computer forensics
DESCRIPTION
Computer Forensics. Chapter 3. Understanding the Windows Registry. *. Understanding the Windows Registry. Registry A database that stores hardware and software configuration information, network connections, user preferences, and setup information - PowerPoint PPT PresentationTRANSCRIPT
Chapter 3
Computer Forensics
Understanding the Windows Understanding the Windows RegistryRegistry
*
Understanding the Windows Registry
• Registry– A database that stores hardware and software
configuration information, network connections, user preferences, and setup information
• For investigative purposes, the Registry can contain valuable evidence
• To view the Registry, you can use:– Regedit (Registry Editor) program for Windows 9x
systems– Regedt32 for Windows 2000 and XP
Exploring the Organization of the Windows Registry
• Registry terminology:– Registry
– Registry Editor
– HKEY
– Key
– Subkey
– Branch
– Value
– Default value
– Hives
Exploring the Organization of the Windows Registry (continued)
Exploring the Organization of the Windows Registry (continued)
Understanding Microsoft Understanding Microsoft Startup TasksStartup Tasks
*
Understanding Microsoft Startup Tasks
• Learn what files are accessed when Windows starts
• This information helps you determine when a suspect’s computer was last accessed– Important with computers that might have been used
after an incident was reported
Startup in Windows NT and Later
• All Windows NT computers perform the following steps when the computer is turned on:– Power-on self test (POST)– Initial startup– Boot loader– Hardware detection and configuration– Kernel loading– User logon
Startup Process for Windows Vista
• Uses the new Extensible Firmware Interface ( EFI) as well as the older BIOS sys-tem.
• NT Loader (NTLDR) has been replaced by three boot utilities– Bootmgr.exe—displays list of operating systems– Winload.exe—loads kernel, HAL, and drivers– Winresume.exe—restarts Vista after hibernation
• See link Ch 6g
Startup Files for Windows XP
• NT Loader (NTLDR)
• Boot.ini
• BootSect.dos
• NTDetect.com
• NTBootdd.sys
• Ntoskrnl.exe
• Hal.dll
• Pagefile.sys
• Device drivers
Startup in Windows NT and Later (continued)
• Windows XP System Files
Startup in Windows NT and Later (continued)
• Contamination Concerns with Windows XP– When you start a Windows XP NTFS workstation,
several files are accessed immediately• The last access date and time stamp for the files
change to the current date and time
– Destroys any potential evidence• That shows when a Windows XP workstation was last
used
Startup in Windows 9x/Me
• System files in Windows 9x/Me containing valuable information can be altered easily during startup
• Windows 9x and Windows Me have similar boot processes
• Windows 9x OSs have two modes:– DOS protected-mode interface (DPMI)– Protected-mode GUI
Startup in Windows 9x/Me (continued)
• The system files used by Windows 9x have their origin in MS-DOS 6.22– Io.sys communicates between a computer’s BIOS,
the hardware, and the OS kernel• If F8 is pressed during startup, Io.sys loads the
Windows Startup menu
– Msdos.sys is a hidden text file containing startup options for Windows 9x
– Command.com provides a command prompt when booting to MS-DOS mode (DPMI)
Understanding MS-DOS Understanding MS-DOS Startup TasksStartup Tasks
*
Understanding MS-DOS Startup Tasks
• Two files are used to configure MS-DOS at startup: – Config.sys
• A text file containing commands that typically run only at system startup to enhance the computer’s DOS configuration
– Autoexec.bat• A batch file containing customized settings for MS-
DOS that runs automatically
• Io.sys is the first file loaded after the ROM bootstrap loader finds the disk drive
Understanding MS-DOS Startup Tasks (continued)
• Msdos.sys is the second program to load into RAM immediately after Io.sys– It looks for the Config.sys file to configure device
drivers and other settings
• Msdos.sys then loads Command.com
• As the loading of Command.com nears completion, Msdos.sys looks for and loads Autoexec.bat
Other Disk Operating Systems
• Control Program for Microprocessors (CP/M)– First nonspecific microcomputer OS– Created by Digital Research in 1970– 8-inch floppy drives; no support for hard drives
• Digital Research Disk Operating System (DR-DOS)– Developed in 1988 to compete with MS-DOS– Used FAT12 and FAT16 and had a richer command
environment
Other Disk Operating Systems (continued)
• Personal Computer Disk Operating System (PC-DOS)– Created by Microsoft under contract for IBM– PC-DOS works much like MS-DOS
Determining What Data to Determining What Data to Collect and AnalyzeCollect and Analyze
*
Determining What Data to Collect and Analyze
• Examining and analyzing digital evidence depends on:– Nature of the case– Amount of data to process– Search warrants and court orders– Company policies
• Scope creep– Investigation expands beyond the original description
• Right of full discovery of digital evidence
Approaching Computer Forensics Cases
• Some basic principles apply to almost all computer forensics cases– The approach you take depends largely on the
specific type of case you’re investigating
• Basic steps for all computer forensics investigations– For target drives, use only recently wiped media that
have been reformatted• And inspected for computer viruses
Approaching Computer Forensics Cases (continued)
• Basic steps for all computer forensics investigations (continued)– Inventory the hardware on the suspect’s computer
and note the condition of the computer when seized– Remove the original drive from the computer
• Check date and time values in the system’s CMOS
– Record how you acquired data from the suspect drive
– Process the data methodically and logically
Approaching Computer Forensics Cases (continued)
• Basic steps for all computer forensics investigations (continued)– List all folders and files on the image or drive– If possible, examine the contents of all data files in
all folders• Starting at the root directory of the volume partition
– For all password-protected files that might be related to the investigation
• Make your best effort to recover file contents
Approaching Computer Forensics Cases (continued)
• Basic steps for all computer forensics investigations (continued)– Identify the function of every executable (binary
or .exe) file that doesn’t match known hash values– Maintain control of all evidence and findings, and
document everything as you progress through your examination
Refining and Modifying the Investigation Plan
• Considerations– Determine the scope of the investigation– Determine what the case requires– Whether you should collect all information– What to do in case of scope creep
• The key is to start with a plan but remain flexible in the face of new evidence
Using AccessData Forensic Toolkit to Analyze Data
• Supported file systems: FAT12/16/32, NTFS, Ext2fs, and Ext3fs
• FTK can analyze data from several sources, including image files from other vendors
• FTK produces a case log file
• Searching for keywords– Indexed search– Live search– Supports options and advanced searching
techniques, such as stemming
Using AccessData Forensic Toolkit to Analyze Data (continued)
Using AccessData Forensic Toolkit to Analyze Data (continued)
Using AccessData Forensic Toolkit to Analyze Data (continued)
• Analyzes compressed files
• You can generate reports– Using bookmarks
Using AccessData Forensic Toolkit to Analyze Data (continued)
Locating and Recovering Locating and Recovering Graphics FilesGraphics Files
*
Locating and Recovering Graphics Files
• Operating system tools– Time consuming– Results are difficult to verify
• Computer forensics tools– Image headers
• Compare them with good header samples
• Use header information to create a baseline analysis
– Reconstruct fragmented image files• Identify data patterns and modified headers
Identifying Graphics File Fragments
• Carving or salvaging– Recovering all file fragments
• Computer forensics tools– Carve from slack and free space– Help identify image files fragments and put them
together
Repairing Damaged Headers
• Use good header samples
• Each image file has a unique file header– JPEG: FF D8 FF E0 00 10– Most JPEG files also include JFIF string
• Exercise:– Investigate a possible intellectual property theft by a
contract employee of Exotic Mountain Tour Service (EMTS)
Searching for and Carving Data from Unallocated Space
Searching for and Carving Data from Unallocated Space (continued)
Searching for and Carving Data from Unallocated Space (continued)
• Steps– Planning your examination– Searching for and recovering digital photograph
evidence• Use ProDiscover to search for and extract (recover)
possible evidence of JPEG files
• False hits are referred to as false positives
Searching for and Carving Data from Unallocated Space (continued)
Searching for and Carving Data from Unallocated Space (continued)
Searching for and Carving Data from Unallocated Space (continued)
Searching for and Carving Data from Unallocated Space (continued)
Searching for and Carving Data from Unallocated Space (continued)
Rebuilding File Headers
• Try to open the file first and follow steps if you can’t see its content
• Steps– Recover more pieces of file if needed– Examine file header
• Compare with a good header sample
• Manually insert correct hexadecimal values
– Test corrected file
Rebuilding File Headers (continued)
Rebuilding File Headers (continued)
Rebuilding File Headers (continued)
Reconstructing File Fragments
• Locate the starting and ending clusters – For each fragmented group of clusters in the file
• Steps– Locate and export all clusters of the fragmented file– Determine the starting and ending cluster numbers
for each fragmented group of clusters– Copy each fragmented group of clusters in their
proper sequence to a recovery file– Rebuild the corrupted file’s header to make it
readable in a graphics viewer
Reconstructing File Fragments (continued)
Reconstructing File Fragments (continued)
Reconstructing File Fragments (continued)
Reconstructing File Fragments (continued)
Reconstructing File Fragments (continued)
• Remember to save the updated recovered data with a .jpg extension
• Sometimes suspects intentionally corrupt cluster links in a disk’s FAT– Bad clusters appear with a zero value on a disk
editor
Reconstructing File Fragments (continued)
Reconstructing File Fragments (continued)
Network Forensics OverviewNetwork Forensics Overview
Network Forensics Overview
• Network forensics– Systematic tracking of incoming and outgoing traffic
• To ascertain how an attack was carried out or how an event occurred on a network
• Intruders leave trail behind
• Determine the cause of the abnormal traffic– Internal bug– Attackers
Securing a Network
• Layered network defense strategy– Sets up layers of protection to hide the most
valuable data at the innermost part of the network
• Defense in depth (DiD)– Similar approach developed by the NSA– Modes of protection
• People (hiring and treatment)
• Technology (firewalls, IDSs, etc.)
• Operations (patches, updates)
Securing a Network (continued)
• Testing networks is as important as testing servers
• You need to be up to date on the latest methods intruders use to infiltrate networks– As well as methods internal employees use to
sabotage networks
Performing Live AcquisitionsPerforming Live Acquisitions
Performing Live Acquisitions
• Live acquisitions are especially useful when you’re dealing with active network intrusions or attacks
• Live acquisitions done before taking a system offline are also becoming a necessity– Because attacks might leave footprints only in
running processes or RAM
• Live acquisitions don’t follow typical forensics procedures
• Order of volatility (OOV)– How long a piece of information lasts on a system
Performing Live Acquisitions (continued)
• Steps– Create or download a live-acquisition forensic CD
– Make sure you keep a log of all your actions
– A network drive is ideal as a place to send the information you collect; an alternative is a USB disk
– Copy the physical memory (RAM)
– The next step varies: search for rootkits, check firmware, image the drive over the network, or shut down for later static acquisition
– Be sure to get a forensic hash value of all files you recover during the live acquisition
Performing a Live Acquisition in Windows
• Several tools are available to capture the RAM.– Mantech Memory DD– Win32dd– winen.exe from Guidance Software– BackTrack
Developing Standard Developing Standard Procedures for Network Procedures for Network
ForensicsForensics*
Developing Standard Procedures for Network Forensics
• Long, tedious process
• Standard procedure– Always use a standard installation image for systems
on a network– Close any way in after an attack– Attempt to retrieve all volatile data– Acquire all compromised drives– Compare files on the forensic image to the original
installation image
Developing Standard Procedures for Network Forensics (continued)
• Computer forensics– Work from the image to find what has changed
• Network forensics– Restore drives to understand attack
• Work on an isolated system– Prevents malware from affecting other systems
Reviewing Network Logs
• Record ingoing and outgoing traffic– Network servers– Routers– Firewalls
• Tcpdump tool for examining network traffic– Can generate top 10 lists– Can identify patterns
• Attacks might include other companies– Do not reveal information discovered about other
companies
Using Network ToolsUsing Network Tools
Using Network Tools
• Sysinternals– A collection of free tools for examining Windows
products
• Examples of the Sysinternals tools:– RegMon shows Registry data in real time– Process Explorer shows what is loaded– Handle shows open files and processes using them– Filemon shows file system activity
SysInternals
• Link Ch 11b
Using Network Tools (continued)
• Tools from PsTools suite created by Sysinternals– PsExec runs processes remotely– PsGetSid displays security identifier (SID)– PsKill kills process by name or ID– PsList lists details about a process– PsLoggedOn shows who’s logged locally– PsPasswd changes account passwords– PsService controls and views services– PsShutdown shuts down and restarts PCs– PsSuspend suspends processes
Using UNIX/Linux Tools
• Knoppix Security Tools Distribution (STD)– Bootable Linux CD intended for computer and
network forensics
• Knoppix-STD tools– Dcfldd, the U.S. DoD dd version– memfetch forces a memory dump– photorec grabs files from a digital camera– snort, an intrusion detection system– oinkmaster helps manage your snort rules
Using UNIX/Linux Tools (continued)
• Knoppix-STD tools (continued)– john– chntpw resets passwords on a Windows PC– tcpdump and ethereal are packet sniffers
• With the Knoppix STD tools on a portable CD– You can examine almost any network system
Using UNIX/Linux Tools (continued)
• BackTrack– Contains more than 300 tools for network scanning,
brute-force attacks, Bluetooth and wireless networks, and more
– Includes forensics tools, such as Autopsy and Sleuth Kit
– Easy to use and frequently updated
Using Packet Sniffers
• Packet sniffers– Devices or software that monitor network traffic– Most work at layer 2 or 3 of the OSI model
• Most tools follow the PCAP format
• Some packets can be identified by examining the flags in their TCP headers
TCP Header
• From Wikipedia
Tools
• Tcpdump (command-line packet capture)
• Tethereal (command-line version of Ethereal)
• Wireshark (formerly Ethereal)– Graphical packet capture analysis
• Snort (intrusion detection)
• Tcpslice– Extracts information from one or more tcpdump files
by time frame
Tools
• Tcpreplay (replays packets)
• Tcpdstat (near-realtime traffic statistics)
• Ngrep (pattern-matching for pcap captures)
• Etherape (views network traffic graphically)
• Netdude (GUI tool to analyze pcap files)
• Argus (analyzes packet flows)
Examining the Honeynet Project
• Attempt to thwart Internet and network hackers– Provides information about attacks methods
• Objectives are awareness, information, and tools
• Distributed denial-of-service (DDoS) attacks– A recent major threat– Hundreds or even thousands of machines (zombies)
can be used
Examining the Honeynet Project (continued)
Examining the Honeynet Project (continued)
• Zero day attacks– Another major threat– Attackers look for holes in networks and OSs and
exploit these weaknesses before patches are available
• Honeypot– Normal looking computer that lures attackers to it
• Honeywalls– Monitor what’s happening to honeypots on your
network and record what attackers are doing
Examining the Honeynet Project (continued)
• Its legality has been questioned– Cannot be used in court– Can be used to learn about attacks
• Manuka Project– Used the Honeynet Project’s principles
• To create a usable database for students to examine compromised honeypots
• Honeynet Challenges– You can try to ascertain what an attacker did and
then post your results online