start	end	text
3060	7960	Okay, first of all, let me just let everybody know that I am actually...
7960	8920	Excuse me.
8920	10580	Hey, sound guy, turn it up, dude.
10880	15060	Dude, I yelled at Jeopardy two nights in a row and got trashed two nights in a row.
15060	16780	You're lucky I'm even upright.
17800	20140	No, because we got ripped off!
22240	26840	Okay, first of all, let me let you know that I am not RS.
26840	35620	He was requested by his employer, the man, not to actually give this talk.
35760	40800	So, since I'm a friend of his and I've done some forensic stuff in the past,
40800	44880	I'm more of a network monkey than a file system monkey.
45000	49920	And so he asked me if I'd be willing to give this talk so that you guys didn't get screwed out of one talk.
50300	53000	I had no idea he was quite this popular.
53000	57980	I thought it'd be about three of you and my friends who wanted to go drink afterwards.
58420	60080	So here it goes.
65400	66300	Okay.
69600	79420	Basically, the talk that Rob was wanting to give is kind of an intro to file system analysis.
79420	82860	Actually, it won't be in a discussion of analysis.
88200	88820	Okay.
88820	89580	Can you roll them up?
89580	92360	Yeah, can the sound guys just boost it a little?
92360	95400	By sound guy, we mean you. Can you slap the pots? No?
95480	96000	No.
96140	96720	All right.
97060	98100	Can I walk over there and do it?
98100	98880	Is that better?
99380	102120	Can everybody here at this point still know?
105460	106480	How about now?
108040	108760	Can you hear me now?
108760	109080	Wow.
109320	110160	Can you hear me now?
111880	113520	Hey, it's a Verizon commercial.
113680	114180	Okay.
116100	143620	Basically, the talk that Rob has asked me to present today is essentially a very basic introduction into how to properly acquire data from a potentially compromised system or a suspect system and the legal aspects of what you have to keep in mind when you want to ensure that you have everything done properly
143620	145800	when presenting it in a court of law.
147020	151000	So, I will do my best to get through the slides.
151000	157520	If you ask me a question that I cannot answer, hopefully Rob is around here somewhere and he will unofficially answer your question.
159420	160680	But here we go.
160680	161040	All right.
161040	184840	Basically, the most important thing you need to keep in mind is that when you have a system that you suspect has been tampered with or has something that you're interested in checking, you have to ensure that you do not alter or contribute to the modification of files on that file system.
185760	188980	Because that's the first way...
188980	193760	Anytime you actually open a file, you modify it, whether you realize it or not.
193760	196160	You change the access times.
196160	202140	You change quite a lot of very subtle metadata associated with that file.
202140	214200	So, it's important that you follow certain very, very strict procedures to try and intrude as little as possible on the suspect system.
215540	218600	Oh, and by the way, the typos are not mine.
222140	236320	So, one of the first things you have to consider is whether or not, if it's a running system, you have to actually look at the entire aspect of what the system is doing.
236340	239200	You have to consider, is it connected to a network?
239240	240320	Is it currently powered up?
240320	241260	Is it powered down?
241260	246320	If it's powered up, is there data that's actually held in memory that you want to try and access?
249320	253720	Because some people, when they tamper a system, will leave a trojan behind.
253820	265000	And as soon as they see some sort of shutdown procedure or whatever, it will remove whatever data you might have actually been interested in.
265000	277760	So, you have to actually be very careful about not doing something without thinking through thoroughly first what may be the ramifications of what you're doing.
286780	293820	But as Rob says here, actually you only get one chance to do it right.
294620	306100	Because, as I mentioned previously, if the system has been trojaned, there's a good possibility that if you're not careful and you do the wrong thing, you lose everything you were actually interested in.
306980	315940	There's many, many ways to actually acquire the data without modifying it too much.
315940	322100	I personally, some of the things that Rob has in here, I haven't used because, frankly, I'm a Unix bigot.
326900	332180	Also, every intrusion is a unique situation.
332180	343500	I mean, it could be a standalone system, we could be talking about ATMs, it could be a system that's connected to a network, it could be a multi-home system, you don't know.
343500	354750	So, you actually have to be very careful and document your entire data acquisition process.
355160	365860	And by documentation, I actually mean photographs, notes, as well as acquiring the actual file system data that you're interested in.
366840	386740	Basically, what the talk will cover is what are you actually trying to accomplish with the forensic acquisition of the file systems and what things can make that difficult or impossible, depending on how badly you screw up.
389520	410060	We will also cover the proper preparation of evidence media so that it is admissible in court and, if done correctly, doesn't get struck down or mitigated, as well as the proper handling of the suspect system.
410060	419360	You're not actually going to utilize the potentially compromised system for anything more than acquiring a copy of the data off of it.
419900	436360	And then, at that point, you will enter the suspect media into your chain of custody so that you can have a very distinct trail of who has had access to the suspect media and when and what was performed.
436360	455560	So, this is all basically required for your court cases to ensure that there is no doubt that whatever was being alleged to have been found on the suspect media was not put there by you or somebody else involved in the prosecution.
457140	460480	There's actually multiple ways to do it, as I mentioned earlier.
460480	465940	There are hardware solutions for accessing a copy of the data on the suspect media.
465940	471240	There are also software mechanisms for doing the same thing.
471900	480260	They all have certain abilities that make them unique, and they all have their limitations.
480260	489460	So, you may actually want to use more than one method to acquire your suspect media data for later analysis.
489460	501400	And the other thing you're probably going to want to do is use some kind of integrity verification mechanism.
501400	516000	Generally, that would be a cryptographic hashing that you would take of the file system image so that you can further prove that it has not been tampered or altered in any way since you acquired the data.
517120	520640	I am not a lawyer, and Rob also is not a lawyer.
521160	525860	So, do not consider this talk as legal advice or legal opinion.
526700	534740	Neither of us actually speak for anyone other than ourselves, and most often we don't do that very well.
535280	543900	So, if you actually want to do these things, if you do it in the privacy of your own home or whatever, that's fine.
543900	560660	If you decide after sitting through this talk that you're now a forensic specialist, and you go and try and perform a data acquisition on a suspect's system at your work, and you screw up the boss's computer and he's pissed off, not my fault.
561160	572760	So, you really ought to check with the policies of your organization, your IT staff, your legal staff, before using any of these tools in an investigation.
572760	591880	And I, frankly, would suggest that you spend a lot of time doing this before you even think you're going to do it properly, because it is a very exact and very precise process that must be followed in order to not taint the data that you're going to present in court.
593400	603220	This is basically a glossary of terms that you should be familiar with to make the talk a little bit more understandable.
603220	615840	By digital evidence, basically that is the file system on the suspect system that you're trying to acquire.
616500	627540	Suspect or original drive, suspect media or original drive media is basically the possibly tainted system or the possibly malicious system that you're interested in.
627540	647990	Forensics media or evidence drive or media is basically the tools that you will use to acquire the... it's basically the system that you will use to actually acquire the data off the suspect system.
649210	672870	Acquisitions and imaging, basically that's two different terms for grabbing all the data off the suspect system. Imaging is just basically creating one or more image files of the suspect system that are a bit-for-bit copy so that you get everything, not just the files that are on there, you get the slack space.
673970	689530	Many people don't actually realize that when you delete a file, you're not actually erasing that file. What you're doing is deleting an entry in a master database on the drive that says it's okay to overwrite this space on the drive, but that doesn't necessarily happen right away.
690570	715650	And not only that, when you copy a file, you quite often don't copy just what you think you're copying. If you open up a document and you write a couple of things into it and then save it and then you open it up later and delete one of those things because you decide that whoever you're giving the document to has no reason to know that stuff, that data is actually still lying around.
715650	736570	So when you copy that file over somewhere else, what you thought you deleted is actually still there in what's called slack space. And so you have to be very, very careful about imaging the entire file system so that you get things that are in slack space that may actually be pertinent to what you're interested in.
738550	764490	Okay. The next thing is chain of custody. Chain of custody is basically nothing more than a hard copy of every individual who's had access to the suspect system as well as the forensic media system and what they did and when they did it and things like that because these have to be... the chain of custody is an admissible item in a court case.
764490	791350	Verification hashes and checksums. That's what I mentioned earlier about wanting to create a hash to check the integrity of your acquisition file system so that you can prove it's not been tampered with.
791350	812810	The integrity has not been tainted at all on your system because if everybody in a particular area has access to your forensic acquisition system, then you can't prove that somebody hasn't altered that to modify whatever data you're trying to acquire to hide whatever they're interested in hiding.
812810	832730	Trusted forensics... the trusted forensic environment just basically means having a means of proving that your acquisition system is exactly what you think it is and nothing more. Original copies and work copies. Basically the way...
832730	834870	If they can't figure that out, they're pretty weak, dude.
834870	849210	I know. But basically the way you do it is you never actually want to do any analysis on your suspect system. You want to capture all the data from the suspect system onto a separate piece of media.
849210	879190	That separate piece of media actually then is what gets admitted to court and quite often you will have that as your means of analysis too. So what happens is you basically capture all the data off the suspect system and once you've done so and the system has been entered into the chain of custody, then that suspect system is placed in a locked space where nobody has access to it anymore.
880290	896310	Okay, it does not fully cover acquiring volatile system information. Basically there's only slight information here on how to actually capture data that resides in memory on a running system.
897170	905790	There's too many different systems and too many different ways to actually do it in a 50 minute talk to adequately explain all this.
907410	928330	Quite often when you're trying to grab data from memory, your system will write out temporary files and things like that to the file system so you have to be very careful that when you're trying to grab volatile data, you're not modifying the file system that you're interested in as well.
929970	949210	The third point is, as I said, it's a very exacting process. So you want to make sure that you know exactly what you're going to do and carefully step through those. Don't take any shortcuts.
949210	972930	And frankly, when I have done forensic acquisitions or some of my staff, I will actually have a written set of steps and insist that they follow them. No matter how many times they've done it, that's the only really way you can carefully not miss something or potentially taint the system you're interested in.
975490	995670	Examples of volatile data would be run time and performance stats, which is basically in most Unix systems, things in the pseudo-proc file system. Time, date, time zone settings, all these things are volatile because some of them are easily changed.
995670	1023110	The active running process listings is another volatile thing, because as I mentioned earlier, if there's a Trojan and you trigger that Trojan, it may either stop running whatever process that it was running that you were probably interested in, or if some of you have attended the Rootkit talks, you'll see that they can hide those processes, keep them running, but you won't be able to actually find them.
1023110	1046270	Logged in user listings, that obviously is for a network-connected system. Open files, libraries, DLLs in use. Basically, it's different for every system, but you can easily find all the files that are currently in use through the system processes.
1046270	1069690	And again, if you're not careful, if there's a Trojan or if it's a network-enabled system and the person that is doing what you're interested in is actually online and finds out, they may stop what they're doing, unload any libraries that are being used by whatever process they're doing, and you will lose data that you potentially need in your prosecution.
1069690	1096910	Network activity, again, obviously, for a network-enabled system is what actually is going on. If you walk up to the system and immediately pull the network cable out of it, you may actually lose data that you're interested in for your prosecution, because that may trigger whatever network system process was going on to either stop or, well, obviously it won't be communicating anymore.
1096910	1116750	And that may trigger it to stop or hide itself. Perhaps the data you're actually interested in is an ongoing streaming of pornographic material or illegal file-sharing activities. And if you're not careful, those things that you need to acquire may stop.
1116750	1124990	It goes back to being very careful about following your steps and not deviating from those.
1127010	1130090	I'm going to move on.
1131790	1140610	We're not going to cover cellular phones, PDAs, wireless and wired network communications, wireless programmable keyboards and EEPROMs.
1140610	1144650	It would just simply take too long, and obviously I'm taking too long as it is.
1149250	1158190	The first bullet up here is actually something that is quite often overlooked by people that don't do this all the time.
1159290	1175450	It is potentially a crime scene, so you want to make sure that if you're going in and looking at the system, you want to ensure that if you start tapping away on the keyboard, you're not destroying fingerprint evidence that might be there.
1175450	1193530	As I mentioned before, you definitely want to document the entire area that you're working in photographically, so that if somebody comes up and says, well, that wasn't my system, you have visual evidence that whatever they're claiming is probably not true.
1193530	1207870	You want to take a look at every cable connection, whether the system is network-enabled, if it's connected to a wireless network, if it's connected to a Cat5 fiber network, if it's multi-home, if there are modems.
1207930	1214330	You want to carefully document all that, both in written form and in photographic form.
1215150	1230610	And consider every incident as if it's going to trial, which basically goes back to set up a certain set of steps to follow and don't deviate from them regardless.
1230610	1241970	Because if it goes to trial, you're going to need all the evidence that you gather. If it doesn't go to trial, it's no big deal. Having more evidence is actually a good thing.
1243530	1249230	Yes, do not examine your evidence at all until you've properly made a forensic image.
1250190	1260290	The reason that he says that is basically because if you're not careful, you will taint the data by altering access times and things like that.
1260290	1279470	So you want to make sure that you have a complete and thorough forensic image so that if somebody questions something, you can actually go back and acquire a second copy of the suspect data without having to access the suspect system.
1280810	1287390	You should try to interact with the system as little as possible.
1287390	1303590	If you have to sit down at the suspect system itself, you need to be very careful. Generally, you want to not ever do anything or attempt to check anything on the suspect system. You want to actually make a copy instead.
1305790	1318050	And again, store everything in a safe location, which basically, generally for me, since I work for the government, and yes, you can spot the fed now, it means a GSA safe with a high security lock.
1318050	1331750	That's another means that gets documented in the chain of custody that proves that it was difficult, if not impossible, for someone to have tainted the system data that you're presenting in your court case.
1336740	1349180	Pretty much all this just really says is to keep track of what you fucking do. I mean, if you're ever going into a government investigation, you're going to be working with people who have done other types of investigations, mostly physical, and you just need to make sure you don't taint the digital data.
1349180	1354460	The chain of custody is exactly the same for physical data as digital data, as long as you don't taint it.
1355020	1362300	All these things are just reiterating how you have to be careful not to taint what you have, not to modify anything, and only work on copies of it.
1362300	1372660	It's a very simple concept where anyone who's ever blown out some data on your home, or on any machine you're working on, back up first, work on your backups, don't work on the true copies, and it's just very important forensic analysis.
1373020	1377420	Right, and the first two kind of reiterate what I've already beaten to death.
1377420	1386220	But, now collate mail, DNS, and other network and service logs to support and verify your findings.
1386220	1389980	Not everything you're interested in is actually right there on the suspect's system.
1389980	1403540	You may actually have network processes like mail being sent out if the system is taken over by a bulk mail or whatever, and you're going to find corroborating evidence on other systems on that network.
1403540	1410380	So, don't just consider the suspect's system as the sole thing to be investigated.
1410980	1423300	And always be able to verify the integrity of your evidence. That basically means be very careful about creating your file system images, and then create cryptographic hashes of them.
1423300	1434460	Whether you use MD5, SHA1, whatever, you need to be able to prove at some point that nothing on the suspect's system has been altered.
1436040	1440880	Yes, never use a tool you're not familiar with on live or original evidence.
1440880	1449320	Again, this just basically says, if you don't know how the system works, then find someone else, find an adult to help you.
1450880	1454060	Or a 12-year-old boy, or a 12-year-old girl, man.
1455600	1463340	Okay, this is some more of the documentation. You want to itemize all the actual hardware involved.
1463740	1476420	With the physical context, I mean, you want to sit down at some point after you've gotten your file system data off, and document the actual computer system that's involved, or systems.
1476420	1486980	And you'll want to actually, as the example that's given here, you're going to want to actually document everything that uniquely identifies every piece of hardware in that system.
1487540	1490260	Basically, it's just be incredibly anal.
1491080	1503680	Because a defense lawyer is going to challenge everything possible, and you have to be very careful and capable of proving that nothing has been changed, nothing has been swapped out, nothing has been modified or tainted.
1504340	1518540	Logical context is basically, on a Unix system, for example, or even on a Windows box, all the mounted file systems, whether they're network mounts, whether they're local mounts, whatever.
1518540	1534640	You want to actually document all the logical things as well to, again, prove that when they see the suspect system in court, that it's exactly the way it was when you began your forensic investigation.
1536040	1556480	Because you will be, if it goes to trial, you will end up testifying as to exactly what you did, how you did it, and why what you did hasn't caused the data that's being entered into the legal record to be tainted or suspicious.
1557020	1566340	Chain of custody quite often will be challenged. That's why you need to keep a very full chain of custody, very thorough, yes.
1570190	1571630	Have to be what?
1573050	1582950	Ah, the question is, does the person doing the data acquisition have to be an independent person so that there's no conflict of interest?
1583690	1601190	Well, it really depends on the situation. I mean, if it's, in Rob's case, basically, he works for Health and Human Services, and they quite often have to deal with, you know, potential medical fraud and things like that.
1602070	1616390	So they're not letting the IT staff of the office investigate that. And yes, quite often you want to make sure that the person is independent, because if you can't trust your forensic investigator, then how can you trust the evidence that's being given to you to take the trial?
1616390	1642630	So yeah, you would want to make sure it's an independent individual or company. Quite often, though, in large companies, they will have, you know, a data security team and a forensics team that, while they work for the same company, they have no vested interest in protecting any particular person in that company.
1642630	1654310	So essentially, they are independent as much as a company employee could be. But yeah, I mean, if you have the chance to get somebody who's independent totally from the outside, yeah, that's probably the best way to do it.
1657200	1663200	There's one question. We do need to bang through this stuff pretty fast, but let's hit the question real quick, and then we'll bang through it fast. What's your question?
1674480	1703280	Correct. Documenting the hardware and everything is, if I didn't make that clear, you would actually do that after you've already assured that you've acquired all the data you're interested in on the suspect system, all the file system data, all the volatile data and everything, and you're convinced that, okay, there's nothing else I want to, you know, I will need to gather from this running system or this system,
1703280	1724300	you know, I'm interested in, now I can actually begin to document the components of the system itself. So yes, that will come at the very end, because as Rob pointed out to me, some of the things that he investigates, it's physicians' offices, and they can't afford to have the potentially compromised system removed from the office.
1724300	1741060	So, you know, basically you have to try and document everything, and then get a verifiable forensic image, and then leave the actual suspect system, you know, running in that office, because you can't.
1741600	1747520	So, all right. Some of the things that you basically need to understand is...
1747520	1752580	I think everybody in here, if they don't understand a partition table and file system, they need a beating.
1752580	1758960	Well, do you guys want me to go over file system? Okay. Then we'll move through. Fine. No problem.
1758960	1760500	Yeah, all that stuff. Partition files is possible.
1760500	1764580	Hey, if something is basically beating a dead horse, let me know, because...
1766880	1768080	Thank you.
1768780	1772300	You know, keep in mind, we were in jeopardy two nights in a row.
1772840	1774040	Beer is evil.
1774400	1775780	No, it's beautiful.
1775780	1784680	All right. Your goals. Basically, you want to make an exact copy of the backup. Basically, this is more beating a dead horse, it looks like.
1785480	1786380	Yep, skip that one.
1786940	1788000	All right, don't fuck with it.
1788000	1790760	I got plenty of tools, yeah. Well, I've only...
1790760	1791760	Hit the second part.
1792220	1803380	All right. Yeah. One thing that you have to keep in mind, a lot of drives now will have host protected area, you know, device configuration overlays, things like that.
1803380	1814420	And you have to be very careful with your tools to ensure that when you're acquiring data off the actual hard drive file system, that you're getting the entire contents of the file system.
1814420	1821780	That you're not missing some portions of the system that are being hidden by the BIOS or the drive BIOS.
1824280	1831780	In older Linux 2.4 ones, for example, some of the hard drives with odd number of sectors would...
1833480	1843420	If you weren't careful about how you acquired that file image, you would actually miss a portion of the drive because the drive itself would report back that it was smaller than it really was.
1846340	1849700	Tool needs to be tested by an independent entity.
1849700	1853840	Basically, don't write your own forensic tools is all this says.
1854320	1866300	Go use something that has been proven to work and proven to do exactly what you want and what you expect so that you can back that up in a court of law.
1868600	1870020	More dead horse.
1871200	1874880	One other thing, preparation of the forensic hard drive.
1874880	1888980	Basically, the drive that you're going to use, drive or tape, that you're going to use as a copy of the suspect system, you want to wipe that drive before you actually use it.
1888980	1894920	And as is suggested here, you want to wipe it with a known pattern.
1894920	1899860	You don't want to use like dev random because you don't want random stuff overriding that drive.
1899860	1912660	You want to use something like dev zero so that it's all zeros so that you can guarantee that everything that gets put on that drive was put on that drive when you did so.
1912720	1914620	None of it was pre-existing.
1916240	1918880	And this basically ensures that.
1918880	1923620	And this will also be part of your documented investigation notes.
1924140	1925280	All right.
1925380	1938580	And again, some of the host protected area and things like that, you have to make sure that whatever tool you're using to format the drive prior to using it will actually overwrite those areas as well.
1939920	1941860	This is how to do it.
1942440	1944420	Yeah, read the CD if you don't want to wipe your drive.
1944420	1955480	Yeah, DBAN is a very nice CD-ROM based system that will work on both x86 and Macs if you have to deal with a Mac OS system.
1955880	1967880	Gdisk, these are basically just a lot of known trusted tools for properly wiping the forensics acquisition system before you actually begin to use it.
1971400	1972620	All right, yeah.
1972660	1979220	Basically, DD, the nice thing about DD is that, you know, it does a bit for a bit of coffee.
1979220	1988300	And then afterwards make a cryptographic hash to prove that later, I'll get to you, to prove that nothing has changed.
1988300	2009280	The CryptCat and NetSea, which is actually NetCat, there's a way, if your system is running and you need to access, you want to save the stuff on a forensic system that's actually on a network or somewhere else,
2009280	2019100	you can pipe the output from DD to NetCat so that you're actually not storing your acquired image locally anywhere.
2019100	2028960	You're actually storing it somewhere else, which is another means of ensuring that you don't modify anything volatile or existing on the file system.
2029500	2031360	Yeah, you had a question back there?
2031360	2043210	That is true. And I'll go back to the first caveat, which is this is not my slide.
2043970	2046350	Yeah, we'll get there later in the slide. We'll spank through them pretty quick.
2046350	2051210	All right. Quite often, quite often, if you're doing this by hand, it's a slow process.
2051210	2058810	There are hardware systems that will image the drives thoroughly that will do it very well and far more quickly.
2061450	2062530	Let's see.
2062530	2068150	Basically just saying in real life you run across shit that you're not expecting. You're not going to run into the perfect scenario every time.
2068290	2074970	And because of that, shit happens. Your hardware may not work right. You may go to plug into a port that's busted.
2075130	2082270	The keyboard may be cracked in half. You never know what's going to happen. Sometimes shit happens. So cover your ass.
2082590	2083030	Yeah.
2084770	2085650	No.
2086170	2091490	No, never yank the power. If you just yank the power, you're losing so much of all the information, you're screwed.
2091490	2096350	Yeah. Yanking the power, everything that was being held in RAM, gone.
2096810	2107970	And if you sat in on the rootkit talks that were presented here, there are actually rootkits now that live in RAM, live in memory solely.
2107970	2110410	And you'll lose that. You'll lose all evidence of it.
2111330	2115370	Well, it depends on what you do. And if you are going to shut down, if you can do your data removal first.
2115630	2119850	It's all in the path of every machine is different and what you can do is different in every situation.
2119850	2123610	In some situations, you'll walk in there and be able to just image everything, including the RAM.
2123630	2127530	In some situations, you'll walk in there and some guy will start shooting at you and put a bolt through his computer.
2127650	2129190	Different situation, different times.
2130010	2136550	Right. You obviously don't want to install your forensic environment on the suspect system.
2136810	2144790	So what you want to do... some people actually use the suspect system to create copies of the suspect system.
2144790	2148230	I personally don't prefer that that be done.
2148350	2158810	But one way to do so is to have a bootable DOS Linux or BSD disk that has been designed specifically for forensic use.
2158810	2163470	And I believe he has examples of some of those as we go along.
2163470	2175870	ImageMaster is one that actually has a pre-configured, I think it's a Win98 environment, that has actually been modified specifically for forensic use.
2176470	2183930	Knoppix is a reasonably user-friendly method for doing this, although there are caveats.
2183930	2198250	You have to throw the noswap command line at your kernel bootup, because otherwise one of the problems with some of the Knoppix systems is that basically if it finds swap space, it'll try mounting it.
2198270	2210410	And when it goes and starts looking at all the drives attached to the system that it's booting, when it finds your suspect file system, if it finds the swap space on there,
2210410	2220330	it's going to go ahead and bring it up, at which point you're losing the integrity of some of the data on that file system.
2221050	2231250	Older versions, and if you do use Knoppix, you need to be very, very careful to make sure you use one of the more recent releases, because older versions do have some issues.
2231270	2237590	For example, some of the older ones, even if you gave the noswap command to the command line, it would just happily ignore it.
2240110	2247010	And the caveat of being not just because the version is newer doesn't mean that it doesn't have a different bug that will affect you.
2247010	2255830	So never actually go fire up Knoppix to do your forensics without actually having done it somewhere else first, so that you, again, have a trusted forensic environment,
2255830	2262890	and you know exactly how it's going to act and what's going to happen, so that you can protect the integrity of the suspect system that you're interested in.
2265290	2272430	Again, this just goes over some of the basics of how to build the forensics system environment.
2272450	2277590	Yeah, go to those links if you want to get good shit.
2277590	2285290	Yeah. Modcom, I believe, is a DOS-based one, which is actually pretty good.
2285290	2295070	NCase, the forensics version of NCase, the licensing doesn't actually require you to pay for it.
2296110	2297690	More stuff, just go to all these sites.
2297690	2306970	Sure. Fire is actually a Knoppix-based one. These are all URLs, and I believe they will have Rob's slides up on the DEF CON site, so you can get them from there.
2306970	2310450	I saw some of the Penguin Sleuthgate guys around here.
2311530	2319350	Let's see. These are commercial hardware solutions. These are systems that actually will do the data acquisition for you, but it's a hardware device,
2319350	2328330	which, as was mentioned earlier, depending on how big the suspect file system is, it could take hours.
2328330	2341330	And some of these systems have been built and optimized to the point where they, like ImageMaster, I believe will get a throughput of something like two gigs,
2342930	2348810	like two gigs a minute, and on a large drive, that's kind of nice, rather than taking a day or two.
2348810	2355550	Just as a side note, I personally don't do data forensics, but a division of the company I work for does, and we just released a press release,
2355550	2362450	which, I don't know what the fuck it means, I don't know what a computer does, hell, but we evidently did five terabytes of data in under 24 hours,
2362450	2367070	and did forensic analysis and everything else, so they say that's good, but that sounds like a lot of data to me.
2367430	2369670	That would take a hell of a long time with some of those other solutions.
2370750	2372590	And just more.
2374550	2385610	These are just examples of, if you're using a tape system, for example, if you have a RAID system and you need to get some data from a previous day for your investigation,
2385610	2393170	these are methods that you can use to actually read data off the tape to put it onto your forensic environment for analysis later.
2396010	2401030	These are other means of creating your forensic media.
2401430	2413430	Hardware write blockers. This is basically a hardware solution to ensure that you don't actually modify the suspect drive.
2414270	2420130	I personally use a Unix environment so that I can mount the suspect system read-only.
2420130	2424370	That's not always possible with Windows systems.
2427680	2434100	Again, here's just examples of software write blockers.
2436780	2446160	One of the things you want to do is, possibly you may be having to acquire a RAID image.
2446160	2457520	So you're going to want to have your forensic system to be as optimized and powerful as you possibly can to make the process not be a lengthy, horrible thing.
2458180	2466460	So promised ATA RAID, serial RAID, is actually a very reasonable and inexpensive RAID solution.
2467500	2473800	These are, again, commercial software data acquisition solutions.
2477820	2479600	And more dead horses.
2480720	2483880	And then the free solutions.
2485380	2496240	These actually are forensic acquisition systems that are available to law enforcement only.
2496240	2511640	They essentially do the same thing that all the other ones do, but they've been specifically designed to ensure that they actually do what is required to properly prosecute.
2514180	2522040	And these will snap back an in-case enterprise are capable of doing imaging over the network.
2523080	2526760	That way you don't have to do things like DD and then pipe it out to Netcat and things like that.
2526760	2530900	Of course, they're quite expensive as well.
2532560	2539780	Okay, basically, if the system is running RAID, you need to be very familiar with how RAID works.
2539780	2547700	And what each different type of RAID, how it's set up, so that you ensure that when you do acquire the RAID array,
2547700	2556700	that you, again, are acquiring the entirety of the virtual file system that makes up that system.
2557960	2562760	This is an interesting thing that I actually didn't know until I talked to Rob yesterday.
2562760	2576460	On macOS, on more recent versions of macOS, if you actually hold up the T key, hold the T key down on boot up, it boots up into what it refers to as disk mode.
2576460	2588060	And that Mac then essentially becomes an external firewall drive that you can use as a live forensics environment to toss data onto.
2589720	2599520	Image integrity, there's checksums, there's hashes, these are all different means for verifying and providing proof of the integrity of the suspect system data.
2603400	2610860	Yeah, MD5 actually recently, they've discovered that there are possibility of collisions.
2610940	2623700	Thus, I would say a good defense lawyer might be able to bring up enough technical data to prove that the MD5 hash may not actually be valid.
2623700	2629380	At least enough to create doubt, which would then sink your prosecution.
2629380	2638880	So, I personally prefer SH8-1 some. These are just commercial versions of hashing applications.
2641280	2650400	These are different formats. The one I've basically talked about the entire time is DD, is basically a raw bit-for-bit copy of the drive.
2650400	2667220	In case, quite often all the commercial systems are capable of reading the disk image, the proprietary disk images that are made by all the different other products, like InCase, SafePak, SnapPak, and Smart.
2668300	2679420	Basically, for more information, these are a lot of URLs where you can find a ton of information on data forensics.
2679420	2690940	And there actually is a forensics mailing list. I currently don't know what... I think it's on security focus, so you might check.
2690960	2692160	And that's about it.
2692380	2693580	Questions?
2709850	2721410	On the other systems that may actually affect it, that are on the network, you don't actually need to get a forensic image of that server.
2721410	2725110	Because that's just an external system that just supplements what you're doing.
2728580	2750740	It is difficult, but being very careful about documenting what you did to get that corroborating data and doing things like, okay, I took a snap of the file system, make a hash of that log file, and then enter all that into your chain of custody documentation, that will help.
2750740	2754180	It's all about documenting. Even if you can't verify things, it's all about documenting.
2754180	2757020	Yeah, basically it's just document the hell out of everything.
2760560	2762540	Yes, sir, on the right side.
2765640	2768680	There's various programs. Almost all of those programs can handle it.
2768940	2775200	Yeah, some of the commercial products will actually access the memory contents as well.
2775420	2785620	I personally will just cap the contents of the kernel proc file system and cat it out across the net to another system.
2786400	2787640	Left side.
2790420	2791380	Louder.
2804770	2809390	Yeah, yeah, so I generally will not use DD on a live system.
2809570	2818910	What I will do is try to document, the few times I've had to do forensic, as I said, I'm more of a network security monkey than a forensics guy.
2818910	2828710	But the few times I have done investigations on potentially compromised systems, basically I did not do the DD copy.
2829790	2831470	On the running system.
2831590	2840530	I got on the running system as unobtrusively as I possibly could, documented the hell out of everything that was on there as much as possible.
2840530	2843670	Of course, you're never guaranteed you're going to get everything.
2843670	2849450	If there's a really, really well done rootkit on there, you're probably not going to find it.
2849450	2852970	But you try your best to find everything that's potentially running.
2852970	2861230	And then eventually at some point you do shut down the system and then you make your bit for bit copy of the hard drive itself.
2861670	2875510	And as I mentioned with respect to RAID systems, you actually not only have to ensure that you get all the data from the RAID system, but that you can actually recreate that RAID array properly.
2875570	2879730	So that it will not be questioned by the defense.
2880090	2882950	Well, it will not be successfully questioned and thrown out.
2882970	2887710	You can prove that you acquired that and that you acquired it properly.
2887710	2892790	And what the jury is being presented with is exactly what was on the suspect's system.
2892790	2898790	But yeah, you will have to power down the system before you take the image of the actual file system itself.
2899410	2900070	Yes.
2911900	2912660	Yes.
2933270	2937070	If properly entered into the chain of custody, yes.
2937070	2944810	And if you're very careful about documenting how you acquired that data and all that, yeah.
2958230	2960270	Yeah, absolutely.
2960630	2963150	We need to go? Alright, thanks.
2963530	2964510	Thanks Aaron.