SlideShare a Scribd company logo

Dracos forensic flavor

•Download as PPTX, PDF•
•
Satria Ady Pradana
Satria Ady Pradana

This document discusses the digital forensic capabilities of the dracOs Linux distribution. It provides an overview of dracOs and its focus on digital forensics. It describes the current state of forensic tools integrated in dracOs and plans to develop a live CD for acquisition and analysis and new forensic tools. It also covers key aspects of digital forensics like stages of acquisition, analysis and reporting and categories of forensic techniques like device type, volatility and format type. Specific open source tools supported in dracOs are highlighted for tasks like disk imaging, file carving, file analysis, anti-malware, memory analysis and more. Contributing to dracOs's development is encouraged.

Software
1 of 35
dracOs Forensic Flavor Satria Ady Pradana http://xathrya.id/ 1
# whoami? • Satria Ady Pradana – Junior Security Analyst at MII – Researcher at dracOS Dev Team – Interest in low level stuffs http://xathrya.id/ 2
Here Comes, dracOs • A lightweight and powerful linux distribution. • Built from scratch. • A research for all. • A linux not only for penetration testing but cyber-security related activity, including digital forensic. http://xathrya.id/ 3
The State of Forensic in dracOs • Current – Integrating modern open-source forensics tools to dracOs. – Creating guide and “how to” for using dracOs and its tools. • Next plan – Live CD for forensic acquisition and analysis. – Develop tools for forensic. – Open research discussion. http://xathrya.id/ 4
What is Digital Forensic? • Forensic – scientific process in collecting, preserving, analyzing evidence during the course of an investigation. • Digital Forensic – branch of forensic where the object of investigation is electronic especially digital data. • Preservation, identification, extraction, interpretation, and documentation of digital evidence which can be used in the court of law. http://xathrya.id/ 5
The Essence of Digital Forensic • Solving a puzzle. • Reconstruct an event or draw a conclusion from evidence. – Financial fraud. – Hacking / security breach. – Crimes using electronic / cyber. http://xathrya.id/ 6
Forensic Stages Commonly consists of 3 stages: • Acquisition • Analysis • Reporting http://xathrya.id/ 7
Acquisition • Collecting and preserving the evidence. • Duplicate the source of evicende (ex: disk, flash drive, sd card, RAM). • Ensure integrity of data in certain level. http://xathrya.id/ 8
Analysis • Examine the content of source. • Identify evidence that either supports or contradicts a hypothesis or for sign of tampering (to hide data). • Should be able to be reproduced by other examiner. http://xathrya.id/ 9
Some Question to Address • What files / artefacts have been deleted from digital device? • What other digital devices has been connected to this system? • Was this system attacked or modified by someone over the network? • Can we know how the breach happen? • Can a remote system or user be located or identified? • What sites on internet were visited by this system? • Was this audio-recording altered? http://xathrya.id/ 10
• Was this image counterfeit? • Can this image / video-recording be enhanced to help identify someone? • Can the physical characteristics of an object in photograph be determined? • Can individuals be determined? • Can unknown victims be located or identified based on phone number, email, etc? • Can pattern of offender activity related to the investigation be reconstructed? • etc http://xathrya.id/ 11
Analysis Category At dracOs research, we divide the fields of techniques and analysis to several categories: • By device type • By volatility • By format type http://xathrya.id/ 12
By Device Type • Computer (desktop, laptop) • Mobile device (cell phone, tablet, PDAs) • Embedded & IoT http://xathrya.id/ 13
By Volatility of Source • Memory • Disk (HDD, SSD, SD card, ...) http://xathrya.id/ 14
By Format Type • Network (traffic and activity on network) • Logs (server log, event log, ...) • Database (database and related metadata) • Document • Image forensic (digital picture analysis) • Video forensic (digital video analysis) • Audio forensic http://xathrya.id/ 15
Anti-Forensic • Data hiding • Artefact wiping • Trail obfuscation • Attack against Forensic Process or Tools http://xathrya.id/ 16
Role of Linux & FOSS • Open Source bring openness to the idea and knowledge. – Transparency, all source code can be reviewed and openly validated. • Knowledge not depends on region, funding, and level of country development. • Encourage collaborative moves. http://xathrya.id/ 17
Perception of Linux by Gov • Linux is HARD – CLI stuffs – Too many commands, hard to remember • Not easy to get started • Not many professional (and easy) tools available. Is it? http://xathrya.id/ 18
drac0s offers? • Arsenal of open source tools, for acquisition and analysis. • The power of open source and linux with DIY flavor. http://xathrya.id/ 19
Tools Category (so far) • Disk Imaging & Hashing • Data Carving & Extraction • File Analysis • Antimalware • Document Metadata Extraction • Memory Analysis • Network Forensic • Mobile Forensic http://xathrya.id/ 20
In current state, most tools are analysis tools. We are working for acquisition. Some tools might not be mentioned due to limited time. We mention only most interesting project for each category. http://xathrya.id/ 21
Disk Imaging & Hashing • To acquire disk image and verify the integrity. • Also to mount the image for analysis if necessary. • Challenges: multiple kind of media. • Some tools of trade: – dd – Ewfacquire – ssdeep http://xathrya.id/ 22
File Carving & Extraction • To extract data from image, hidden or not. • Challenges: multiple possible format. • Some tools: – Foremost – Bulk_Extractor http://xathrya.id/ 23
foremost http://xathrya.id/ 24
Bulk Extractor http://xathrya.id/ 25
File Analysis • Analyze a single file and determine what it is. • Binary, document, link,photo, video, email, etc. http://xathrya.id/ 26
Anti Malware • Check whether system is infected by malware. • Some tools: – rkhunter http://xathrya.id/ 27
Document Metadata Extraction • Has special purpose to analyze document and metadata extraction. • At this stage, only PDF and photo (EXIF) available. http://xathrya.id/ 28
Memory Analysis • Analyze memory dump and determine various state an operating system in. • Some tools: – Volatility http://xathrya.id/ 29
Network Forensic • Analyze network traffic and draw conclusion about what happen in network from log (mainly). • Some tools: – Tshark (from Wireshark suite). – Xplico http://xathrya.id/ 30
Mobile Forensics • Acquire and analysis artefact from mobile phone. http://xathrya.id/ 31
Log Analysis • Analyze various logs produced by system. • In this stage, only Windows Event Log tools included. • Some Tools: – evtkit http://xathrya.id/ 32
Password Recovery • Obtain password from locked system / archive. • Might need table to do so. http://xathrya.id/ 33
How to Contribute? • dracOs is open source project. • Still far from perfect. • Anyone can contribute. – Report bug – Give suggestion for what should be included (and why this awesome tools are needed). – Test installation of a software on dracOs. – Be a package maintainer for dracOs ecosystem. – Use dracOs for forensic and let us know. – Spread the word! http://xathrya.id/ 34
Question?

Recommended

(Workshop) Memory Forensic - Investigating Memory Artefact
(Workshop) Memory Forensic - Investigating Memory Artefact(Workshop) Memory Forensic - Investigating Memory Artefact
(Workshop) Memory Forensic - Investigating Memory Artefact
Satria Ady Pradana
 
Memory Forensic - Investigating Memory Artefact
Memory Forensic - Investigating Memory ArtefactMemory Forensic - Investigating Memory Artefact
Memory Forensic - Investigating Memory Artefact
Satria Ady Pradana
 
Path of Cyber Security
Path of Cyber SecurityPath of Cyber Security
Path of Cyber Security
Satria Ady Pradana
 
Web Security Workshop : A Jumpstart
Web Security Workshop : A JumpstartWeb Security Workshop : A Jumpstart
Web Security Workshop : A Jumpstart
Satria Ady Pradana
 
(Training) Malware - To the Realm of Malicious Code
(Training) Malware - To the Realm of Malicious Code(Training) Malware - To the Realm of Malicious Code
(Training) Malware - To the Realm of Malicious Code
Satria Ady Pradana
 
Another Side of Hacking
Another Side of HackingAnother Side of Hacking
Another Side of Hacking
Satria Ady Pradana
 
Malware analysis, threat intelligence and reverse engineering
Malware analysis, threat intelligence and reverse engineeringMalware analysis, threat intelligence and reverse engineering
Malware analysis, threat intelligence and reverse engineering
bartblaze
 
Hunting on the Cheap
Hunting on the CheapHunting on the Cheap
Hunting on the Cheap
EndgameInc
 

Recommended

(Workshop) Memory Forensic - Investigating Memory Artefact
(Workshop) Memory Forensic - Investigating Memory Artefact(Workshop) Memory Forensic - Investigating Memory Artefact
(Workshop) Memory Forensic - Investigating Memory Artefact
Satria Ady Pradana
 
Memory Forensic - Investigating Memory Artefact
Memory Forensic - Investigating Memory ArtefactMemory Forensic - Investigating Memory Artefact
Memory Forensic - Investigating Memory Artefact
Satria Ady Pradana
 
Path of Cyber Security
Path of Cyber SecurityPath of Cyber Security
Path of Cyber Security
Satria Ady Pradana
 
Web Security Workshop : A Jumpstart
Web Security Workshop : A JumpstartWeb Security Workshop : A Jumpstart
Web Security Workshop : A Jumpstart
Satria Ady Pradana
 
(Training) Malware - To the Realm of Malicious Code
(Training) Malware - To the Realm of Malicious Code(Training) Malware - To the Realm of Malicious Code
(Training) Malware - To the Realm of Malicious Code
Satria Ady Pradana
 
Another Side of Hacking
Another Side of HackingAnother Side of Hacking
Another Side of Hacking
Satria Ady Pradana
 
Malware analysis, threat intelligence and reverse engineering
Malware analysis, threat intelligence and reverse engineeringMalware analysis, threat intelligence and reverse engineering
Malware analysis, threat intelligence and reverse engineering
bartblaze
 
Hunting on the Cheap
Hunting on the CheapHunting on the Cheap
Hunting on the Cheap
EndgameInc
 
Docker and-daily-devops
Docker and-daily-devopsDocker and-daily-devops
Docker and-daily-devops
Satria Ady Pradana
 
Windows Threat Hunting
Windows Threat HuntingWindows Threat Hunting
Windows Threat Hunting
GIBIN JOHN
 
Autopsy Digital forensics tool
Autopsy Digital forensics toolAutopsy Digital forensics tool
Autopsy Digital forensics tool
Sreekanth Narendran
 
Anti forensics-techniques-for-browsing-artifacts
Anti forensics-techniques-for-browsing-artifactsAnti forensics-techniques-for-browsing-artifacts
Anti forensics-techniques-for-browsing-artifacts
gaurang17
 
Hunting on the cheap
Hunting on the cheapHunting on the cheap
Hunting on the cheap
Anjum Ahuja
 
Malware analysis
Malware analysisMalware analysis
Malware analysis
xabean
 
A journey into Application Security
A journey into Application SecurityA journey into Application Security
A journey into Application Security
Christian Martorella
 
Malware for Red Team
Malware for Red TeamMalware for Red Team
Malware for Red Team
Satria Ady Pradana
 
Hunting: Defense Against The Dark Arts - BSides Philadelphia - 2016
Hunting: Defense Against The Dark Arts - BSides Philadelphia - 2016Hunting: Defense Against The Dark Arts - BSides Philadelphia - 2016
Hunting: Defense Against The Dark Arts - BSides Philadelphia - 2016
Danny Akacki
 
IOCs for modern threat landscape-slideshare
IOCs for modern threat landscape-slideshareIOCs for modern threat landscape-slideshare
IOCs for modern threat landscape-slideshare
Sai Kesavamatham
 
Sigma and YARA Rules
Sigma and YARA RulesSigma and YARA Rules
Sigma and YARA Rules
Lionel Faleiro
 
ShmooCon 2015: No Budget Threat Intelligence - Tracking Malware Campaigns on ...
ShmooCon 2015: No Budget Threat Intelligence - Tracking Malware Campaigns on ...ShmooCon 2015: No Budget Threat Intelligence - Tracking Malware Campaigns on ...
ShmooCon 2015: No Budget Threat Intelligence - Tracking Malware Campaigns on ...
Andrew Morris
 
CNIT 121: 3 Pre-Incident Preparation
CNIT 121: 3 Pre-Incident PreparationCNIT 121: 3 Pre-Incident Preparation
CNIT 121: 3 Pre-Incident Preparation
Sam Bowne
 
Extracting the Malware Signal from Internet Noise
Extracting the Malware Signal from Internet NoiseExtracting the Malware Signal from Internet Noise
Extracting the Malware Signal from Internet Noise
Ashwini Almad
 
Malware analysis
Malware analysisMalware analysis
Malware analysis
Prakashchand Suthar
 
Defcon Crypto Village - OPSEC Concerns in Using Crypto
Defcon Crypto Village - OPSEC Concerns in Using CryptoDefcon Crypto Village - OPSEC Concerns in Using Crypto
Defcon Crypto Village - OPSEC Concerns in Using Crypto
John Bambenek
 
Incident response, Hacker Techniques and Countermeasures
Incident response, Hacker Techniques and CountermeasuresIncident response, Hacker Techniques and Countermeasures
Incident response, Hacker Techniques and Countermeasures
Jose L. Quiñones-Borrero
 
Unmasking Careto through Memory Forensics (video in description)
Unmasking Careto through Memory Forensics (video in description)Unmasking Careto through Memory Forensics (video in description)
Unmasking Careto through Memory Forensics (video in description)
Andrew Case
 
OSINT for Attack and Defense
OSINT for Attack and DefenseOSINT for Attack and Defense
OSINT for Attack and Defense
Andrew McNicol
 
Basic Malware Analysis
Basic Malware AnalysisBasic Malware Analysis
Basic Malware Analysis
Albert Hui
 
Tugas Akhir 13510030 - Analisis Keamanan Dalam Pengembangan Sistem Transaksi ...
Tugas Akhir 13510030 - Analisis Keamanan Dalam Pengembangan Sistem Transaksi ...Tugas Akhir 13510030 - Analisis Keamanan Dalam Pengembangan Sistem Transaksi ...
Tugas Akhir 13510030 - Analisis Keamanan Dalam Pengembangan Sistem Transaksi ...
Satria Ady Pradana
 
Defense of the assets
Defense of the assetsDefense of the assets
Defense of the assets
Satria Ady Pradana
 

More Related Content

What's hot

ShmooCon 2015: No Budget Threat Intelligence - Tracking Malware Campaigns on ...
ShmooCon 2015: No Budget Threat Intelligence - Tracking Malware Campaigns on ...ShmooCon 2015: No Budget Threat Intelligence - Tracking Malware Campaigns on ...
ShmooCon 2015: No Budget Threat Intelligence - Tracking Malware Campaigns on ...
Andrew Morris
 

What's hot (20)

Docker and-daily-devops
Docker and-daily-devopsDocker and-daily-devops
Docker and-daily-devops
 
Windows Threat Hunting
Windows Threat HuntingWindows Threat Hunting
Windows Threat Hunting
 
Autopsy Digital forensics tool
Autopsy Digital forensics toolAutopsy Digital forensics tool
Autopsy Digital forensics tool
 
Anti forensics-techniques-for-browsing-artifacts
Anti forensics-techniques-for-browsing-artifactsAnti forensics-techniques-for-browsing-artifacts
Anti forensics-techniques-for-browsing-artifacts
 
Hunting on the cheap
Hunting on the cheapHunting on the cheap
Hunting on the cheap
 
Malware analysis
Malware analysisMalware analysis
Malware analysis
 
A journey into Application Security
A journey into Application SecurityA journey into Application Security
A journey into Application Security
 
Malware for Red Team
Malware for Red TeamMalware for Red Team
Malware for Red Team
 
Hunting: Defense Against The Dark Arts - BSides Philadelphia - 2016
Hunting: Defense Against The Dark Arts - BSides Philadelphia - 2016Hunting: Defense Against The Dark Arts - BSides Philadelphia - 2016
Hunting: Defense Against The Dark Arts - BSides Philadelphia - 2016
 
IOCs for modern threat landscape-slideshare
IOCs for modern threat landscape-slideshareIOCs for modern threat landscape-slideshare
IOCs for modern threat landscape-slideshare
 
Sigma and YARA Rules
Sigma and YARA RulesSigma and YARA Rules
Sigma and YARA Rules
 
ShmooCon 2015: No Budget Threat Intelligence - Tracking Malware Campaigns on ...
ShmooCon 2015: No Budget Threat Intelligence - Tracking Malware Campaigns on ...ShmooCon 2015: No Budget Threat Intelligence - Tracking Malware Campaigns on ...
ShmooCon 2015: No Budget Threat Intelligence - Tracking Malware Campaigns on ...
 
CNIT 121: 3 Pre-Incident Preparation
CNIT 121: 3 Pre-Incident PreparationCNIT 121: 3 Pre-Incident Preparation
CNIT 121: 3 Pre-Incident Preparation
 
Extracting the Malware Signal from Internet Noise
Extracting the Malware Signal from Internet NoiseExtracting the Malware Signal from Internet Noise
Extracting the Malware Signal from Internet Noise
 
Malware analysis
Malware analysisMalware analysis
Malware analysis
 
Defcon Crypto Village - OPSEC Concerns in Using Crypto
Defcon Crypto Village - OPSEC Concerns in Using CryptoDefcon Crypto Village - OPSEC Concerns in Using Crypto
Defcon Crypto Village - OPSEC Concerns in Using Crypto
 
Incident response, Hacker Techniques and Countermeasures
Incident response, Hacker Techniques and CountermeasuresIncident response, Hacker Techniques and Countermeasures
Incident response, Hacker Techniques and Countermeasures
 
Unmasking Careto through Memory Forensics (video in description)
Unmasking Careto through Memory Forensics (video in description)Unmasking Careto through Memory Forensics (video in description)
Unmasking Careto through Memory Forensics (video in description)
 
OSINT for Attack and Defense
OSINT for Attack and DefenseOSINT for Attack and Defense
OSINT for Attack and Defense
 
Basic Malware Analysis
Basic Malware AnalysisBasic Malware Analysis
Basic Malware Analysis
 

Viewers also liked

Emirates Forensic Presentation
Emirates Forensic PresentationEmirates Forensic Presentation
Emirates Forensic Presentation
Emirates Forensic
 
Real time trade surveillance in financial markets
Real time trade surveillance in financial marketsReal time trade surveillance in financial markets
Real time trade surveillance in financial markets
Hortonworks
 

Viewers also liked (20)

Tugas Akhir 13510030 - Analisis Keamanan Dalam Pengembangan Sistem Transaksi ...
Tugas Akhir 13510030 - Analisis Keamanan Dalam Pengembangan Sistem Transaksi ...Tugas Akhir 13510030 - Analisis Keamanan Dalam Pengembangan Sistem Transaksi ...
Tugas Akhir 13510030 - Analisis Keamanan Dalam Pengembangan Sistem Transaksi ...
 
Defense of the assets
Defense of the assetsDefense of the assets
Defense of the assets
 
Android security by ravi-rai
Android security by ravi-raiAndroid security by ravi-rai
Android security by ravi-rai
 
Docker and Devops
Docker and DevopsDocker and Devops
Docker and Devops
 
Proof Of Concept (PoC) CTF Hack The Dragon Ultah Indonesian BackTrack Team 2015
Proof Of Concept (PoC) CTF Hack The Dragon Ultah Indonesian BackTrack Team 2015Proof Of Concept (PoC) CTF Hack The Dragon Ultah Indonesian BackTrack Team 2015
Proof Of Concept (PoC) CTF Hack The Dragon Ultah Indonesian BackTrack Team 2015
 
Emirates Forensic Presentation
Emirates Forensic PresentationEmirates Forensic Presentation
Emirates Forensic Presentation
 
Digital Forensic
Digital Forensic Digital Forensic
Digital Forensic
 
Cyber forensic readiness cybercon2012 adv j fick
Cyber forensic readiness cybercon2012 adv j fickCyber forensic readiness cybercon2012 adv j fick
Cyber forensic readiness cybercon2012 adv j fick
 
BDO Forensic Services
BDO Forensic ServicesBDO Forensic Services
BDO Forensic Services
 
MobilePolicing –Investing in Mobile Technology to Produce an Efficient and Ag...
MobilePolicing –Investing in Mobile Technology to Produce an Efficient and Ag...MobilePolicing –Investing in Mobile Technology to Produce an Efficient and Ag...
MobilePolicing –Investing in Mobile Technology to Produce an Efficient and Ag...
 
Raising performance in composites bonding - Highlight
Raising performance in composites bonding - HighlightRaising performance in composites bonding - Highlight
Raising performance in composites bonding - Highlight
 
M.Tech. Cyber Security & Incident Response
M.Tech. Cyber Security & Incident ResponseM.Tech. Cyber Security & Incident Response
M.Tech. Cyber Security & Incident Response
 
EC-Council Computer Hacking Forensic Investigator v9
EC-Council Computer Hacking Forensic Investigator v9EC-Council Computer Hacking Forensic Investigator v9
EC-Council Computer Hacking Forensic Investigator v9
 
Cyber fraud in banks
Cyber fraud in banksCyber fraud in banks
Cyber fraud in banks
 
Workshop Digital Forensic - Cyber Security Community
Workshop Digital Forensic - Cyber Security CommunityWorkshop Digital Forensic - Cyber Security Community
Workshop Digital Forensic - Cyber Security Community
 
Real time trade surveillance in financial markets
Real time trade surveillance in financial marketsReal time trade surveillance in financial markets
Real time trade surveillance in financial markets
 
Utilizing Internet for Fraud Examination and Investigation
Utilizing Internet for Fraud Examination and InvestigationUtilizing Internet for Fraud Examination and Investigation
Utilizing Internet for Fraud Examination and Investigation
 
Securing the Internet from Cyber Criminals
Securing the Internet from Cyber CriminalsSecuring the Internet from Cyber Criminals
Securing the Internet from Cyber Criminals
 
Lect 1 computer forensics
Lect 1 computer forensicsLect 1 computer forensics
Lect 1 computer forensics
 
Cybersecurity Risk Management for Financial Institutions
Cybersecurity Risk Management for Financial InstitutionsCybersecurity Risk Management for Financial Institutions
Cybersecurity Risk Management for Financial Institutions
 

Similar to Dracos forensic flavor

Computer Forensics – What Every Lawyer Needs to Know
Computer Forensics – What Every Lawyer Needs to KnowComputer Forensics – What Every Lawyer Needs to Know
Computer Forensics – What Every Lawyer Needs to Know
Winston & Strawn LLP
 
Hunting: Defense Against The Dark Arts v2
Hunting: Defense Against The Dark Arts v2Hunting: Defense Against The Dark Arts v2
Hunting: Defense Against The Dark Arts v2
Spyglass Security
 
Analisis Estatico y de Comportamiento de un Binario Malicioso
Analisis Estatico y de Comportamiento de un Binario MaliciosoAnalisis Estatico y de Comportamiento de un Binario Malicioso
Analisis Estatico y de Comportamiento de un Binario Malicioso
Conferencias FIST
 

Similar to Dracos forensic flavor (20)

Memory Forensic: Investigating Memory Artefact
Memory Forensic: Investigating Memory ArtefactMemory Forensic: Investigating Memory Artefact
Memory Forensic: Investigating Memory Artefact
 
Digital Forensics
Digital ForensicsDigital Forensics
Digital Forensics
 
Digital forensics
Digital forensicsDigital forensics
Digital forensics
 
Super Easy Memory Forensics
Super Easy Memory ForensicsSuper Easy Memory Forensics
Super Easy Memory Forensics
 
Path of Cyber Security
Path of Cyber SecurityPath of Cyber Security
Path of Cyber Security
 
Computer Forensics – What Every Lawyer Needs to Know
Computer Forensics – What Every Lawyer Needs to KnowComputer Forensics – What Every Lawyer Needs to Know
Computer Forensics – What Every Lawyer Needs to Know
 
5.2. Digital forensics
5.2. Digital forensics5.2. Digital forensics
5.2. Digital forensics
 
Computer Forensic Tools.pptx
Computer Forensic Tools.pptxComputer Forensic Tools.pptx
Computer Forensic Tools.pptx
 
Best Cyberforensic Tools.pdf
Best Cyberforensic Tools.pdfBest Cyberforensic Tools.pdf
Best Cyberforensic Tools.pdf
 
Hunting: Defense Against The Dark Arts v2
Hunting: Defense Against The Dark Arts v2Hunting: Defense Against The Dark Arts v2
Hunting: Defense Against The Dark Arts v2
 
Presentation cyber forensics & ethical hacking
Presentation cyber forensics & ethical hackingPresentation cyber forensics & ethical hacking
Presentation cyber forensics & ethical hacking
 
hacking techniques and intrusion techniques useful in OSINT.pptx
hacking techniques and intrusion techniques useful in OSINT.pptxhacking techniques and intrusion techniques useful in OSINT.pptx
hacking techniques and intrusion techniques useful in OSINT.pptx
 
Memory Forensics
Memory ForensicsMemory Forensics
Memory Forensics
 
CS426_forensics.ppt
CS426_forensics.pptCS426_forensics.ppt
CS426_forensics.ppt
 
CS426_forensics_tools to analyse and deve
CS426_forensics_tools to analyse and deveCS426_forensics_tools to analyse and deve
CS426_forensics_tools to analyse and deve
 
CS426_forensics.ppt
CS426_forensics.pptCS426_forensics.ppt
CS426_forensics.ppt
 
Draft current state of digital forensic and data science
Draft current state of digital forensic and data science Draft current state of digital forensic and data science
Draft current state of digital forensic and data science
 
ISACA Ethical Hacking Presentation 10/2011
ISACA Ethical Hacking Presentation 10/2011ISACA Ethical Hacking Presentation 10/2011
ISACA Ethical Hacking Presentation 10/2011
 
Analisis Estatico y de Comportamiento de un Binario Malicioso
Analisis Estatico y de Comportamiento de un Binario MaliciosoAnalisis Estatico y de Comportamiento de un Binario Malicioso
Analisis Estatico y de Comportamiento de un Binario Malicioso
 
Digital forensics
Digital forensicsDigital forensics
Digital forensics
 

More from Satria Ady Pradana

More from Satria Ady Pradana (8)

Rekayasa Balik - Sebuah Hikayat dari Dunia Digital
Rekayasa Balik - Sebuah Hikayat dari Dunia DigitalRekayasa Balik - Sebuah Hikayat dari Dunia Digital
Rekayasa Balik - Sebuah Hikayat dari Dunia Digital
 
The Offensive Python - Practical Python for Penetration Testing
The Offensive Python - Practical Python for Penetration TestingThe Offensive Python - Practical Python for Penetration Testing
The Offensive Python - Practical Python for Penetration Testing
 
From Reversing to Exploitation
From Reversing to ExploitationFrom Reversing to Exploitation
From Reversing to Exploitation
 
Android Security : A Hacker's Perspective
Android Security : A Hacker's PerspectiveAndroid Security : A Hacker's Perspective
Android Security : A Hacker's Perspective
 
Bypass Security Checking with Frida
Bypass Security Checking with FridaBypass Security Checking with Frida
Bypass Security Checking with Frida
 
(Workshop) Reverse Engineering - Protecting and Breaking the Software
(Workshop) Reverse Engineering - Protecting and Breaking the Software(Workshop) Reverse Engineering - Protecting and Breaking the Software
(Workshop) Reverse Engineering - Protecting and Breaking the Software
 
Reverse Engineering - Protecting and Breaking the Software
Reverse Engineering - Protecting and Breaking the SoftwareReverse Engineering - Protecting and Breaking the Software
Reverse Engineering - Protecting and Breaking the Software
 
Drac lab automatic malware analysis & repository
Drac lab automatic malware analysis & repositoryDrac lab automatic malware analysis & repository
Drac lab automatic malware analysis & repository
 

Recently uploaded

GraphAware - Transforming policing with graph-based intelligence analysis
GraphAware - Transforming policing with graph-based intelligence analysisGraphAware - Transforming policing with graph-based intelligence analysis
GraphAware - Transforming policing with graph-based intelligence analysis
Neo4j
 
JustNaik Solution Deck (stage bus sector)
JustNaik Solution Deck (stage bus sector)JustNaik Solution Deck (stage bus sector)
JustNaik Solution Deck (stage bus sector)
Max Lee
 
Mastering Windows 7 A Comprehensive Guide for Power Users .pdf
Mastering Windows 7 A Comprehensive Guide for Power Users .pdfMastering Windows 7 A Comprehensive Guide for Power Users .pdf
Mastering Windows 7 A Comprehensive Guide for Power Users .pdf
mbmh111980
 
AI/ML Infra Meetup | ML explainability in Michelangelo
AI/ML Infra Meetup | ML explainability in MichelangeloAI/ML Infra Meetup | ML explainability in Michelangelo
AI/ML Infra Meetup | ML explainability in Michelangelo
Alluxio, Inc.
 
Tree in the Forest - Managing Details in BDD Scenarios (live2test 2024)
Tree in the Forest - Managing Details in BDD Scenarios (live2test 2024)Tree in the Forest - Managing Details in BDD Scenarios (live2test 2024)
Tree in the Forest - Managing Details in BDD Scenarios (live2test 2024)
Gáspár Nagy
 
How To Build a Successful SaaS Design.pdf
How To Build a Successful SaaS Design.pdfHow To Build a Successful SaaS Design.pdf
How To Build a Successful SaaS Design.pdf
ayushiqss
 
Corporate Management | Session 3 of 3 | Tendenci AMS
Corporate Management | Session 3 of 3 | Tendenci AMSCorporate Management | Session 3 of 3 | Tendenci AMS
Corporate Management | Session 3 of 3 | Tendenci AMS
Tendenci - The Open Source AMS (Association Management Software)
 
AI/ML Infra Meetup | Improve Speed and GPU Utilization for Model Training & S...
AI/ML Infra Meetup | Improve Speed and GPU Utilization for Model Training & S...AI/ML Infra Meetup | Improve Speed and GPU Utilization for Model Training & S...
AI/ML Infra Meetup | Improve Speed and GPU Utilization for Model Training & S...
Alluxio, Inc.
 

Recently uploaded (20)

Top Mobile App Development Companies 2024
Top Mobile App Development Companies 2024Top Mobile App Development Companies 2024
Top Mobile App Development Companies 2024
 
Benefits of Employee Monitoring Software
Benefits of Employee Monitoring SoftwareBenefits of Employee Monitoring Software
Benefits of Employee Monitoring Software
 
WSO2Con2024 - WSO2's IAM Vision: Identity-Led Digital Transformation
WSO2Con2024 - WSO2's IAM Vision: Identity-Led Digital TransformationWSO2Con2024 - WSO2's IAM Vision: Identity-Led Digital Transformation
WSO2Con2024 - WSO2's IAM Vision: Identity-Led Digital Transformation
 
GraphAware - Transforming policing with graph-based intelligence analysis
GraphAware - Transforming policing with graph-based intelligence analysisGraphAware - Transforming policing with graph-based intelligence analysis
GraphAware - Transforming policing with graph-based intelligence analysis
 
AI/ML Infra Meetup | Perspective on Deep Learning Framework
AI/ML Infra Meetup | Perspective on Deep Learning FrameworkAI/ML Infra Meetup | Perspective on Deep Learning Framework
AI/ML Infra Meetup | Perspective on Deep Learning Framework
 
JustNaik Solution Deck (stage bus sector)
JustNaik Solution Deck (stage bus sector)JustNaik Solution Deck (stage bus sector)
JustNaik Solution Deck (stage bus sector)
 
Facemoji Keyboard released its 2023 State of Emoji report, outlining the most...
Facemoji Keyboard released its 2023 State of Emoji report, outlining the most...Facemoji Keyboard released its 2023 State of Emoji report, outlining the most...
Facemoji Keyboard released its 2023 State of Emoji report, outlining the most...
 
Paketo Buildpacks : la meilleure façon de construire des images OCI? DevopsDa...
Paketo Buildpacks : la meilleure façon de construire des images OCI? DevopsDa...Paketo Buildpacks : la meilleure façon de construire des images OCI? DevopsDa...
Paketo Buildpacks : la meilleure façon de construire des images OCI? DevopsDa...
 
Mastering Windows 7 A Comprehensive Guide for Power Users .pdf
Mastering Windows 7 A Comprehensive Guide for Power Users .pdfMastering Windows 7 A Comprehensive Guide for Power Users .pdf
Mastering Windows 7 A Comprehensive Guide for Power Users .pdf
 
A Python-based approach to data loading in TM1 - Using Airflow as an ETL for TM1
A Python-based approach to data loading in TM1 - Using Airflow as an ETL for TM1A Python-based approach to data loading in TM1 - Using Airflow as an ETL for TM1
A Python-based approach to data loading in TM1 - Using Airflow as an ETL for TM1
 
AI/ML Infra Meetup | ML explainability in Michelangelo
AI/ML Infra Meetup | ML explainability in MichelangeloAI/ML Infra Meetup | ML explainability in Michelangelo
AI/ML Infra Meetup | ML explainability in Michelangelo
 
A Guideline to Gorgias to to Re:amaze Data Migration
A Guideline to Gorgias to to Re:amaze Data MigrationA Guideline to Gorgias to to Re:amaze Data Migration
A Guideline to Gorgias to to Re:amaze Data Migration
 
Tree in the Forest - Managing Details in BDD Scenarios (live2test 2024)
Tree in the Forest - Managing Details in BDD Scenarios (live2test 2024)Tree in the Forest - Managing Details in BDD Scenarios (live2test 2024)
Tree in the Forest - Managing Details in BDD Scenarios (live2test 2024)
 
How Does XfilesPro Ensure Security While Sharing Documents in Salesforce?
How Does XfilesPro Ensure Security While Sharing Documents in Salesforce?How Does XfilesPro Ensure Security While Sharing Documents in Salesforce?
How Does XfilesPro Ensure Security While Sharing Documents in Salesforce?
 
How To Build a Successful SaaS Design.pdf
How To Build a Successful SaaS Design.pdfHow To Build a Successful SaaS Design.pdf
How To Build a Successful SaaS Design.pdf
 
Corporate Management | Session 3 of 3 | Tendenci AMS
Corporate Management | Session 3 of 3 | Tendenci AMSCorporate Management | Session 3 of 3 | Tendenci AMS
Corporate Management | Session 3 of 3 | Tendenci AMS
 
KLARNA - Language Models and Knowledge Graphs: A Systems Approach
KLARNA - Language Models and Knowledge Graphs: A Systems ApproachKLARNA - Language Models and Knowledge Graphs: A Systems Approach
KLARNA - Language Models and Knowledge Graphs: A Systems Approach
 
Crafting the Perfect Measurement Sheet with PLM Integration
Crafting the Perfect Measurement Sheet with PLM IntegrationCrafting the Perfect Measurement Sheet with PLM Integration
Crafting the Perfect Measurement Sheet with PLM Integration
 
top nidhi software solution freedownload
top nidhi software solution freedownloadtop nidhi software solution freedownload
top nidhi software solution freedownload
 
AI/ML Infra Meetup | Improve Speed and GPU Utilization for Model Training & S...
AI/ML Infra Meetup | Improve Speed and GPU Utilization for Model Training & S...AI/ML Infra Meetup | Improve Speed and GPU Utilization for Model Training & S...
AI/ML Infra Meetup | Improve Speed and GPU Utilization for Model Training & S...
 

Dracos forensic flavor

  • 1. dracOs Forensic Flavor Satria Ady Pradana http://xathrya.id/ 1
  • 2. # whoami? • Satria Ady Pradana – Junior Security Analyst at MII – Researcher at dracOS Dev Team – Interest in low level stuffs http://xathrya.id/ 2
  • 3. Here Comes, dracOs • A lightweight and powerful linux distribution. • Built from scratch. • A research for all. • A linux not only for penetration testing but cyber-security related activity, including digital forensic. http://xathrya.id/ 3
  • 4. The State of Forensic in dracOs • Current – Integrating modern open-source forensics tools to dracOs. – Creating guide and “how to” for using dracOs and its tools. • Next plan – Live CD for forensic acquisition and analysis. – Develop tools for forensic. – Open research discussion. http://xathrya.id/ 4
  • 5. What is Digital Forensic? • Forensic – scientific process in collecting, preserving, analyzing evidence during the course of an investigation. • Digital Forensic – branch of forensic where the object of investigation is electronic especially digital data. • Preservation, identification, extraction, interpretation, and documentation of digital evidence which can be used in the court of law. http://xathrya.id/ 5
  • 6. The Essence of Digital Forensic • Solving a puzzle. • Reconstruct an event or draw a conclusion from evidence. – Financial fraud. – Hacking / security breach. – Crimes using electronic / cyber. http://xathrya.id/ 6
  • 7. Forensic Stages Commonly consists of 3 stages: • Acquisition • Analysis • Reporting http://xathrya.id/ 7
  • 8. Acquisition • Collecting and preserving the evidence. • Duplicate the source of evicende (ex: disk, flash drive, sd card, RAM). • Ensure integrity of data in certain level. http://xathrya.id/ 8
  • 9. Analysis • Examine the content of source. • Identify evidence that either supports or contradicts a hypothesis or for sign of tampering (to hide data). • Should be able to be reproduced by other examiner. http://xathrya.id/ 9
  • 10. Some Question to Address • What files / artefacts have been deleted from digital device? • What other digital devices has been connected to this system? • Was this system attacked or modified by someone over the network? • Can we know how the breach happen? • Can a remote system or user be located or identified? • What sites on internet were visited by this system? • Was this audio-recording altered? http://xathrya.id/ 10
  • 11. • Was this image counterfeit? • Can this image / video-recording be enhanced to help identify someone? • Can the physical characteristics of an object in photograph be determined? • Can individuals be determined? • Can unknown victims be located or identified based on phone number, email, etc? • Can pattern of offender activity related to the investigation be reconstructed? • etc http://xathrya.id/ 11
  • 12. Analysis Category At dracOs research, we divide the fields of techniques and analysis to several categories: • By device type • By volatility • By format type http://xathrya.id/ 12
  • 13. By Device Type • Computer (desktop, laptop) • Mobile device (cell phone, tablet, PDAs) • Embedded & IoT http://xathrya.id/ 13
  • 14. By Volatility of Source • Memory • Disk (HDD, SSD, SD card, ...) http://xathrya.id/ 14
  • 15. By Format Type • Network (traffic and activity on network) • Logs (server log, event log, ...) • Database (database and related metadata) • Document • Image forensic (digital picture analysis) • Video forensic (digital video analysis) • Audio forensic http://xathrya.id/ 15
  • 16. Anti-Forensic • Data hiding • Artefact wiping • Trail obfuscation • Attack against Forensic Process or Tools http://xathrya.id/ 16
  • 17. Role of Linux & FOSS • Open Source bring openness to the idea and knowledge. – Transparency, all source code can be reviewed and openly validated. • Knowledge not depends on region, funding, and level of country development. • Encourage collaborative moves. http://xathrya.id/ 17
  • 18. Perception of Linux by Gov • Linux is HARD – CLI stuffs – Too many commands, hard to remember • Not easy to get started • Not many professional (and easy) tools available. Is it? http://xathrya.id/ 18
  • 19. drac0s offers? • Arsenal of open source tools, for acquisition and analysis. • The power of open source and linux with DIY flavor. http://xathrya.id/ 19
  • 20. Tools Category (so far) • Disk Imaging & Hashing • Data Carving & Extraction • File Analysis • Antimalware • Document Metadata Extraction • Memory Analysis • Network Forensic • Mobile Forensic http://xathrya.id/ 20
  • 21. In current state, most tools are analysis tools. We are working for acquisition. Some tools might not be mentioned due to limited time. We mention only most interesting project for each category. http://xathrya.id/ 21
  • 22. Disk Imaging & Hashing • To acquire disk image and verify the integrity. • Also to mount the image for analysis if necessary. • Challenges: multiple kind of media. • Some tools of trade: – dd – Ewfacquire – ssdeep http://xathrya.id/ 22
  • 23. File Carving & Extraction • To extract data from image, hidden or not. • Challenges: multiple possible format. • Some tools: – Foremost – Bulk_Extractor http://xathrya.id/ 23
  • 26. File Analysis • Analyze a single file and determine what it is. • Binary, document, link,photo, video, email, etc. http://xathrya.id/ 26
  • 27. Anti Malware • Check whether system is infected by malware. • Some tools: – rkhunter http://xathrya.id/ 27
  • 28. Document Metadata Extraction • Has special purpose to analyze document and metadata extraction. • At this stage, only PDF and photo (EXIF) available. http://xathrya.id/ 28
  • 29. Memory Analysis • Analyze memory dump and determine various state an operating system in. • Some tools: – Volatility http://xathrya.id/ 29
  • 30. Network Forensic • Analyze network traffic and draw conclusion about what happen in network from log (mainly). • Some tools: – Tshark (from Wireshark suite). – Xplico http://xathrya.id/ 30
  • 31. Mobile Forensics • Acquire and analysis artefact from mobile phone. http://xathrya.id/ 31
  • 32. Log Analysis • Analyze various logs produced by system. • In this stage, only Windows Event Log tools included. • Some Tools: – evtkit http://xathrya.id/ 32
  • 33. Password Recovery • Obtain password from locked system / archive. • Might need table to do so. http://xathrya.id/ 33
  • 34. How to Contribute? • dracOs is open source project. • Still far from perfect. • Anyone can contribute. – Report bug – Give suggestion for what should be included (and why this awesome tools are needed). – Test installation of a software on dracOs. – Be a package maintainer for dracOs ecosystem. – Use dracOs for forensic and let us know. – Spread the word! http://xathrya.id/ 34