1
00:00:03,060 --> 00:00:07,960
Okay, first of all, let me just let everybody know that I am actually...

2
00:00:07,960 --> 00:00:08,920
Excuse me.

3
00:00:08,920 --> 00:00:10,580
Hey, sound guy, turn it up, dude.

4
00:00:10,880 --> 00:00:15,060
Dude, I yelled at Jeopardy two nights in a row and got trashed two nights in a row.

5
00:00:15,060 --> 00:00:16,780
You're lucky I'm even upright.

6
00:00:17,800 --> 00:00:20,140
No, because we got ripped off!

7
00:00:22,240 --> 00:00:26,840
Okay, first of all, let me let you know that I am not RS.

8
00:00:26,840 --> 00:00:35,620
He was requested by his employer, the man, not to actually give this talk.

9
00:00:35,760 --> 00:00:44,880
So, since I'm a friend of his and I've done some forensic stuff in the past, I'm more of a network monkey than a file system monkey.

10
00:00:45,000 --> 00:00:49,920
And so he asked me if I'd be willing to give this talk so that you guys didn't get screwed out of one talk.

11
00:00:50,300 --> 00:00:53,000
I had no idea he was quite this popular.

12
00:00:53,000 --> 00:00:57,980
I thought it'd be about three of you and my friends who wanted to go drink afterwards.

13
00:00:58,420 --> 00:01:00,080
So here it goes.

14
00:01:05,400 --> 00:01:06,300
Okay.

15
00:01:09,600 --> 00:01:19,420
Basically, the talk that Rob was wanting to give is kind of an intro to file system analysis.

16
00:01:19,420 --> 00:01:22,860
Actually, it won't be in a discussion of analysis.

17
00:01:28,200 --> 00:01:28,820
Okay.

18
00:01:28,820 --> 00:01:29,580
Can you roll them up?

19
00:01:29,580 --> 00:01:32,360
Yeah, can the sound guys just boost it a little?

20
00:01:32,360 --> 00:01:33,240
By sound guy, we mean you.

21
00:01:33,240 --> 00:01:34,960
Can you slap the pots?

22
00:01:34,960 --> 00:01:35,400
No?

23
00:01:35,480 --> 00:01:36,000
No.

24
00:01:36,140 --> 00:01:36,720
All right.

25
00:01:37,060 --> 00:01:38,100
Can I walk over there and do it?

26
00:01:38,100 --> 00:01:38,880
Is that better?

27
00:01:39,380 --> 00:01:42,120
Can everybody here at this point still know?

28
00:01:45,460 --> 00:01:46,480
How about now?

29
00:01:48,040 --> 00:01:48,760
Can you hear me now?

30
00:01:48,760 --> 00:01:49,080
Wow .

31
00:01:49,320 --> 00:01:50,160
Can you hear me now?

32
00:01:51,880 --> 00:01:53,520
Hey, it's a Verizon commercial.

33
00:01:53,680 --> 00:01:54,180
Okay.

34
00:01:56,100 --> 00:02:25,800
Basically, the talk that Rob has asked me to present today is essentially a very basic introduction into how to properly acquire data from a potentially compromised system or a suspect system and the legal aspects of what you have to keep in mind when you want to ensure that you have everything done properly when presenting it in a court of law.

35
00:02:27,020 --> 00:02:31,000
So, I will do my best to get through the slides.

36
00:02:31,000 --> 00:02:37,520
If you ask me a question that I cannot answer, hopefully Rob is around here somewhere and he will unofficially answer your question.

37
00:02:39,420 --> 00:02:40,680
But here we go.

38
00:02:40,680 --> 00:02:41,040
All right.

39
00:02:41,040 --> 00:03:04,840
Basically, the most important thing you need to keep in mind is that when you have a system that you suspect has been tampered with or has something that you're interested in checking, you have to ensure that you do not alter or contribute to the modification of files on that file system.

40
00:03:05,760 --> 00:03:08,980
Because that's the first way...

41
00:03:08,980 --> 00:03:13,760
Anytime you actually open a file, you modify it, whether you realize it or not.

42
00:03:13,760 --> 00:03:16,160
You change the access times.

43
00:03:16,160 --> 00:03:22,140
You change quite a lot of very subtle metadata associated with that file.

44
00:03:22,140 --> 00:03:34,200
So, it's important that you follow certain very, very strict procedures to try and intrude as little as possible on the suspect system.

45
00:03:35,540 --> 00:03:38,600
Oh, and by the way, the typos are not mine.

46
00:03:42,140 --> 00:03:56,320
So, one of the first things you have to consider is whether or not, if it's a running system, you have to actually look at the entire aspect of what the system is doing.

47
00:03:56,340 --> 00:03:59,200
You have to consider, is it connected to a network?

48
00:03:59,240 --> 00:04:00,320
Is it currently powered up?

49
00:04:00,320 --> 00:04:01,260
Is it powered down?

50
00:04:01,260 --> 00:04:06,320
If it's powered up, is there data that's actually held in memory that you want to try and access?

51
00:04:09,320 --> 00:04:13,720
Because some people, when they tamper a system, will leave a trojan behind.

52
00:04:13,820 --> 00:04:25,000
And as soon as they see some sort of shutdown procedure or whatever, it will remove whatever data you might have actually been interested in.

53
00:04:25,000 --> 00:04:37,760
So, you have to actually be very careful about not doing something without thinking through thoroughly first what may be the ramifications of what you're doing.

54
00:04:46,780 --> 00:04:53,820
But as Rob says here, actually you only get one chance to do it right.

55
00:04:54,620 --> 00:05:06,100
Because, as I mentioned previously, if the system has been trojaned, there's a good possibility that if you're not careful and you do the wrong thing, you lose everything you were actually interested in.

56
00:05:06,980 --> 00:05:15,940
There's many, many ways to actually acquire the data without modifying it too much.

57
00:05:15,940 --> 00:05:22,100
I personally, some of the things that Rob has in here, I haven't used because, frankly, I'm a Unix bigot.

58
00:05:26,900 --> 00:05:32,180
Also, every intrusion is a unique situation.

59
00:05:32,180 --> 00:05:43,500
I mean, it could be a standalone system, we could be talking about ATMs, it could be a system that's connected to a network, it could be a multi-home system, you don't know.

60
00:05:43,500 --> 00:05:54,750
So, you actually have to be very careful and document your entire data acquisition process.

61
00:05:55,160 --> 00:06:05,860
And by documentation, I actually mean photographs, notes, as well as acquiring the actual file system data that you're interested in.

62
00:06:06,840 --> 00:06:26,740
Basically, what the talk will cover is what are you actually trying to accomplish with the forensic acquisition of the file systems and what things can make that difficult or impossible, depending on how badly you screw up.

63
00:06:29,520 --> 00:06:50,060
We will also cover the proper preparation of evidence media so that it is admissible in court and, if done correctly, doesn't get struck down or mitigated, as well as the proper handling of the suspect system.

64
00:06:50,060 --> 00:06:59,360
You're not actually going to utilize the potentially compromised system for anything more than acquiring a copy of the data off of it.

65
00:06:59,900 --> 00:07:16,360
And then, at that point, you will enter the suspect media into your chain of custody so that you can have a very distinct trail of who has had access to the suspect media and when and what was performed.

66
00:07:16,360 --> 00:07:35,560
So, this is all basically required for your court cases to ensure that there is no doubt that whatever was being alleged to have been found on the suspect media was not put there by you or somebody else involved in the prosecution.

67
00:07:37,140 --> 00:07:40,480
There's actually multiple ways to do it, as I mentioned earlier.

68
00:07:40,480 --> 00:07:45,940
There are hardware solutions for accessing a copy of the data on the suspect media.

69
00:07:45,940 --> 00:07:51,240
There are also software mechanisms for doing the same thing.

70
00:07:51,900 --> 00:08:00,260
They all have certain abilities that make them unique, and they all have their limitations.

71
00:08:00,260 --> 00:08:09,460
So, you may actually want to use more than one method to acquire your suspect media data for later analysis.

72
00:08:09,460 --> 00:08:21,400
And the other thing you're probably going to want to do is use some kind of integrity verification mechanism.

73
00:08:21,400 --> 00:08:36,000
Generally, that would be a cryptographic hashing that you would take of the file system image so that you can further prove that it has not been tampered or altered in any way since you acquired the data.

74
00:08:37,120 --> 00:08:40,640
I am not a lawyer, and Rob also is not a lawyer.

75
00:08:41,160 --> 00:08:45,860
So, do not consider this talk as legal advice or legal opinion.

76
00:08:46,700 --> 00:08:54,740
Neither of us actually speak for anyone other than ourselves, and most often we don't do that very well.

77
00:08:55,280 --> 00:09:03,900
So, if you actually want to do these things, if you do it in the privacy of your own home or whatever, that's fine.

78
00:09:03,900 --> 00:09:20,660
If you decide after sitting through this talk that you're now a forensic specialist, and you go and try and perform a data acquisition on a suspect's system at your work, and you screw up the boss's computer and he's pissed off, not my fault.

79
00:09:21,160 --> 00:09:32,760
So, you really ought to check with the policies of your organization, your IT staff, your legal staff, before using any of these tools in an investigation.

80
00:09:32,760 --> 00:09:51,880
And I, frankly, would suggest that you spend a lot of time doing this before you even think you're going to do it properly, because it is a very exact and very precise process that must be followed in order to not taint the data that you're going to present in court.

81
00:09:53,400 --> 00:10:03,220
This is basically a glossary of terms that you should be familiar with to make the talk a little bit more understandable.

82
00:10:03,220 --> 00:10:15,840
By digital evidence, basically that is the file system on the suspect system that you're trying to acquire.

83
00:10:16,500 --> 00:10:27,540
Suspect or original drive, suspect media or original drive media is basically the possibly tainted system or the possibly malicious system that you're interested in.

84
00:10:27,540 --> 00:10:47,990
Forensics media or evidence drive or media is basically the tools that you will use to acquire the... it's basically the system that you will use to actually acquire the data off the suspect system.

85
00:10:49,210 --> 00:10:58,790
Acquisitions and imaging, basically that's two different terms for grabbing all the data off the suspect system.

86
00:10:59,570 --> 00:11:12,870
Imaging is just basically creating one or more image files of the suspect system that are a bit-for-bit copy so that you get everything, not just the files that are on there, you get the slack space.

87
00:11:13,970 --> 00:11:18,870
Many people don't actually realize that when you delete a file, you're not actually erasing that file.

88
00:11:18,890 --> 00:11:29,530
What you're doing is deleting an entry in a master database on the drive that says it's okay to overwrite this space on the drive, but that doesn't necessarily happen right away.

89
00:11:30,570 --> 00:11:40,190
And not only that, when you copy a file, you quite often don't copy just what you think you're copying.

90
00:11:40,190 --> 00:11:55,650
If you open up a document and you write a couple of things into it and then save it and then you open it up later and delete one of those things because you decide that whoever you're giving the document to has no reason to know that stuff, that data is actually still lying around.

91
00:11:55,650 --> 00:12:03,430
So when you copy that file over somewhere else, what you thought you deleted is actually still there in what's called slack space.

92
00:12:03,430 --> 00:12:16,570
And so you have to be very, very careful about imaging the entire file system so that you get things that are in slack space that may actually be pertinent to what you're interested in.

93
00:12:18,550 --> 00:12:19,510
Okay.

94
00:12:20,090 --> 00:12:21,830
The next thing is chain of custody.

95
00:12:21,830 --> 00:12:44,490
Chain of custody is basically nothing more than a hard copy of every individual who's had access to the suspect system as well as the forensic media system and what they did and when they did it and things like that because these have to be... the chain of custody is an admissible item in a court case.

96
00:12:44,490 --> 00:12:47,030
Verification hashes and checksums.

97
00:12:47,030 --> 00:13:11,350
That's what I mentioned earlier about wanting to create a hash to check the integrity of your acquisition file system so that you can prove it's not been tampered with.

98
00:13:11,350 --> 00:13:32,810
The integrity has not been tainted at all on your system because if everybody in a particular area has access to your forensic acquisition system, then you can't prove that somebody hasn't altered that to modify whatever data you're trying to acquire to hide whatever they're interested in hiding.

99
00:13:32,810 --> 00:13:50,010
Trusted forensics... the trusted forensic environment just basically means having a means of proving that your acquisition system is exactly what you think it is and nothing more.

100
00:13:50,290 --> 00:13:51,910
Original copies and work copies.

101
00:13:51,910 --> 00:13:52,730
Basically the way...

102
00:13:52,730 --> 00:13:54,870
If they can't figure that out, they're pretty weak, dude.

103
00:13:54,870 --> 00:13:55,430
I know.

104
00:13:55,430 --> 00:14:04,210
But basically the way you do it is you never actually want to do any analysis on your suspect system.

105
00:14:04,210 --> 00:14:09,210
You want to capture all the data from the suspect system onto a separate piece of media.

106
00:14:09,210 --> 00:14:21,830
That separate piece of media actually then is what gets admitted to court and quite often you will have that as your means of analysis too.

107
00:14:21,830 --> 00:14:39,190
So what happens is you basically capture all the data off the suspect system and once you've done so and the system has been entered into the chain of custody, then that suspect system is placed in a locked space where nobody has access to it anymore.

108
00:14:40,290 --> 00:14:45,230
Okay, it does not fully cover acquiring volatile system information.

109
00:14:45,690 --> 00:14:56,310
Basically there's only slight information here on how to actually capture data that resides in memory on a running system.

110
00:14:57,170 --> 00:15:05,790
There's too many different systems and too many different ways to actually do it in a 50 minute talk to adequately explain all this.

111
00:15:07,410 --> 00:15:28,330
Quite often when you're trying to grab data from memory, your system will write out temporary files and things like that to the file system so you have to be very careful that when you're trying to grab volatile data, you're not modifying the file system that you're interested in as well.

112
00:15:29,970 --> 00:15:38,530
The third point is, as I said, it's a very exacting process.

113
00:15:38,530 --> 00:15:47,350
So you want to make sure that you know exactly what you're going to do and carefully step through those.

114
00:15:47,350 --> 00:15:49,210
Don't take any shortcuts.

115
00:15:49,210 --> 00:16:01,430
And frankly, when I have done forensic acquisitions or some of my staff, I will actually have a written set of steps and insist that they follow them.

116
00:16:01,430 --> 00:16:12,930
No matter how many times they've done it, that's the only really way you can carefully not miss something or potentially taint the system you're interested in.

117
00:16:15,490 --> 00:16:27,850
Examples of volatile data would be run time and performance stats, which is basically in most Unix systems, things in the pseudo-proc file system.

118
00:16:27,890 --> 00:16:35,670
Time, date, time zone settings, all these things are volatile because some of them are easily changed.

119
00:16:35,670 --> 00:16:56,870
The active running process listings is another volatile thing, because as I mentioned earlier, if there's a Trojan and you trigger that Trojan, it may either stop running whatever process that it was running that you were probably interested in, or if some of you have attended the Rootkit talks,

120
00:16:56,870 --> 00:17:03,110
you'll see that they can hide those processes, keep them running, but you won't be able to actually find them.

121
00:17:03,110 --> 00:17:09,070
Logged in user listings, that obviously is for a network-connected system.

122
00:17:10,310 --> 00:17:13,130
Open files, libraries, DLLs in use.

123
00:17:13,130 --> 00:17:26,270
Basically, it's different for every system, but you can easily find all the files that are currently in use through the system processes.

124
00:17:26,270 --> 00:17:44,230
And again, if you're not careful, if there's a Trojan or if it's a network-enabled system and the person that is doing what you're interested in is actually online and finds out, they may stop what they're doing, unload any libraries that are being used by whatever process they're doing,

125
00:17:44,230 --> 00:17:49,690
and you will lose data that you potentially need in your prosecution.

126
00:17:49,690 --> 00:17:57,090
Network activity, again, obviously, for a network-enabled system is what actually is going on.

127
00:17:57,390 --> 00:18:16,910
If you walk up to the system and immediately pull the network cable out of it, you may actually lose data that you're interested in for your prosecution, because that may trigger whatever network system process was going on to either stop or, well, obviously it won't be communicating anymore.

128
00:18:16,910 --> 00:18:19,850
And that may trigger it to stop or hide itself.

129
00:18:20,070 --> 00:18:30,830
Perhaps the data you're actually interested in is an ongoing streaming of pornographic material or illegal file-sharing activities.

130
00:18:30,830 --> 00:18:36,750
And if you're not careful, those things that you need to acquire may stop.

131
00:18:36,750 --> 00:18:44,990
It goes back to being very careful about following your steps and not deviating from those.

132
00:18:47,010 --> 00:18:50,090
I'm going to move on.

133
00:18:51,790 --> 00:19:00,610
We're not going to cover cellular phones, PDAs, wireless and wired network communications, wireless programmable keyboards and EEPROMs.

134
00:19:00,610 --> 00:19:04,650
It would just simply take too long, and obviously I'm taking too long as it is.

135
00:19:09,250 --> 00:19:18,190
The first bullet up here is actually something that is quite often overlooked by people that don't do this all the time.

136
00:19:19,290 --> 00:19:35,450
It is potentially a crime scene, so you want to make sure that if you're going in and looking at the system, you want to ensure that if you start tapping away on the keyboard, you're not destroying fingerprint evidence that might be there.

137
00:19:35,450 --> 00:19:53,530
As I mentioned before, you definitely want to document the entire area that you're working in photographically, so that if somebody comes up and says, well, that wasn't my system, you have visual evidence that whatever they're claiming is probably not true.

138
00:19:53,530 --> 00:20:07,870
You want to take a look at every cable connection, whether the system is network-enabled, if it's connected to a wireless network, if it's connected to a Cat5 fiber network, if it's multi-home, if there are modems.

139
00:20:07,930 --> 00:20:14,330
You want to carefully document all that, both in written form and in photographic form.

140
00:20:15,150 --> 00:20:30,610
And consider every incident as if it's going to trial, which basically goes back to set up a certain set of steps to follow and don't deviate from them regardless.

141
00:20:30,610 --> 00:20:36,170
Because if it goes to trial, you're going to need all the evidence that you gather.

142
00:20:36,170 --> 00:20:38,230
If it doesn't go to trial, it's no big deal.

143
00:20:38,230 --> 00:20:41,970
Having more evidence is actually a good thing.

144
00:20:43,530 --> 00:20:49,230
Yes, do not examine your evidence at all until you've properly made a forensic image.

145
00:20:50,190 --> 00:21:00,290
The reason that he says that is basically because if you're not careful, you will taint the data by altering access times and things like that.

146
00:21:00,290 --> 00:21:19,470
So you want to make sure that you have a complete and thorough forensic image so that if somebody questions something, you can actually go back and acquire a second copy of the suspect data without having to access the suspect system.

147
00:21:20,810 --> 00:21:27,390
You should try to interact with the system as little as possible.

148
00:21:27,390 --> 00:21:32,350
If you have to sit down at the suspect system itself, you need to be very careful.

149
00:21:32,550 --> 00:21:41,370
Generally, you want to not ever do anything or attempt to check anything on the suspect system.

150
00:21:41,370 --> 00:21:43,590
You want to actually make a copy instead.

151
00:21:45,790 --> 00:21:58,050
And again, store everything in a safe location, which basically, generally for me, since I work for the government, and yes, you can spot the fed now, it means a GSA safe with a high security lock.

152
00:21:58,050 --> 00:22:11,750
That's another means that gets documented in the chain of custody that proves that it was difficult, if not impossible, for someone to have tainted the system data that you're presenting in your court case.

153
00:22:16,740 --> 00:22:20,140
Pretty much all this just really says is to keep track of what you fucking do.

154
00:22:20,140 --> 00:22:29,180
I mean, if you're ever going into a government investigation, you're going to be working with people who have done other types of investigations, mostly physical, and you just need to make sure you don't taint the digital data.

155
00:22:29,180 --> 00:22:34,460
The chain of custody is exactly the same for physical data as digital data, as long as you don't taint it.

156
00:22:35,020 --> 00:22:42,300
All these things are just reiterating how you have to be careful not to taint what you have, not to modify anything, and only work on copies of it.

157
00:22:42,300 --> 00:22:52,660
It's a very simple concept where anyone who's ever blown out some data on your home, or on any machine you're working on, back up first, work on your backups, don't work on the true copies, and it's just very important forensic analysis.

158
00:22:53,020 --> 00:22:57,420
Right, and the first two kind of reiterate what I've already beaten to death.

159
00:22:57,420 --> 00:23:06,220
But, now collate mail, DNS, and other network and service logs to support and verify your findings.

160
00:23:06,220 --> 00:23:09,980
Not everything you're interested in is actually right there on the suspect's system.

161
00:23:09,980 --> 00:23:23,540
You may actually have network processes like mail being sent out if the system is taken over by a bulk mail or whatever, and you're going to find corroborating evidence on other systems on that network.

162
00:23:23,540 --> 00:23:30,380
So, don't just consider the suspect's system as the sole thing to be investigated.

163
00:23:30,980 --> 00:23:34,020
And always be able to verify the integrity of your evidence.

164
00:23:34,020 --> 00:23:43,300
That basically means be very careful about creating your file system images, and then create cryptographic hashes of them.

165
00:23:43,300 --> 00:23:54,460
Whether you use MD5, SHA1, whatever, you need to be able to prove at some point that nothing on the suspect's system has been altered.

166
00:23:56,040 --> 00:24:00,880
Yes, never use a tool you're not familiar with on live or original evidence.

167
00:24:00,880 --> 00:24:09,320
Again, this just basically says, if you don't know how the system works, then find someone else, find an adult to help you.

168
00:24:10,880 --> 00:24:14,060
Or a 12-year-old boy, or a 12-year-old girl, man.

169
00:24:15,600 --> 00:24:19,540
Okay, this is some more of the documentation.

170
00:24:19,560 --> 00:24:23,340
You want to itemize all the actual hardware involved.

171
00:24:23,740 --> 00:24:36,420
With the physical context, I mean, you want to sit down at some point after you've gotten your file system data off, and document the actual computer system that's involved, or systems.

172
00:24:36,420 --> 00:24:46,980
And you'll want to actually, as the example that's given here, you're going to want to actually document everything that uniquely identifies every piece of hardware in that system.

173
00:24:47,540 --> 00:24:50,260
Basically, it's just be incredibly anal.

174
00:24:51,080 --> 00:25:03,680
Because a defense lawyer is going to challenge everything possible, and you have to be very careful and capable of proving that nothing has been changed, nothing has been swapped out, nothing has been modified or tainted.

175
00:25:04,340 --> 00:25:18,540
Logical context is basically, on a Unix system, for example, or even on a Windows box, all the mounted file systems, whether they're network mounts, whether they're local mounts, whatever.

176
00:25:18,540 --> 00:25:34,640
You want to actually document all the logical things as well to, again, prove that when they see the suspect system in court, that it's exactly the way it was when you began your forensic investigation.

177
00:25:36,040 --> 00:25:56,480
Because you will be, if it goes to trial, you will end up testifying as to exactly what you did, how you did it, and why what you did hasn't caused the data that's being entered into the legal record to be tainted or suspicious.

178
00:25:57,020 --> 00:26:01,340
Chain of custody quite often will be challenged.

179
00:26:01,520 --> 00:26:06,340
That's why you need to keep a very full chain of custody, very thorough, yes.

180
00:26:10,190 --> 00:26:11,630
Have to be what?

181
00:26:13,050 --> 00:26:22,950
Ah, the question is, does the person doing the data acquisition have to be an independent person so that there's no conflict of interest?

182
00:26:23,690 --> 00:26:27,270
Well, it really depends on the situation.

183
00:26:27,270 --> 00:26:41,190
I mean, if it's, in Rob's case, basically, he works for Health and Human Services, and they quite often have to deal with, you know, potential medical fraud and things like that.

184
00:26:42,070 --> 00:26:47,070
So they're not letting the IT staff of the office investigate that.

185
00:26:47,070 --> 00:26:56,390
And yes, quite often you want to make sure that the person is independent, because if you can't trust your forensic investigator, then how can you trust the evidence that's being given to you to take the trial?

186
00:26:56,390 --> 00:27:02,750
So yeah, you would want to make sure it's an independent individual or company.

187
00:27:03,730 --> 00:27:22,630
Quite often, though, in large companies, they will have, you know, a data security team and a forensics team that, while they work for the same company, they have no vested interest in protecting any particular person in that company.

188
00:27:22,630 --> 00:27:27,490
So essentially, they are independent as much as a company employee could be.

189
00:27:27,950 --> 00:27:34,310
But yeah, I mean, if you have the chance to get somebody who's independent totally from the outside, yeah, that's probably the best way to do it.

190
00:27:37,200 --> 00:27:38,080
There's one question.

191
00:27:38,080 --> 00:27:42,360
We do need to bang through this stuff pretty fast, but let's hit the question real quick, and then we'll bang through it fast.

192
00:27:42,460 --> 00:27:43,200
What's your question?

193
00:27:54,480 --> 00:27:55,600
Correct.

194
00:27:57,020 --> 00:28:14,840
Documenting the hardware and everything is, if I didn't make that clear, you would actually do that after you've already assured that you've acquired all the data you're interested in on the suspect system, all the file system data, all the volatile data and everything,

195
00:28:14,840 --> 00:28:29,980
and you're convinced that, okay, there's nothing else I want to, you know, I will need to gather from this running system or this system, you know, I'm interested in, now I can actually begin to document the components of the system itself.

196
00:28:29,980 --> 00:28:44,300
So yes, that will come at the very end, because as Rob pointed out to me, some of the things that he investigates, it's physicians' offices, and they can't afford to have the potentially compromised system removed from the office.

197
00:28:44,300 --> 00:29:01,060
So, you know, basically you have to try and document everything, and then get a verifiable forensic image, and then leave the actual suspect system, you know, running in that office, because you can't.

198
00:29:01,600 --> 00:29:03,300
So, all right.

199
00:29:04,320 --> 00:29:07,520
Some of the things that you basically need to understand is...

200
00:29:07,520 --> 00:29:12,580
I think everybody in here, if they don't understand a partition table and file system, they need a beating.

201
00:29:12,580 --> 00:29:16,640
Well, do you guys want me to go over file system?

202
00:29:16,640 --> 00:29:17,120
Okay.

203
00:29:17,120 --> 00:29:17,900
Then we'll move through.

204
00:29:17,900 --> 00:29:18,460
Fine.

205
00:29:18,460 --> 00:29:18,960
No problem.

206
00:29:18,960 --> 00:29:20,080
Yeah, all that stuff.

207
00:29:20,080 --> 00:29:20,500
Partition files is possible.

208
00:29:20,500 --> 00:29:24,580
Hey , if something is basically beating a dead horse, let me know, because...

209
00:29:26,880 --> 00:29:28,080
Thank you.

210
00:29:28,780 --> 00:29:32,300
You know, keep in mind, we were in jeopardy two nights in a row.

211
00:29:32,840 --> 00:29:34,040
Beer is evil.

212
00:29:34,400 --> 00:29:35,780
No, it's beautiful.

213
00:29:35,780 --> 00:29:36,640
All right.

214
00:29:38,200 --> 00:29:39,000
Your goals.

215
00:29:39,000 --> 00:29:42,120
Basically, you want to make an exact copy of the backup.

216
00:29:42,280 --> 00:29:44,680
Basically, this is more beating a dead horse, it looks like.

217
00:29:45,480 --> 00:29:46,380
Yep, skip that one.

218
00:29:46,940 --> 00:29:48,000
All right, don't fuck with it.

219
00:29:48,000 --> 00:29:49,420
I got plenty of tools, yeah.

220
00:29:49,660 --> 00:29:50,760
Well, I've only...

221
00:29:50,760 --> 00:29:51,760
Hit the second part.

222
00:29:52,220 --> 00:29:52,960
All right.

223
00:29:54,040 --> 00:29:54,760
Yeah.

224
00:29:55,640 --> 00:30:03,380
One thing that you have to keep in mind, a lot of drives now will have host protected area, you know, device configuration overlays, things like that.

225
00:30:03,380 --> 00:30:14,420
And you have to be very careful with your tools to ensure that when you're acquiring data off the actual hard drive file system, that you're getting the entire contents of the file system.

226
00:30:14,420 --> 00:30:21,780
That you're not missing some portions of the system that are being hidden by the BIOS or the drive BIOS.

227
00:30:24,280 --> 00:30:31,780
In older Linux 2.4 ones, for example, some of the hard drives with odd number of sectors would...

228
00:30:33,480 --> 00:30:43,420
If you weren't careful about how you acquired that file image, you would actually miss a portion of the drive because the drive itself would report back that it was smaller than it really was.

229
00:30:46,340 --> 00:30:49,700
Tool needs to be tested by an independent entity.

230
00:30:49,700 --> 00:30:53,840
Basically, don't write your own forensic tools is all this says.

231
00:30:54,320 --> 00:31:06,300
Go use something that has been proven to work and proven to do exactly what you want and what you expect so that you can back that up in a court of law.

232
00:31:08,600 --> 00:31:10,020
More dead horse.

233
00:31:11,200 --> 00:31:14,880
One other thing, preparation of the forensic hard drive.

234
00:31:14,880 --> 00:31:28,980
Basically, the drive that you're going to use, drive or tape, that you're going to use as a copy of the suspect system, you want to wipe that drive before you actually use it.

235
00:31:28,980 --> 00:31:34,920
And as is suggested here, you want to wipe it with a known pattern.

236
00:31:34,920 --> 00:31:39,860
You don't want to use like dev random because you don't want random stuff overriding that drive.

237
00:31:39,860 --> 00:31:52,660
You want to use something like dev zero so that it's all zeros so that you can guarantee that everything that gets put on that drive was put on that drive when you did so.

238
00:31:52,720 --> 00:31:54,620
None of it was pre-existing.

239
00:31:56,240 --> 00:31:58,880
And this basically ensures that.

240
00:31:58,880 --> 00:32:03,620
And this will also be part of your documented investigation notes.

241
00:32:04,140 --> 00:32:05,280
All right.

242
00:32:05,380 --> 00:32:18,580
And again, some of the host protected area and things like that, you have to make sure that whatever tool you're using to format the drive prior to using it will actually overwrite those areas as well.

243
00:32:19,920 --> 00:32:21,860
This is how to do it.

244
00:32:22,440 --> 00:32:24,420
Yeah, read the CD if you don't want to wipe your drive.

245
00:32:24,420 --> 00:32:35,480
Yeah, DBAN is a very nice CD-ROM based system that will work on both x86 and Macs if you have to deal with a Mac OS system.

246
00:32:35,880 --> 00:32:47,880
Gdisk, these are basically just a lot of known trusted tools for properly wiping the forensics acquisition system before you actually begin to use it.

247
00:32:51,400 --> 00:32:52,620
All right, yeah.

248
00:32:52,660 --> 00:32:59,220
Basically, DD, the nice thing about DD is that, you know, it does a bit for a bit of coffee.

249
00:32:59,220 --> 00:33:08,300
And then afterwards make a cryptographic hash to prove that later, I'll get to you, to prove that nothing has changed.

250
00:33:08,300 --> 00:33:39,100
The CryptCat and NetSea, which is actually NetCat, there's a way, if your system is running and you need to access, you want to save the stuff on a forensic system that's actually on a network or somewhere else, you can pipe the output from DD to NetCat so that you're actually not storing your acquired image locally anywhere.

251
00:33:39,100 --> 00:33:48,960
You're actually storing it somewhere else, which is another means of ensuring that you don't modify anything volatile or existing on the file system.

252
00:33:49,500 --> 00:33:51,360
Yeah, you had a question back there?

253
00:33:51,360 --> 00:33:51,600
That

254
00:33:55,950 --> 00:33:59,050
is true.

255
00:33:59,070 --> 00:34:03,210
And I'll go back to the first caveat, which is this is not my slide.

256
00:34:03,970 --> 00:34:05,270
Yeah, we'll get there later in the slide.

257
00:34:05,270 --> 00:34:06,350
We'll spank through them pretty quick.

258
00:34:06,350 --> 00:34:07,190
All right.

259
00:34:08,150 --> 00:34:11,210
Quite often, quite often, if you're doing this by hand, it's a slow process.

260
00:34:11,210 --> 00:34:18,810
There are hardware systems that will image the drives thoroughly that will do it very well and far more quickly.

261
00:34:21,450 --> 00:34:22,530
Let's see.

262
00:34:22,530 --> 00:34:26,090
Basically just saying in real life you run across shit that you're not expecting.

263
00:34:26,090 --> 00:34:28,150
You're not going to run into the perfect scenario every time.

264
00:34:28,290 --> 00:34:30,190
And because of that, shit happens.

265
00:34:30,290 --> 00:34:32,450
Your hardware may not work right.

266
00:34:32,450 --> 00:34:34,970
You may go to plug into a port that's busted.

267
00:34:35,130 --> 00:34:37,070
The keyboard may be cracked in half.

268
00:34:37,070 --> 00:34:38,390
You never know what's going to happen.

269
00:34:38,490 --> 00:34:40,210
Sometimes shit happens.

270
00:34:40,210 --> 00:34:42,270
So cover your ass.

271
00:34:42,590 --> 00:34:43,030
Yeah .

272
00:34:44,770 --> 00:34:45,650
No.

273
00:34:46,170 --> 00:34:47,410
No, never yank the power.

274
00:34:47,410 --> 00:34:51,490
If you just yank the power, you're losing so much of all the information, you're screwed.

275
00:34:51,490 --> 00:34:51,950
Yeah.

276
00:34:52,370 --> 00:34:56,350
Yanking the power, everything that was being held in RAM, gone.

277
00:34:56,810 --> 00:35:07,970
And if you sat in on the rootkit talks that were presented here, there are actually rootkits now that live in RAM, live in memory solely.

278
00:35:07,970 --> 00:35:08,950
And you'll lose that.

279
00:35:08,950 --> 00:35:10,410
You'll lose all evidence of it.

280
00:35:11,330 --> 00:35:12,630
Well, it depends on what you do.

281
00:35:12,630 --> 00:35:15,370
And if you are going to shut down, if you can do your data removal first.

282
00:35:15,630 --> 00:35:19,850
It's all in the path of every machine is different and what you can do is different in every situation.

283
00:35:19,850 --> 00:35:23,610
In some situations, you'll walk in there and be able to just image everything, including the RAM.

284
00:35:23,630 --> 00:35:27,530
In some situations, you'll walk in there and some guy will start shooting at you and put a bolt through his computer.

285
00:35:27,650 --> 00:35:29,190
Different situation, different times.

286
00:35:30,010 --> 00:35:30,610
Right.

287
00:35:31,650 --> 00:35:36,550
You obviously don't want to install your forensic environment on the suspect system.

288
00:35:36,810 --> 00:35:44,790
So what you want to do... some people actually use the suspect system to create copies of the suspect system.

289
00:35:44,790 --> 00:35:48,230
I personally don't prefer that that be done.

290
00:35:48,350 --> 00:35:58,810
But one way to do so is to have a bootable DOS Linux or BSD disk that has been designed specifically for forensic use.

291
00:35:58,810 --> 00:36:03,470
And I believe he has examples of some of those as we go along.

292
00:36:03,470 --> 00:36:15,870
ImageMaster is one that actually has a pre-configured, I think it's a Win98 environment, that has actually been modified specifically for forensic use.

293
00:36:16,470 --> 00:36:23,930
Knoppix is a reasonably user-friendly method for doing this, although there are caveats.

294
00:36:23,930 --> 00:36:38,250
You have to throw the noswap command line at your kernel bootup, because otherwise one of the problems with some of the Knoppix systems is that basically if it finds swap space, it'll try mounting it.

295
00:36:38,270 --> 00:37:00,330
And when it goes and starts looking at all the drives attached to the system that it's booting, when it finds your suspect file system, if it finds the swap space on there, it's going to go ahead and bring it up, at which point you're losing the integrity of some of the data on that file system.

296
00:37:01,050 --> 00:37:11,250
Older versions, and if you do use Knoppix, you need to be very, very careful to make sure you use one of the more recent releases, because older versions do have some issues.

297
00:37:11,270 --> 00:37:17,590
For example, some of the older ones, even if you gave the noswap command to the command line, it would just happily ignore it.

298
00:37:20,110 --> 00:37:27,010
And the caveat of being not just because the version is newer doesn't mean that it doesn't have a different bug that will affect you.

299
00:37:27,010 --> 00:37:42,890
So never actually go fire up Knoppix to do your forensics without actually having done it somewhere else first, so that you, again, have a trusted forensic environment, and you know exactly how it's going to act and what's going to happen, so that you can protect the integrity of the suspect system that you're interested in.

300
00:37:45,290 --> 00:37:52,430
Again, this just goes over some of the basics of how to build the forensics system environment.

301
00:37:52,450 --> 00:37:57,590
Yeah, go to those links if you want to get good shit.

302
00:37:57,590 --> 00:37:58,150
Yeah.

303
00:38:00,270 --> 00:38:05,290
Modcom, I believe, is a DOS-based one, which is actually pretty good.

304
00:38:05,290 --> 00:38:15,070
NCase, the forensics version of NCase, the licensing doesn't actually require you to pay for it.

305
00:38:16,110 --> 00:38:17,690
More stuff, just go to all these sites.

306
00:38:17,690 --> 00:38:18,210
Sure.

307
00:38:18,210 --> 00:38:20,150
Fire is actually a Knoppix-based one.

308
00:38:20,150 --> 00:38:26,970
These are all URLs, and I believe they will have Rob's slides up on the DEF CON site, so you can get them from there.

309
00:38:26,970 --> 00:38:30,450
I saw some of the Penguin Sleuthgate guys around here.

310
00:38:31,530 --> 00:38:32,570
Let's see.

311
00:38:32,570 --> 00:38:34,590
These are commercial hardware solutions.

312
00:38:34,590 --> 00:38:48,330
These are systems that actually will do the data acquisition for you, but it's a hardware device, which, as was mentioned earlier, depending on how big the suspect file system is, it could take hours.

313
00:38:48,330 --> 00:39:08,810
And some of these systems have been built and optimized to the point where they, like ImageMaster, I believe will get a throughput of something like two gigs, like two gigs a minute, and on a large drive, that's kind of nice, rather than taking a day or two.

314
00:39:08,810 --> 00:39:22,450
Just as a side note, I personally don't do data forensics, but a division of the company I work for does, and we just released a press release, which, I don't know what the fuck it means, I don't know what a computer does, hell, but we evidently did five terabytes of data in under 24 hours,

315
00:39:22,450 --> 00:39:27,070
and did forensic analysis and everything else, so they say that's good, but that sounds like a lot of data to me.

316
00:39:27,430 --> 00:39:29,670
That would take a hell of a long time with some of those other solutions.

317
00:39:30,750 --> 00:39:32,590
And just more.

318
00:39:34,550 --> 00:39:53,170
These are just examples of, if you're using a tape system, for example, if you have a RAID system and you need to get some data from a previous day for your investigation, these are methods that you can use to actually read data off the tape to put it onto your forensic environment for analysis later.

319
00:39:56,010 --> 00:40:01,030
These are other means of creating your forensic media.

320
00:40:01,430 --> 00:40:03,590
Hardware write blockers.

321
00:40:03,730 --> 00:40:13,430
This is basically a hardware solution to ensure that you don't actually modify the suspect drive.

322
00:40:14,270 --> 00:40:20,130
I personally use a Unix environment so that I can mount the suspect system read-only.

323
00:40:20,130 --> 00:40:24,370
That's not always possible with Windows systems.

324
00:40:27,680 --> 00:40:34,100
Again, here's just examples of software write blockers.

325
00:40:36,780 --> 00:40:46,160
One of the things you want to do is, possibly you may be having to acquire a RAID image.

326
00:40:46,160 --> 00:40:57,520
So you're going to want to have your forensic system to be as optimized and powerful as you possibly can to make the process not be a lengthy, horrible thing.

327
00:40:58,180 --> 00:41:06,460
So promised ATA RAID, serial RAID, is actually a very reasonable and inexpensive RAID solution.

328
00:41:07,500 --> 00:41:13,800
These are, again, commercial software data acquisition solutions.

329
00:41:17,820 --> 00:41:19,600
And more dead horses.

330
00:41:20,720 --> 00:41:23,880
And then the free solutions.

331
00:41:25,380 --> 00:41:36,240
These actually are forensic acquisition systems that are available to law enforcement only.

332
00:41:36,240 --> 00:41:51,640
They essentially do the same thing that all the other ones do, but they've been specifically designed to ensure that they actually do what is required to properly prosecute.

333
00:41:54,180 --> 00:42:02,040
And these will snap back an in-case enterprise are capable of doing imaging over the network.

334
00:42:03,080 --> 00:42:06,760
That way you don't have to do things like DD and then pipe it out to Netcat and things like that.

335
00:42:06,760 --> 00:42:10,900
Of course, they're quite expensive as well.

336
00:42:12,560 --> 00:42:19,780
Okay, basically, if the system is running RAID, you need to be very familiar with how RAID works.

337
00:42:19,780 --> 00:42:36,700
And what each different type of RAID, how it's set up, so that you ensure that when you do acquire the RAID array, that you, again, are acquiring the entirety of the virtual file system that makes up that system.

338
00:42:37,960 --> 00:42:42,760
This is an interesting thing that I actually didn't know until I talked to Rob yesterday.

339
00:42:42,760 --> 00:42:56,460
On macOS, on more recent versions of macOS, if you actually hold up the T key, hold the T key down on boot up, it boots up into what it refers to as disk mode.

340
00:42:56,460 --> 00:43:08,060
And that Mac then essentially becomes an external firewall drive that you can use as a live forensics environment to toss data onto.

341
00:43:09,720 --> 00:43:19,520
Image integrity, there's checksums, there's hashes, these are all different means for verifying and providing proof of the integrity of the suspect system data.

342
00:43:23,400 --> 00:43:30,860
Yeah, MD5 actually recently, they've discovered that there are possibility of collisions.

343
00:43:30,940 --> 00:43:43,700
Thus , I would say a good defense lawyer might be able to bring up enough technical data to prove that the MD5 hash may not actually be valid.

344
00:43:43,700 --> 00:43:49,380
At least enough to create doubt, which would then sink your prosecution.

345
00:43:49,380 --> 00:43:53,380
So, I personally prefer SH8-1 some.

346
00:43:54,200 --> 00:43:58,880
These are just commercial versions of hashing applications.

347
00:44:01,280 --> 00:44:03,800
These are different formats.

348
00:44:03,940 --> 00:44:10,400
The one I've basically talked about the entire time is DD, is basically a raw bit-for-bit copy of the drive.

349
00:44:10,400 --> 00:44:27,220
In case, quite often all the commercial systems are capable of reading the disk image, the proprietary disk images that are made by all the different other products, like InCase, SafePak, SnapPak, and Smart.

350
00:44:28,300 --> 00:44:39,420
Basically, for more information, these are a lot of URLs where you can find a ton of information on data forensics.

351
00:44:39,420 --> 00:44:42,600
And there actually is a forensics mailing list.

352
00:44:44,160 --> 00:44:50,940
I currently don't know what... I think it's on security focus, so you might check.

353
00:44:50,960 --> 00:44:52,160
And that's about it.

354
00:44:52,380 --> 00:44:53,580
Questions?

355
00:45:09,850 --> 00:45:21,410
On the other systems that may actually affect it, that are on the network, you don't actually need to get a forensic image of that server.

356
00:45:21,410 --> 00:45:25,110
Because that's just an external system that just supplements what you're doing.

357
00:45:28,580 --> 00:45:49,820
It is difficult, but being very careful about documenting what you did to get that corroborating data and doing things like, okay, I took a snap of the file system, make a hash of that log file, and then enter all that into your chain of custody documentation,

358
00:45:49,820 --> 00:45:50,740
that will help.

359
00:45:50,740 --> 00:45:51,860
It's all about documenting.

360
00:45:51,860 --> 00:45:54,180
Even if you can't verify things, it's all about documenting.

361
00:45:54,180 --> 00:45:57,020
Yeah, basically it's just document the hell out of everything.

362
00:46:00,560 --> 00:46:02,540
Yes, sir, on the right side.

363
00:46:05,640 --> 00:46:06,580
There's various programs.

364
00:46:06,580 --> 00:46:08,680
Almost all of those programs can handle it.

365
00:46:08,940 --> 00:46:15,200
Yeah, some of the commercial products will actually access the memory contents as well.

366
00:46:15,420 --> 00:46:25,620
I personally will just cap the contents of the kernel proc file system and cat it out across the net to another system.

367
00:46:26,400 --> 00:46:27,640
Left side.

368
00:46:30,420 --> 00:46:31,380
Louder.

369
00:46:44,770 --> 00:46:49,390
Yeah, yeah, so I generally will not use DD on a live system.

370
00:46:49,570 --> 00:46:58,910
What I will do is try to document, the few times I've had to do forensic, as I said, I'm more of a network security monkey than a forensics guy.

371
00:46:58,910 --> 00:47:08,710
But the few times I have done investigations on potentially compromised systems, basically I did not do the DD copy.

372
00:47:09,790 --> 00:47:11,470
On the running system.

373
00:47:11,590 --> 00:47:20,530
I got on the running system as unobtrusively as I possibly could, documented the hell out of everything that was on there as much as possible.

374
00:47:20,530 --> 00:47:23,670
Of course, you're never guaranteed you're going to get everything.

375
00:47:23,670 --> 00:47:29,450
If there's a really, really well done rootkit on there, you're probably not going to find it.

376
00:47:29,450 --> 00:47:32,970
But you try your best to find everything that's potentially running.

377
00:47:32,970 --> 00:47:41,230
And then eventually at some point you do shut down the system and then you make your bit for bit copy of the hard drive itself.

378
00:47:41,670 --> 00:47:55,510
And as I mentioned with respect to RAID systems, you actually not only have to ensure that you get all the data from the RAID system, but that you can actually recreate that RAID array properly.

379
00:47:55,570 --> 00:47:59,730
So that it will not be questioned by the defense.

380
00:48:00,090 --> 00:48:02,950
Well, it will not be successfully questioned and thrown out.

381
00:48:02,970 --> 00:48:07,710
You can prove that you acquired that and that you acquired it properly.

382
00:48:07,710 --> 00:48:12,790
And what the jury is being presented with is exactly what was on the suspect's system.

383
00:48:12,790 --> 00:48:18,790
But yeah, you will have to power down the system before you take the image of the actual file system itself.

384
00:48:19,410 --> 00:48:20,070
Yes.

385
00:48:31,900 --> 00:48:32,660
Yes.

386
00:48:53,270 --> 00:48:57,070
If properly entered into the chain of custody, yes.

387
00:48:57,070 --> 00:49:04,810
And if you're very careful about documenting how you acquired that data and all that, yeah.

388
00:49:18,230 --> 00:49:20,270
Yeah, absolutely.

389
00:49:20,630 --> 00:49:21,890
We need to go?

390
00:49:21,890 --> 00:49:23,150
Alright, thanks.

391
00:49:23,530 --> 00:49:24,510
Thanks Aaron.