Beyond eXtreme Forensics Update 3Q / 2016 by Alvaro Soto

•

1 like•332 views

Lecture will cover advanced forensic techniques that law enforcement authorities can use for physical recovery. Law enforcement agents are regularly faced with new challenges, new devices and new recovery methods. This is an outline from a 7-day long law enforcement and military bootcamp of advanced forensic techniques for HDD recovery and Chips (NAND) recovery. We have trained several law enforcement agencies around the world and helped deploy multiple laboratories and advanced forensic technologies for law enforcement, military and international agencies. This lecture will be a practical demonstration and live lab of NAND recovery, HDD hack and crack, an introduction to electronics, mechanics and soft areas inside HDD, including foundations about HDD and NAND (chips) structure.

Technology

© Legal Disclaimer…
Copyright Disclaimer Under Sec6on 107 of the
Copyright Act 1976, allowance is made for "fair
use" for purposes such as cri6cism, comment,
news repor6ng, teaching, scholarship, and
research. Fair use is a use permiDed by copyright
statute that might otherwise be infringing. Non-
proﬁt, educa6onal or personal use 6ps the
balance in favor of fair use.
All materials/trademarks used in this
presenta6on belong to their respec6ve owners.

Goals for this update from the lab...
Take a quick look around:

•  Share “stories from trenches”
•  Give an awarness of poten6al issues/ﬁxes
•  Give you some resources for R&D and Fun J
•  Ques6ons / Answers…
Alvaro Alexander Soto - Lab Director / Senior Trainer - asoto@asoto.com

Our main resources… and suggesBon for
you to use too..
Alvaro Alexander Soto - Lab Director / Senior Trainer - asoto@asoto.com

EncrypBon everywhere… but…
Corrup6on.
Alvaro Alexander Soto - Lab Director / Senior Trainer - asoto@asoto.com

IoT / Firmware everywhere… but…
Alvaro Alexander Soto - Lab Director / Senior Trainer - asoto@asoto.com

Inside HDD…
Diags..
•  SA corrup6on..
•  Motor stuck..
•  Heads..
•  Electronics..
•  Scratches..
•  ESD
•  Sounds / Clicks
•  Natural elements…

SA in somewhere…NegaBve Tracks..?
•  -1 FFFFh
•  -2 FFFEh
•  Etc…

SA vulnerability / Fix…
•  ATA Pwd
•  Change / Oﬀ - H
•  HPA/DCO
•  Malware/Code injec6on
•  Hidden data / Tools
•  S/N
•  ….

Sample Scenario: Data theQ problem..

•  SED HDD solu6ons here right now!!!
•  Really a solu6on?.....
•  Lets take a look around…

Resources
•  hDps://www.itosaka.com/WordPress/wp-content/
uploads/2009/07/Seagate-Diagnos6c-
Command.pdf
•  hDp://openocd.org/

Alvaro Alexander Soto - Lab Director / Senior Trainer -
asoto@asoto.com

The document provides guidance on managing e-learning resources, including creating, commissioning, and sharing digital content while respecting copyright. It discusses copyright basics, obtaining permission to use content, creative commons licensing, commissioning others to create content, and sharing standards. A five step process is outlined for identifying content, determining rights, obtaining authorization, defining licensing terms, and selecting distribution channels. Risk management strategies are also covered.

13 0813 session 1

CleantechOpen

This document summarizes a webinar hosted by Cleantech Open on August 13, 2013. The webinar focused on legal environments, issues, and risks for entrepreneurs and early-stage companies. It included discussions on legal issues related to investments, intellectual property, operations, and exit strategies. Attendees were encouraged to consider how to address potential legal issues and risks in their business plans and models. The webinar provided an overview of key legal considerations and took questions from participants.

The Hitchhikers' Guide to Free and Open Source Software Development (CompCon ...

Elena Williams

There is only one serious course about Free and Open Source Software Development delivered in Australia annually, the postgraduate level COMP8440 at ANU. Moreover the course is delivered by Andrew "Tridge" Tridgell who authored the seminal open source projects samba and the rsync algorithm. During this course he discusses his wealth of experience and trains then assesses students on contributing to the open source community. This talk will be conveying as much of this week-long course as is possible in the time available, as seen through the eyes of a graduating student who was always keen about open source yet who hadn't made their first pull-requests until during this course. Now, more than a year later, the presenter is actively involved in several open source projects and will be talking about some of the characteristics of the open source community today and describing in specific detail about how to become involved. The presenter will discuss the highs, the lows, the awkwardness and unique sense of connection and achievement that can only be fulfilled by contributing to open source. Elena Williams is a python/django web developer now working in Perth. She graduated from Master ITS program from CECS ANU in 2012. She's taught Django/Python, been involved with the Django, Python and Linux communities around Australia and organised the Python user group in Canberra whilst studying at ANU. She presented about open source participation at PyConAU 2012. She is also enthusiastic about teaching programming to non-programmers, kitesurfing, snowboarding, endurance navigation sports; is an active hacker/maker and was only called a Douglas Adams "tragic" by the Canberra Times once.

Gene patenting grammar practice copy 2

marianogalan23

The document discusses gene patenting and intellectual property rights. It explains that patents give inventors exclusive rights over their ideas and creations to ensure they can profit from years of research. While whole living organisms cannot be patented, DNA sequences can if they have been isolated or altered by genetic engineers. The number of DNA patents is rising as discoveries in genetics increase. The document provides examples of DNA patenting for new types of cattle and the potential cloning of livestock.

Radiology Residents Involvement in Research 2016

evadew1

The document discusses opportunities for radiology residents to engage in research. It begins by addressing some common questions from residents about research, such as whether they need an idea or mentor, how much time is required, and how to get protected time off from clinical duties. It then provides tips for residents who want to do substantial research, such as ways to find funding and mentors and publish their work. The presentation encourages residents to pursue some type of research project and offers resources to support their efforts.

Technology Trend Analysis of R&D Strategy on iPS Cells

VALUENEX

Protecting innovation - PATENTS, TRADEMARKS, AND COPYRIGHTS

Bagus Anjari

Intellectual Property in Engineering

Technology Ventures Event - MMUBS / DBMS

The document discusses intellectual property (IP) protection strategies for engineering ideas and inventions. It explains that while ideas alone are not enough to commercialize an invention, overprotecting IP can also deter investors. The best strategy is to appeal to investors without appearing too permissive. It then discusses various forms of IP protection like patents, trademarks, registered designs, copyright, and trade secrets, when they should be considered, and how to identify and protect valuable technological and scientific creations.

Whether people admit or not, everyone is moving to the cloud and all future business will run somewhere on the internet. Moving to the cloud requires different set of architecture and mindset. Data is stored, accessed and processed on different platforms and devices. Employees are working anywhere from the world, corporate data is no more under company IT custody. CISOs and CIOs need to think differently and set new Cloud Security Architecture. This session will try to draw the main areas of concern from Security perspective while moving to the cloud.

Phases of Incident Response

EC-Council

Weaponizing OSINT – Hacker Halted 2019 – Michael James

EC-Council

The document discusses weaponizing open-source intelligence (OSINT) and outlines potential passive attack paths an attacker could take using only publicly available information. It describes how attackers could profile targets using personal details from social media, pastebins, medical records, business cards, news articles, and other open sources. The document also provides recommendations for prevention, including assessing one's digital footprint and value to attackers, using privacy tools, updating social media settings, and spreading disinformation to obscure true personal details and locations that could be leveraged in attacks.

Hacking Your Career – Hacker Halted 2019 – Keith Turpin

EC-Council

Hacking Diversity – Hacker Halted . 2019 – Marcelle Lee

EC-Council

Cloud Proxy Technology – Hacker Halted 2019 – Jeff Silver

EC-Council

The document provides an overview of cloud proxy technology and cyber security. It discusses how proxies work by terminating connections between users and servers and inspecting transmitted objects. The document then shares several "real world" examples of how proxies can detect and prevent phishing attempts, malware infections, and other cyber threats by analyzing URLs, file downloads, and network traffic patterns. It emphasizes the importance of threat intelligence and how proxies use global intelligence networks to identify and block malicious activity in real-time.

DNS – Strategies for Reducing Data Leakage & Protecting Online Privacy – Hack...

EC-Council

This document discusses strategies for reducing DNS data leakage and protecting online privacy. It begins with an introduction and overview of topics to be covered, including why DNS data is important from a privacy perspective, common DNS privacy exploits, insecure DNS resolution processes, and solutions for anonymizing DNS data like DNS over HTTPS and DNS over TLS. The document provides details on how DNS data can be tracked and leaked, as well as tools and techniques for analyzing DNS traffic and protecting privacy, including public secure resolvers, browser-based protections, VPNs, and running one's own recursive resolver. It concludes with taking privacy to varying degrees and balancing privacy with usability.

Data in cars can be creepy – Hacker Halted 2019 – Andrea Amico

EC-Council

Breaking Smart [Bank] Statements – Hacker Halted 2019 – Manuel Nader

EC-Council

Are your cloud servers under attack?– Hacker Halted 2019 – Brian Hileman

EC-Council

War Game: Ransomware – Global CISO Forum 2019

EC-Council

This document describes a tabletop exercise to simulate responding to a ransomware attack. It provides examples of recent ransomware attacks against various organizations, including municipalities and healthcare and private companies. These resulted in ransoms demanded from $51,000 to $600,000 and costs of recovery and lost operations from $17 million to companies having to cease operations. The exercise involves forming an incident response team and working through simulated ransomware attacks, assessing damage, determining payment and recovery options, developing alternative communications, and deciding whether to pay a ransom demand.

How to become a Security Behavior Alchemist – Global CISO Forum 2019 – Perry ...

EC-Council

Introduction to FAIR Risk Methodology – Global CISO Forum 2019 – Donna Gall...

EC-Council

Alexa is a snitch! Hacker Halted 2019 - Wes Widner

EC-Council

Hacker Halted 2018: Don't Panic! Big Data Analytics vs. Law Enforcement

EC-Council

A man was discovered murdered on a street late at night. Police were called to the scene and began their investigation. They found limited clues but saw footage of a potential suspect. Detectives then used big data analytics to identify individuals near the crime scene around the time of the murder. This led them to three male suspects. Further investigation of these suspects focused on building profiles of their patterns of life in hopes of identifying the killer.

Hacker Halted 2018: HACKING TRILLIAN: A 42-STEP SOLUTION TO EXPLOIT POST-VOGA...

EC-Council

Hacker Halted 2018: Breaking the Bad News: How to Prevent Your IR Messages fr...

EC-Council

This document provides guidance on effective communication when delivering bad news or security incidents to various stakeholders. It discusses targeting communications to different audience levels, including end users, middle management, and C-level executives. For each group, it suggests focusing on the relevant impact and providing information in a concise, judicious, and empathetic manner. The document also emphasizes the importance of non-verbal communication and body language awareness to ensure the intended message is properly conveyed.

Hacker Halted 2018: From CTF to CVE – How Application of Concepts and Persist...

EC-Council

Hacker Halted 2018: SE vs Predator: Using Social Engineering in ways I never ...

EC-Council

Climate Impact of Software Testing at Nordic Testing Days

Kari Kakkonen

My slides at Nordic Testing Days 6.6.2024 Climate impact / sustainability of software testing discussed on the talk. ICT and testing must carry their part of global responsibility to help with the climat warming. We can minimize the carbon footprint but we can also have a carbon handprint, a positive impact on the climate. Quality characteristics can be added with sustainability, and then measured continuously. Test environments can be used less, and in smaller scale and on demand. Test techniques can be used in optimizing or minimizing number of tests. Test automation can be used to speed up testing.

How to Get CNIC Information System with Paksim Ga.pptx

danishmna97

Recently uploaded

Climate Impact of Software Testing at Nordic Testing Days

Kari Kakkonen

How to Get CNIC Information System with Paksim Ga.pptx

danishmna97

Presentation of the OECD Artificial Intelligence Review of Germany

innovationoecd

Taking AI to the Next Level in Manufacturing.pdf

ssuserfac0301

Read Taking AI to the Next Level in Manufacturing to gain insights on AI adoption in the manufacturing industry, such as: 1. How quickly AI is being implemented in manufacturing. 2. Which barriers stand in the way of AI adoption. 3. How data quality and governance form the backbone of AI. 4. Organizational processes and structures that may inhibit effective AI adoption. 6. Ideas and approaches to help build your organization's AI strategy.

HCL Notes und Domino Lizenzkostenreduzierung in der Welt von DLAU

panagenda

Webinar Recording: https://www.panagenda.com/webinars/hcl-notes-und-domino-lizenzkostenreduzierung-in-der-welt-von-dlau/ DLAU und die Lizenzen nach dem CCB- und CCX-Modell sind für viele in der HCL-Community seit letztem Jahr ein heißes Thema. Als Notes- oder Domino-Kunde haben Sie vielleicht mit unerwartet hohen Benutzerzahlen und Lizenzgebühren zu kämpfen. Sie fragen sich vielleicht, wie diese neue Art der Lizenzierung funktioniert und welchen Nutzen sie Ihnen bringt. Vor allem wollen Sie sicherlich Ihr Budget einhalten und Kosten sparen, wo immer möglich. Das verstehen wir und wir möchten Ihnen dabei helfen! Wir erklären Ihnen, wie Sie häufige Konfigurationsprobleme lösen können, die dazu führen können, dass mehr Benutzer gezählt werden als nötig, und wie Sie überflüssige oder ungenutzte Konten identifizieren und entfernen können, um Geld zu sparen. Es gibt auch einige Ansätze, die zu unnötigen Ausgaben führen können, z. B. wenn ein Personendokument anstelle eines Mail-Ins für geteilte Mailboxen verwendet wird. Wir zeigen Ihnen solche Fälle und deren Lösungen. Und natürlich erklären wir Ihnen das neue Lizenzmodell. Nehmen Sie an diesem Webinar teil, bei dem HCL-Ambassador Marc Thomas und Gastredner Franz Walder Ihnen diese neue Welt näherbringen. Es vermittelt Ihnen die Tools und das Know-how, um den Überblick zu bewahren. Sie werden in der Lage sein, Ihre Kosten durch eine optimierte Domino-Konfiguration zu reduzieren und auch in Zukunft gering zu halten. Diese Themen werden behandelt - Reduzierung der Lizenzkosten durch Auffinden und Beheben von Fehlkonfigurationen und überflüssigen Konten - Wie funktionieren CCB- und CCX-Lizenzen wirklich? - Verstehen des DLAU-Tools und wie man es am besten nutzt - Tipps für häufige Problembereiche, wie z. B. Team-Postfächer, Funktions-/Testbenutzer usw. - Praxisbeispiele und Best Practices zum sofortigen Umsetzen

Programming Foundation Models with DSPy - Meetup Slides

Zilliz

UI5 Controls simplified - UI5con2024 presentation

Wouter Lemaire

Video Streaming: Then, Now, and in the Future

Alpen-Adria-Universität

In his public lecture, Christian Timmerer provides insights into the fascinating history of video streaming, starting from its humble beginnings before YouTube to the groundbreaking technologies that now dominate platforms like Netflix and ORF ON. Timmerer also presents provocative contributions of his own that have significantly influenced the industry. He concludes by looking at future challenges and invites the audience to join in a discussion.

Best 20 SEO Techniques To Improve Website Visibility In SERP

Pixlogix Infotech

Uni Systems Copilot event_05062024_C.Vlachos.pdf

Uni Systems S.M.S.A.

Ocean lotus Threat actors project by John Sitima 2024 (1).pptx

SitimaJohn

Ocean Lotus cyber threat actors represent a sophisticated, persistent, and politically motivated group that poses a significant risk to organizations and individuals in the Southeast Asian region. Their continuous evolution and adaptability underscore the need for robust cybersecurity measures and international cooperation to identify and mitigate the threats posed by such advanced persistent threat groups.

HCL Notes and Domino License Cost Reduction in the World of DLAU

panagenda

Webinar Recording: https://www.panagenda.com/webinars/hcl-notes-and-domino-license-cost-reduction-in-the-world-of-dlau/ The introduction of DLAU and the CCB & CCX licensing model caused quite a stir in the HCL community. As a Notes and Domino customer, you may have faced challenges with unexpected user counts and license costs. You probably have questions on how this new licensing approach works and how to benefit from it. Most importantly, you likely have budget constraints and want to save money where possible. Don’t worry, we can help with all of this! We’ll show you how to fix common misconfigurations that cause higher-than-expected user counts, and how to identify accounts which you can deactivate to save money. There are also frequent patterns that can cause unnecessary cost, like using a person document instead of a mail-in for shared mailboxes. We’ll provide examples and solutions for those as well. And naturally we’ll explain the new licensing model. Join HCL Ambassador Marc Thomas in this webinar with a special guest appearance from Franz Walder. It will give you the tools and know-how to stay on top of what is going on with Domino licensing. You will be able lower your cost through an optimized configuration and keep it low going forward. These topics will be covered - Reducing license cost by finding and fixing misconfigurations and superfluous accounts - How do CCB and CCX licenses really work? - Understanding the DLAU tool and how to best utilize it - Tips for common problem areas, like team mailboxes, functional/test users, etc - Practical examples and best practices to implement right away

AI 101: An Introduction to the Basics and Impact of Artificial Intelligence

IndexBug

Removing Uninteresting Bytes in Software Fuzzing

Aftab Hussain

Imagine a world where software fuzzing, the process of mutating bytes in test seeds to uncover hidden and erroneous program behaviors, becomes faster and more effective. A lot depends on the initial seeds, which can significantly dictate the trajectory of a fuzzing campaign, particularly in terms of how long it takes to uncover interesting behaviour in your code. We introduce DIAR, a technique designed to speedup fuzzing campaigns by pinpointing and eliminating those uninteresting bytes in the seeds. Picture this: instead of wasting valuable resources on meaningless mutations in large, bloated seeds, DIAR removes the unnecessary bytes, streamlining the entire process. In this work, we equipped AFL, a popular fuzzer, with DIAR and examined two critical Linux libraries -- Libxml's xmllint, a tool for parsing xml documents, and Binutil's readelf, an essential debugging and security analysis command-line tool used to display detailed information about ELF (Executable and Linkable Format). Our preliminary results show that AFL+DIAR does not only discover new paths more quickly but also achieves higher coverage overall. This work thus showcases how starting with lean and optimized seeds can lead to faster, more comprehensive fuzzing campaigns -- and DIAR helps you find such seeds. - These are slides of the talk given at IEEE International Conference on Software Testing Verification and Validation Workshop, ICSTW 2022.

Serial Arm Control in Real Time Presentation

tolgahangng

20240605 QFM017 Machine Intelligence Reading List May 2024

Matthew Sinclair

Microsoft - Power Platform_G.Aspiotis.pdf

Uni Systems S.M.S.A.

“I’m still / I’m still / Chaining from the Block”

Claudio Di Ciccio

CAKE: Sharing Slices of Confidential Data on Blockchain

Claudio Di Ciccio

Presented at the CAiSE 2024 Forum, Intelligent Information Systems, June 6th, Limassol, Cyprus. Synopsis: Cooperative information systems typically involve various entities in a collaborative process within a distributed environment. Blockchain technology offers a mechanism for automating such processes, even when only partial trust exists among participants. The data stored on the blockchain is replicated across all nodes in the network, ensuring accessibility to all participants. While this aspect facilitates traceability, integrity, and persistence, it poses challenges for adopting public blockchains in enterprise settings due to confidentiality issues. In this paper, we present a software tool named Control Access via Key Encryption (CAKE), designed to ensure data confidentiality in scenarios involving public blockchains. After outlining its core components and functionalities, we showcase the application of CAKE in the context of a real-world cyber-security project within the logistics domain. Paper: https://doi.org/10.1007/978-3-031-61000-4_16

Let's Integrate MuleSoft RPA, COMPOSER, APM with AWS IDP along with Slack

shyamraj55

Recently uploaded (20)

Climate Impact of Software Testing at Nordic Testing Days

How to Get CNIC Information System with Paksim Ga.pptx

Presentation of the OECD Artificial Intelligence Review of Germany

Taking AI to the Next Level in Manufacturing.pdf

HCL Notes und Domino Lizenzkostenreduzierung in der Welt von DLAU

Programming Foundation Models with DSPy - Meetup Slides

UI5 Controls simplified - UI5con2024 presentation

Video Streaming: Then, Now, and in the Future

Best 20 SEO Techniques To Improve Website Visibility In SERP

Uni Systems Copilot event_05062024_C.Vlachos.pdf

Ocean lotus Threat actors project by John Sitima 2024 (1).pptx

HCL Notes and Domino License Cost Reduction in the World of DLAU

AI 101: An Introduction to the Basics and Impact of Artificial Intelligence

Removing Uninteresting Bytes in Software Fuzzing

Serial Arm Control in Real Time Presentation

20240605 QFM017 Machine Intelligence Reading List May 2024

Microsoft - Power Platform_G.Aspiotis.pdf

“I’m still / I’m still / Chaining from the Block”

CAKE: Sharing Slices of Confidential Data on Blockchain

Let's Integrate MuleSoft RPA, COMPOSER, APM with AWS IDP along with Slack

Beyond eXtreme Forensics Update 3Q / 2016 by Alvaro Soto

2. © Legal Disclaimer… Copyright Disclaimer Under Sec6on 107 of the Copyright Act 1976, allowance is made for "fair use" for purposes such as cri6cism, comment, news repor6ng, teaching, scholarship, and research. Fair use is a use permiDed by copyright statute that might otherwise be infringing. Non- proﬁt, educa6onal or personal use 6ps the balance in favor of fair use. All materials/trademarks used in this presenta6on belong to their respec6ve owners.

3. What we do in Forensic Lab…

4. What we do in the forensic lab…

5. Goals for this update from the lab... Take a quick look around: •  Share “stories from trenches” •  Give an awarness of poten6al issues/ﬁxes •  Give you some resources for R&D and Fun J •  Ques6ons / Answers… Alvaro Alexander Soto - Lab Director / Senior Trainer - asoto@asoto.com

6. HDD Storage components review.

7. HDD Storage components review.

8. Our main resources… and suggesBon for you to use too.. Alvaro Alexander Soto - Lab Director / Senior Trainer - asoto@asoto.com

9. EncrypBon everywhere… but… Corrup6on. Alvaro Alexander Soto - Lab Director / Senior Trainer - asoto@asoto.com

10. IoT / Firmware everywhere… but… Alvaro Alexander Soto - Lab Director / Senior Trainer - asoto@asoto.com

11. Inside HDD… Diags.. •  SA corrup6on.. •  Motor stuck.. •  Heads.. •  Electronics.. •  Scratches.. •  ESD •  Sounds / Clicks •  Natural elements…

12. SA in somewhere…NegaBve Tracks..? •  -1 FFFFh •  -2 FFFEh •  Etc…

13. Seagate DiagnosBc Serial Port

14. Tools..

15. SA vulnerability / Fix… •  ATA Pwd •  Change / Oﬀ - H •  HPA/DCO •  Malware/Code injec6on •  Hidden data / Tools •  S/N •  ….

16. Tools / RE Cracks / Filesystem Hacks

17. Sample Scenario: Data theQ problem.. •  SED HDD solu6ons here right now!!! •  Really a solu6on?..... •  Lets take a look around…

18. SED HDD

19. SED HDD

20. Playing Cops and Robbers

21.

22. •  BIOS Mods

23. Job Done…lets go back to home

24. Resources •  hDps://www.itosaka.com/WordPress/wp-content/ uploads/2009/07/Seagate-Diagnos6c- Command.pdf •  hDp://openocd.org/ Alvaro Alexander Soto - Lab Director / Senior Trainer - asoto@asoto.com

25. THANKS!!! Q&A – Experience sharings...

Beyond eXtreme Forensics Update 3Q / 2016 by Alvaro Soto

Recommended

Recommended

More Related Content

More from EC-Council

More from EC-Council (20)

Recently uploaded

Recently uploaded (20)

Beyond eXtreme Forensics Update 3Q / 2016 by Alvaro Soto