FORENSIC INVESTIGATIONS by DR. SACHIN PANDEY Roles & Responsibilities Of An Investigator

Computer Forensics - The search for, and the collection of evidence from computer systems in a standardized and well documented manner to maintain its admissibility and probative value in a legal proceeding. "Forget Trash-Can diving. Computers harbor more personal information and secrets than anyone can discard into a 20-gallon trash container. A typical computer holds information people once stored in wallets, cameras, contact lists, calendars, and filing cabinets. Computers are the treasure trove of personal contacts, personal finance, and correspondence. Practically every investigation can benefit from the proper analysis of the suspect's computer systems."

What is Cyber Security? Preventing a problem from occurring in your system Protecting people, data, software, hardware & facilities Requires a wide-range of preparation Awareness, planning, policies, procedures, tools, technologies, training, education, dedication, ‘soft-skills’ & common sense Preparation ranges from Security to Cyber Forensics

Preventing a problem from occurring in your system

Protecting people, data, software, hardware & facilities

Requires a wide-range of preparation

Awareness, planning, policies, procedures, tools, technologies, training, education, dedication, ‘soft-skills’ & common sense

Preparation ranges from Security to Cyber Forensics

Preparation Spectrum Security : Preparation Prevention Detection Minimize Problem Cyber Forensics : Investigation Analysis Recovery Improved preparation Security Event Time line

Security :

Preparation

Prevention

Detection

Minimize Problem

Cyber Forensics :

Investigation

Analysis

Recovery

Improved preparation

Cyber Security Changes

Early 2000’s Cyber Security Problems seen as event driven Wait for a problem to occur Attack simulation not usually performed Network admin proud of hacker’s lack of success (hero after the fact). Posture primarily Reactive, not proactive Security more of an add-on, not integrated

Problems seen as event driven

Wait for a problem to occur

Attack simulation not usually performed

Network admin proud of hacker’s lack of success (hero after the fact).

Posture primarily

Reactive, not proactive

Security more of an add-on, not integrated

Pre 9/11…. Major vulnerabilities were laptops Theft, loss of data Desktop workstations vulnerable to viruses Installing virus protection software Constantly upgrading Defenses primarily Access control software Front door to applications Emphasis on authorized users

Major vulnerabilities were laptops

Theft, loss of data

Desktop workstations vulnerable to viruses

Installing virus protection software

Constantly upgrading

Defenses primarily

Access control software

Front door to applications

Emphasis on authorized users

Attacks Rising

Rise in Cyber Crime

Distribution of Spam senders

$ Billions 2000 Increasing Impact of Malware on Economy 2001 2002 2003 2004 2005 2006 2007

Vulnerabilities On The Rise

Statistics of Vulnerabilities

Vendor Specific Vulnerabilities

Consequences of Exploitation As part of its analysis of each vulnerability, the X-Force records the primary consequence of exploitation. The consequences are defined as the most common effect of exploitation and are divided into nine categories described below : • Bypass Security – An attacker can bypass security restrictions such as a firewall, proxy, IDS system or a virus scanner. • Data Manipulation – An attacker is able to manipulate data stored or used by the host associated with the service or application.

• Denial of Service – An attacker can crash or disrupt a service or system to take down a network. • File Manipulation – An attacker can create, delete, read, modify or overwrite files. Gain Access – An attacker can obtain local and remote access. This also includes vulnerabilities by which an attacker can execute code or commands, because this usually allows the attacker to gain access to the system. • Gain Privileges – Privileges can be gained on the local system only. • Obtain Information – An attacker can obtain information such as file and path names, source code, passwords or server configuration details. • Informational – Service name disclosure. • Other The trend from 2006 continues, as the number one consequence of exploitation remains Gain Access, with a total of 51.6 percent of vulnerabilities. Consequences 2007

• Denial of Service – An attacker can crash or disrupt a service or

system to take down a network.

• File Manipulation – An attacker can create, delete, read, modify or

overwrite files.

Gain Access – An attacker can obtain local and remote access. This

also includes vulnerabilities by which an attacker can execute code or

commands, because this usually allows the attacker to gain access to

the system.

• Gain Privileges – Privileges can be gained on the local system only.

• Obtain Information – An attacker can obtain information such as file

and path names, source code, passwords or server configuration details.

• Informational – Service name disclosure.

• Other

The trend from 2006 continues, as the number one consequence of

exploitation remains Gain Access, with a total of 51.6 percent of vulnerabilities.

Consequences 2007

Top Ten Cyber Threats

Labor Demand Picture - Cyber Security 89% of businesses expect large scale cyber attack within 2 years @60% feel they are unprepared to defend themselves 4/5 feel the US generally is unprepared to defend Many large scale attacks are unreported (confidence issues)‏ Better mousetraps make better mice

89% of businesses expect large scale cyber attack within 2 years

@60% feel they are unprepared to defend themselves

4/5 feel the US generally is unprepared to defend

Many large scale attacks are unreported (confidence issues)‏

Better mousetraps make better mice

1950 1998 2007 On the Other Hand Demand for the Skilled Investigator is Rising : Over the past 50 years, the need for “skilled” investigators has grown from 20% to 65% of the available workforce. Professional Unskilled Skilled

Role & Responsibilities of the forensic Investigator Confirms or dispels the compromise Determine extent of damage Answer: Who, what, when, where, how and why Gathering data in a forensically sound manner Handle and analyze evidence Present admissible evidence in court

Confirms or dispels the compromise

Determine extent of damage

Answer: Who, what, when, where, how and why

Gathering data in a forensically sound manner

Handle and analyze evidence

Present admissible evidence in court

Challenges How to choose the appropriate tools and techniques Retaining the admissible information stored in computers and other devices Minimizing the risk of losing important information or destroying data. How to effectively enhance our lab materials with new exposures of threats and technologies as well.

How to choose the appropriate tools and techniques

Retaining the admissible information stored in computers and other devices

Minimizing the risk of losing important information or destroying data.

How to effectively enhance our lab materials with new exposures of threats and technologies as well.

Goal Of The Cyber Forensic Investigator To be capable of performing cyber forensic investigation using appropriate tools and procedures . Identify and employ tools used for tracking, gathering, preserving and analyzing evidence. Learn the procedures used to gather and preserve this evidence to ensure admissibility in court. Emphasis on applying classroom knowledge to real world applications through hands-on exercises in a controlled environment.

To be capable of performing cyber forensic investigation using appropriate tools and procedures .

Identify and employ tools used for tracking, gathering, preserving and analyzing evidence.

Learn the procedures used to gather and preserve this evidence to ensure admissibility in court.

Emphasis on applying classroom knowledge to real world applications through hands-on exercises in a controlled environment.

What is important? Process of investigation Techniques and tools Ethics, privacy, and legal issues

Process of investigation

Techniques and tools

Ethics, privacy, and legal issues

Different elements faced during investigation Processor/Hardware (x86, Sun, Mac, etc)‏ OS (Win/Unices/Mac/others)‏ Application (task-specific, general)‏ Filesystem (NTFS/UFS/ext/hpfs)‏ Storage (local, networked, NAS, SAN, raid)‏ Other (PDA / cellphones / cameras / memory sticks & cards / MP3 players / etc)‏

Processor/Hardware (x86, Sun, Mac, etc)‏

OS (Win/Unices/Mac/others)‏

Application (task-specific, general)‏

Filesystem (NTFS/UFS/ext/hpfs)‏

Storage (local, networked, NAS, SAN, raid)‏

Other (PDA / cellphones / cameras / memory sticks & cards / MP3 players / etc)‏

A trained computer forensic examiner should: Make forensic duplicate drive images and document all files on the hard drive and the procedures used to obtain them. Use only DOS utilities or Linux DD to make forensic copy. NEVER ALLOW A MACHINE TO BOOT INTO WINDOWS! Windows updates timestamps on ALL files it touches!! Forensic copy preserves source drive above all else. Use MD5 File Hash to Verify Copy. Take Lots of Digital Pictures, Document everything! Maintain a record of chain of custody of all computer media

Use only DOS utilities or Linux DD to make forensic copy.

NEVER ALLOW A MACHINE TO BOOT INTO WINDOWS!

Windows updates timestamps on ALL files it touches!!

Forensic copy preserves source drive above all else.

Use MD5 File Hash to Verify Copy.

Take Lots of Digital Pictures, Document everything!

Maintain a record of chain of custody of all computer media

Recover deleted files. Recover data from a reformatted drive. Recover data in file slack and unallocated portions of drive. A trained computer forensic examiner can:

Recover deleted files.

Recover data from a reformatted drive.

Recover data in file slack and unallocated portions of drive.

What is File Slack? The DOS file system, file allocation table (FAT) was never designed to handle storage device with more than 32767 units of data. 32767 is the largest number that can be represented with 16 bits. Data is written in sectors of 512 bytes (hard drives, floppy), or 2048 bytes (CD-ROM). This set an arbitrary limit on disk storage devices of 512x32767 = 16MB. To accommodate larger drives the concept of “clusters” was invented. Clusters are a group of sectors written as a single atomic unit. The larger the drive capacity the more sectors are grouped into clusters. ( up to 128 sectors )‏

What is File Slack ? FAT16 Clustering up to 128 sectors of 512 bytes allowed the original 16 bit FAT (FAT16) to handle devices up to 2GB. FAT32 When devices grew over 2GB file allocation system had to go to a 32bit FAT (FAT32) this will allow for drive capacity to grow to 17 TB. ( 32bit max: 268,435,455 Clusters )‏

What is File Slack? With clustering came file slack. RAM Slack If the file you are writing is shorter than the number of bytes in the clusters you have allocated for your file, the file system will pad the data out to the end of the current sector with “RAM slack”. RAM slack is random data that happens to be in RAM memory at the time the file is written. It can contain any data that you were working on since you last booted the PC. Such as emails, word documents, graphics, etc.

What is File Slack ? Drive Slack Unlike RAM slack which comes from working storage, “drive slack” is data left on the drive from a previous file. After completing the last partial sector with RAM slack, subsequent whole sectors in the last cluster are left as is with whatever data was written there previously. This is possible because deleting a file only removes it from the FAT, the data remains on the drive until the sector it occupies is overwritten by a subsequent file.

A Trained Computer Forensic Examiner can: Work with File Hashes A file hash is a mathematical calculation made from every byte in a file. It creates a unique digital fingerprint for that file. Using File hashes a forensic examiner can: Quickly locate and catalog every (graphic) file on a PC hard drive, and flag child pornographic images using a national database of known images. Identify known system and software files that can safely be ignored. KFF - Known File Filter NIST, INORP Databases of File Hashes Hash Keeper

Forensic Recovery - Seizure Take pictures to document area around the computer. You may find removable media, or clues to your subject’s passwords in your photos.

BIOS PW? Default/backdoor pws AMI = 589589, amisw, ami Award = AWARD_SW, AWARD_PW, condo, j262 Jumper? Remove drive Bypassing/cracking system and application passwords

BIOS PW?

Default/backdoor pws

AMI = 589589, amisw, ami

Award = AWARD_SW, AWARD_PW, condo, j262

Jumper?

Remove drive

Forensic Recovery - Physical Copy Tip : Add a clean slave drive to subject’s computer, or remove hard drive(s) and copy on your system. Do a physical copy (sector by sector) to the clean media.

A trained computer forensic examiner can: MS OFFICE FORENSICS Every PC leaves a unique electronic fingerprint on every MS Office document it creates. (“GUID”) The “GUID” is unique to the PC and the logged in user. We can examine these documents to determine on which machine a document was created, and when and by whom it was created. “ GUIDClean.exe allows users to detect, display and modify the Global Unique Identifiers (GUID) that some MS Office products (Word and Excel) place in user's documents. An argument can be made that these GUID strings are a breach of users' privacy and may be used to track documents and bind them to particular users or particular machines.”

A trained computer crime investigator can: Trace and validate email messages stored on the hard drive. With a court order we can get additional information from the internet service providers to help ascertain the source and author of the email. Check email headers for spoofs. Software that can be used: E-mail Examiner v5.8 , Network E-mail Examiner v2.1.

A trained computer forensic examiner can: Recover passwords from most Windows application software, and those used by Windows 9x, Windows NT, and Novell Netware servers. Decrypt encrypted data and messages. Software that can be used: Winhex ,Stego Suite , Decryption Collection Enterprise v4.0.

A Trained computer forensic examiner can: Locate and identify all "mal-ware" (viruses, worms, Trojans and other malicious software) and Vulnerabilities on the hard drive and on the network. Software that can be used: DragonSoft ,Gargoyle Investigator Forensic Pro ,LiveWire Investigator Edition and LiveDiscover Forensic Edition

Thank You For more information feel free to contact us at E-Mail: [email_address] URL: http://www.agapeinc.in blog: http://www.agapeFORENSIC.COM