hello

CSCI 352 - Intro to Digital Forensics Week 2: Forensic Methods and Labs

Instructor: Song Huang, Ph.D. Email: [email protected]

August 31, 2020

Instructor: Song Huang, Ph.D.Email: [email protected] 352 - Intro to Digital Forensics Week 2: Forensic Methods and LabsAugust 31, 2020 1 / 19

Outline of the Slides

1 Forensics Methods and Labs what are forensic methodologies what are formal forensic approaches how to documentation of methodologies and findings what are evidence-handling tasks how to set up a forensic lab introduce common forensic software programs introduce forensic certifications

2 Summery chapter summery key concepts and terms chapter-3 assignment

Instructor: Song Huang, Ph.D.Email: [email protected] 352 - Intro to Digital Forensics Week 2: Forensic Methods and LabsAugust 31, 2020 2 / 19

Chapter 3: What are Forensic Methodologies

It is important that we have a general framework for approaching forensics. This section examines general principles and specific methodologies you can apply to your own forensic investigations. First, here are some basic principles to consider.

Handle Original Data as Little as Possible: A forensic specialist should touch the original data as little as possible. Instead, information should be copied prior to examination. Tools can be used:EnCase, Forensic Toolkit, and OSForensics (even basic linux commands) Comply with the Rules of Evidence: During an investigation, a forensic specialist should keep in mind the relevant rules of evidence, e.g. The chain of custody and the Daubert standard. Avoid Exceeding Your Knowledge:A forensic specialist should not undertake an examination that is beyond his or her current level of knowledge and skill.

Instructor: Song Huang, Ph.D.Email: [email protected] 352 - Intro to Digital Forensics Week 2: Forensic Methods and LabsAugust 31, 2020 3 / 19

What are Forensic Methodologies (cont’d)

Create an Analysis Plan:Before you begin any forensic examination, you should have an analysis plan: how to gather evidence? specific tools? admissible rules? etc. Technical Information Collection Considerations:System forensics specialists must keep in mind three main technical data collection considerations: understanding the life span of information, collecting information quickly, and collecting bit-level information.

Considering the Life Span of Information(volatility) e.g. Network traffic packet, computer memory, log files, etc. Collecting Information Quickly Collecting Bit-Level Information. For example, if you use the file system to copy a suspect drive, you probably won’t get slack space or hidden partitions. But you will get those items with a bit-level copy.

Instructor: Song Huang, Ph.D.Email: [email protected] 352 - Intro to Digital Forensics Week 2: Forensic Methods and LabsAugust 31, 2020 4 / 19

Formal Forensic Approaches

Several organizations have established formal guidelines for approaching a forensic investigation.

Department of Defense Forensic Standards : The DoD Cyber Crime Center (DC3) sets standards for digital evidence processing, analysis, and diagnostics. Refer to: http://www.dc3.mil. The Digital Forensic Research Workshop Framework : The DFRWS developed a framework for digital investigation that is still applicable and followed. The DFRWS framework is a matrix with six classes:

Identification Preservation Collection Examination Analysis Presentation

Instructor: Song Huang, Ph.D.Email: [email protected] 352 - Intro to Digital Forensics Week 2: Forensic Methods and LabsAugust 31, 2020 5 / 19

Formal Forensic Approaches (cont’d)

The Scientific Working Group on Digital Evidence Framework: The Scientific Working Group on Digital Evidence (SWGDE) promotes a framework process that:

Collect Preserve Examine Transfer

That final step means any sort of transfer. This includes moving evidence from the lab to a court, or even returning evidence when no longer needed. An Event-Based Digital Forensics: A group of researchers (CERIAS) at Purdue University, proposed a model that is more intuitive and flexible than the DFRWS framework:

Readiness phase Deployment phase Physical Crime Scene Investigation phase Digital Crime Scene Investigation phase Presentation phase

Instructor: Song Huang, Ph.D.Email: [email protected] 352 - Intro to Digital Forensics Week 2: Forensic Methods and LabsAugust 31, 2020 6 / 19

Documentation of Methodologies and Findings Documentation of forensic processing methodologies and findings is critical (required by legal system). Without documentation, courts are unlikely to accept investigative results.

Disk Structure A system forensics specialist should have a good understanding of how computer hard disks and compact discs (CDs) are structured, also, data hidden in obscure places on CDs and hard disk drives. File Slack Searching: A system forensics specialist should understand techniques and automated tools used to capture and evaluate file slack. File slack:A hard disk or CD is segmented into clusters of a particular size. Each cluster can hold only a single file or part of a single file. If you write a 1-kilobyte (KB) file to a disk that has a cluster size of 4 KB, the last 3 KB of the cluster are wasted. This unused space between the logical end of file and the physical end of file is known as file slack or slack space.

Instructor: Song Huang, Ph.D.Email: [email protected] 352 - Intro to Digital Forensics Week 2: Forensic Methods and LabsAugust 31, 2020 7 / 19

Evidence-Handling Tasks

A system forensics specialist has three basic tasks related to handling evidence:

Find evidence: Investigators may need to investigate thousands of active files and fragments of deleted files to find just one that makes a case

“Looking for one needle in a mountain of needles” Preserve evidence: Preserving computer evidence is important because data can be destroyed easily

Forensic examiners should assume that every computer has been rigged to destroy evidence

Prepare evidence: Evidence must be able to withstand judicial scrutiny (proper documentation is required). Failing to document where evidence comes from and failing to ensure that it has not been changed can ruin a case.

Judges have dismissed cases because of such failures.

Instructor: Song Huang, Ph.D.Email: [email protected] 352 - Intro to Digital Forensics Week 2: Forensic Methods and LabsAugust 31, 2020 8 / 19

Evidence-Gathering Measures

Avoid changing the evidence: Photograph equipment in place as you find it before you remove it; Transport items carefully, and avoid touching hard disks or CDs; Label wires and sockets so that you can put things back at lab, etc. Determine when evidence was created: You should create timelines of computer usage and file accesses. Timelines can make/break a case. Trust only physical evidence: The 1s and 0s of data are recorded at the physical level of magnetic materials. Search throughout a device: You need to search at this level of 1s and 0s across a wide range of areas inside a computer. Present the evidence well: Forensic examiners must present computer evidence in a logical, compelling, and persuasive manner. A jury must be able to understand the evidence.

Instructor: Song Huang, Ph.D.Email: [email protected] 352 - Intro to Digital Forensics Week 2: Forensic Methods and LabsAugust 31, 2020 9 / 19

Expert Reports An expert report is a formal document that details the expert’s findings. When you do need to write an expert report, it is critical that you do so properly. You should consider several issues:

Format: The first issue is the format of the report. (1) All items, documents, and evidence you considered (2) All tests you performed, analysis done, and your conclusion (3) Entire curriculum vitae (CV) detailing your experience and qualifications for a position, e.g. every publication, award, or credential you have earned.

Thoroughness: In most jurisdictions, if it is not in your report, you are not allowed to testify about it at trial. Anything you leave out may become a problem at trial. Document Trail: document everything. For example, if you performed three tests and all three support a specific conclusion, make sure you list all three tests. Backup Everything: Remember that there is an opposing counsel whose job it is to disagree with you.

Instructor: Song Huang, Ph.D.Email: [email protected] 352 - Intro to Digital Forensics Week 2: Forensic Methods and LabsAugust 31, 2020 10 / 19

How to Set Up a Forensic Lab The detailed specifics of any given lab are based on the needs of the lab, the budget, and the types of cases that lab is likely to handle. General principles apply to all labs are listed below:

Equipment: (1) Adequate storage for the data, e.g. a server with redundancy (minimum of RAID 1 (disk mirroring), but RAID 5 is recommended), and it should be backed up at least once per day. (2) A variety of computers capable of attaching various types of drives, e.g. USB, SCSI, SATA. (3) Power connectors for all types of smartphones, laptops, routers, and other devices.

Security: First and foremost, the machines being examined should not be connected to the Internet. It is also important to have the lab in a room that is shielded from any electromagnetic interference. And limit physical access to the lab. ASCLD: The American Society of Crime Laboratory Directors (ASCLD) regulates how to organize and manage crime labs.

Instructor: Song Huang, Ph.D.Email: [email protected] 352 - Intro to Digital Forensics Week 2: Forensic Methods and LabsAugust 31, 2020 11 / 19

Common Forensic Software Programs

Several software tools are available that you might want to use in your forensic lab. This section takes a brief look at several commonly used tools.

EnCase:EnCase from Guidance Software is a very widely used forensic toolkit. This tool allows the examiner to connect an Ethernet cable or null modem cable to a suspect machine and to view the data on that machine.

The EnCase concept is based on the evidence file, which contains the header, the checksum, and the data blocks. Data blocks are the actual data copied from the suspect machine. The checksum is done to ensure there is no error in the copying of that data and that the information is not subsequently modified.

Instructor: Song Huang, Ph.D.Email: [email protected] 352 - Intro to Digital Forensics Week 2: Forensic Methods and LabsAugust 31, 2020 12 / 19

Common Forensic Software Programs (cont’d)

Forensic Toolkit: The Forensic Toolkit (FTK) from AccessData is another widely used forensic analysis tool that is also very popular with law enforcement.

Forensic Toolkit is particularly useful at cracking passwords, e.g. PDF, Excel, etc. FTK also provides tools to search and analyze the Windows Registry. Windows Registry is where Windows stores all information regarding any programs installed. This includes viruses, worms, Trojan horses, hidden programs, and spyware. The ability to effectively and efficiently scan the Registry for evidence is critical. FTK gives you a robust set of tools for examining email. Another feature of this toolkit is its distributed processing. Scanning disk, search registry and analysis is time consuming, FTK provides processing and analysis can be distributed across up to three computers. This lets all three computers perform the three parts of the analysis in parallel, thus significantly speeding up the forensic process.

Instructor: Song Huang, Ph.D.Email: [email protected] 352 - Intro to Digital Forensics Week 2: Forensic Methods and LabsAugust 31, 2020 13 / 19

Common Forensic Software Programs (cont’d)

OSForensics: This tool has been widely used since about 2010, product from an Australia company. It will do most of what Encase and FTK will do, but lacks a few of those productsâĂŹ specialized features. Helix: Helix is a customized Linux Live CD used for computer forensics. This product is robust and full of features, but simply has not become as popular as AccessData’s FTK and Guidance Software’s EnCase. Kali Linux: Kali Linux (formerly called BackTrack) is a free Linux Live CD that you use to boot a system and then use the tools. It is not used just for forensics, however; it offers a wide array of general security and hacking tools. AnaDisk Disk Analysis Tool: AnaDisk, from New Technologies Incorporated (NTI), turns a PC into a sophisticated disk analysis tool, originally created to meet the needs of the U.S. Treasury Department in 1991. AnaDisk supports all DOS formats and many non- DOS formats, such as Apple Macintosh and UNIX TAR.

Instructor: Song Huang, Ph.D.Email: [email protected] 352 - Intro to Digital Forensics Week 2: Forensic Methods and LabsAugust 31, 2020 14 / 19

Common Forensic Software Programs (cont’d)

CopyQM Plus Disk Duplication Software: CopyQM Plus from NTI essentially turns a PC into a disk duplicator. In a single pass, it formats, copies, and verifies a disk. It copies files, file slack, and unallocated storage space. However, it does not copy all areas of copy-protected disks - extra sectors added to one or more tracks on a CD. The Sleuth Kit: The Sleuth Kit is a collection of command-line tools that are available as a free download. This toolset is not as rich or as easy to use as EnCase, FTK, or OSForensics, but it can be a good option for a budget-conscious agency. Disk Investigator: This is a free utility that comes as a graphical user interface for use with Windows operating systems. It is not a full-featured product like EnCase, but it is remarkably easy to use. It can be useful to use more than one tool to search a hard drive. If multiple tools yield the same result, this can preempt any objections the opposing attorney or his or her expert may attempt to present at trial.

Instructor: Song Huang, Ph.D.Email: [email protected] 352 - Intro to Digital Forensics Week 2: Forensic Methods and LabsAugust 31, 2020 15 / 19

Forensic Certifications

Some people swear by them and won’t even interview a candidate who does not have a few. Other people are convinced they are worthless. A good attitude towards this:

It is meant to demonstrate a baseline of competence. Certification-oriented boot camp is a problem. Regardless of your personal feelings about certifications, it is a fact that they can only help your resume as a forensic analyst. Good background certifications for forensics can include:

PC hardware, e.g. CompTIA A+ certification Basic networking, e.g. CompTIA Network+, Cisco Certified Network Associate certifications. Security, e.g. (ISC)2 CISSP certification, CompTIA Security+ certification Hacking, Certified Ethical Hacker from EC Council, GIAC Penetration Tester (GPEN) from SANS.

Instructor: Song Huang, Ph.D.Email: [email protected] 352 - Intro to Digital Forensics Week 2: Forensic Methods and LabsAugust 31, 2020 16 / 19

Forensic Certifications (cont’d)

Now that you have learned about certifications in general, it’s time to consider specific forensic certifications.

EnCase Certified Examiner Certification: Guidance Software, the creator of EnCase, sponsors the EnCase Certified Examiner (EnCE) certification program. AccessData Certified Examiner: AccessData is the creator of Forensic Toolkit (FTK) and sponsors the AccessData Certified Examiner (ACE) certification program. OSForensics: OSForensics has a certification test that covers a few basics of forensic methodology, but focuses on the use of the OSForensics tool. Certified Cyber Forensics Professional: A test from ISC2. This test is about forensic science, legal principles, and forensic concepts. It does not deal with specific tools.

Instructor: Song Huang, Ph.D.Email: [email protected] 352 - Intro to Digital Forensics Week 2: Forensic Methods and LabsAugust 31, 2020 17 / 19

Forensic Certifications (cont’d)

EC Council Computer Hacking Forensic Investigator: The EC Council Computer Hacking Forensic Investigator (CHFI) certification is a good general forensic certification. High Tech Crime Network Certifications: This specific certification is solid and well designed, including:

Certified Computer Crime Investigator, Basic Certified Computer Crime Investigator, Advanced Certified Computer Forensic Technician, Basic Certified Computer Forensic Technician, Advanced

Global Information Assurance Certification Certifications: The Global Information Assurance Certification (GIAC) certifications are well respected in the IT industry. The company has security, hacking, and forensic certifications.

Instructor: Song Huang, Ph.D.Email: [email protected] 352 - Intro to Digital Forensics Week 2: Forensic Methods and LabsAugust 31, 2020 18 / 19

Chapter Summery

(1) This chapter provided an overview of the forensic process. You examined general concepts as well as specific forensic frameworks. (2) This chapter looked at some widely used forensic tools. Kali Linux, in particular, is a tool you should become familiar with because is it free to use. (3) This chapter also introduces several widely adopted certifications you should know about.

Instructor: Song Huang, Ph.D.Email: [email protected] 352 - Intro to Digital Forensics Week 2: Forensic Methods and LabsAugust 31, 2020 19 / 19