Cyber Crime - Cyber Evidence Assignment

jeguiris87

Berkeley_Fall_2016_JUS4403_ppt_ch12.ppt

Home >Law homework help >Criminal homework help >Cyber Crime - Cyber Evidence Assignment

Computer Forensics and Cyber Crime

CHAPTER

Computer Forensics and Cyber Crime, 3rd ed. Marjie T. Britz

Processing of Evidence and Report Preparation

Computer Forensics and Cyber Crime, 3rd ed. Marjie T. Britz

Learning Objectives

Explore completely the aspects of data analysis.
Understand CMOS passwords and their uses.
Gain knowledge of the ways in which investigators can gather information from hard drives by circumventing CMOS passwords.
Understand the preparation process that investigators go through to formally present the findings of their analysis of digital evidence.
Develop further understanding of the importance of documentation of computer forensic investigators.

Computer Forensics and Cyber Crime, 3rd ed. Marjie T. Britz

Aspects of Data Analysis

Always keep in mind:

Document, document, document
Procedures vary due to departmental resources, expertise of personnel, and exigent circumstances
Case characteristics can dictate analysis, since may not need to analyze every file
Departments should provide guidance to investigators through policy and procedure

Computer Forensics and Cyber Crime, 3rd ed. Marjie T. Britz

Aspects of Data Analysis

Establishing Forensically Sterile Conditions

Use new media, forensically wiped prior to analysis
Small or poorly funded agencies need to ensure that media to be reused must be forensically wiped to meet DoD standards
Do not use media containing damaged areas
Verify condition of all physical drives prior to analysis

Computer Forensics and Cyber Crime, 3rd ed. Marjie T. Britz

Aspects of Data Analysis

Ensure Legitimacy and Capabilities of Analysis Tools

Use only properly licensed software.
Validate forensic software by testing it at the extremes.
Familiarize all who would use the software with its capabilities.
If testifying, each needs to be able to articulate the limitations of the analysis tools and the steps taken to identify them.

Computer Forensics and Cyber Crime, 3rd ed. Marjie T. Britz

Aspects of Data Analysis

Physical Examination

Make notes about the physical condition of equipment to be used.

Creation and Verification of Image

This is the version used for analysis; never use the original.

Computer Forensics and Cyber Crime, 3rd ed. Marjie T. Britz

Aspects of Data Analysis

Use forensic floppy:
Contains applicable OS
Means to lock hard drive before imaging
Applicable storage enhancement software
External media, printer, drivers
Miscellaneous drivers based upon pre-seizure surveillance/evaluation of CONFIG.SYS and AUTOEXEC.BAT files

Computer Forensics and Cyber Crime, 3rd ed. Marjie T. Britz

Aspects of Data Analysis

Consider using batch files that evaluate computers for court purposes.
Boot disks with virus protection, but don't remove any viruses found.
CMOS password may prevent removal of the drive.
Jumping the CMOS password
Would require hardware manipulation
Can bypass with jumpers to get around password issues, one at a time

Computer Forensics and Cyber Crime, 3rd ed. Marjie T. Britz

Aspects of Data Analysis

Short-circuiting the chip
Another way to defeat the boot process, via a wire or paperclips

Pulling the battery
Removing the CMOS battery for at least 24 hours
Could damage other portions of CMOS, so exercise great care
If doing this results in modification of memory, manual reconfiguration will be necessary

Computer Forensics and Cyber Crime, 3rd ed. Marjie T. Britz

Aspects of Data Analysis

Recovering passwords
Default passwords can be used to bypass CMOS passwords; can be obtained from manufacturer

Social engineering/brute force: Relying on traditional investigative processes
Key disks might be available to bypass BIOS, but only a floppy, so must have a drive

Computer Forensics and Cyber Crime, 3rd ed. Marjie T. Britz

Aspects of Data Analysis

Image verification
Expect that most verification capabilities are in imaging programs, as noted in Chapter 10

Logical examination
Verify partition tables and disk information, often through programs
This is because data can exist in different levels

Computer Forensics and Cyber Crime, 3rd ed. Marjie T. Britz

Aspects of Data Analysis

Restoration of Files
Hope and expect that many users are technologically unaware of how better to hide data
Could use off-the-shelf software that restores deleted files
Even simple measures could be used to hide data
Might use steganography, where message is kept in a container

Computer Forensics and Cyber Crime, 3rd ed. Marjie T. Britz

Aspects of Data Analysis

Listing of files
Disk editors could be very helpful here

Examine the unallocated space for data remnants
Some software can do this

Computer Forensics and Cyber Crime, 3rd ed. Marjie T. Britz

Aspects of Data Analysis

Unlocking files
These do not affect startup, for the most part
Those with pretty good password (PGP) protection or advanced encryption standard (AES) might be tougher
May be possible with some forensic utilities
Also look at file swap and slack space

Computer Forensics and Cyber Crime, 3rd ed. Marjie T. Britz

Aspects of Data Analysis

Brute force/social engineering
Consider some of the more obvious passwords
Program defaults and program-specific crackers

Examination of user data files
Search, but tough to come up with effective keyword list for each case
Also check out autoexec.bat
Take care, as there may be a booby-trap

Computer Forensics and Cyber Crime, 3rd ed. Marjie T. Britz

Aspects of Data Analysis

Piping of evidence
Make hard copies, especially of what would be used at trial.
Keep track of these documents, perhaps by using Bates numbering system.

Examination of executable programs
For example, what if child pornography were unknowingly hidden in a Trojan?
May need to talk about their presence/absence at trial.

Computer Forensics and Cyber Crime, 3rd ed. Marjie T. Britz

Aspects of Data Analysis

Document, document, document
Methodology may vary, even to include doing this manually.
Especially review removable storage media.

Computer Forensics and Cyber Crime, 3rd ed. Marjie T. Britz

Aspects of Data Analysis

Evidence from Internet Activity

Criminals use the Internet for:
Trading or sharing information
Concealing their identity
Assuming another identity
Identifying and gathering information on victims
Communicating with co-conspirators
Distributing information or misinformation
Coordinating meetings, meeting sites, or parcel drops

Computer Forensics and Cyber Crime, 3rd ed. Marjie T. Britz

Aspects of Data Analysis

Look at:
Tracing IP addresses, looking at Net, host section, and use whois
Domain name system
MAC Addresses
For geographical identification, use Traceroute, which follows path a packet takes

Computer Forensics and Cyber Crime, 3rd ed. Marjie T. Britz

Non-Windows Operating Systems

Macintosh Operating System

Imaging: Need to have disk arbitration disabled, then connect or remove
Finding evidence: Some in obvious places or in unallocated space
Forensic toolkits can include the following suite of tools:
Black Bag Technologies Mac Forensic Software
MacForensicsLab

Computer Forensics and Cyber Crime, 3rd ed. Marjie T. Britz

Non-Windows Operating Systems

Linux/Unix Operating Systems

A number of computers use an OS that runs on Linux/Unix-based kernels:
Red Hat
SUSE Linux
Solaris
HP Unix
IBM’s AIX

Computer Forensics and Cyber Crime, 3rd ed. Marjie T. Britz

Non-Windows Operating Systems

Open-source (“In the Wild”) systems or commercial systems

Examples of files that could contain criminal evidence:
/etc/passwd contains account ID, encrypted password, Numeric UserID, Number GroupID, account information, home directory, login shell
/etc/shadow contains shadow passwords and associated user account information

Computer Forensics and Cyber Crime, 3rd ed. Marjie T. Britz

Non-Windows Operating Systems

/etc/hosts holds local domain name system (DNS) entries
/etc/sysconfig has assorted configuration files (i.e., peripherals, scripts running at boot, etc.)
/etc/syslog/conf indicates location of log files
/home/useraccountID/trash access to specific user’s trash (i.e., deleted files which have not been permanently released to unallocated space)

Computer Forensics and Cyber Crime, 3rd ed. Marjie T. Britz

Non-Windows Operating Systems

Other forensic tools include:

Maresware: Linux Forensics
The Farmer’s Boot CD
SMART
The Sleuth Kit
Coroner’s Toolkit
Autopsy

Computer Forensics and Cyber Crime, 3rd ed. Marjie T. Britz

Smartphones and GPS Forensics

Smartphones are essentially portable personal computers with greater communication capabilities.
However, the file system on certain systems is volatile, not nonvolatile memory.
Hibernate mode may prove useful in revealing what is still running, even when idle.
Smartphones have shorter product cycles, so greater care is needed when selecting forensic tools.

Computer Forensics and Cyber Crime, 3rd ed. Marjie T. Britz

A Sample of Popular Products

Mobile Phone Examiner Plus (MPE+), from AccessData
Device Seizure, from Paraben Software
UFED, from CelleBrite
XRY Complete, from MicroSystemation

Computer Forensics and Cyber Crime, 3rd ed. Marjie T. Britz

Navigation Systems

Impact of increased use, reliance on Global Positioning System (GPS)

Consists of:
Ephemeris data
Almanac data
Pseudorandom code

Forensic tools are relatively new for these devices.
JTAG, aka boundary scan
TomCopy, the custom kernel method

Computer Forensics and Cyber Crime, 3rd ed. Marjie T. Britz

Report Preparation and Final Documentation

Successful prosecution may hinge on formal reporting, and the competency and credibility of courtroom witnesses.

Computer Forensics and Cyber Crime, 3rd ed. Marjie T. Britz

Report Preparation and Final Documentation

As proper documentation is essential, reports on data analysis should include date, time, and identification of investigative personnel about:
Evidence seizure
Digital imaging and verification
Application of forensic software
Special techniques or unique problems encountered
Consultation with outside sources

FTK and EnCase include reporting capability in their platforms.

Computer Forensics and Cyber Crime, 3rd ed. Marjie T. Britz

Conclusions

Use automated, manual forensic tools

Case characteristics and situational variables will dictate necessary tools

Familiarity with computer operating systems and the mechanics of data storage is necessary to show competency