jobs finished the prototype of the first Apple computer. Wozniak worked for Hewlett-Packard (HP) and his employment contract required him to give his employer first right of refusal on any of his inventions. However, HP was not interested and released the technology to Wozniak. Apple Computer was formed in April 1976 by Steve Jobs, Steve Wozniak, and Ronald Wayne. The Apple I, created by Wozniak, had an 8-bit microprocessor running at just below 1 MHz. The Apple I had a built-in video terminal, sockets for 8 kilobytes of onboard RAM, a keyboard, and a cassette board meant to work with regular cassette recorders

Center for Education and Research in Information Assurance and Security (CERIAS)

In 2004 Brian Carrier and Eugene Spafford at Purdue University proposed a forensics model that was more flexible and intuitive. Has five primary phases: -Readiness -Deployment -Physical Crime Scene Investigation -Digital Crime Scene Investigation -Presentation

Incident Response Plan

In place to respond to: Fire Flood Hurricane Tornado Hard drive failure Network outage Malware infection Data theft or deletion Intrusion

var/vm folder

In this folder, you will find a subfolder named app profile, which will contain lists of recently opened applications as well as temporary data used by applications

/var/spool/cups

In this folder, you will find information about printed documents, including the name of the document printed and the user who printed it.

The Scientific Working Group on Digital Evidence Framework (SWGDE)

Includes 4 stages, Collect, preserve, examine, transfer

Recovery PLan

Includes business continutity plan disaster recovery blan based on priorities established in business impact analysis Alternate equipment identified? Alternate facilities identified? Mechanism in place for contacting all affected parties, employees, vendors, customers, and contractors, even if primary means of communication are down? Off-site backup of the data exists? Can backup be readily retrieved and restored?

Sparse Infector

Infects only on certain occasions - for example, it may infect every 10th program executed, or it might wake up once a month and infect. This strategy makes it more difficult to detect the virus.

What is bit level information?

Information at the level of actual 1's and 0's stored in memory or on the storage device, as opposed to going through the file systems interpretation

Network packets

Information that is sent across a network is divided into chunks, called packets. Packets exist in the OSI model at Layer 3 and are typically formatted according to the Internet Protocol—though you may come across many other protocols and their unique formats.

HTTP Response Messages 100-199

Informational; the server is giving your browser some information, most of which will never be displayed to the user

Deleting a File in Linux

Inode hard link is integral Inode links directly to a specific file OS keeps a count of references to each hard link When reference count reaches zero, file is deleted

Scapel Usage

Install tool Verify output directory is empty edit config file: In the configuration file /etc/scalpel/scalpel.conf, uncomment the specific file format you want to recover. run scalpel command: sudo scalpel [device/directory/file name] -o [output directory]

memory resident

Instructions that remain in memory while the computer or mobile device is running.

Playfair Cipher

Invented by Charles Wheatstone in mid 1800s. Lord Playfair pushed use of it. Works by encrypting pairs of letters, also called digraphs, at a time Uses a 5 × 5 table that contains a keyword or key phrase To use , one need only memorize that keyword and four rules Example: "Attack at dawn" becomes "At ta ck at da wn"

How SQL injection affects forensics

Investigator should search firewall logs and database logs

Recovery

Involves returning the affected systems to normal status If malware: Ensure the system is back in full working order with no presence of malware Might need to restore software and data from backup

Universial Serial Bus (USB)

Is actually a connectivity technology, not a storage technology Can be used to connect to external drives that can be either magnetic or solid state Have no moving parts, which means these drives are resilient to shock damage Thumb drives can be easily erased or overwritten. Copy data from USB drive to a target forensic drive for analysis

discarded information

Is another method that allows a hacker to gather information about a person's identity Often referred to as dumpster diving Shred documents before throwing them out to avoid identity thief

What three things should be considered regarding cyberstalking/harassment cases?

Is it possible, if a person make a threat is it credible? How frequent How serious, example specific detailed threats, taking the "I will kill him/her", to the next step including detailing how you might accomplish it

What are three roles can a computer or device play in computer crime

It can be the target of the crime It can be the instrument of the crime It can be an evidence repository that stores valuable information about the crime

Proper Procedure: Transporting the Computer System to a Secure Location:

It is evidence Lock it in the vehicle Drive straight to lab

Attempting Local Repair

It is possible that the data is deemed "lost," and there will be no increased loss if you attempt local repair and fail. If so, you can try the following: a. Remove the printed circuit board and replace it with a matching circuit board from a known healthy drive. b. Change the read/write head assembly with matching parts from a known healthy drive. c. Remove the hard disk platters from the original drive and install them into a known healthy drive.

Windows Registry : Tracking Word Documents

It is possible to track Word documents in the Registry. Many versions of Word store a PID_GUID value in the Registry, for example, something like: { 1 2 3 A 8 B 2 2 - 6 2 2 B - 1 4 C 4 - 8 4 A D - 0 0 D 1 B 6 1 B 0 3 A 4 }. The string 0 0 D 1 B 6 1 B 0 3 A 4 is the MAC address of the machine on which this document was created.

Getting Header in Outlook

It is relatively easy to view the headers using Outlook. With a specific message open, select File and then Info. Then select Properties and you will be able to view the headers. Older versions of Outlook have a different method to get to headers. With Outlook 2000/2003/2007, there are two methods: Method #1—Right-click the message in the folder view, and then choose Options. Method #2—In an open message, choose View and then Options. With either method, you will see the Internet headers portion of the Message Options dialog box.

/var/log/lpr.log

Items that have been printed Useful or corportate espinoage cases

JTAG

Joint Test Action Group An Institute of Electrical and Electronics Engineers (IEEE) standard for testing chips Test access points (TAPs) used to directly access the chip and extract data Forensic examiner takes back off of phone, and then connects wires by soldering or by using some other means to the TAPs of the phone's memory chip Wires also connected to a JTAG device that uses software to extract the data directly from the memory chip

Preventing Logical Damage

Journaling file systems Use a consistency checker Use disk controllers with battery backups

/etc directory

Just as in Linux, this is where configuration files are located. Cybercriminals often adjust the system's configuration. Sometimes this is done in order to facilitate the criminal's return to the system later.

volatile memory analysis: Step Four

Justify the validity of the acquired memory data (essential when producing digital data from a live system as evidence in court). One common approach is to acquire volatile memory data in a dump file for offline examination. You can then analyze the dump electronically or manually in its static state.

transporting the evidence (computer)

Keep evidence in possession or control at all times Document movement of evidence between investigators Secure evidence appropriately so it can't be tampered with or corrupted Lock in a vehicle Drive vehicle directly to lab

volume Shadow copy

Keeps a record or copy of state changes Stores them in blocks of data that are compared daily Changed blocks are copied to Volume Shadow Volume Shadow Copy service runs once per day

Windows Boot Process: Step 13

Kernel initialization begins (screen turns blue

AES Steps

Key Expansion Initial Round: AddRoundKey Rounds: SubBytes ShiftRows MixColumns AddRoundKey Final Round: SubBytes ShiftRows AddRoundKey

linux directories

Key directories are important to the functioning of every operating system Directories are also important places to seek out evidence in an investigation

modern methods

Known Plaintext Chosen Plaintext Ciphertext-only Related-key

Modern Methods of Cracking Encryption

Known plaintext attack Chosen plaintext attack Ciphertext-only Related-key attack

Technical information collection considerations:

Lifespan of information, how long is information valid and accessible for example some evidence resides in storage that must have constant power. It is also frequently not possible or practical to determine who made a change and when.

636

Lightweight Directory Access Protocol Secure (LDAPS) (SSL or TLS)

What are some challenges to System Forensics

Large volume of data, system complexity, distributed crime scenes, growing caseload and limited resources, obscured information and anti-forensics

Sleuth Kit

Library and collection of command-line tools allowing investigation of volume and file system data

Linux shell commands for forensics

Linux has hundreds of shell commands Some can be very useful in forensic investigations

Log Files as Source of Evidence

Log files contain primary records of a person's activities on a system or network Log files can often identify: Source, nature, and time of an attack Specific user account of events related to illicit activities

Types of Logs: Security event

Log files from servers and Windows security event logs on domain controllers, for instance, can attribute activities to a specific user account. This may lead you to the person responsible. Intrusion detection systems (IDSs) record events that match known attack signatures, such as buffer overflows or malicious code execution. Configure an IDS to capture all the network traffic associated with a specific event. In this way, you can discover what commands an attacker ran and what files he or she accessed. You can also determine what files the criminal downloaded, such as malicious code, or uploaded, such as files copied from the system.

Functions of Network Layer

Logical Addressing - The data link layer provides physical addressing which is useful for a local network. When the packet is designed for a device outside the network, we require other addressing scheme to identify source and destination. Network layer adds header to the data that includes the logical address (IP address) of the source and destination. It is a 32-bit address that uniquely identifies the device connected to the network. Routing - It defines the proper path of a packets to reach in its correct destination. Routing can be of two types, static or dynamic. Handling Congestion issues - Any given network has a certain capacity to deliver or handle number of packets. When the packets exceed the handling capacity then the lots congestion occurs. It is the responsibility of the network layer to control such congestion problems. Inter-networking - Inter-networking means connecting two or more computer networks together. The Internet is the best example of inter-networking. There are different types of networks that exist in the real world such as LAN, MAN and WAN.

Identity Theft Forensics

Look for spyware on the victim's machine If spyware exists, search for where the spyware is sending its data Periodic email with an attachment A stream of packets to a server the criminal has access to If phishing, check email history on the victim's computer as well as the web history

Windows Boot Process: Step Three

MBR locates boot partition. This is the partition that has the operating system on it.

Windows Boot Process: Step Four

MBR passes control to boot sector on boot partition

NTFS Fundamental Files

MFT(Master File Table) which describes all files on the volume Cluster bitmap which is a map of all the clusters on the hard drive

New Technology File System (NTFS)

Mac OS X includes read-only support for the New Technology File System (NFTS). This means if you have a portable drive that is NTFS, Mac OS X can read that partition

Microsoft Disk Operating System (MS-DOS)

Mac OS X includes support for Microsoft Disk Operating System (MS-DOS) file systems FAT12, FAT16, and FAT32.

Yosemite

Mac OS X v10.10)—Released in October 2014. The most important part of this release, from a forensics standpoint, is that it allowed users who have iPhones with iOS 8.1 or later to pass certain tasks to their Macintosh computer.

Leopard

Mac OS X v10.5)—Had over 300 new features, support for Intel x86 chips, and support for the new G3 processor

Lion

Mac OS X v10.7)—Included a major interface change that made it more like the iOS interfaces used on iPhone and iPad.

Mountain Lion

Mac OS X v10.8)—Had built-in support for iCloud, to support cloud computing.

1985

MacIntosh Had an 8-MHz Motorola processor, a black-and-white monitor, and a 3.5-inch floppy drive. The operating system was System 1, which eventually led to the Macintosh II running System 7. System 7—Allowed text dragging between applications, viewing and switching applications from a menu, a control panel, and cooperative multitasking. Mac OS for PowerPC—Introduced the System 7.1.2 operating system. AIX for PowerPC—Used a variation of the IBM AIX system. It also used the Common Desktop Environment, a graphical user interface that is popular in the UNIX world. This product did not do well in the market and was discontinued in 1997

Machintosh File System (MFS)

Macintosh File System (MFS) shipped with the first Macintosh in 1984. It has not been used in more than 15 years and you are unlikely to encounter it.

MacIntosh

Macintosh OS X and later versions are based on FreeBSD A UNIX clone, much like Linux Mac OS X uses HFS+, or Hierarchical File System Plus Earlier versions of Macintosh used HFS Therefore, some of the techniques that work for Linux also work with Macintosh. However, there are also some tools you can use that are made specifically for Macintosh

Directories

Macintosh has a number of important directories Some are relevant to a forensic examination of a Macintosh machine

Imaging with Encase

Makes bit-level images and then mounts them for analysis Preview mode allows investigator to use a null modem cable or Ethernet connection to view data on the subject machine safely Doesn't alter evidence

spoofing

Making an email message appear to come from someone or someplace other than the real sender or location First machine to receive spoofed message records machine's real IP address Header contains both the faked IP and the real IP address unless, of course, the perpetrator is clever enough to have also spoofed his or her actual IP address.

Windows Registry: Malware

Malware may be found in the Registry. If you search the Registry and find HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon, it has a value named Shell with default data Explorer.exe. This tells the system to launch Windows Explorer when the logon is completed. Some malware appends the malware executable file to the default values data, so that the malware will load every time the system launches. It is important to check this Registry setting if you suspect malware is an issue. The key HKLM\SYSTEM\CurrentControlSet\Services\ lists system services. Several types of malware install as a service, particularly backdoor software. Be sure to also check this key if you suspect malware is an issue.

linux shells

Many Linux administrators work entirely in the shell without ever using a graphical user interface (GUI). Linux offers many different shells

/mnt

Many devices are mounted in /mnt Drives must be mounted prior to use Checking this directory lets you know what is currently mounted on system

How to Examine a Mac

Many forensics tools are less effective in extracting data on a Macintosh than in Windows. One technique is to create a copy of the forensic image and then mount it as a read-only virtual machine (VM). Mount it as read only.

RFC 2822 Specifications for Email Headers

Message header must include From field-the email address and optionally the name of the sender Date field-the local time and date when the message was written Message header should include: (not required) Message-ID field-an automatically generated field in-Reply-To field- the message-ID of the message that is a reply to which is used to link related messages together

/var/log/kern.log

Messages from the operating system's kernel less interesting forensically but can be used to rule out malware

Windows 8 phone

Microsoft Mobile Nokia

Recovering After Logical Damage

Microsoft Windows: chkdsk Linux: fsck Mac OS X: Disk Utility The Sleuth Kit TestDisk

RAID 1 (mirroring)

Mirrors the contents of the disks creating an identical copy of the drive running on the machine.

Wi-Fi

Most cellular phones and other mobile devices can connect to Wi-Fi networks Free Wi-Fi hotspots in restaurants, coffee shops, hotels, homes, and many other locations

solid state drives

Most use Negated AND (NAND) gate-based flash memory NAND retains memory without power

Recovering a file in linux

Move system to single-user mode with init 1 command Use grep to search for and recover files Example: # grep -i -a -B10 -A100 'forensics' /dev/sda2 > file.txt

Windows Boot Process : Step 11

NTLDR loads hal.dll (hardware abstraction layer).

Windows Boot Process: Step 12

NTLDR loads the system hive (i.e., the Registry) and reads in settings from it.

Windows Boot Process: Step 9

NTLDR reads boot.ini and displays the boot loader menu. If there are multiple operating systems, they will be displayed.

Windows Boot Process: Step 8

NTLDR starts minimal file system drivers (FAT, FAT32, NTFS).

Windows Boot Process: Step 7

NTLDR switches from real mode 32-bit memory or 64-bit depending on the system. Real mode is the default for x86 systems. It provides no support for memory protection, multitasking, or code privilege levels.

Wireless Network Discovery Tools

NetStumbler MacStumbler iStumbler

Network Traffic Analysis

Network Monitoring-the big picture of what is happening on a network Network Analysis-discovers the details of what is happening on a network

Function of Application Layer

Network Virtual Terminal - It is a software version of physical terminal. It allows the user to login to the computer remotely connected in the network. File Transfer Access and Management (FTAM) - It helps user to access files in a remote computer and make changes. User can directly edit the file in the remote computer or they can download it into their local computer. Mail Services - It helps in e-mails forwarding to another device over the internet.

Security

Network and electronic security Lab network should not be attached to the Internet Includes physical security Access to the lab Ways of securing evidence

Wireshark

Network protocol analyzer Captures Ethernet, IEEE 802.11, PPP/HDLC, ATM, Bluetooth, USB, Token Ring, Frame Relay, FDDI, and other packets Analyzes real-time and saved data Runs on Windows, Linux, OS X, Solaris, FreeBSD, NetBSD, and others Supports IPv4 and IPv6 Allows Voice over IP (VoIP) analysis Freely available

stateless

No information about the exchange is permanently retained by the server without help (i.e. cookies) ; applies to normal web traffic

/proc

Not stored on hard disk Is created in memory and keeps information about currently running processes Contains subdirectories that can be used to recover files and evidence EX:Assume that an intruder has downloaded a password cracker and is attempting to crack system passwords. The tool is attempting a number of passwords in a text file called pass. The intruder subsequently deletes both the executable and the text file, but the process is still running in memory. You can use ps or pstree to find the running processes and get the process ID. Assume the process ID is 3201. Now in the /proc directory, you can find /proc/3201. If you simply copy the executable from /proc to some other directory, it recovers that deleted executable. Of course, this works only on a live system, prior to shutting it down

Windows Boot Process: Step 6

Note that if instead of being shut down, Windows has been put in the hibernation state, the contents of hiberfil.sys are loaded into memory and the system resumes at the previous state

Windows Boot Process: Step 10

Ntldr loads NTOSKRNL and passes hardware information. The NTOSKRNL is the actual kernel for the Windows operating system. This is the end of the boot phase and the beginning of the load phase

Packet Mistreating

Occurs when a compromised router mishandles packets Results in congestion in a part of the network

crytographic hashes

One -way, not reversibile Fixed-length output regardless of input Must be collision resistant

Getting Header in Apple Mail

Open Apple Mail. Click on the message for which you want to view headers. Go to the View menu. Select Message, then Long Headers. The full headers will appear in the window below your Inbox.

Linux Distributions

Open source operating system Popular distributions: Ubuntu Red Hat Enterprise Linux (RHEL) OpenSUSE Debian Slackware

Generic Forensic Zip (Gfzip)

Open-source file format used to store evidence from a forensic examination

Types of Logs: Operating system event

Operating systems log certain events, such as the use of devices, errors, and reboots. Operating system logs can be analyzed to identify patterns of activity and unusual events

Other symmetric algorithms

Other symmetric algorithms: Blowfish Serpent Skipjack

DoS:

Overwhelming a system with requests

Certifications

PC Hardware: Comp TIA A + Basic Networking: Network+ or Cisco Certified Network Associate (CCNA) Security: Comp TIA Security + or ISC2 CISSP Hacking: EC-Council Certified Ethical Hacker

995

POP3 Secure encrypted POP3

SAM file

Password hashes are stored in a SAM file in Windows. It's in c:\windows\system32\config\SAM. There is a backup of this file in the repair folder. It's encrypted with Syskey which is 128 bit. Windows locks this file when it boots but ophcrack boots to linux live cd and scans hash during this process

Hacking via Cross-Site Scripting

Perpetrator seeks out someplace on target website that allows end users to post text that other users will see, such as product reviews Instead of posting a review or other text, the attacker posts JavaScript If website does not filter user input before displaying, other users navigate to this review and script executes

Avoid Changing evidence

Photograph equipment in place before removing it Label wires and sockets so computers and peripherals can be reassembled in a laboratory exactly as they were in the original location Transport computers, peripherals, and media carefully to avoid heat damage or jostling Avoid touching original computer hard disks and CDs Make exact bit-by-bit copies and store the copies on a medium that cannot be altered, such as a CD-ROM

Snort

Primarily used as an open source intrusion detection system Can function as a robust packet sniffer with a lot of configuration options

Wardriving

Process of driving around an area while a passenger in the vehicle scans for insecure, or weakly secured, wireless networks Participants then attempt to breach the targets they find

show version

Provides a significant amount of hardware and software detail about the router. It displays the platform, operating system version, system image file, any interfaces, the amount of RAM the router has, and the number of network and voice interfaces there are.

American Society of Crime Laboratory Directors (ASCLD) (slides)

Provides guidelines for: Managing a forensics lab Acquiring crime lab and forensic lab certification A lab must meet about 400 criteria to achieve accreditation TEMPEST

Types of RAID

RAID 0, 1, 3, 4, 5, 6, 1+0

Raid Aquisitions

RAID 0, 1, 3, 4, 5, 6, 1+0 Can acquire RAID 1 disks separately RAID 0, 3, 4, 5, and 6 use data striping across multiple disks Make a forensic image of the entire RAID array

password cracking tools

Rainbow Tables John the Ripper

431888 Important Intruder Ports

Reachout (malware)

Four types of Evidence -

Real, Documentary, Testimonial and Demonstrative

Data Doctor

Recovers all Inbox and Outbox data and all contact data, and has an easy-to-use interface. It has a free trial version, but there is a cost for the full version. Data Doctor retrieves Inbox and sent message data as well as contact data.

MacKeeper

Recovers deleted files on Macintosh computers Free, fully functional trial version available

HTTP Response Messages 300-399

Redirect messages telling the browser to go to another URL

caesar cipher

Referred to as the substitution cipher A simple method of encryption and very easy to crack Choose some number by which to shift each letter of a text Substitute the new alphabetic letter for the letter being encrypted used by the ancient Romans

3389 Important Intruder Ports

Remote Desktop

Proper Procedure: Preparing the System

Remove all drives Create chain of custody form (for each) Or, leave in system and acquire with forensically safe boot disks, CD-ROMs, or thumb drives

HTTP Commands: DELETE

Remove the webpage

HTTP Commands: POST

Request to append to a webpage

HTTP Commands: GET

Request to read a webpage

HTTP Commands: HEAD

Request to read just the head section of a webpage

ISO 27001

Requirements for Information Security Management Systems Section 14 addresses business continuity management.

Router Forensics

Router is hardware or software device that forwards data packets across a network to a destination network May contain: Read-only memory (ROM) with power-on self test code Flash memory containing the router's operating system Nonvolatile random access memory (RAM) containing configuration information Volatile RAM containing routing tables and log information

Federal Rules of Evidence (FRE)

Rules established by the US Supreme Court guiding the introduction and use of evidence in federal court proceedings that are an important benchmark for state and other courts. FRE governs what and how electronic records may be used, and the roles of record custodianship Uses rules 901 and 902

Where windows password hashes are stored

SAM file in Windows\System32 directory

integrated circuit card identifier (ICCID).

SIM is identified by this These numbers are engraved on the SIM during manufacturing. This number has subsections that are very important for forensics. This number starts with the issuer identification number (IIN), which is a seven-digit number that identifies the country code and issuer, followed by a variable-length individual account identification number to identify the specific phone, and a check digit.

Hacking systems for data,

SQL injection, Cross-Site scripting, Ophcrack, Tricking tech support

993

Secure IMAP or Encrypted IMAP

Types of Windows Log Files

Security Application- System Forwarded Events Applications and Services

Proper Procedure:Shutting Down the Computer: Windows

See what is currently running - but touch as little as possible 1. Ctrl+Alt+Del to check a. Task Manager b. Process Tab c. Take a photo with a camera 2. Check for live connections to the system: run each of the following commands and photograph the results before shutting down the machine a. netstat b. net sessions c. Openfiles 3. Capture memory using a forensic tool from a USB device a. OSForensics b. Access Data's FTK 4. Shut down by pulling the plug

Windows Boot Process: Step 14

Services load phase begins

/etcinittab File

Sets boot-up process and operation includes: label run_level action:a process boot bootwait initdefault sysinit

/sbin directory

Similar to /bin Contains binary files not intended for the average computer user EX: mke2fs command, a file system utility that is usually utilized by administrators, is in this directory.

Deleting Files on Macintosh

Similar to Windows, when file is deleted, references to file are gone and clusters might be used and overwritten Even if data is overwritten, data might exist in unallocated space and in index nodes Deleted files moved to the trash folder, similar to Recycle Bin in Windows Macintosh trash folder is .Trash, a hidden folder on the root directory of file system Recover deleted files from .Trash by copying or moving to other location or Use tools to recover files, even after trash bin has been emptied Mac Undelete Free Undelete MacKeeper

artificial intelligence (AI)

Simulates human intelligence such as the ability to reason and learn

How denial of service attacks affect forensics

Single machine-trace packets (common for attackers to spoof IP addresses, less common to spoof MAC addresses) Seek commonalities of zombie computers

history of encryption

Single-alphabet ciphers - Caesar Cipher Multi-alphabet Substitution ciphers

Sniffer

Software or hardware that can intercept and log traffic passing over a digital network Extracts network packets and performs a statistical analysis on the dumped information Commonly applied sniffers include Tcpdump (UNIX platforms and) WinDump

Percentage of computers suspected of having some type of spyware

Some estimates as high as 80%. Spyware can be legal such as parents monitoring children, cookies (at a base level are spyware) or employer's monitoring employees. Illegal spyware often tranferred via trojans through a link or email.

FIN Scan

Sometimes a host may need to terminate a connection quickly, due to a port being unreachable or a timeout, for example. Can send a Reset (RST) packet. Initial SYN packet should never have FIN or RST associated with it. Indicates an attack/malicious attempt to get by your firewall. A packet is sent with the FIN flag turned on. If port is open, this generates an error message. Because there was no prior communication, an error is generated telling the hacker the port is open and in use.

NFPA 1600:

Standard on Disaster/Emergency Management and Business Continuity Programs This is from the U.S. National Fire Protection Association.

boot

Starts the process and continues to the next entry without waiting for the process to complete. When the process dies, init does not restart the process.

bootwait

Starts the process once and waits for it to terminate before going on to the next inittab entry

sysinit

Starts the process the first time init reads the table and waits for it to terminate before going on to the next inittab entry

What Is Disaster Recovery?

Steps taken after an information technology-related disaster to restore operations Forensic techniques may be best method for determining what caused the disaster and for avoiding a repeat of it Forensic process begins once an incident has been discovered Is not fully underway until after the disaster or incident is contained

RAID 1+0 - A Stripe of Mirrors

Stripe file blocks across mirrored drives High disk space utilization High redundancy Minimum of 4 drives

documentation

Strong evidence-processing documentation Good chain-of-custody procedures A systems forensics specialist should have a good understanding of: Computer hard disks and CDs, and know how to find hidden data in obscure places The techniques and automated tools used to capture and evaluate file slack or slack space

Hierarchical File System Plus (HFS+) and Forensics

Supports aliases Performs defragmentation on a per-file basis

Reiser File System

Supports journaling Performs well when hard disk has large number of smaller files

Features HFS+

Supports journaling Supports disk quotas Has hard and soft links Uses 32 bits for allocation blocks rather than 16 bits Supports long filenames, up to 255 characters Uses Unicode rather than ASCII

Intrusion detection system logs

Suspicious traffic

Searching Virtual Memory

Swap file/virtual memory is in /var/vm/ Check it with Linux commands: ls returns list of files ls -al returns list of all files in virtual memory, who launched program and when grep lets you search in virtual memory folder

substitution and transposition

Swapping of blocks of ciphertext All modern block-cipher algorithms use substitution and transposition Combination of substitution and transposition increases security of resultant ciphertext by making cryptanalysis more complex

Evidence-Gathering Measures

Take following measures: Avoid changing evidence Determine when evidence was created Search throughout device (level of 1s and 0s) Determine info about encrypted and steganized files, without decoding Present evidence well

Proper Procedure: Documenting the Hardware Configuration of the System (before dismantling)

Take pictures of computer from all angles Label each wire Record BIOS/UEFI information

Imaging with Forensic Toolkit (FTK)

Takes snapshot of entire disk, makes bit-level copy for analysis Inexpensive, easy to use, good all-in-one forensic tool Offers Registry viewing, in-depth logging, standalone disk imaging, direct email and zip file analysis

MacIntosh Forensic Techniques

Target Disk Mode Searching Virtual Memory Shell Commands

Narrow al

Technologies that can perform specific tasks as well as, or better than humans.

viewing logs in linux

Text editor in GUI Any of these commands work from the shell: dmesg | lpr # tail -f /var/log/lpr.log # less /var/log/ lpr.log # more -f /var/log/ lpr.log

caesar cipher example:

Text is: A CAT You choose to shift by two letters, then A replaces C, E replaces C, C replaces A, and V replaces T; encrypted message is: C ECV If shift by three letters, message is: D FDW

Identifying File, Program, and Storage Anomalies

Text search programs can't identify text data stored in binary format They require manual evaluation Evaluate hidden partitions for evidence and document their existence In Windows, also evaluate files in the Recycle Bin If you find relevant files, thoroughly document the issues involved. Those issues can include the following: • How did you find the files? • What condition were they in (i.e., did you recover the entire file or just part of the file)? • When was the file originally saved? Remember that the more information you document about evidence, the better.

Identifying File, Program, and Storage Anomalies (slides)

Text search programs can't identify text data stored in binary format They require manual evaluation Evaluate hidden partitions for evidence and document their existence In Windows, also evaluate files in the Recycle Bin

plaintext

Text you want to encrypt

Windows Boot Process: Step One

The BIOS conducts the power-on self test (POST). This is when the system's BIOS checks to see if the drives, keyboard, and other key items are present and working. This occurs before any operating system components are loaded.

Windows Registry: Uninstalled software

The HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall key lets you see all the software that has been uninstalled from this machine.

Hierarchial File System (HFS)

The Hierarchical File System (HFS) was used on the Macintosh Plus. Apple introduced this file system in 1985, specifically to support its new Apple hard drive. It replaced the earlier Macintosh File System.

Windows Registry: USB Devices

The Registry key HKEY_LOCAL_MACHINE\System\ControlSet\Enum\UBSTOR lists USB devices that have been connected to the machine. It is often the case that a criminal will move evidence or exfiltrate other information to an external device and take it with him or her. This Registry setting tells you about the external drives that have been connected to this system.

Windows Registry: Wireless Networks

The Registry stores passphrases for accessing wireless networks. When an individual connects to a wireless network, the service set identifier (SSID) is logged as a preferred network connection. This information can be found in the Registry in the HKEY_LOCAL_MACHINE \SOFTWARE\Microsoft\WZCSVC\Parameters\Interfaces key.

Triple DES (3DES)

The U.S. federal government began a contest seeking a replacement cryptography algorithm. In the meantime, Triple Des (3DES) was created as an interim solution. Essentially, it does DES three times, with three different keys. More secure variant of DES

Mean time to failure (MTTF)

The amount of time, on average, before a given device is likely to fail through normal use

Steganography

The art and science of writing hidden messages Goal is to hide information so that even if it is intercepted, it is not clear that information is hidden there Most common method today is to hide messages in pictures using the least significant bit (LSB) method

Chosen plaintext attack

The attacker obtains the ciphertexts corresponding to a set of plaintexts of his own choosing. This can allow the attacker to attempt to derive the key used and thus decrypt other messages encrypted with that key.

Mean time to repair (MTTR)

The average time it takes to repair an item

Storing a file in Windows (NTFS)

The cluster bitmap file map is an array of bit entries where each bit indicates whether its corresponding cluster is allocated/used or free/unused. MFT contains one base file record for each file and directory MFT serves same purpose as FAT Cluster bitmap file maps all clusters on disk

grep flags

The flags used are defined as follows: -i—Ignore case distinctions in both the PATTERN and the input files; that is, match both uppercase and lowercase characters. -a—Process a binary file as if it were text. -B—Print number lines/size of leading context before matching lines. -A—Print number lines/size of trailing context after matching lines.

payload

The information to be covertly communicated; the message the user wants to hide

run_level

The init level at which the entry is executed

Deleting a File in Windows (FAT/FAT32)

The more recently a file was deleted, the more likely you will be able to recover the file. Over time, it becomes more likely that clusters marked as unused have had other information saved in them. A cluster may have been deleted and saved over several times. Recovering a deleted file is not always an all-or-nothing procedure. It is possible to recover When a file is deleted, data not removed from disk FAT is updated to reflect clusters no longer in use New data saved to those clusters may overwrite old information

Packet Filter Firewall

The most basic type of firewall Filters incoming packets and either allows them entrance or denies them passage based on a set of rules Also referred to as a screened firewall Can filter packets based on packet size, protocol used, source IP address, and so on Many routers offer this type of firewall option in addition to their normal routing functions

Cellabrite

The most widely known phone forensics tool. Used heavily by federal law enforcement. It is a very robust and effective tool. Downside: the high cost. It is the most expensive phone forensics tool on the market.

Important Windows Files: Crss.exe

The program that handles tasks like creating threads, console windows, and so forth

HKEY_CURRENT_USER (HKCU)

This hive is very important to any forensic investigation. It stores information about the currently logged-on user, including desktop settings, user folders, and so forth.

Email headers contain:

The sender, the application, and any servers it passed through. Header keeps record of the message's journey networks and mail servers Each server adds information to the header Each network device has an Internet Protocol (IP) address Identifies device Can be resolved to a location address

Order of Volatility

The sequence of volatile data that must be preserved in a computer forensic investigation.

carrier

The signal, stream, or file in which the payload is hidden

email client

The software program used to compose and read email messages

Super DLT (SDLT)

The successor to Digital Linear Tape (DLT). (4)

Rainbow tables

The time of cryptanalysis can be reduced by using precalculated data stored in memory. Essentially, these types of password crackers work with precalculated hashes of all passwords available within a certain character space. These files are called rainbow tables because they contain every letter combination "under the rainbow." They are particularly useful when trying to crack hashes. Popular hacking tools like Ophcrack depend on rainbow tables. Ophcrack is usually very successful at cracking Windows local machine passwords

channel

The type of medium used. It can be a passive channel such as photos, video, or sound files. It can also be an active channel such as a streaming video connection.

Windows 95

The underlying operating system and the graphical user interface were fused into one single, coherent product.

Wireless Networking: 802.11g

There are still many of these wireless networks in operation, but you can no longer purchase new Wi-Fi access points that use it. This standard has an indoor range of 125 feet and a bandwidth of 54 Mbps. It includes backward compatibility with 802.11b

HKEY_CLASSES_ROOT (HKCR)

This hive stores information about drag-and-drop rules, program shortcuts, the user interface, and related items

MobileEdit

There are several variations of this product. MobileEdit Lite is the most forensically advanced version of MobileEdit. This is a very easy-to-use tool that can aid a forensic examiner in extracting data from cell phones

Foreign Intelligence Surveillance Act (FISA)

This U.S. law prescribes procedures for the physical and electronic surveillance and collection of "foreign intelligence information" between foreign powers and agents of foreign powers, which may include American citizens and permanent residents suspected of espionage or terrorism. The law does not apply outside the United States but may be encountered by a forensic investigator in researching intelligence even if it does not specifically regard espionage or terrorism. The law is an important part of many agencies' approaches to information gathering. It has been amended frequently so it is important to stay current on the latest revisions and court cases

Related-key attack

This attack is similar to a chosen plaintext attack, except the attacker can obtain ciphertexts encrypted under two different keys. This is actually a very useful attack if you can obtain the plaintext and matching ciphertext.

Apple II

This computer was based on the same microprocessor but came in a plastic case with the keyboard built in. It was also the first personal computer with color graphics. Apple II was followed by a series of enhancements, including the Apple IIGS in 1986, which was 16-bit rather than 8-bit. There were multiple operating systems for the Apple II.

/Users directory

This directory contains all the user accounts and associated files.

/Network directory

This directory contains information about servers, network libraries, and network properties.

/var/log

This directory has many logs in it. The /var/log/daily.out contains data on all mounted volumes, including the dates they were mounted. This is very important in cases involving stolen data. You can see what devices have been attached and potentially get data from them. This folder includes data on removable media, including serial numbers.

/Applications directory

This directory is where all applications are stored. It can hold important information about any malware.

Windows Registry: ShellBag

This entry can be found at HKCU\Software\Microsoft\Shell\Bags. ShellBag entries indicate a given folder was accessed, not a specific file. This Windows Registry key is of particular interest in child pornography investigations

/Library/Receipts

This folder contains information about system and software updates. Though less useful for a forensic investigation than some of the other folders, it does include information about if and when a given patch was applied, which might be of some interest in investigating malware crimes.

/Users/<user>/Library/Preferences/ folder

This folder contains user preferences, including the preferences of programs that have been deleted. This could be a valuable place to get clues about programs that have been deleted from the system.

HKEY_LOCAL_MACHINE (HKLM)

This hive can also be important to a forensic investigation. It contains those settings common to the entire machine, regardless of the individual user.

HKEY_CURRENT_CONFIG (HCU)

This hive contains the current system configuration. This might also prove useful in your forensic examinations

Korn shell (ksh)

This is a popular shell developed by David Korn in the 1980s. The Korn shell is meant to be compatible with the Bourne shell, but to also incorporate true programming language capabilities.

Hierarchical File System Plus (HFS +)

This is an enhancement of the HFS file system. HFS+ is the preferred file system on Mac OS X.

file accessed

This is the date the file was last accessed. An access can be a move, an open, or any other simple access. It can also be tripped by antivirus scanners or Windows system processes.

bourne-again shell (Bash)

This is the most commonly used shell in Linux. It was released in 1989.

18 U.S.C. 2252B

This law is about perpetrators who attempt to hide the pornographic nature of their website, often to make it more accessible to minors. This is a very serious concern, and one that sometimes arises in child predator cases.

/Users/<user>/.bash_history log

This log will show you a variety of commands, such as rm (removing or deleting something) and dd (indicating the user might have tried to make an image of the drive).

C shell (csh)

This shell derives its name from the fact that it uses very C-like syntax. Linux users who are familiar with C will like this shell. It was first released for UNIX in 1978.

NIST 800-61

This standard also will help guide you in forming an incident response plan

ISO 27035

This standard guides you in how to formulate an incident response plan. It requires a structured and planned approach to detect, report, and assess information security incidents; respond to and manage information security incidents; detect, assess, and manage information security vulnerabilities; and continuously improve information security and incident management as a result of managing incidents

Wireless Networking: 802.11b

This standard operated at 2.4 GHz and had an indoor range of 125 feet with a bandwidth of 11 megabits per second (Mbps).

Wireless Networking: 802.11n

This standard was a tremendous improvement over preceding wireless networks. It obtained a bandwidth of 100 to 140 Mbps. It operates at frequencies of 2.4 or 5.0 GHz, and has an indoor range of up to 230 feet.

Wireless Networking: 802.11ac

This standard was approved in January 2014. It has throughput of up to 1 Gbps with at least 500 Mbps. It uses up to eight MIMO.

Wireless Networking: 802.11n-2009

This technology gets bandwidth of up to 600 Mbps with the use of four spatial streams at a channel width of 40 MHz. It uses multiple-input multiple-output (MIMO), which uses multiple antennas to coherently resolve more information than possible using a single antenna.

Forensic SIM Cloner

This tool is used to clone SIM cards, allowing you to perform forensic analysis of the SIM card.

live forensic tools:netstat

This utility is important in checking live system data is a command-line tool that displays both incoming and outgoing network connections. It also displays routing tables and a number of network interface statistics. It is available on UNIX, UNIX-like, and Windows-based operating systems.

Wireless Networking: 802.11a

This was the first widely used Wi-Fi standard. It operated at 5 GHz and was relatively slow.

RSA NetWitness

Threat analysis software/protocol analyzer Captures raw packets from wired and wireless interfaces Analyzes real-time data throughout the seven layers Filters by Media Access Control (MAC) address, Internet Protocol (IP) address, user, and more Freely available and threat analysis software

Collecting Data

Three primary types of data that a forensic investigator must collect, in this order: Volatile data Temporary data Persistent data

Collecting data

Three primary types of data that a forensic investigator must collect, in this order: Volatile data Temporary data Persistent data

Important Intruder Ports: 407

Timbuktu has any legitimate use. Timbuktu is an open source alternative to PC Anywhere. It allows program users to log on to a remote system and work just like they were sitting in front of the desktop. It is possible that technical support personnel are using Timbuktu to make support calls more efficient. But it is also possible that an intruder is logging on and taking over the system.

Modern cryptography

Two main types: Symmetric and asymmetric Used every day by millions of consumers on the World Wide Web to buy products and services securely "https" at beginning of Web address or a padlock symbol indicates a secure protocol such as Transport Layer Security (TLS) is at work Cryptography also used in: Antivirus software Wireless security (WPA and WPA2 encryption) Hard disk encryption using Microsoft Encrypting File System (EFS) is a form of cryptography Did you know your mobile phone transmissions are encrypted, as are your ATM and credit cards?

SYN Flood Attack

Type of DoS attack in which the attacker sends multiple SYN messages initializing TCP connections with a target host attacker sends SYN server replies with SYN/ACK attacker sends another SYN server replies with SYN/ACK and continues this pattern taking up all server resources

Hacking via SQL Injection

Typical SQL statement SELECT * FROM tblUsers WHERE USERNAME = '" + txtUsername.Text +' AND PASSWORD = '" + txtPassword.Text +" ' Specific username and password: SELECT * FROM tblUsers WHERE USERNAME = 'thisuser' AND PASSWORD = 'letmein' SQL injection example: SELECT * FROM tblUsers WHERE USERNAME = '' or '1' = '1' AND PASSWORD = '' or '1' = '1'

1969

UNIX created at Bell Laboratories

1972

UNIX operating system released

Solid-state drives (SSD)

Use microchips that retain data in non-volatile memory chips Contain no moving parts Drives are usually less susceptible to physical damage than magnetic drives If internal, SSDs can use same interfaces as magnetic drives, including SCSI and SATA If external, it is most common for them to have a universal serial bus (USB) connection

index.dat

Used by Microsoft Internet Explorer Stores: Web addresses Search queries Recently opened files Even if the suspect's browsing history has been erased, it is still possible to retrieve it if he or she was using Microsoft Internet Explorer. Internet Explorer uses index.dat to store Web addresses, search queries, and recently opened files. So if a file is on a universal serial bus (USB) device but was opened on the suspect machine, index.dat would contain a record of that file. You can download a number of tools from the Internet that will allow you to retrieve and review the index.dat file.

Email Protocols: Post Office Protocol version 3 (POP3)

Used to receive email Operates on port 110, or 995 (secure) Designed to delete email on server as soon as user downloads email

Email Protocols: Internet Message Access Protocol (IMAP)

Used to receive email Operates on port 143 User views email on the server, decides whether to download the mail; email is retained on server allows client to only view headers so user can decide which message to download

Email Protocols:Simple Mail Transfer Protocol (SMTP)

Used to send email from a client to a mail server, and between servers Typically operates on port 25 SMTPS (secure) operates on port 465

Multialphabet substitution

Uses multiple numbers by which letters in plaintext are shifted Multiple substitution alphabets are created Represents a slight improvement on the Caesar cipher but is still easily cracked

symmetric cryptography

Uses same key to encrypt and decrypt plaintext May have one encryption key sender to receiver & different key for receiver to Sender

Getting Header for Gmail

Viewing email headers in Gmail is fairly simple. Follow these steps: 1. Log on to Gmail. 2. Open the message for which you want to view headers. 3. Click the down arrow next to Reply, at the top of the message pane. 4. Select Show Original. The headers appear in a separate window.

Windows 8

Was a radical change. Even though the desktop looks much like Windows 7, the operating system is meant to be more like that of a tablet.

Wireless Storage Devices

Wireless digital and video cameras Wireless printers with storage capacity Wireless network-attached storage (NAS) devices Tablets and smartphones Wireless digital video recorders (DVRs) Wireless game consoles

advanced steganography

With BPCS (Bit-plan complexity segmentation), carrier is often an image that stores colors in 24 bits, and this fact can be used to increase storage area for payload. The complex areas on the bit planes are replaced with the payload

Deleting Files in Windows (NTFS)

When a file is deleted, data not removed from disk Clusters are marked as deleted and "moved" to Recycle Bin When Recycle Bin is emptied, clusters marked as fully available Filename in the MFT is marked with a special character that means the file has been deleted In NTFS prior to Vista, the Recycle Bin resides in a hidden directory called RECYCLER. In Vista and Windows 7, the name of the directory was changed to $recycle.bin. Just as with FAT systems, clusters in an NTFS system are more likely to be overwritten as more time elapses after deletion.

Windows Files and Permissions

When copying and pasting on the same partition, files and folders inherit the rights of the folder they are being copied to. When cutting and pasting (moving), files and folders retain the original permissions if they are on the same partition.

Usiing Paraben

When you first start Paraben, you select New and then create a new case. Paraben will associate information about the investigator along with the case information. Next, select the type of email database you are going to be working with. The major email clients are all represented. At this point, you select the database you want to work with, and it is added to the case. From within Paraben, you can sort, search, scan, and otherwise work with the email data.

dmesg command

When your system boots up, you see a lot of information telling you what processes are starting, what processes failed, what hardware is being initialized, and more. This can be invaluable information to a forensic investigation. You can use the dmesg command to view all the messages that were displayed during the boot process. The command dmesg displays the messages for you. However, it does tend to fill up multiple screens. It is recommended that you simply pipe the output to some file (for example, dmesg>myfile.txt) and then search that file.

1998

Windows 98

1996

Windows NT 4.0

2013

Windows Server 2012 R1

2016

Windows Server 2016

2008

Windows Vista Home Basic, Home Premium, Business, Ultimate, Windows Server 2008

2001

Windows XP (first 64 bit version)

2003

Windows XP with Server 2003

Legacy

Windows XP, 2000 MAC OS 8 or earlier

Wireless Networking: 802.11ad

Wireless Gigabyte Alliance—This supports data transmission rates up to 7 Gbps—more than 10 times faster than the highest 802.11n rate.

types of crimes involving computers

White-collar crimes Violent crimes—murder, terrorism Counterintelligence Economic espionage Counterfeiting Child pornography Drug dealing

Windows Boot Process : Step 15

Win32 subsystem start phase begins

1985

Windows 1.0 opened

2015

Windows 10

current OS

Windows 10, 8, 7 Windows Server 2016, 2012 2008 Mac os 9 10

2000

Windows 2000

2009

Windows 7 and Server 2008 R2

2012

Windows 8 and Server 2012

1995

Windows 95

Scalpel

Works with Linux and Mac OS Possible to compile source code to work in Windows

extundelete

Works with both ext3 and ext4 partitions in Linux Uses shell commands Example: To restore all deleted files from sda1 partition: extundelete /dev/sda4 --restore-all

Enigma Machine

World War II by Germans-electromechanical rotor-based cipher system Is a multialphabet substitution cipher using machinery to accomplish the encryption When operator pressed a key, encrypted ciphertext for plaintext was altered each time

Universal Mobile Telecommunications System (UMTS)

a 3G standard based on GSM. It is essentially an improvement of GSM

fraud

a broad category of crime that is an attempt to gain financial reward through deception. Two subclasses are investment offers and data piracy

personal unlocking code (PUK)

a code used to reset a forgotten PIN. Using the code returns the phone to its original state, causing loss of most forensic data. If the code is entered incorrectly 10 times in a row, the device becomes permanently blocked and unrecoverable.

dd

a common UNIX program whose primary purpose is the low-level copying and conversion of raw data at the bit level. If you do your copy through the file system/operating system, then you can see only the data that the operating system sees. You won't get deleted files or slack space, so a basic file system copy is inadequate for forensic analysis. You must get a bit-level copy, and the dd utility is perfect for that

Feistel Function

a cryptographic function that splits blocks of data into two parts. Uses XOR one of the most influential developments in symmetric block ciphers

inode

a data structure in the file system that stores all the information about a file except its name and its actual data

Windows Registry

a database in Windows that stores user preferences, file locations, program configuration settings, startup information, hardware settings, and more. This includes viruses, worms, Trojan horses, hidden programs, and spyware. The ability to effectively scan registry for evidence is critical

home location register (HLR)

a database used by the MSC that contains subscriber data and service information. It is related to the visitor location register (VLR), which is used for roaming phones.

Quiescent State

a dormant mode that conserves battery life while maintaining user data and performing other background functions. Context information for the device is preserved in memory to allow a quick resumption of processing when returning to the active state.

User Assist

a feature of Windows 2000 and later that tracks what happens on the computer, including programs launched. Unless it is disabled there will be a record of everything done on that computer. This information is encrypted and stored in the Registry. The free UserAssist tool allows you to find out more.

Expert report

a formal document that details expert's findings. Often filed prior to trial. Can be used in a deposition. Considerations include: -format of report -throughness -back up everything you say

test system

a functional system compatible with the hard drive from which someone is trying to recover data

shielding

a high-cost approach to preventing EMR detection includes: -lining wall, ceiling, floor and doors with specially conductive metal sheeting -installing filters that prevent power cables from transmitting computer emanations -installing special baffles in heating and ventilation ducts to trap emanations -installing line filters on telephone lines -installing special features at entrances and exits that prevent facility from being open to outside at any time

Volitile Memory Analysis

a live system forensic technique in which you collect a memory dump and perform analysis in an isolated enviornment Must establish A trusted command shell A data collection system and a method for transmitting the data

fuzzy logic

a mathematical method of handling imprecise or subjective information

DoD 5220.22-M

a matrix of how to sanitize different types of media Department of Defense standards most people inaccurately believe seven over-writes ensures data is completely wiped really depends on type of medium data is stored on or in.

subscriber identity module (SIM)

a memory chip that stores the International Mobile Subscriber Identity (IMSI). It is intended to be unique for each phone and is what you use to identify the phone. Many modern phones have removable SIMs, which means you could change out the SIM and essentially have a different phone with a different number.

Digital Forensic Research Workshop Foundation

a nonprofit volunteer organization with the goal of enhancing the sharing of knowledge and ideas about digital forensics research

Window Washer

an example of one tool that enables you to retrieve and review the index.dat file.

Cross-Site Scripting (XSS)

a vulnerability in dynamic web pages that allows an attacker to bypass a browser's security mechanisms and instruct the victim's browser to execute code, thinking it came from the desired website

TCP Header Bits, of Interest:ACK (1 bit

acknowledges the attempt to synchronize communications

EnCase data blocks

actual data copied from the suspect machine

XOR

affects the study of encryption the most checks to see whether there is a 1 in a number in a given place, but not in both numbers at the same place. If not, the resultant number is 0. is reversible if you XOR the resultant number with the second number you get back the first number, and if you XOR the resultant number with the first number you get back the second number

soft link

aka symbolic link Is not actually a file itself, but rather a pointer to another file or directory.

Proper Procedure: Documenting Filenames Dates and Times

all allocated and "erased" files

Full Backup

all changes restore just the last backup

FISA) the foreign intelligence surveillance act of 1978

allows for collection of "foreign intelligence information" between foreign powers and agents of foreign powers using physical and electronic surveillance. Warrant necessary

Wireless Communications and Public Safety Act of 1999

allows for the collection and use of empty communication which means nonverbal and non-text communications such as GPS

disk quotas

allows the administrator to limit the amount of disk space a given user can use, keeping that user from taking up all the space

live forensic tools: ListDLLs

allows you to view the currently loaded dynamic-link libraries (DLLs) for a process. ListDLLs lists the DLLs loaded by all running processes. cannot show the DLLs loaded for hidden processes. A common attack involves using a Trojan horse to compromise a program or system DLL. So this tool can be important to your forensic investigation. It is available online for free.

Cyclical Redundancy Check (CRC)

almost always in trailer not header Ethernet uses a 32-bit cyclic redundancy check (CRC). The sender calculates the CRC using a very complex calculation on the source address, destination address, length, payload, and pad, if any. The four-octet (32-bit) result is stored in the trailer by the sender and the frame is transmitted. The receiving device repeats the exact same calculation as the sender and compares the result with the value stored in the trailer. If the values match, the frame is good and the frame is processed. But if the values do not match, the receiving device has a decision to make. The decision is made consistently based upon the protocol involved. In the case of Ethernet, the receiver discards the errored frame and sends no indication whatsoever that the frame has been discarded. The receiver usually does, however, update some internal counter, which can be queried to say how many frames were discarded. There is also a counter that says how many frames arrived and passed the CRC check.

AES

also known as Rijndael block cipher 1. Key expansion 2. Initial round 3. Rounds 4. Final round

Natural language processing

an AI technique using software to interpret natural languages (the languages spoken by people, such as English, French, Chinese and others). These techniques deal with speech recognition, understanding and generation.

genetic algorithm

an artificial intelligence system that mimics the evolutionary, survival-of-the-fittest process to generate increasingly better solutions to a problem

Router Attacks-Router table poisoning

an attacker alters the routing data update packets that the routing protocols need, resulting in incorrect entries in the routing table Incorrect router table entries can result in: Artificial congestion The router becoming overwhelmed An attacker being allowed access to data in the compromised network

anonymous remailing

an attempt to throw tracing or tracking attempts off the trail Suspect sends an email message to an anonymizer To find out who sent remailed email, must examine logs maintained by remailer or anonymizer companies however most of these services usually do not maintain logs can also closely analyze the message for embedded information that might give clues to the user or system that sent the message . Often the remailing servers are outside of the jurisdiction of U.S. law enforcement and may even be on another continent.

Phishing

an attempt to trick a victim into giving up personal information

clean room

an environment that has a controlled level of contamination such as from dust, microbes, and other particles

Internet fraud,

any attempt to gain financial reward through deception. Two major subclasses of fraud are; Investment offers and Data piracy

Identity theft

any crime in which someone wrongfully obtains and uses another person's personal data in some way that involves fraud or deception, typically for economic gain

Discarded information

any documents that are thrown out without being shredded

process

any program or daemon

Spyware

any software that monitor your activity on a computer.

/var/log/apache2/*

apache web server activity

sectors

are contiguous on a disk and are defined by two radii on the platter

journaling file systems

are fault tolerant because the file system logs all changes to files, directories, or file structures.

aliases

are like symbolic links; they allow you to have multiple references to a single file or directory.

active state

are powered on, performing tasks, and able to be customized by the user and have their filesystems populated with data.

Electronic serial numbers (ESNs

are unique identification numbers developed by the United States Federal Communications Commission (FCC) to identify cell phones. They are now used only in code division multiple access (CDMA) phones, whereas GSM and later phones use the International Mobile Equipment Identity (IMEI) number. The first 8 bits of the ESN identify the manufacturer, and the subsequent 24 bits uniquely identify the phone. The IMEI is used with GSM and Long Term Evolution (LTE) as well as other types of phones.

Chi-square analysis

assesses how closely the observed frequencies fit the pattern of the expected frequencies and is referred to as a "goodness-of-fit" test

Digital Steganography

at one time, was only used by computer professionals because it required writing specific computer program code to manipulate the bits in an image. That is not the case today. There are a number of tools readily available on the Internet that will enable a user to hide information in an image or detect steganography

multipartie virus

attack the computer in multiple ways including infecting the boot sector of the hard disk and one or more file

Remote-to-local:

attacker does not have a user account but exploits a vulnerability to gain access

Banner grabbing

attempts to connect to a web server on port 23 (Telnet) is evidence of a well-known old hacker trick, which is to attempt to telnet into a web server and grab the server's banner or banners. This allows the hacker to determine the exact operating system and web server running unless the system administrator has modified the banner to avoid this hacker trick.

Sparse Infector

attempts to elude detection by performing its malicious activities only sporadically.

Known plaintext attack

based on having a sample of known plaintexts and their resulting ciphertexts, and then using this information to try and ascertain something about the key used.

Frequency Analysis

basic tool for breaking most classical ciphers such as the Caesar cipher, the Vigenère cipher, etc. In natural languages, certain letters of the alphabet appear more frequently than others. By examining those frequencies, you can derive some information about the key that was used. While this method is effective against classic ciphers, it is not effective against modern methods of cryptography

file command

can tell you exactly what a file is regardless of whether or not it has been renamed or had its extension changed. This can be very important in a forensic investigation will help you in situations where the criminal has changed the file extension to make the file appear to be something other than what it is.

TEMPEST

certifies equipment that sheilds from EMR detection

consistency checking

checking involves scanning a disk's logical structure to ensure that it is consistent with its specification. In most file systems, a directory must have at least two entries: a dot (.) entry that points to itself and a dot-dot (..) entry that points to its parent. A file system repair program reads each directory to ensure that these entries exist and point to the correct directories. If they do not, the program displays an error message, and you can correct the problem. Both chkdsk and fsck work in this fashion.

OR

checks to see whether there is a 1 in either or both numbers in a given place. If so, then the resultant number is 1. If not the resultant number is 0.

sweeper or scrubber

clean unallocated space by writing over the unallocated old fragments to remove evidence most write over once or twice DoD standard 7 times

The /hdiutil partition /dev/disk0

command lists the partition table for the boot drive. It is important to know the partitions the machine recognizes upon boot-up.

fdisk

command lists various paritions

Email files: .emi

common to several email clients

A person from Nigeria emails you, asking to use your bank account to "park" some money temporarily.

computer fraud

Data piracy is an example of this type of crime.

computer fraud

/etc

contains configuration files. Most applications require some configuration when they start up . The web servers, boot loaders (LILO and GRUB), and many other applications have configuration files. Obviously, an intruder into a system may want to change how a given application behaves. web server, boot loader, and security software configuration files would be attractive targets for any hacker.

system log

contains events logged by Windows system components, including events like driver failures; Not as interesting from a forensic perspective as the other logs are

The Sarbanes-Oxley Act of 2002

contains many provisions about record keeping and destruction of electronic records relating to the management and operation of publicly held companies.

Center for Education and Research in Information Assurance and Security (CERIAS): Readiness Phase

contains sub-phases called Operations Readiness which involves training people and testing investigative tools and the Infrastructure Readiness phase which involves configuring equipment.

Library/Preferences/SystemConfiguration/dom.apple.preferences.plist

contains the network configuration data for each network card. This is important information to document before beginning your search for evidence

/varspool

contains the print queue, so it can be very important if something is currently in the print queue

The IP header

contains the source IP address, the destination IP address, and the protocol number of the protocol in the IP packet's payload. These are critical pieces of information. l

The TCP header

contains the source port, destination port, a sequence number, and several other fields. The sequence number is very important to network traffic; for example, knowing this is packet 4 of 10 is important. The TCP header also has synchronization bits that are used to establish and terminate communications between both communicating parties.

application log

contains various events logged by applications or programs; Many applications record their errors here

cp

copies one file to another directorye

mkdir

creates a new directory

non-access computer crimes

crimes that do not involve an attempt to access a target examples are viruses logic bombs and denisl of service attacks

Non-access computer crimes,

crimes that do not involve an attempt to actually access the target. Examples include DDoS, viruses, and logic bombs.

Helix

customized Linux Live Cd used for computer forensics

A suspicious person in a chat room asks for your home address every time you are both online together.

cyberstalking/harassment

Logical damage

damage to how the data is stored for example file system corruption May prevent host operating system from mounting or using the file system May cause system crashes and data loss May be caused by power outages, or turning off a machine while it is booting or shutting down

data encryption standard (DES)

ex of Feistel cipher

process (/etcinit file)

executes upon entering the specified run level

Electronic Communications Privacy Act of 1986

governs privacy and disclosure, access, and interception f content and traffic data related to electronic communications

RFC 3864

describes message header field names. Common header fields for email include: • To—The email address and, optionally, name of the message's primary recipient(s) • Subject—A brief summary of the topic of the message • Cc—Carbon copy; a copy is sent to secondary recipients • Bcc—Blind carbon copy; a copy is sent to addresses added to the SMTP delivery list while the Bcc address remains invisible to other recipients • Content-Type—Information about how the message is to be displayed, usually a Multipurpose Internet Mail Extensions (MIME) type • Precedence—Commonly with values "bulk," "junk," or "list"; used to indicate that automated "vacation" or "out of office" responses should not be returned for this mail, for example, to prevent vacation notices from being sent to all other subscribers of a mailing list • Received—Tracking information generated by mail servers that have previously handled a message, in reverse order (last handler first) • References—Message-ID of the message to which this is a reply • Reply-To—Address that should be used to reply to the message • Sender—Address of the actual sender acting on behalf of the author listed in the From field

Communications Decency Act of 1996

designed to protect persons 18 and under from downloading or viewing material considered indecent.

Nascent State

devices are in this state when received from the manufacturer—the device contains no user data and has its original factory configuration settings.

-What are 7 types of Digital system Forensics?

disk forensics email forensics network forensics internet forensics software forensics live system forensics cell phone forensics

EnCase View pane

displays selected item

Enhanced Data Rates for GSM Evolution (EDGE

does not fit neatly into the 2G-3G-4G continuum. It is technically considered 2G, but was an improvement on GSM (2G), so it can be considered a bridge between 2G and 3G technologies.

secure emails

each email protocol has secured version which is encrypted with Tranport Layer Security (TLS).

How virus affect forensics

easy to locate, but difficult to trace back to creator first step is to document the particulars of virus, its behavior, file characteristics etc see if there is a commanlity between infected computers

WinUndelete

easy to use wizard driven

/var/log/mail.*

email activity useful for cyberstalking cases as well as many other types of forensic cases

Anonymizer

email server that strips identifying information from message before forwarding it with anonymous mailing computer's IP address

Stream Cipher

encrypts data as a stream, one bit at a time

EnCase checksum

ensures no error in copying of data and subsequently no information is modified by verifying before transfer and after transfer checksums

The Privacy Act of 1974

establishes a standard of information-handling practices that governs the collection, maintenance, use, and dissemination of information about individuals that is maintained in systems of records by U.S. federal agencies.

Linux File Systems

ext3 ext4 Linux stores files in contiguous blocks which are normally large enough to accommodate the content, so defragmentation is not required. In rare cases, the blocks need to be extended. The exact size of these blocks depends on the parameters used with the command to create that partition. There are prepackaged tools and some built-in commands for recovering deleted files from Linux operating systems.

linux utilites

extundelete scalpel

/var/log/faillog

failed user logins tracks attempt to break into the system

zero-knowledge analysis

few assumptions are made about the state of the file system. The file system is rebuilt from scratch using knowledge of an undamaged file system structure. In this process, scan the drive of the affected computer noting all file system structures and possible file boundaries. Then match the results to the specifications of a working file system. usually much slower than consistency checking. You can use it, however, to recover data even when the logical structures are almost completely destroyed. This technique generally does not repair the damaged file system but allows you to extract the data to another storage device.

A criminal changes a file extension. This command can identify the file

file

both physical and logical analysis

file residue ambient data

fsck

files system check. can check to see whether a given parition is in good working condition

provides information about a specific user

finger

iPod_control\device\sysinfo

folder contains model number and serial number

allocation unit

formal definition of cluster

Expert Report

formal document that lists what tests you conducted, what you found and your conclusions, it also includes your CV(similar to resume)

FreeUndelete

free Windows tool for personal use commerical version available

Disk Investigator

free utility that comes as a GUI for use with Windows OS -presents a cluster-by-cluster view of hard drive in hexidecimal -from view menu can view directories and root -tools menu allows search for specific file or to recover deleted files

EnCase

from Guidance Software; widely used forensic toolkit. Prevents examiner from making accidental changes to suspect machine. Organizes information into cases. Based on evidence file which contains header, checksum and data blocks.

Oxygen Forensics

full forensic tool capable of imaging and examining iPhones and Android phones. It provides a number of user-friendly tools for extracting specific data such as contacts, social media data, and the like.

EC Council Computer Hacking Forensic Investigator (CHFI)

good general forensic certification covers general principles and techniques rather than specific software

rules of evidence

govern whether, when, how and why proof of a legal case can be placed before a judge and jury

Center for Education and Research in Information Assurance and Security (CERIAS): Deployment Phase

includes the Detection and Notification sub-phase, in which someone detects and incident and alerts investigators and the Confirmation and Authorization sub-phase which investigators receive authorization to conduct an investigation

TCP Header Bits, of Interest:FIN (1 bit)—

indicates there is no more data from the sender

Macro

infect the macros in office documents

macro virus

infect the macros in office documents by writing the macros as mini-virus scripts

Bit-level information

information at the level of actual 1s and 0s stored in memory or on the storage device

Obscured information

information that is encrypted, hidden via steganography, compressed, or proprietary formatted

SQL injection

inserting Structured Language Query commands into text boxes such as username and password fields to gain unauthorized data.

Memory resident

installs itself and remains in RAM from the time the computer is booted to the time it is shut down

Important Windows Files: Explorer.exe

interface the user interacts with such as the desktop, Windows Explorer, etc.

logical analysis

involves using the native operating system, on the evidence disk or a forensic duplicate, to peruse the data. looking for things that are visible, known about, and possibly controlled by the user. includes partitions, file metadata, context of data and file paths

iOS

iphone ipad ipod

Communication Assistance for Law Enforcement Act (CALEA)

is a U.S. wiretapping law. Its purpose is to allow law enforcement and intelligence agencies to lawfully conduct electronic surveillance by requiring that telecommunications carriers and manufacturers of telecommunications equipment modify and design their equipment, facilities, and services to ensure that they have built-in surveillance capabilities, allowing federal agencies to monitor all telephone, broadband Internet, and VoIP traffic in real time.

live forensic tools: FPort

is a free tool that is now distributed by McAfee. FPort allows you to view all open TCP and UDP ports and maps those to specific processes. This lets you know which process is using which port. This tool is similar in function to running netstat -an.

Windows Registry

is a repository of all the information on a Windows system. For example, the configuration settings for a newly installed program are stored in the Registry. Among other things, the Registry: Includes information about the computer's hardware configuration Allows the operating system to keep multiple hardware configurations Allows multiple users with individual preferences Includes program shortcut menus and property sheets Supports remote administration through the network The usual way to get to the Registry is through the tool regedit. In Windows 10 and Server 2012, you select Start, then Run, then type in regedit. In Windows 8, you need to go to the applications list and select All Apps then find regedit.

INFO2

legacy Windows stores deleted files from Recycle Bin in D%DriveLetter%_%IndexNumber%_%FileExtension% D stands for drive %DriveLetter% is drive that the file was on before deletion %IndexNumber% a number assigned to each file or directory that is sent to Recycle Bin and indicates order of deletion %FileExtension% is the original file extension. If it is a folder there will be no extension

/var/log/lighttpd/*

lighttpd web server activity

EnCase Tree pane

like windows explorer. Lists all folders and can expand any element in the tree.

Containment

limit the impact of the incident. This means keeping it from affecting more systems. In the case of a virus, the strategy is to keep the virus from spreading. Have a policy in place that instructs users to disconnect their computers from the network and then call tech support if they suspect they have a virus. This contains the virus and prevents it from spreading further. The containment path may not be as clear for other incidents. For example, how would you contain a situation where an intruder is getting into the web server? First, you would isolate the web server from the rest of the network. Then you would attempt to prevent further intrusion, perhaps by changing passwords throughout the organization, on the assumption that the intruder might have compromised passwords. Although the specifics of containment might vary, the goal does not. Limit the spread of the incident as much as possible. This phase must occur first.

ps

lists all currently running processes that the user has started.

top

lists all currently running processes whether the user started them or not. It also lists more detail on the processes

ls

lists contents of current directory

EnCase Table pane

lists subfolders and files contained within the folder selected in Tree pane

ls /dev/disk? command

lists the current device files that are in use. You should document this information before shutting the system down for transport to the forensic lab.

Techniques of forensic analysis

live analysis physical analysis logical analysis Create a timeline

Types of Logs: Application

logs record the time, date, and application identifier. When someone uses an application, it produces a text file on the desktop system containing the application identifier, the date and time the user started the application, and how long that person used the application.

Types of Logs: Authentication

logs show accounts related to a particular event and the authenticated user's IP address. They contain date and timestamps as well as the username and IP address of the requestor.

Types of Logs: Network device

logs, such as firewall and router logs, provide information about the activities that take place on the network. You can also coordinate and synchronize them with logs provided by other systems to create a more complete picture of an attack. For example, a firewall log may show access attempts that the firewall blocked. These attempts may indicate an attack. Log files can show how an attacker entered a network. They can also help find the source of illicit activities.

Linux EMail Server

logs/var/log/mail.*

File systems

look at clusters not sectors

logical analysis

looking for things that are visible, known about, and possibly controlled by the user

General Al

machine that have all the sense (maybe more), all the reason, and think just like people do.

mac tools

mackeeper

Viruses can be divided into 6 distinct categories;

macro memory resident multipartite armored sparse infector polymorphic

storage formats

magnetic media solid state drives digital audio tape drives digital linear tape and super DLT optical media usb drives

payload

message to be hidden

Machine Learning

method of data analysis that automates data building. ML uses algorithms that learn interactively from data and can find insights without explicit programming

Find evidence

more than data recovery; finding and isolating evidence to prove or disprove allegations. Often must search through thousands of deleted files and fragments. Examiners work in secure labs to check for viruses in suspect machines and isolate data to avoid contamination. Work with verifiable copies of disks not actual disks, thus advisable to make more than one copy of the evidence depending on tests need to run and copies need to present.

mount

mounts a partition, allowing you to work with it

Undeleting Linux Files: Manually(Recovering Deleted Files)

move to single user mode (init 1) use grep of similar command (i.e. grep -b 'search-text' /dev/partitiion > file.txt use command-line editor to view file

Prepare evidence

must be able to withstand judicial scrutiny; thus through documentation of all tests conducted and all results must be accounted for. Failing to document and ruin a case.

/var/log/mysql.*

my SQL database useful for SQL injection attacks and other hacking crimes

Clusters

need not consist of contiguous sectors; for example, a 10-sector cluster may have sectors from many different locations.

net user trick to gain domain admin privilege

net user /domain /add localaccountname password net group /domain "Domain Admins" /addlocalaccount saves script to all users startup folder and waits for domain admin to logon which usually occurs in tech support dept so breaking a machine can have tech support login

Blackberry

new versions use android

hacking

orginally meant experimenting with a system, now generally means to break into a system

Email files: .pst

outlook

Email files: .mbx or .dbx

outlook express

Ping of Death

packets in excess of 65535 bytes sent targeted machine

Basic steganography terms

payload carrier channel

cmp

performs a textual comparison of two files and tells you the difference between the two

diff

perfroms a byte-by-byte comparison of two files and tells you the difference between the two

takes the name you provide and returns ID for that process; can work with paritial names

pgrep

ciphertext

plaintext subjected to an algorithm and key

switch

prevents traffic jams by ensuring that data goes straight from its origin to its proper destination. Switches remember the address of every node on the network and anticipate where data needs to go. A switch operates only with the computers on the same LAN because it operates based on the MAC address in a packet, which is not routable. It cannot send data out to the Internet or across a wide area network (WAN). These functions require a router.

Exchange Private folder

priv.edb

Streaming Data

priv.stm

Disk forensics

process of acquiring and analyzing information stored on physical storage media, includes recovery of deleted and hidden information as well as identifying who created the file.

Software forensics -

process of examining malicious computer code, also knows as malware forensics

Network forensics

process of examining network traffic, including transaction logs and real-time monitoring using sniffers and tracing

Internet forensics

process of piecing together where and when a user has been on the internet.

Important Windows Files: Lsass.exe

program that handles security and logon policies

Scientific Working Group on Digital Evidence (SWGDE)

promotes a framework process that include the following four stages: -Collect -Preserve -Examine -Transfer

Children's Online Privacy Protection Act of 1998 COPPA

protects children under 13 from the collection and use of their personal info. by websites. (replaces the 1988 COPA

Privacy Protection Act of 1980

protects journalists from being required to turn over to law enforcement any work product and documentary material, including sources, before it is disseminated to the public.

Federal Standards on BCP's

provide a good overview of what should be covered in any business continuity plan, and some, like NIST 800-34, are also applicable to disaster recovery plans. For the purposes of forensic examination, you don't need to be an expert in disaster recovery—just a basic overview of the process is sufficient.

Hierarchical storage management (HSM)

provides continuous online backup by using optical or tape "jukeboxes." It appears as an infinite disk to the system, and can be configured to provide the closest version of an available, real-time backup.

American Society of Crime Laboratory Directors (ASCLD)

provides guidelines for managing a forensic lab, for acquiring crime lab and forensic lab certification.

Telecommunications Act of 1996

provisions relative to the privacy and disclosure of info. in motion through and across telephony and computer networks

shows all the processes in the form of a tree structure

pstree

Exchange Public Folders

pub.edb

Locky

ransomware virus that encrypts sensitive files and demands payment for encryption key -first appeared 2016

The system_profiler SPSoftwareDataType command

related to system_profiler SPHardwareDataType. returns information about the operating system. This is also important for documenting the system prior to starting the forensic examination.

Windows N.T. 4.0

released shortly after Windows 95 for servers and professionals

The Child Protection and Sexual Predator Punishment Act of 1998

requires service providers that become aware of the storage or transmission of child pornography to report it to law enforcement

TCP Header Bits, of Interest:RST (1 bit)—

resets the connection

date command

returns the current date and time zone. It is good for documenting when exactly you begin your forensic examination. If you need the date in Coordinated Universal Time (UTC), then use date −u.

system_profiler SPHardwareDataType command

returns the hardware information for the host system. This provides information useful for the basic documentation of the system prior to beginning your forensic examination. There are related commands, such as system_profiler SPSerialATADataType. This command gives information on all the attached Serial Advanced Technology Attachment (SATA) devices.

android

samsung galaxy many many types

What are the 5 guidelines required by the Daubert Ruling for scientific evidence to be admissible in court?

scientific theory/technique has been tested • it has been subjected to peer review or publication • the known or potential error rate must be known • the technique must follow set standards so it can be replicated (existence and maintenance of standards controlling its operation) • it can be explained so that the court and jury understand it.(it has attracted widespread acceptance within the scientific community)

how netuser trick affects forensics

search system for unrecognized scripts esp in startup folders check account usage for odd behavior forensic investigator dhould be familiar with hacking techniques and tools

hard drives store data as a _______________

sector

Christmas Tree Scan

sends a TCP packet to target with the URG, PUSH, and FIN flags set alternates bits turned on and off in the flags byte server sends a rst flag

DOD Cyber Crime Center (DC3)

sets standards for digital evidence processing, analysis, and diagnostics. Require computer forensics support to detect, enhance, or recover digtial media. Involved with both law enforcement and counterintelligence

Global Information Assurance Certification (GIAC)

several levels of certification that include security, hacking, and forensics

router

similar to a switch, but it can also connect different logical networks or subnets and enable traffic that is destined for the networks on the other side of the router to pass through. Routers utilize the IP address to determine the path of outgoing packets and work at the Network Layer of the OSI model. Modern routers are complex devices. They handle packets, often have firewall and Dynamic Host Configuration Protocol (DHCP) capabilities, are programmable, and maintain logs.

pstree command

similar to the ps command, except it shows all the processes in the form of a tree structure. The tree format gives more information particular to a given forensic investigation. Not only will you know what processes are running, but also which process initiated those processes.

how cyberterrorism affects forensics

since cyberterrorism often uses multiple layers of attacks; each layer must be investigated. usually state-sponsored so difficult tedious investigation due to sophistication and monies spent on attack

Spyware

software that can monitor a user's activity on a computer

Three ways to fake emails

spoofing anonymous remailing "valid" emails

encrypgion vs steganography

steganography: message hidden encryption: message present but obfuscated and not easily deciphered

UDP header

still has a source and destination port number, but it lacks a sequence number and synchronization bits.

linux

stores files in contiguous blocks Inode (hard links and soft links) Manual recovery with grep and >

Email forensics

study of the source and content of email as evidence, includes identifying sender, recipient, date, time, and origination location of email.

invokes super user mode

su

TCP Header Bits, of Interest:SYN (1 bit

synchronizes sequence numbers.

AND

take two binary numbers and compare them one place at a time. If both numbers have a 1 in both places then the resultant number is 1. If not then the resultant number is 0.

TCP/IP VS OSI

tcp/ip application layer = osi model application/presentation/session tcp/ip transport layer=osi model transport tcp/ip internet layer= osi model network tcp/ip network access layer=osi data link and physical

open files command

tells you if any shared files or folders are open and who has them open.

Ciphertext-only attack

the easist attack to defend against The attacker only has access to a collection of ciphertexts. This is much more likely than known plaintext, but also the most difficult. The attack is successful if the corresponding plaintexts or, even better, the key can be deduced. However, obtaining any information at all about the underlying plaintext in this situation is considered a success.

Frye Standard

the evidence in question must be "generally accepted" by the scientific community

Session Layer

the fifth layer of the OSI model. This layer establishes, manages, synchronizes and terminates connection between the computers. It provides either half duplex or full duplex service.

CAN-SPAM Act (2003)

the first law meant to curtail unsolicited email, referred to as spam. However, the law has loopholes. You do not need permission before sending email. This means that unsolicited email is not prohibited. It applies only to commercial emails—emails that are trying to sell some product or service. Therefore, mass emailings for political, religious, or ideological purposes are not covered by the Act. The only requirement of CAN-SPAM is that the sender must provide some mechanism whereby the receiver can opt out of future emails and that method cannot require the receiver to pay in order to opt out. Restrictions on how the sender can acquire the recipient's email address and how the sender can actually transmit the email: A message cannot be sent through an open relay. A message cannot be sent to a harvested email address. A message cannot contain a false header. These methods are often used by people who send spam email. Tracking down the original sender of the email is the first step in investigating spam. Unfortunately, the email is sometimes sent from offshore sites or relayed through an innocent third party's servers. This makes prosecuting spam very difficult and enforcing a judgment almost impossible in most cases.

TCP/IP Network Access Layer

the first layer of the four layer TCP/IP model. Network Access Layer defines details of how data is physically sent through the network, including how bits are electrically or optically signaled by hardware devices that interface directly with a network medium, such as coaxial cable, optical fiber, or twisted pair copper wire. The protocols included in Network Access Layer are Ethernet, Token Ring, FDDI, X.25, Frame Relay etc. The most popular LAN architecture among those listed above is Ethernet. Ethernet uses an Access Method called CSMA/CD (Carrier Sense Multiple Access/Collision Detection) to access the media, when Ethernet operates in a shared media. An Access Method determines how a host will place data on the medium. IN CSMA/CD Access Method, every host has equal access to the medium and can place data on the wire when the wire is free from network traffic. When a host wants to place data on the wire, it will check the wire to find whether another host is already using the medium. If there is traffic already in the medium, the host will wait and if there is no traffic, it will place the data in the medium. But, if two systems place data on the medium at the same instance, they will collide with each other, destroying the data. If the data is destroyed during transmission, the data will need to be retransmitted. After collision, each host will wait for a small interval of time and again the data will be retransmitted.

Physical Layer

the first or the bottom most layer of the OSI model where all the physical connectivity of devices takes place in a network. It also defines the electrical and mechanical specifications like cables, connectors and signaling options of the medium. It converts the data into binary bits and then transfer to data link layer.

defragmentation

the following conditions are checked, and if met, the file is defragmented when it is opened: • The file is less than 20 megabytes in size. • The file is not already in use. • The file is not read-only. • The file is fragmented. • The system uptime is at least three minutes.

identity theft

the fraudulent acquisition and use of a person's private identifying information, usually for financial gain.

Phishing

the fraudulent practice of sending emails purporting to be from reputable companies in order to induce individuals to reveal personal information, such as passwords and credit card numbers. Usually done in mass email campaigns that yield a 1-3% success rate.

how logic bombs affect forensics

the nature of the logic bomb will give clues to creator usually an employee with access to system and programming background so relatively straightforward to investigate follow same parameters as investigating viruse if delivered by trojan

base transceiver station (BTS)

the part of the cellular network responsible for communications between the mobile phone and the network switching system. The base station system (BSS) is a set of radio transceiver equipment that communicates with cellular devices. It consists of a BTS and a base station controller (BSC). The BSC is a central controller coordinating the other pieces of the BSS.

Email Laws: Fourth Amendment to U.S. Constiution

this as well as state requirements govern the seizure and collection of any email messages that reside on a sender's or recipient's computer or other device. Does the person on whose computer the evidence resides have a reasonable expectation of privacy on that computer? If so, requires a search warrant or one of the recognized exceptions to the search warrant requirements, such as consent from the device owner.

state of running processes

this data is captured before system is shutdown

state of network connections

this data is captured before the system is shutdown

>

this is a redirect command, instead of displaying the output of a command like ls to the screen, it redirects the file

lists the processes in the order of how much CPU time the process is utlilizing

top

how fraud affects forensics

trace communications the more sophisticated an attack the less evidence there is follow the money trace owners of websites

Null Scan

turns off all flags creating a lack of TCP flags in packet (0000000)This would never happen in normal communications results in an error packet being sent again server sends a rst flag

channel

type of medium used

BPCS Bit Plane complexity segmentation

up to 50% of vessel data

live forensic tools: PSList

use to to view process and thread statistics on a system lists all running processes on the system. However, it does not reveal the presence of the rootkit or the other processes that the rootkit has hidden is a part of a suite of tools, PsTools, available as a free download.

Atbash Cipher

used by Hebrew scholars copying the book of Jeremiah Reverses the alphabet—substituting the first letter of the alphabet for the last letter, the second letter for the second-to-last letter, and so on Is primitive and easy to break

TCP Three-Way Handshake

used by TCP establishes a session between two systems. The first system sends a packet with the SYN flag set. The second system responds with a packet that has the SYN and ACK flags set. The first system responds with a packet with the ACK flag set. The two systems have now started a session.

LinEn boot disk

used to aquire contents of a Linux machine.

cd

used to change directories

rm

used to delete or remove a file

Swap file

used to optimize the use of random access memory (RAM). Data is frequently found in the swap file. The details on how to extract data from the swap file vary depending on the installed operating system.

rmdir

used to remove or delete entire directories

Forwarded Events log

used to store events collected from remote computers; Has data in it only if event forwarding has been configured

Applications and Services log

used to store events from a single application or component rather than events that might have systemwide impact

Windows Boot Process: Step 16

user logs on

GroupWise User Databases

userxxx.db

Vigenere Cipher

uses a table and a selected keyword to encrypt a message. Match the letter of your keyword on the top with the letter of your plaintext on the left to find the ciphertext. This type of multialphabet cipher is more secure than a single-alphabet substitution cipher but is still easily cracked by computers. Example: if you are encrypting the word cat and your keyword is horse, then the ciphertext is jok.

Asymmetric Cryptography

uses different keys to encrypt and decrypt plaintext

asymmetric crytography

uses different keys to encrypt and decrypt plaintext RSA Diffie-Hellman

Armoured virus

uses techniques that make it hard to analyze by compressing the code or encrypting it with a weak encryption method

Armored

uses techniques that make it hard to analyze, this is done by compressing it or encrypting it

Symmetric Cryptography

uses the same key to encrypt and decrypt plaintext Can use two different encryption keys, one from sender to receiver and one from receiver to sender Same key is still used for encryption and decryption Having different keys in both directions provides additional security if keys are learned or disclosed

Foresnic Network Analysis

uses tools and techniques of the network trade. Network monitoring helps get the "big picture" perspective, an insight into how networks and systems behave. Network analysis takes a deeper look at the traces between systems, networks, and intruders. Also referred to as "network forensic analysis." Analysis of network data to reconstruct network activity over a specific period of time Commonly used to: Reconstruct the sequence of events that took place during a network-based security incident Discover the source of security policy violations, vulnerabilities, or information assurance breaches Investigate individuals suspected of crimes

Format of expert report

usually list all items, documents, and evidence considered; detail tests performed and analysis done, and conclusion. Should also list entire curriculum vitae (CV)-documentation that details your experience and qualifications in an appendix. CV should include every publication, award and credential earned and very detailed work and education history. In most jurisdictions if it is not in the report, it cannot be presented during trial so thoroughness is essential. Be able to back up everything that you say with well-respected references to support claims.

2017

v 10.12 ( Sierra)

2001

v10.0 (Cheetah)

2011

v10.7 (Lion)

EnCase Network boot disk

very similar to Encase boot disk but allows you to perform process over a crossover cable between investigator's computer and suspect computer

FakeAV:86

virus that purports to be a free antivirus scan but is a Trojan first appeared in 2012

USA Patriot Act (2001)

was passed into law as a response to the terrorist attacks of September 11, 2001. The Act: Reduced restrictions on law enforcement agencies' intelligence gathering within the United States Expanded the Secretary of the Treasury's authority to regulate financial transactions Broadened the discretion of law enforcement and immigration authorities in detaining and/or deporting immigrants suspected of terrorism and related acts Expanded the definition of terrorism to include domestic terrorism, thus enlarging the number of activities to which the PATRIOT Act's extended law enforcement powers can be applied In May of 2011, President Barack Obama signed a four-year extension of three key provisions in the USA PATRIOT Act: roving wiretaps, searches of business records, and conducting surveillance of individuals suspected of terrorist-related activities not linked to terrorist groups. gives law enforcement dramatically enhanced powers for information gathering and should be a part of the knowledge base for any forensic investigator.

fyre standard

what was the requirement for evidence to be admissible in court? - Scientific evidence must be "generally accepted" by experts in the particular field of study.

$I AND $R

when files are moved to Recycle Bin, the original file is renamed starting with $R, followed by a series of random characters but maintain original file extension. a new file is also created beginning with $I

1990

windows 3.0

1992

windows 3.1 released

GroupWise Post Office Database

wphost.db

If the forensic workstation is a Windows machine

you can use the Windows Registry to prevent the workstation from writing to the mobile device. Before connecting to a Windows machine, find the Registry key HKEY_LOCAL_MACHINE\System\CurrentControlset\StorageDevicePolicies, set the value to 0x00000001, and restart the computer. This prevents that computer from writing to mobile devices that are connected to it.

steganalysis tools

• StegSecret • StegSpy • Invisible Secrets • MP3Stego