SolvingComputerCrime:AnIntroductiontoDigitalForensicsGoldenG.RichardIII,Ph.D.Dept.ofComputerScienceGulfCoastComputerForensicsLaboratory(GCCFL)DigitalForensicsDefinition:“Toolsandtechniquestorecover,preserve,andexaminedigitalevidenceonortransmittedbydigitaldevices.〞Devicesincludecomputers,PDAs,cellularphones,videogameconsoles…ExamplesofDigitalEvidenceComputersincreasinglyinvolvedincriminalandcorporateinvestigationsDigitalevidencemayplayasupportingroleorbethe“smokinggun〞EmailHarassmentorthreatsBlackmailIllegaltransmissionofinternalcorporatedocumentsMeetingpoints/timesfordrugdealsSuicidelettersTechnicaldataforbombmakingImageordigitalvideofiles(esp.,childpornography)EvidenceofinappropriateuseofcomputerresourcesorattacksUseofamachineasaspamemailgeneratorUseofamachinetodistributeillegallycopiedsoftwareMajorIssuesIdentificationofpotentialdigitalevidenceWheremighttheevidencebe?Whichdevicesdidthesuspectuse?PreservationofevidenceOnthecrimescene…First,stabilizeevidence…preventlossandcontaminationIfpossible,makeidenticalcopiesofevidenceforexaminationCarefulextractionandexaminationofevidencePresentation“TheFATwasfubared,butusingahexeditorIchangedthefirstbyteofdirectoryentry13from0xEFto0x08torestore‘HITLIST.DOC’…〞“ThesuspectattemptedtohidetheMicrosoftWorddocument‘HITLIST.DOC’butIwasabletorecoveritwithouttamperingwiththefilecontents.〞Legal:InvestigatoryneedsmeetprivacyPreservationofEvidence:Hardlytrivial…LivingroomBasement/closetwirelessconnection“DearSusan,It’snotyourfault…Justpulltheplug?Movethemouseforaquickpeek?

Tripwirestick…tick…tick…VolatilecomputingPreservation:ImagingWhenmakingcopiesofmediatobeinvestigated,mustpreventaccidentalmodificationordestructionofevidence!Writeblockers:Usethem.Always.ddunderLinuxDOSbootfloppiesProprietaryimagingsolutionsDrivelockwriteblockerExtractionandExaminationKnowwhereevidencecanbefoundUnderstandtechniquesusedtohideor“destroy〞digitaldataToolboxoftechniquestodiscoverhiddendataandrecover“destroyed〞dataCopewithHUGEquantitiesofdigitaldata…IgnoretheirrelevantandtargettherelevantWhere’stheevidence?Undeletedfiles,expectsomenamestobeincorrectDeletedfilesWindowsregistryPrintspoolfilesHibernationfilesTempfiles(allthose.TMPfiles!)SlackspaceSwapfilesBrowsercachesAlternatepartitionsOnavarietyofremovablemedia(floppies,ZIP,Jazz,tapes,…)Fallacyvs.FactinDigitalForensicsManydigitalforensicstoolsandtechniquesarequitecomplex…VerydifficulttocoverinashortlectureToillustrateinvestigativeproceduresfordigitalforensics,afactvs.fallacyapproachFallacy:Userattemptingtohideevidencebelievesonething…Fact:Butinfact…Lookatafewfactvs.fallacyscenarios…Then,onemoreadvancedtopicFallacy:Filewasdeleted,it’sgone!Usersoftenmistakenormaldeletionoffilesfor“secure〞deletionDeletedfilesrecoverableusingforensicstoolsWhy?FilesystemmakesasmallchangeinitsbookkeepinginfotomarkafileasdeletedDataassociatedwithfileisNOTerasedExample:FAT32(Windows),firstcharacteroffilenameischangedto0xEFindirectoryentryto“delete〞fileForensicssoftwarechangesonecharacterindirectoryentry,filereappearsTopreventrecovery,mustperformsecureoverwriteofthefileorphysicallydestroythemediaFallacy:Irenamedthefile,I’msafe!“childporn.jpg〞“winword.exe〞RenamingfilesisanineffectivedefenseagainstdigitalforensicsinvestigationTechnique#1:Mostfiletypes(e.g.,JPEGimage)haveastructurethatcanberecognizeddirectly,regardlessofthefilenameauserchoosese.g.,JPEGfilescontain0x4a464946or0x45786966inthefirstblockofthefileTechnique#2:Cryptographichashingprovidesamechanismfor“fingerprinting〞filesFilecontentsismatchedquickly,regardlessofnameHashesequivalent,filecontentsequivalentThink:fingerprintsdon’tcareabouthaircolor…Aside:HashingTypicalalgorithms:SHA-1,MD5Example:C:>md5sumgolden.jpgb28f08b004a7251a418e089ef3bb7409*golden.jpgC:>renamegolden.jpgwinword.exeC:>md5sumwinword.exeb28f08b004a7251a418e089ef3bb7409*winword.exeCanautomatecheckingofhashesHugedictionariesexistwithhashesforknownfiles:…andknownchildpornographyfilesCanquicklydisregardknownfilesandtargettheinterestingstuffFallacy:Iformat-edthedrive,whew!FormattingadrivedoesnotpreventrecoveryofdigitalevidenceInfact,formattypicallyoverwriteslessthan1%ofdrivecontentsWhydoesittakesolong?FormatisreadingdiskblockstodetermineifbadblocksexistFormatwipesoutdirectories,sonamesoffilesarelostAlotofthedatacanstillberecoveredbysiftingthroughdatathatremainsaftertheformatoperationForexample,filecarvingtoolsreconstructfilesbyexaminingtheinitialandterminalbytesofthefileSeedigitalforensicsTechnique#1underfilerenamingfallacyFallacy:Mediamutilation==Millertime!Example#1:CuttingafloppyintopiecesExample#2:Openingaharddrive,removingtheplatters,throwingthemintothetrashUnlessthedamageisextreme,mutilationofmagneticmediaisinsufficienttopreventrecoveryMediacanbereassembledandpartialrecoveryperformedEvenstrongmagneticfieldsareinsufficient…Older“militarygrade〞degausserforerasingharddriveswassostrongthatitbenttheplattersinsidethedriveYourbulktapeeraserisn’tgoingtodothejobTodestroydata:multipleoverwrites(software)orcompletedestructionofhardwareThat’sOneBigDegausser!Fallacy:IusedWeb-basedemail…Fallacy:Useofweb-basedemailratherthanstoringemailmessagesdirectlyonacomputerissafer(intermsofthwartingrecoveryattempts)It’snot.Evenifyouneverdownloadtheemailandimmediatelydeleteallmessagesontheserver!Recentlyviewedwebpagesarestoredinwebbrowser’scacheCacheisofteninahard-to-findplace…InternetExplorerToolsInternetOptionsDeleteFilesclearsthecacheinIESeeslideonrecoveryofdeletedfilesforfutilityquotientFilesstoredinbrowsercachearenotsecurelydeletedwhenthecacheisclearedBrowsercacheminingtoolsbringrecentlyviewedwebpages,includingweb-basedemailmessages,backtolifeinaflashRecoveryofweb-basedemailsFallacy:Applicationuninstallsareeasy…Illegalapplicationinstalled…Fearensues…Applicationisuninstalled…(AmIsafe?)…applicationfilescanstillbeundeleted,provingapplicationwasinstalledFurtherstepstoobscureinstallation:SecurelyoverwriteapplicationfilesNowamIsafe?Nope.RemnantsofinstallationcanlikelystillbefoundintheWindowsregistryBasically,ifauserinstallssoftwareandwantstopermanentlyeradicateanytraces,mustsecurelyerasetheentiredriveordestroythehardwareFallacy:Iencryptedmyfiles…Onencryptedfilesystems,iffileiseverprintedandspooldirectoryisn’tencrypted,fragmentsmaybeleftbehindOnsomesystems(e.g.,Windows2000),a“recoveryagent〞isabletoreadallencryptedfilesForWindows2000,thisistheadministratoraccount,thusjustneedtobreakadministratorpasswordProblem:keysfortrulysecureencryptionschemesarelongSearchforslipsofpaperSearchforunencryptedpasswordlistsSearchPDAs,phones,andorganizersforpasswordsandencryptionkeysSoftwareorhardwarekeystrokeloggersVanEckradiationIfthefilecan’tbedecrypted,thenameofthefilemaystillbeusefulinprosecutionBeowulf,SlayerofPoorlyChosenPasswords…Howgoodareyourpasswords?Steganography“Techniquesforhidinginformationwithinotherinformation〞HistoricalTattoosTextonwoodunderwaxlayeronawaxtablet“Invisible〞ink(e.g.,writingwithlemonjuice)ModernMuchmoresophisticatedEmploypowerfulencryptiontechniquesHidedocumentsw/inanimage,video,oraudiofileHiddendocumentscanbeharmless,orchildpornography,bombplans,…Stego(2)Stego(3)Stego(4)Slippedinsidethe2ndcactuspictureby“jphide〞…Embeddinginthiscaseisnotobvious(visually)…andimagew/embeddedGoldenisactuallysmaller(inbytes)thanoriginalStatisticalanalysisby“stegdetect〞guessescorrectlythatsomethingishidden.ButjphideusesBlowfishtoscrambletheorderofembeddeddata,sosuccessfulextractionisveryunlikelyunlessthepasswordisknown.CoreIgniterStego(5)This“bomb〞diagram,however,isnotdetectedinsidethecactuspicture…Bluepipe:OntheSpotDigitalForensicsLegalIssuesInvestigativeneedsvs.therighttoprivacySearchwarrantlaws,e.g.,FourthAmendmenttotheU.S.ConstitutionWiretaplawsChainofcustodyAdmissibilityofevidenceincourt:DaubertEssentially:Hastheoryortechniqueinquestionbeentested?Iserrorrateknown?Widespreadacceptancewithinarelevantscientificcommunity?PatriotActGreatlyexpandsgovernmentalpowersintermsofsearching,wiretapw/opriornotificationTheOtherSide:PrivacyWe’veco