The document discusses two methods for providing access to forensic disk images in a web service: 1) Emulation as a Service (bwFLA) which implements a QEMU emulator to access disk images and allows booting or mounting images in an emulated environment via a web interface. 2) BitCurator Access Webtools which uses digital forensics libraries to synthesize a view of file systems and data within disk images and provides a web interface for selectively accessing content. Both aim to simplify access while maintaining protections for disk image integrity and allowing redaction of sensitive content.

1. Functional Access to Forensic Disk
Images in a Web Service
Presenter: Kam Woods
UNC School of Information
and Library Science
Authors: Kam Woods, Cal Lee, Oleg Stobbe, Thomas Liebetraut, Klaus Rechert
iPRES 2015
November 3, 2015
Chapel Hill, NC
The Andrew W. Mellon Foundation
1

2. Capturing disk images from legacy digital media is an
increasingly common practice in collecting institutions
2

3. A noted criticism: “Disk imaging only addresses a slice of the
problem, and may ‘mask out’ other preservation issues”.
• Physical decay and obsolescence
• Format obsolescence
• Format identification and
verification
• Rendering old formats with
modern tools
• Identifying and reporting on
private and sensitive information
• Metadata management
• Storage
• Providing access
3
Source: “Digital Forensics and creation of a
narrative.” Da Blog: ULCC Digital Archives
Blog.
http://dablog.ulcc.ac.uk/2011/07/04/forensics/

4. Simplifying access supports high quality preservation
outcomes
4
• Forensically packaged disk images include protections
against bit-rot and package metadata that support
records of provenance and fixity
– Yet many common file
system processing tools
can’t talk to these images
directly
– Redacting or limiting
access to specific items
within disk images may
also be required

5. Forensic disk imaging and metadata extraction provides
clear provenance for redacted access copies
5
Acquire disk image from
original media
Identify items to
redact
Generate redacted
disk image and/or files
Report on redacted items for
preservation record
Access

6. Access copies may not always be the right (or most
desirable) approach
6
Original file
(unredacted in
disk image)
File object identified in disk image
and recorded in a forensic
metadata format (DFXML)
Redacted
access views
PII identified at
byte offsets

7. Two methods of access
7
Browsing the unmounted disk image
(including non-file system elements)
in a web interface
Interacting with bootable /
mountable file systems via EaaSin a
web interface

8. Two methods of access
8
• bwFLA – Emulation as a Service implements a
QEMU block-level driver to access EWF-format
images (a common forensic packaging format)
– Alterations to the booted or mounted image
are written to an overlay and discarded after
the session
– Read operations may be similarly intercepted
by this overlay, preventing access to specific
files and file system contents
– Deployment via Docker or bare metal
• BitCurator Access Webtools uses an open source
forensic image access library to synthesize a view
into file system and other data contained within
the disk image, selectively allowing access
– Deployment via Vagrant or bare metal

9. Emulation as a Service (bwFLA)
9

10. Emulation as a Service (bwFLA)
10

11. Emulation as a Service (bwFLA)
11

12. Emulation as a Service (bwFLA)
12
• Each disk image is described in an associated XML metadata document:
<emulationEnvironment xmlns="http://bwfla.bwl.de/common/datatypes">
<id>2010</id>
<description><title>Microsoft DOS 6.20 (CD-ROM)
E01</title></description>
<arch>i386</arch>
<emulator bean="Qemu” >
…
<drive>
<data></data>
<iface>ide</iface>
<bus>0</bus>
<unit>1</unit>
<type>cdrom</type>
<boot>false</boot>
<filesystem>ISO</filesystem>
</drive
…
<binding id="main_hdd">
<url>imagearchive:qemu-i386-DOS_6.20_CDROM.E01</url>
<access>cow</access>
</binding>
</emulationEnvironment>

13. Emulation as a Service (bwFLA)
13

14. Web access to disk images: (bca-webtools)
14
Using lightweight web service tools along with digital forensics libraries to
produce easy-to-use navigation and management interfaces for disk images
via a web browser.

15. Web access to disk images: (bca-webtools)
15

16. Web access to disk images: (bca-webtools)
16

17. Synthesizing file system views to present redacted contents
without altering the original file system
17
Acquisition and forensic
processing
Sensitive information linked
to files within file system
Web page displays file
system view; links to
redacted materials
download from alternate
storage

18. Find out more about bw-FLA / Eaas and BitCurator Access
online
BitCurator Access software and
documentation
http://access.bitcurator.net/
https://github.com/bitcurator/bca-
webtools
18
bwFLA / EaaS software and
documentation
http://bw-fla.uni-freiburg.de/
https://github.com/eaas-framework

19. Questions
19
?

20. 20
Bca-webtools a prototype to demonstrate integrating digital forensics
forensics software libraries and lightweight webservices tools. Drop your disk
images in a local or network-accessible location, start up the service, and start
browsing.
https://github.com/bitcurator/bca-webtools
• Most analysis runs server-
side (via Sleuthkit and
DFXML Python bindings,
among others)
• Service is database-agnostic
(we use postgres)
• Automatic metadata
production (DFXML,
PREMIS, others)