When you're broke.
Lots of companies or organizations, public organizations like the one I work for, are dealing with budget constraints now.
It's a very real thing.
You need a tool, or you think you need a tool, and it costs a lot of money.
And how do you get that job done?
You need people that are knowledgeable, problem solvers that can come up with those kinds of solutions.
And after all my experience in the field, and poking around a bit, playing around with different stuff, I believe I found quite a few tools out there that can pretty much get the job of forensics done for a company.
Which is kind of amazing that you don't have to pay $5,000 for something.
So another thing, another thing I wanted to, a group of people I wanted to speak to, or anybody that's new to forensics, thinking about getting into forensics, I wanted to speak to them too.
Because I want to show you what the forensic process looks like, what it's all about, what you're actually striving to do, and what kind of tools are out there for each step of the way.
So I hope you guys get something out of that.
This isn't like a, this isn't a presentation about, you know, listing all the free tools out there and, you know, training you on how to do them.
This is just a, you know, this is what computer forensics looks like.
These are the things you need to watch out for.
And here's some tools along the way that can help you get each step of the process done.
And I'm also going to demonstrate a few of those things.
They're pretty simple demos.
You'll see them along the way.
So yeah, let's get into the meat of it.
So the goals of forensics.
What do you think the goal of forensics is?
This is, I want to make this like an interactive class too.
So feel free to raise your hand, okay?
What's forensics?
I mean, you can think like CSI, whatever.
Yeah.
Evidence.
Evidence is definitely part of it.
What's the, what's the aim of forensics?
Figuring out what happened.
Good.
Those are, those are good accurate answers.
Some people think that forensics is, oh you're trying to, you know, you're trying to analyze evidence to prove a point.
I don't like that answer.
I don't like that answer at all.
I don't think forensics is about proving points.
I think forensics is about reviewing the evidence and presenting the facts of a case.
And points can be made based off those facts.
So yeah, good answers.
So yeah, you're trying to answer the who, what, when, why, and how, those kinds of questions.
We're gonna go into the process of forensics more, but basically the way it works is you're gonna start out, somebody's gonna have a question about something.
So for example, let's say I'm working at the university and, you know, somebody says that, oh so-and-so down the hall had, you know, nude ladies up on a screen last week or something like that.
Well that rolls down to me and that's an allegation .
That's got a specific, you know, time and date stamped on it for me.
And so my goal at that point is to say, you know, did he look at that stuff at that point in time and present the facts around that.
So that's kind of an example of something you'd be seeing.
So like I said, explicit content.
Another really practical one for like enterprise-wide environments is if you have a SIM and you receive some kind of alert that there's malicious activity on whatever segment of your network.
It's, you know, just blowing up traffic or whatever and it's coming from this IP address.
That's another thing that I would go and analyze.
I try to see what's on the, what's on that box, what's causing it and preserve the evidence there.
So those are the goals of forensics.
The process.
This, I came up with this.
This isn't like the official forensic process.
This is just like, this is what I do every time.
Every time I work on a case, this is what I do.
Starts out with communication.
What I mean by that is, it starts somewhere.
You know, someone asks for my service.
Someone's gonna ask for, if any forensic examiners are out there, they're gonna ask for your service to help you answer a question.
So that's, that's kind of what I mean by communication.
You might receive a telephone call asking you to do something, that kind of thing.
So you got the first alert.
Preserving the evidence.
I would argue that preserving the evidence is probably the most important part of the forensic process.
And why is that?
What happens, what happens if I get it wrong?
What happens if I don't preserve the evidence properly?
Yeah.
The whole, I mean, that's the foundation.
That's the foundation of your investigation.
The integrity is just shot.
The credibility is out the window.
If you do it wrong, then, you know, down the road, if you end up in litigation and you got to stand before a judge, like, what are you gonna say?
What are you gonna say about the integrity of an evidence, of the evidence?
What's the attorney on the other side gonna say about you?
You know?
I'll get into, I'll get into that.
I'm gonna go, so you can line out in more details about exactly what I mean with that and do some demos on that.
All right.
So, yeah.
Let's move on.
Oh, I'm sorry.
Actually, yeah.
Processing it.
The evidence that you preserve it and then you process it.
Processing has specific goals in mind.
I'm gonna get into that.
You analyze the evidence to try to answer the questions.
And then, lastly, you're gonna report the findings to the person who asked you to do it in the first place.
That's the forensic process in a nutshell.
All right.
Preserving the evidence.
Look like that got more powerful.
So, we already talked about why we do it, why it's important.
There's some free tools out there.
FTK Imager, Forensic Linux Distribution, such as CAIN, which stands for the Computer Aided Investigative Environment.
Volatility and Redline are also wonderful tools.
Preserving the evidence.
Yeah, important.
Credibility there.
I want to talk about a couple concepts, forensic concepts.
Right-blocking.
Does anybody know what right-blocking is?
I'm assuming we have... we've got newbies here.
We've got, you know, middle of the road.
We've got seasoned veterans.
So, can somebody answer what's right-blocking?
Yeah, back there.
Right.
Right, yeah.
So, right-blocking.
It's, yeah, it's exactly what it sounds like.
You're blocking the ability to write to the piece of evidence.
Not possible in all scenarios.
I would probably use the example of cell phone forensics as one.
That's not always possible to do that.
So, yeah.
What was I gonna say?
Sorry.
So, FTK Imager is a good tool to create a forensic image of something that's right-blocked.
So, forensics.
Thinking about traditional forensics and handling a crime scene per se.
You wouldn't just go walking around on a crime scene moving things around.
You wouldn't be placing new things on the crime scene.
And that's essentially why we're using a right-blocker.
We don't want to change anything about the piece of evidence because it's, like I said, the whole foundation of our investigation.
Some Linux distributions.
I mentioned Kane.
It's just a personal favorite of mine.
There's other ones out there.
Kane is a forensic Linux distribution that enables right-blocking by default when you boot into it.
So, for example, let's say I have a laptop that has a solid-state drive.
You know, one of those that's, it's like, it looks like a little, I'm not a hardware guy.
Looks like a memory stick almost and doesn't interface well with traditional SATA interfaces.
I'm not really able to plug that in to anything.
So, what I would do in that scenario is I would boot into something like Kane or another Linux distribution just off the laptop itself.
And it's gonna right-block everything and then I'm gonna plug in an external drive to it and I'm gonna image it.
That's just how it goes.
Speaking of imaging, does anyone know what forensic imaging is?
Back.
You're not saying it?
Okay.
Yep.
Right, yeah.
So, in traditional crime scenes you see the forensic guys, I'm just gonna call them, taking pictures and stuff of the evidence, you know, putting numbers by the evidence and whatnot.
We're creating a forensic image of a hard drive or whatever the digital device is and we're, yeah, making an exact bit-by-bit copy of that hard drive, preserving it exactly how it was.
So, yeah, that's what forensic imaging is.
A couple other tools I listed there, volatility and redline.
Those come into play for memory forensics and that's just a whole another ballgame.
We're gonna be talking more about just doing traditional hard drive forensics today and doing my labs through that.
But if you know anything about memory, RAM, whatever you want to call it, it's a volatile piece of evidence.
That means as soon as you turn that computer off, you've cleared out the memory.
And I won't go into, you know, all the tricks that you can do to actually preserve the actual memory using like freezing techniques and whatnot.
But for all intents and purposes, the data is lost once the device gets turned off.
So, yeah, so let's take a look at a demo.
I'm just gonna turn the mic off here and going to fire up FTK Imager.
Really simple demo, but I just wanted to show you like how easy it is to use a free tool like FTK Imager to create a forensic image of a hard drive.
But, you know, saying that we're using a write blocker and that's the whole foundation of our investigation.
I'm just going to show you how easy it is to just do it right.
So,
yes, that's a really good question.
How do software write blockers compared to hardware write blockers?
I've played around with that a little bit.
I haven't actually used like a paid piece of software.
It's my first inclination to go with a hardware write blocker every time, because that just kind of leaves, you know, bugs and things out of the scenario for the most part.
If it's just cutting it off at the hardware level, I feel much more comfortable about that.
So if I don't have that capability of having a hardware write blocker, I would try to implement a technique like booting into a Linux distribution where, you know, the policy is just set in the Linux distro to automatically write block.
I've played with things where, you know, it's changed, you know, one bit in the Windows registry to turn off the ability to write to USB drives.
It seemed to have worked in my testing.
I just don't have 100% confidence in that though.
So I hope that answers your question.
All right, let's get into the lab.
All right, so FTK Imager.
We got it going on here.
I am basically just going to go file and basically say create a disk image.
We're creating an image of a hard drive, whatever.
I'm going to select physical disk.
I might run over on time if I keep asking questions like this.
What's the difference between a physical drive and a logical drive?
Can someone answer that?
Yes.
They're partitions, yes.
So you'd be taking a forensic image of a partition, not the actual whole or everything that's on the physical hard drive.
So we want physical drive.
So we're just going to select that.
All right, so we've got the physical drives listed there.
We would then find our piece of evidence here that we're dealing with.
You would see, you know, physical drive, zero, one, two, three, four, five, whatever, however many drives you have.
And you would pick the most relevant one.
Hit finish.
It's going to ask you where you want to put the forensic image and what format you'd like to store it in.
It gives you a few options here.
You have the ability to store it in just a raw, as a raw DD image.
That's just, this is bit by bit everything that's on the disk.
There's no compression, nothing like that.
So if you have a two terabyte drive you are doing a forensic image of, your raw forensic image is two terabytes as well.
So you got to be smart about that.
Typically the formats you're going to see are raw DD and E01 formats.
The E01 format is the NCASE witness format and it has compression capabilities.
You can do just a little bit of a compression and all the way to super crazy and that will change how long it takes for your forensic image to be made.
So we're just going to select raw.
At this point you're going to see, it's going to ask you for case number, evidence number, description, your damner name, all that kind of stuff.
It's good to try to fill in as much as you can.
Especially if you have to produce a forensic image to the other side in the courtroom and they would like to penalize it, they will care about this kind of documentation.
Next, select the destination, give it a name, and you're finished.
And it's good.
And that's all there is to it.
That's all there is to creating a forensic image there.
Okay, as you can see it's very simple.
Processing the evidence.
So this is really where I think the experience in forensics training comes into play.
Because you're trying to figure out, okay, what kind of question am I answering here?
What's the whole reason I'm doing this case?
Like we said, are we looking for, you know, explicit content on somebody's computer on a certain date?
That's the goal of my investigation.
Am I going to check and see that, is there this kind of activity on that date?
So by reviewing the goals and trying to remember them, you're setting yourself up to process the evidence in an efficient way.
Give me a second here.
Okay.
So some tools to do this.
Free tools.
You can write them down if you want.
Locked timeline.
Redline.
Volatility.
I mentioned those already.
Red Ripper.
Wireshark.
Snort.
Scalpel.
Photoreq.
Clam AV.
Virus Total.
And Lime.
So obviously I'm not taking credit for any of these these tools whatsoever.
There's amazing authors out there in the forensic community.
Some of which I can't even pronounce their names, like Logged Timeline.
So some of the concepts I want to go over.
Timeline analysis.
Why would you think this is important?
Yeah, you're just trying to prove, did something happen at a certain time on a computer?
It also, for example, if we're dealing with like a piece of malware or something, you might see a series of events occur on a computer.
In which case, timeline analysis is super helpful for trying to figure out the whole story of that piece of malware.
Delete file recovery.
I hope that we all know that when we delete something on a hard drive, it's not gone forever.
Metadata analysis.
We're reviewing pieces of information about a specific file.
So a piece of metadata would be like a timestamp, like the created time of a file , the modification time of a file.
Those could be important.
Worked on a case where there was someone trying to forge a will to gain sole ownership over a company that this guy was passing along in his will.
So he's trying to forge a will.
Just simple metadata analysis right there on a PDF file.
Who the author was, when was the last modified time of it, the creation time of it.
Just answering simple questions and that's, you know, what helps solve the case.
Memory forensics.
We talked about that.
Capturing.
Instead of doing like a forensic image of a hard drive, you would basically be capturing the live memory of a computer and performing forensics on it after you captured it.
Tools like volatility and redline can assist you in that.
Even FTK imager can actually done memory.
Network forensics.
That's usually important when you're dealing with a piece of malware and you have an outbreak on your network of an infection and you're trying to see what's communicating with what.
Data exfiltration could possibly be seen by network forensics as well.
And lastly file carving.
Does anybody know what file carving is?
Yeah.
File carving.
Yeah.
Go ahead.
Sure.
So, and one of the examples I have of a file carver is scalpel and photorec.
So, the way file carving works is you have to kind of think, okay, what is a file?
What is file?
Like how does the computer know what an Excel file is?
How does a computer know what a PDF document is?
Or so on so forth.
Has anyone heard of the magic numbers at all?
Yeah.
Magic numbers.
So, I don't call them magic numbers.
I usually call them headers and trailers.
Hexadecimal numbers that will identify the signature of a file type.
So, it helps the operating system know how like what is an Excel file?
What's a PDF file?
So, these tools like scalpel and photorec, they use the magic numbers to scan your the hard disk or whatever whatever piece of evidence you're working with.
Find matches for those and then pull them out.
Carve them out.
So, what could you do with that?
I mean, if you have lots of deleted files on a computer and you're not able to recover them by conventional means, you can carve them out based on their file signatures.
They're still there if they haven't been overwritten by other data on the hard drive.
So, goodness gracious.
So, let's do let's do a demo of log to timeline real quick.
We're just gonna do a quick timeline generation.
Okay, so this is how easy it is.
So, I want to make a timeline of all of the data on a computer.
It's it's seriously just one command there.
So, I'm using, you may notice that the command says, hopefully that's easy to see for you guys, it says psteel.exe.
Log to timeline is actually a part of a set of tools called the Plazo tools.
I believe that's how you pronounce it.
Psteel is one particular piece of functionality from log to timeline.
Basically, you're just saying that I want you to generate the entire timeline of absolutely everything on this piece of evidence.
Whereas log to timeline, you might be able to customize it a little bit more.
Say, I only want artifacts in the Windows system 32 folder or something like that.
And it'll generate a timeline based on that.
Psteel.exe, it's just saying, the full kitchen sink, give it all to me.
So, commands just psteel.exe dash dash source, tell where my piece of evidence is.
And then, dash W, I tell it where I want to output just a text file in CSV format.
So, here we go.
So, this
is what you end up with.
It's gonna spit out a CSV file.
It's gonna just, you have these different headers for the columns here.
You got the time stamp, time stamp description.
It's gonna tell you, what does that even mean?
Where is it getting this time stamp from?
The source, is it just file system metadata like creation time, the file last access time?
Or if you go down here, let's see.
There's different types of metadata and it will kind of list them out.
It says meta, yeah, so there you go.
Tells you the source there, tells you the message.
So, the message is kind of just like, let me expand it out here.
It's gonna be like the name of a file, a little bit of information there.
So, this particular file is a PowerPoint file.
So, it's pulling a piece of metadata, the description of the file there.
Tells you which log-to-timeline parser it used to get that information and the display name of the file.
So, this one you can see is just a secret project design concept dot PowerPoint.
So, there you go.
Where does it pull all the information from?
So, if I took a forensic image of a hard drive, who asked the question?
So, I can just look at you.
Great.
So, if I took a forensic image of a hard drive and then ran a PC or a log-to-timeline or whatever against that hard drive, it's going through there.
It's gonna, it's gonna find the partitions, like Windows partitions or recovery partitions, whatever it sees.
And then it's going to pull all the information from the master file table is one thing.
And the cool thing about log-to-timeline that I actually really like over a lot of enterprise tools is that it will do things, it'll like expand out.
For example, Windows event logs just automatically throw that in there with regular file system metadata.
And so, yeah, it pulls it from the master file table.
And if any other files, like such as office documents that are written in XML format, they have some different metadata fields and will pull that as well.
So, I hope that answered your question.
Okay, cool.
That's awesome.
Sadness.
I'm just gonna have to rob you guys of the slideshow.
So, reviewing, going back to the forensic process, the next step would be analyzing the evidence.
Basically, when I analyze stuff like that, you can see it's just like in a spreadsheet.
It's not like in any like fancy tool or whatever.
So, I mean, if you have access to Google Docs, like what I just showed you up there, you can analyze the timeline of a computer.
So, we analyze and, yeah, we analyze spreadsheets, we can analyze a notepad, terminal, command prompt, looking at the output of certain commands.
What is something, so when you're using all these different tools, what is something to consider as far as, let's say you're working on a case that might have to go to litigation, what is an important consideration of using some of these tools?
Yes?
Has it been validated in court?
Have I validated it myself?
Like, I mean, that has some power in itself that, hey, I ran my own tests on this.
I mean, when you think of traditional forensics and CSI or whatever, like what are they doing in those shows?
They're like, they're running tests, like all the time.
It's got to be the same thing.
You have to validate that kind of stuff.
You have to know what you're talking about.
You have to be accurate.
Accuracy is so important.
I worked on this case back in California where there is, I was a forensic examiner on the case and there was one on the opposing side as well, and we were talking about USB timestamps.
When a USB was plugged in, when it was unplugged, that kind of thing.
Files being moved to it.
It was a theft to trade secrets case.
I used a particular tool to analyze the USB timestamps.
He used a different one and we came up with different results.
Hmm, how does that happen?
We're both forensic examiners.
We should both be right somehow, right?
So my boss is like, what happened?
You know, like looking at me like, you messed up.
You know, that kind of thing.
So I'm like, I'm going into like the Windows Registry.
I'm pulling out the timestamps manually.
I'm not relying on a tool to do it for me.
Pulling them out manually.
Validating those timestamps that I originally produced were accurate.
And so I'm like, okay, well where is this guy getting his timestamps from?
And eventually they produced their report.
And I take a look at the report and I can kind of tell like, oh, I've used this tool before somewhere.
And you know, I do some googling.
I'm like, yeah, it's this tool.
So I like go on their website.
I start playing around with it.
And I start reading the fine print on the website.
And it was something as silly as not compatible with versions of Windows after Vista or something like that.
And that was it.
That was it.
It was a Windows 7 computer.
That was it.
And he used, so he used it, that tool.
It wasn't compatible with Windows.
Sure enough, we go and try to validate that.
And we came up with the timestamps he did on the same piece of evidence.
So you really have to consider, consider accuracy of these tools.
And how important that can be.
And you know, if it makes or breaks the case.
So yeah.
Right.
So a lot, a lot of tools nowadays, man, how do I answer that?
It depends on your tool set for sure.
There are some tools that can take an image of just an encrypted hard drive.
Let's say it's just encrypted with like BitLocker.
And you throw that, you point that forensic tool to the the image.
It says, oh yeah, it's a encrypted with BitLocker.
Give me the recovery key.
Punch in the recovery key.
Voila .
And it's opened up.
Some of our tools that we deal with, you might have to get kind of weird with them.
I imagine that, you know, perhaps if you mounted an encrypted disk image to, like, that's encrypted with BitLocker to Windows.
How many minutes?
20 minutes?
Thank you.
I imagine if you mounted that encrypted image to Windows, that it might see it as a BitLocker encrypted drive.
I can't, I've never done that, so I can't accurately answer that.
But yeah, some of these tools do handle encrypted hard drives or allow you to move forward from there.
There's different ways to solve the same kind of problem.
You just have to figure out how you want to approach taking the forensic image.
That is a very good question though, especially if you get like a laptop or something.
Asking them right off the bat, is this laptop have its hard drive encrypted?
So yeah, good point.
The last thing I want to talk about with the forensic process is reporting.
That's like the kind of whole point of this.
We're given the answers.
I'm not gonna talk too much about reporting because this isn't a class about how to write a report.
You can figure that out on your own.
There's some tools out there to do it.
Open Office, LibreOffice, Google Docs.
Whenever you're writing a report for anything at all, for any kind of technical report, you have to consider who your audience is.
Who am I talking to?
Am I talking to the chief information security officer?
Am I talking to an attorney?
Am I talking to an executive?
Depending on who the person is, there's some assumption of technical knowledge there.
You know, an attorney is probably gonna know less about techie techie stuff than a CISO is.
So you have to kind of consider who your audience is and man, is that a challenge of computer forensics.
Communicating like super technical information and just layman's terms kind of way.
Your report could go to the courtroom, could be you know put in front of, what is it, just put in front of the courtroom and people need to understand that, learn how to process that evidence.
So yeah, reporting is a huge part.
So all that said, I'm kind of winding down here.
We have all these free tools out there.
We have the knowledge of the forensic process.
Where does that leave us now?
What are the where the capabilities of that?
And this is kind of what I've been experimenting with lately is, am I able to, with a little programming and scripting knowledge, am I able to make a very nice fluid process on how to create a forensic image, process it in the way I want it processed and produce the exact kind of information that I care about?
The answer is absolutely yes, you can do that .
With a little, little bit of scripting knowledge, a little bit of programming knowledge, you can automate just about any kind of forensic task out there.
Another thing to consider, especially with memory forensics, which I didn't talk too much about today, is baselining your evidence.
So you, you might have one particular image running on, you know, all your Windows desktops at your company.
They're all gonna have the same kind of processes sitting in the memory out there.
Can we baseline that to make our investigation a little more efficient down the road?
Yeah, we can.
We absolutely can.
Another thing I want to make clear before I wrap up, and if you guys have questions, I left some time for that, but another thing I want to make clear, I love, I love forensic tools that you pay for, so I'm not bashing them today.
I just wanted to, I wanted to highlight the, the possibilities of these free tools out there, and how, where they fit in the forensic process.
And hopefully I did a good job of that.
Hopefully you guys got a good understanding, or at least a good overview of the forensic process, and how these tools can be useful to you.
And just thinking about how we can even automate them after we've mastered using them in the future.
So yeah, there's plenty of enterprise-level, paid-for forensic tools out there that I use.
They're awesome.
They have their purpose.
So yeah, anybody have some questions for me?
Yeah?
What's that?
That's, that's a great question.
How do you do forensics in the cloud?
Wow.
So I've come across this a few times.
So it really depends on what kind of piece of evidence it is.
So let's take like an Amazon web server, for example.
Depends on what kind of service that server is hosting up.
The type of way I'm going to connect to it.
So am I just gonna traditionally authenticate to it, like I normally would with an Amazon web server?
Some tools out there have that built into them, where you say, point me to a server, an Amazon web server, or a Gmail account even.
And you pop in the credentials and it's going to pull down the data from there.
Now, considering that, it makes you wonder, like okay, we talked about preserving the evidence, right blocking things earlier.
What, you know, what does that mean for like cloud information?
How do we, like what does that, what does that mean?
Does that like totally get rid of the credibility of the evidence at that point?
And not necessarily, no.
What we will try, what we try to do as forensic examiners is be honest about the data.
Especially like, for example, if we made a mistake in collecting the data, it's not good to lie.
It's not good to say, oh you know, well that's normal, that's normal behavior.
Or you know, like other forensic examiners do that.
No, we mess up.
We have to own it.
We got to be responsible.
We have to say, this is what I changed about the evidence.
And take responsibility for it and move forward from there.
So same kind of thing with cloud data.
We have to recognize it for what it is.
We show the steps that we took to collect that data.
We document everything so it can be reproduced.
Same thing with memory forensics too.
Yeah, go ahead.
Sure, chain of custody.
Yeah, that's that's a really good question.
So I don't use any particular software to handle chain of custody.
Chain of custody can really, I guess I could say Adobe PDF or whatever, you know.
Like you could make a PDF document of a chain of custody form.
And depending on what organization you work with, or if you're just like a private contractor, you could dish those out to people along the way.
As soon as that evidence comes into play, like let's say you're gonna be working with the server admin.
He's gonna be, that's gonna be the first name on the chain of custody.
And the server room is gonna be where it came from.
That kind of thing.
Does that kind of answer your question at all?
Right, right, yeah.
And you really you want to be involved in the process from the start.
And try to just kind of butt your way in there as soon as you can.
Because like if any of this information is new to you, it's new to other people out there too.
They don't know like how to preserve things.
And they might change things about a piece of evidence before it even comes to you.
And you need to know that.
You need to know that information.
Really common thing is, I'm just gonna shut the server down.
Like well, it might be important, you know.
So yeah.
Any other questions?
Yeah, I'm sorry an online service.
Yeah, okay.
I'm not sure I understand the question.
I'm sorry.
Sure, okay.
Gotcha, okay, yeah.
Okay, okay, right.
Oh that's, I gotcha.
Okay, that's an excellent question.
So especially, yeah, like if you're dealing with something like child pornography that's super serious.
So I've worked with a few of those cases.
And typically because I'm not law enforcement, it gets passed along pretty quickly.
It's my obligation if I'm dealing with child pornography, any kind of case like that, as soon as I know that's what I'm dealing with, it's gone.
Like bye-bye.
Calling the police, calling the FBI, whatever.
It's going to them.
So to answer your question, they would have to subpoena the ISP to get that information.