Using Computer Forensics in your Investigations

(1)

Using Computer Forensics in your

Investigations

Dave Nardoni

January 12

th

_{, 2010}

Presented to: ISACA – Los Angeles Chapter

(2)

Agenda

Introduction

Dave Nardoni

Analytic & Forensic Technology

Dave Nardoni

Q & A

(3)

Who are we?

• Analytic & Forensic Technology (AFT) group

• Experienced team of analytic and forensic professionals

• Computer forensics labs throughout the US

• Access to labs throughout the globe within the Deloitte Touche

Tohmatsu member firms and their affiliates

(4)

AFT

International group

• 9 Labs in the US

• 16 International Labs

Approximately 250 professionals in the U.S.

• Federal government

• Law enforcement

• Information technologists

• Business development

Unique background and experience

• Certified Public Accountants, Certified Fraud Examiners, statisticians, online

and Internet research professionals and computer forensic specialists

• Former senior law enforcement officials and agents from the FBI, Justice

Department and other government agencies

(5)

Where does the trash go?

• Recycle bin

• Unallocated space

• Swap file and Memory/RAM

• Slack space

(6)

Problems with deleted files

• Physical disk failure

• Software failure

• Deleted files, missing metadata

• How to really delete data?

(7)

How do files get deleted?

• User deleted

– Recycle bin

• Proof of deletion

– Unallocated space

Index Date

Deleted path

1 06/30/06 12:05:09PM

C:\Documents and Settings\dnardoni\My Documents\Secret\Stock

Options\Stock Options Grants.doc

(8)

How do files get deleted?

• Computer deleted

– Unallocated space

(9)

The clock is ticking

Success is partially predicated on time that elapses between when the

incident happens and when the data is preserved

• Electronic evidence is latent (similar to a fingerprint)

• Startup and shutdown (creates and deletes files)

• Temporary internet files

(10)

Deleted Files

(11)

(12)

(13)

(14)

Recovered Deleted Files

What can we say about these files that were previously deleted?

• When were they deleted?

(15)

(16)

File carving – Looking for file signatures

JPG file – Picture

File Signature: Unique bytes at the beginning

of a file that identify the file. These bytes

constitute a “signature” for the file.

The first 4 bytes of the JPG file are ÿØÿà or

FF D8 FF E0

(17)

(18)

Recovering data – Keyword searches

(19)

Understanding the swap file

• Memory/RAM = Desk

• Swap/Page file = File cabinet

(20)

Reviewing the file cabinet – pagefile.sys

I've mentioned to a couple of people that the BB can be used as a modem. Here is info on how to configure

your BB as a modem — so you can get your laptop online anywhere you have a cell signal:

http://www.blackberryforums.com/blackberry-guides/2019-user-howto-use-blackberry-modem-laptop.html?highlight=blackberry+modem

Also useful is Google Maps for your BB:

ùÿÔýcom/blackberry-guides/2019-user-howto-use-blackberry-modem-laptop.html?highlight=blackberry+modem

x®@

rdoni, David (US – Los Angeles)0 €

We are looking for evidence of the custodian searching for how to use PDA as a modem.

Here is what we found in the pagefile.sys

(21)

Slack space

(22)

Slack space (continued)

One program on a tape but program may use several tapes

Sopranos…

NBA Finals

24 News

(23)

Slack space (continued)

Collection of half hour video tapes

Remains of Sopranos…

60 Min

…More Remains of Sopranos

Myth Busters

CSI

Remains of NBA Finals

24 Episode two

(24)

Preservation Considerations

• When to Ghost?

• Major differences between a “ghost” image and a “forensic” image

–

“bit-stream” versus “logical file” copy

• Larger drives = more free space

(25)

Metadata - What it isn’t

Metadata

Who, What, When, Where

Why do I care?

Inadvertent disclosure

What’s available

(26)

Types of Metadata

Application

System

(27)

Application Metadata

Microsoft

®

_Word

Novell

®

_WordPerfect

Microsoft

®

_Excel

Microsoft

®

_Outlook

®

Adobe Acrobat Portable Document Format (PDF)

Exchangeable Image File Format (EXIF)

(28)

(29)

(30)

(31)

Metadata Report

Analyzing hiddent data sample from Deloitte Letter Template.doc Document Name: hidden data sample from Deloitte Letter Template.doc Path: C:\Documents and Settings\tcastrejon\My Documents\MetaData Deck Document Format: Word Document

Built-in document properties:

Built-in Properties Containing Metadata: 2 Title: Deloitte Letter.dot

Comments: Deloitte Word Template v2004.1 08/22/2004

Document Statistics:

Document Statistics Containing Metadata: 6 Creation Date: 7/18/2006 11:16:00 PM Last Save Time: 7/18/2006 11:29:00 PM Time Last Printed: 5/1/2002 4:04:00 PM Last Saved By: Deloitte & Touche Revision Number: 5

Total Edit Time (Minutes): 13 Minutes

Custom document properties: No Custom Document Properties

Last 10 authors: NOT PROCESSED

Attached Template (Convert to Normal):

Attached Template: C:\Program Files\Microsoft Office\Templates\Deloitte\Deloitte Letter.dot Routing slip:

No Routing Slip Versions:

No Versions Track Changes:

Tracked Changes: 5. Tracked Changes are On. 1 Type: Delete Author: Deloitte & Touche

(32)

Metadata Report cont,

4 Type: Paragraph Number Author: Deloitte & Touche

allows you to see how the document would look if you accepted all changes. Showing Markup shows deleted text in balloons in the margin of the document, while inserted text and formatting changes are shown inline. shows the original, unchanged document so that you can see how the document would look if you rejected all changes. Showing Markup shows the inserted text and formatting changes in balloons, while the deleted text remains inline.

[Carriage Return] Location: Main Text

5 Type: Delete Author: Deloitte & Touche

Final allows you to see how the document would look if you accepted all changes. Showing Markup shows deleted text in balloons in the margin of the document, while inserted text and formatting changes are shown inline. shows the original, unchanged document so that you can see how the document would look if you rejected all changes. Showing Markup shows the inserted text and formatting changes in balloons, while the deleted text remains inline.

Location: Main Text

Fast Saves: Fast Saves is Off

Hidden text:

Blocks of Hidden Text: 1 HiddenText 1

Text: Hidden text within a Word doc. While this technique is uncommon, it is mentioned to raise awareness that it does exist.

Location: Main Text Comments:

Comments: 1

Comment 1 Author: Deloitte & Touche Comment: This picture is cool.

Location: Main Text

Graphics:

(33)

(34)

Outlook Metadata

From:

deleted

J

To: Castrejon, Tomas (US - San Francisco) </O=DELOITTE/OU=US/CN=RECIPIENTS/CN=TCASTREJON>

Subject:

FTP and Password Info

Created:

06/13/06 12:55:20

Sent:

06/13/06 12:55:09

Header:

Microsoft Mail Internet Headers Version 2.0

Received:

from usndc0480.us.deloitte.com ([10.28.30.180]) by uscnt0413.us.deloitte.com with Microsoft

SMTPSVC(6.0.3790.211);

Tue, 13 Jun 2006 14:55:20 -0500

Received:

from atl1.deloitte.com ([10.28.30.11]) by usndc0480.us.deloitte.com with Microsoft

SMTPSVC(6.0.3790.211);

Tue, 13 Jun 2006 15:55:19 -0400

Return-Path: <[email protected]>

Received

: from nmp3.deloitte.com ([10.28.230.102] [10.28.230.102]) by atl1.deloitte.com with ESMTP for

[email protected]; Tue, 13 Jun 2006 19:55:19 Z

Received:

from wr-out-0506.google.com (wr-out-0506.google.com [64.233.184.228]) by nmp3.deloitte.com with

ESMTP for [email protected]; Tue, 13 Jun 2006 19:55:19 Z

Received:

by wr-out-0506.google.com with SMTP id i31so878769wra

for <[email protected]>; Tue, 13 Jun 2006 12:55:19 -0700 (PDT)

DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;

s=beta; d=gmail.com;

(35)

(36)

(37)

(38)

(39)

(40)

(41)

Issues to avoid

Don’t Snoop

• Locard’s principal

Don’t try to hide images (Examples)

Don’t shrink images or fonts

(Examples)

Don’t use same color text as

background (Examples)

(42)

Ways to minimize exposure

Change default settings

• Word

(43)

Minimize exposure, cont.

(44)

Removing metadata

Use a meta data scrubbing tool

Save original, remove sensitive data, copy out, PDF

Microsoft Metadata Office removal tool

• http://www.microsoft.com/downloads/details.aspx?FamilyID=144e54ed-d43e-42ca-bc7b-5446d34e5360&displaylang=en

Metadata Assistant

(45)

Using it to your advantage

Identify potential metadata

Ø

Email, Office files, system

What is relevant

Ø

Example (PDF version and producer)

Preservation

Ø

Example (NTFS v. CD)

Presentation

(46)

(47)

Contact Information

Deloitte Financial Advisory

Services LLP

350 South Grand Ave

Los Angeles, CA 90071

USA

David Nardoni, EnCE, CISSP

Senior Manager

Tel: (213) 996-5927

Analytic & Forensic Technology

Cell: (626) 840-8952

Fax: (213) 694-5916

[email protected]

www.deloitte.com

(48)

About Deloitte

Deloitte refers to one or more of Deloitte Touche Tohmatsu, a Swiss Verein, its member firms, and their respective subsidiaries and affiliates. Deloitte Touche Tohmatsu is an organization of member firms around the world devoted to excellence in providing professional services and advice, focused on client service through a global strategy executed locally in nearly 140 countries. With access to the deep intellectual capital of approximately 150,000 people worldwide, Deloitte delivers services in four professional areas — audit, tax, consulting, and financial advisory services — and serves more than 80 percent of the world’s largest companies, as well as large national enterprises, public institutions, locally important clients, and successful, fast-growing global companies. Services are not provided by the Deloitte Touche Tohmatsu Verein, and, for regulatory and other reasons, certain member firms do not provide services in all four professional areas.

As a Swiss Verein (association), neither Deloitte Touche Tohmatsu nor any of its member firms has any liability for each other’s acts or omissions. Each of the member firms is a separate and independent legal entity operating under the names “Deloitte,” “Deloitte & Touche,” “Deloitte Touche Tohmatsu,” or other related names.

In the United States, Deloitte & Touche USA LLP is the U.S. member firm of Deloitte Touche Tohmatsu and services are provided by the subsidiaries of Deloitte & Touche USA LLP (Deloitte & Touche LLP, Deloitte Consulting LLP, Deloitte Financial Advisory Services LLP, Deloitte Tax LLP, and their subsidiaries), and not by Deloitte & Touche USA LLP. The subsidiaries of the U.S. member firm are among the nation’s leading professional services firms, providing audit, tax, consulting, and financial advisory services through nearly 40,000 people in more than 90 cities. Known as employers of choice for innovative human resources programs, they are dedicated to helping their clients and their people excel. For more information, please visit the U.S. member firm’s Web site at www.deloitte.com