Transcript Document 7722490

COS/PSA 413
Day 15
Agenda
•
Assignment 3 corrected
–
•
Lab 5 corrected
–
•
4 A’s and 1 B
Lab 6 corrected
–
•
•
•
5 A’s, 4 B’s and 1 C
A, 2 B’s, 1 C and 1 D
Lab 7 write-up Due
Lab 8 write-up Due Nov. 4
Capstone Proposals Over due
–
–
–
–
See guidelines in WebCT
8 require some modifications (emails sent)
Next Progress report Due on November 4
Timing of proposal and progress reports is 10% of Grade
•
•
Today we will be discussing Computer Forensic Analysis
–
•
In others words if you don’t do this part the best score you can get is a B
Chap 10 in both texts with differences (using FTK)
Tomorrow is Lab 9 in OMS
–
–
–
–
Make sure you read lab beforehand
Know what it is you are trying accomplish
Hands-on Project 10-1, and 10-3
Lab notes will be distributed tomorrow
Computer Forensic Analysis
Chapter 10
Learning Objectives
•Understand Computer Forensic Analysis
•Use DriveSpy to Analyze Computer Data
•Use Other Digital Intelligence Computer
Forensics Tools
•Use AccessData’s Forensic Toolkit
•Perform a Computer Forensic Analysis
•Address Data-Hiding Techniques
Understanding Computer
Forensics Analysis
• Examining and analyzing digital evidence
–
–
–
–
–
Nature of the case
Amount of data to process
Search warrants
Court orders
Company policies
• Scope creep
• Right of full discovery of digital evidence
Refining the Investigation Plan
• Steps:
–
–
–
–
–
–
Determine the scope of the investigation
Estimate number of hours to complete the case
Determine whether you should collect all information
Plan what to do in case of scope creep
Determine if you have adequate resources
Establish the deadline
Refining the Investigation Plan
(continued)
• After you refine your plan, acquire evidence
• Examine evidence
• Review the latest changes in technology
– Find new places for hiding information
– Learn of new methods for storing data
– Verify that your tools still work
• Determine the suspect’s motive
Understanding Computer Forensic
Analysis
Perform the following tasks to investigate:
-Examine file and folder date and time stamps.
-Locate and extract all log files.
-Locate and recover any temporary print spool files.
-Locate and recover any encrypted or archived files.
-Perform a keyword search on all data within the digital
evidence.
-Examine Windows shortcuts, Internet, and Recycle Bin
files.
Using DriveSpy to Analyze
Computer Data
• Files
– DriveSpy.exe/ini/hlp
• DriveSpy.ini sections
–
–
–
–
License
File Headers
File Groups
Search
• Ascii – hex –decimal conversion
– http://www.ascii.cl/
Using DriveSpy to Analyze
Computer Data (continued)
Using DriveSpy to Analyze
Computer Data (continued)
• File Headers
– Hexadecimal numbers
– Identify known files even if extension if different
– You can add more headers
• File Groups
– Consolidate similar file types
– Search for several header types at one time
– You can define your own groups
Using DriveSpy to Analyze
Computer Data (continued)
Using DriveSpy to Analyze
Computer Data (continued)
Using DriveSpy to Analyze
Computer Data (continued)
• Search
–
–
–
–
–
Include keywords
Defines level of accuracy
Not case sensitive
Can produce false-positive hits
Use hex values for special characters or keywords
Using DriveSpy to Analyze
Computer Data (continued)
Using DriveSpy to Analyze
Computer Data (continued)
DriveSpy Keyword Searching
• Search at physical level (Drive mode) or logical
level (Partition mode)
• Use Output command to create a log
• Drive mode supports other file systems
– NTFS, HFS, UNIX/Linux
• Searches in partition gaps
• Cannot analyze archive or encrypted files
DriveSpy Scripts
•
•
•
•
Run predefined commands
Similar to DOS batch files
Use them at all three DriveSpy modes
Creating a script
– Use any text editor (Notepad)
– Enter each command line by line
– Can call other script files
DriveSpy Scripts (continued)
• Example:
DriveSpy Data Integrity Tools
• Wipe
– Overwrites possible sensitive data that can corrupt
output data
– Works on sectors, partitions, drives, unallocated
space, and MBR
– Available in Drive and Partition modes
DriveSpy Integrity Tools (continued)
• MD5
– RFC-complaint MD5 function
– Hashes an entire partition, or specific files
– Available in Drive and Partition mode
• Dbexport
– Creates a text file of all specified data in a file or disk
– Works only in Partition mode
DriveSpy Residual Data
Collection Tools
• Recover deleted files and unused space
• SaveSlack
– Copy slack space from files on a partition
– 8.3 filename with .dat as file extension
– Works only in Partition mode
• SaveFree
– Collects all unallocated disk space on a partition
– Works only in Partition mode
Other Useful DriveSpy
Command Tools
•
•
•
•
Get FAT Entry (GFE)
Chain FAT Entry (CFE)
Chain Directory Entry (CDE)
Trace Directory Cluster (TDC)
Other Useful DriveSpy
Command Tools (continued)
•
•
•
•
Cluster
Boot
PartMap
Tables
Using Other Digital Intelligence
Computer Forensics Tools
• Using PDBlock
– Prevents data from being written on a disk drive
– Can only be used on a true MS-DOS level
– Turns off BIOS’s Interrupt 13
• Using PDWipe
– Overwrites hard disk drives
– For sanitation purposes
– Wipe disk at least three to seven times