Computer Forensics Principles and Practices

Computer Forensics

Principles and Practices

Objectives

  Conduct efficient and effective investigations

of Windows systems

  Find user data and profiles in Windows

folders

  Locate system artifacts in Windows systems   Examine the contents of Linux folders

Objectives

(Cont.)

  Identify graphic files by file extensions and

file signatures

  Identify what computer forensics graphic

Introduction

In many cases you may have gigabytes or even terabytes of data that must be searched for

evidence. This chapter helps maximize

efficiency of the search by showing default

locations of file storage and hiding techniques of wrongdoers.

Investigating Windows Systems

  Activities of the user result in user data

  User profiles

  Program files

  Temporary files (temp files)

Investigating Windows Systems

(Cont.)

  System data and artifacts are generated by

the operating system

  Metadata

  Windows system registry

  Event logs or log files

  Swap files

  Printer spool

Hidden Files

  Files that do not appear by default are hidden

files

  These can be viewed through the following

steps:

  Open Windows Explorer

  Go to Tools > Folder Options > View > Hidden

files and folders

Investigating Windows Systems

(Cont.)

  Data and user authentication weaknesses of

FAT

  Userids are not required

  Only attributes are associated with files or folders

  Data and user authentication improvements

in NTFS

  Separation of duties

Investigating Windows Systems

(Cont.)

  Identify the operating systems of a target

hard drive by:

  Operating system folder names

  The folder for the Recycle Bin

  The construction of the user root folders because

Finding User Data and Profiles in

Windows Folders

  Documents and Settings folder

  Contains a user root folder for each user account

created on the computer

  Windows NT and above automatically install

  Administrator

  All users

Finding User Data and Profiles in

Windows Folders

(Cont.)

  Data stored in the user root folder:

  Desktop settings, such as wallpaper,

screensavers, color schemes, and themes

  Internet customizations, such as the homepage,

favorites, and history

  Application parameters and data, such as e-mail

and upgrades

  Personal files and folders, such as My

Finding User Data and Profiles in

Windows Folders

(Cont.)

  Some of the subfolders in the user root folder

include:

  Application data (hidden)

  Cookies

  Desktop

  Favorites

  Local Settings (hidden)

Location of User Root Folders

Operating System

(Platform) User Root Folder Location

Windows 9x <partition>:\WINDOWS\Profiles\userid USER.DAT file

Windows NT <partition>:\WINNT\Profiles\userid NTUSER.DAT file

Windows 2000 and Windows XP

<partition>:\Documents and Settings \userid

NTUSER.DAT file

In Practice: Temp Internet Files

Provide Valuable E-Evidence

  Data stored in the Temporary Internet Files

folder can be valuable supporting evidence, even if deleted

  Statute 18 U.S.C. §2256(8) rules as

pornography any data stored on computer disk that can be converted into a visual

Investigating System Artifacts

  Types of metadata

  Descriptive: describes a resource for purposes

such as discovery and identification

  Structural: indicates how compound objects are

put together

  Administrative: provides information to help

manage a resource, such as when it was created, last accessed, and modified

In Practice: Searching for Evidence

out a search for evidence

  Using Windows to search and open files can

change the file’s metadata

  Such changes may cause evidence to be

Investigating System Artifacts

(Cont.)

  Registry

  Can reveal current and past applications, as well

as programs that start automatically at bootup

  Viewing the registry requires a registry editor

  Event logs track system events

  Application log tracks application events

  Security log shows logon attempts

Investigating System Artifacts

(Cont.)

  Swap file/page file

  Used by the system as virtual memory

  Can provide the investigator with a snapshot of

volatile memory

  Print spool

  May contain enhanced metafiles of print jobs

  Recycle Bin/Recycler

“Shredding” Data

  Third-party software packages can be used

to delete data and actually overwrite the information, essentially shredding the data

Investigating Linux Systems

  Windows can have many users with

administrator access, but Linux has only one administrative account, called root

  Root account has complete control of the

system

  In Linux, all devices, partitions, and folders

are seen as a unified file system

Investigating Linux Systems

(Cont.)

  The Linux file system includes the data

structure as well as the processes that manage the files in the partition

  Linux’s virtual file system provides a common

set of data structures:

  Superblock

  Inode

Investigating Linux Systems

(Cont.)

  Seven different file types available in Linux:

  Normal files

  Directories

  Links

  Named pipes

  Sockets

  Block devices

Investigating Linux Systems

(Cont.)

  Default Linux installations generally include

system directories such as the following:

  /boot

  /dev

  /etc

  /home

  /lib

  /lost+found

  /proc

  /root

  /sbin

  /tmp

  /usr

Investigating Linux Systems

(Cont.)

  Key Linux files and directories to investigate:

  /etc/passwd

  /etc/shadow

  /etc/hosts

  /etc/sysconfig/

Investigating Linux Systems

(Cont.)

  Deleted files

  Check the Trash can for each login user for

deleted files that can be recovered

  Using grep to search file contents

  Grep allows for sophisticated character-based

data searches

  Compressed files

  Some Linux applications such as OpenOffice

Graphic File Forensics

  The investigator can use file signatures to

determine where data starts and ends and the file type

  File extension (such as .jpg) one way to identify a

graphic file

  A user can easily change the file extension, but

the data header does not change

Graphic File Forensics

(Cont.)

  The process of retrieving all relevant pieces

of a file is called data carving or data salvaging

  An investigator may have to reconstruct the

data header using file signature information

  Layered graphic files (such as Photoshop or

Corel) can hide information behind layers

Graphic File Forensics

(Cont.)

  Steganography is a form of data hiding in

which a message is hidden within another file

  Data to be hidden is the carrier medium

  The file in which the data is hidden is the

steganographic medium

  Both parties communicating via

steganography must use the same stego application

Graphic File Forensics

(Cont.)

  Steganography is difficult to detect; the

following clues may indicate stego use

  Technical capabilities or sophistication of the

computer’s owner

  Software clues on the computer

  Other program files that indicate familiarity with

data-hiding methods

  Multimedia files

In Practice: Child Pornography

  Hiding criminal content within “innocent” files

can allow perpetrators such as child

pornographers to exchange information

  A scenario is described by which child

pornographers can easily pass information to others in the ring

Summary

  Search times can be reduced through the

use of default folders and operating system artifacts

  The skill level of the user will determine

whether this is an effective use of time in the case

Summary

(Cont.)

  A savvy user can hide data through:

  Nonstandard file folders

  Renaming file types

  Using layered graphics

  Masquerading data with steganographic