• Share
  • Email
  • Embed
  • Like
  • Save
  • Private Content
Digital Forensics
 

Digital Forensics

on

  • 2,335 views

A Pilot study on issues and complexity of digital forensics and how digital forensics can be applied in a live environment without the loss or spoilage of valuable data and evidence

A Pilot study on issues and complexity of digital forensics and how digital forensics can be applied in a live environment without the loss or spoilage of valuable data and evidence

Statistics

Views

Total Views
2,335
Views on SlideShare
2,332
Embed Views
3

Actions

Likes
1
Downloads
91
Comments
0

3 Embeds 3

http://www.lmodules.com 1
http://www.linkedin.com 1
http://www.slashdocs.com 1

Accessibility

Categories

Upload Details

Uploaded via as Microsoft PowerPoint

Usage Rights

© All Rights Reserved

Report content

Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
  • Full Name Full Name Comment goes here.
    Are you sure you want to
    Your message goes here
    Processing…
Post Comment
Edit your comment

    Digital Forensics Digital Forensics Presentation Transcript

    • Digital Forensics
      Evidence
    • Road Map
      Basic Digital Forensics
      Traditional Digital Forensics
      Live Digital Forensics
      Anti-Digital Forensics
      Questions
    • Basic Forensics
      Registry
      Thumbs.db
      Index.dat
      Commands
    • Registry
      • Last Logon
      HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinLogon
      Security Center
      • HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity Center
      Recent Documents
      • HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerRecentDocs.doc
      Typed URLs
      • hkcusoftwaremicrosoftinternet explorer ypedurls
    • Thumbs.DB
      Pictures opened in Windows OS
      Filmstrip
      Thumbnails
      Thumbs.DB Viewer
    • Index.DAT
      Contains all of the Web sites
      Every URL
      Every Web page
      All email sent or received through Outlook or Outlook Express
      All internet temp files
      All pictures viewed
    • Commands
      Dir: Lists all files and directories in the directory that you are currently in.
      Ls: List the contents of your home directory by adding a tilde after the ls command.
      Ps: Displays the currently-running processes.
      Fdisk: A utility that provides disk partitioning functions, and information.
    • Traditional Forensics
      Hardware Write Block/Software Write Block
      Cell Phones
      Digital Forensics Programs
      Hex Editor
      FTK
      EnCase
      ProDiscover
    • Hardware Write Block
    • Hardware Write BlockHard Drive Connected
    • Hardware Write Block Image in process
    • Destination Drive
    • Safe Block XP
    • Software Write Block
      Registry Edit USB Block
      HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlStorageDevicePolicies
      Write protect
      Disable WriteProtect dword:00000001
      Enable WriteProtect dword:00000000
    • Cell Phone
    • USB Drive
    • Hex Editor
    • FTK
    • EnCase
    • EnCase Continued
    • ProDiscover
    • Live Digital Forensics
      ProDiscover IR
      Helix
      Sleuth Kit & Autopsy
      Caine
      FTK/EnCase making them live?
      Both newer offerings have live capabilities
    • ProDiscoverIR
    • Live environment warnings
    • Helix
    • Helix Continued
    • Sleuth Kit & Autopsy
    • Caine
    • FTK/EnCase Live?
      Older versions no.
      EnCase 4.6 no.
      FTK 1.8 no.
      New versions yes
      EnCase 6 supports network and live digital forensics.
      FTK 3 supports live digital forensics
    • Problems
      Firewalls/Routers/Switches
      Proxies
      IP packets
      TTL issues
      IDS
    • Anti-Digital Forensics
      Steganography
      Encryption
      Data Wiping
      Metadata Spoilage
      Alternative Data Streams
      Index.Dat
      Thumbs.db
      Death of digital forensics
    • Steganography
      Detection
      WetStone Technologies' Gargoyle
      Niels Provos' Stegdetect
      Hiding
      StegoMagic
      wbStego
      HIP (Hide In Picture)
    • StegoMagic
    • wbStego
    • HIP
    • Encryption
      File encryption
      Full disc-encryption
    • Data Wiping
      M-Sweep Pro Data Eliminator
      DBAN
      DOD 5220.22M
      File Shredder Beyond DOD
    • M-Sweep Pro Data Eliminator
    • DBAN
    • File Shredder
    • Metadata spoilage
      Metaspolit
      TimeStomp
      Slack
      Metachanger
    • Metasploit
    • Timestomp
    • MetaChanger
    • Alternative data streams
      Data fork Resource fork old Macintosh Hierarchical File System
      Impossible to protect your system against ADS.
      Cannot be disabled
      No way to limit this capability
      redirect [>] and colon [:] to fork one file into another.
      C: est> type c:windows otepad.exe > ads.txt:hidden.exe
    • Alternate Data Streams scan engine
    • Locations of Index.DAT files VISTA
      Users<Username>AppDataRoamingMicrosoftWindowsCookiesindex.datUsers<Username>AppDataRoamingMicrosoftWindowsCookieslowindex.datUsers<Username>AppDataLocalMicrosoftWindowsTemporary Internet FilesContent.IE5index.datC:Users<UserName>AppDataLocalMicrosoftWindowsHistoryContent.IE5index.dat
    • Index.DAT Analyzer
    • Thumbs.DB Viewer
    • Death of Digital Forensics
      SSDs are much like memory
      Smallest part written too is a sector
      Erases data in a block
      Anything changes physical placement of data
      Logical placement stays the same.
      Black boxes from a system's point of view
      Property
    • Conclusion
      We can see the live digital forensics is best used for starting an investigation.
      Traditional Digital forensics is best for collecting the data
      And knowing the techniques of Anti-digital forensics can help the investigator find data that he/she might not other wise be able to find.
    • Questions