Análise Forense Digital - Atividade Recente

MCIF - Digital Forensic Analysis 1 - Autopsy

• Autopsy: A graphical tool for digital investigations of storage media images. Developed in Java, mainly for Windows. It's expandable, supporting modules in Python for Java and has limited support for Android.
• Autopsy Workflow:
  • Create a Case: Includes case name, type, directory, basic information.
  • Add a Data Source: Can use raw (dd) or EnCase (E01) images, drives, files, or virtual machine drives.
  • Analyze with Ingest Modules: Ingest modules perform tasks like analysis with pre-installed modules.
  • Manual Analysis: Manual inspection of data.
  • Report Generation: Creating reports of findings.

Introductory Concepts

• Autopsy's url: http://www.sleuthkit.org/autopsy/
• Autopsy is a graphical tool for digital investigation of storage media images.
• Autopsy is developed in Java, mainly for Windows.
• Autopsy is expandable (supports modules developed in Python for Java).
• Autopsy has limited support for Android.

Tips: Making Autopsy Run Faster

• Run Autopsy under Linux: Avoids anti-virus interference and reduces concurrent processes for better CPU performance. However, certain tools like OCR may not work.
• Give more RAM to Autopsy JVM: For example, change the value from 4 GB to 8 GB. Increasing CPU cores increases needed RAM.
• More memory to Solr: The indexing service enhancing search features.
• Increasing from 1 to 2 GB should be sufficient; never give more than 2 GB for the JVM.

Tips: Autopsy Installation on Ubuntu

• Download the snap package from https://github.com/sleuthkit/autopsy/releases
• Install the package using sudo snap install --dangerous autopsy.snap
• Connect to snap using sudo snap connect {} (replace {} with the output from snap connections autopsy | sed -ne 's/^[^ ]* *([^]*) *- *- *$/\1/p')
• Run the first time: snap run autopsy --nosplash

Data Processing - Ingest Modules

• Automated Processing: Using ingest modules effectively processes data.
• Ingest Modules: Examples include:
  • All Files, Directories, and Unallocated Space
  • Recent Activity
  • Hash Lookup
  • File Type Identification
  • Embedded File Extractor
  • Exif Parser
  • Keyword Search
  • Email Parser
  • Extension Mismatch Detector
  • E01 Verifier
  • Encryption Detection
  • Interesting Files Identifier
  • PhotoRec Carver
  • Virtual Machine Extractor
• Multi-core support: Enables parallel processing of files to reduce processing time. Configure the number of threads using Tools -> Options -> Ingest -> Settings.

Case 1: Hacking

• Lost PC: On 20-09-2004, a computer was found abandoned, with potential use for hacking.
• Suspect: Nicknamed "Mr. Evil."
• Goal: Intercept internet traffic to obtain credit card information, usernames and passwords.
• Tasks:
  • Download PC drive images from Moodle.
  • Create a new case in Autopsy.
  • Start automated processing.

Module: Recent Activity

• Extracts information: from the last 7 days.
• Information included: Internet usage (including searches), installed programs, connected devices , processes.
• Display: Results are displayed in "Extracted Content."

Module: Hash Lookup

• Computes hash values: of found files and compares to existing MD5 hashsets.
• Known bad hashsets: Files to be validated.
• Known good hashsets: Files that can be safely ignored.
• Known hashsets: Files that can be good or bad depending on context.
• Hash sets: Commonly available for police forces (e.g., child pornography images).
• National Software Reference Library (NSRL): A publicly available hash database from NIST, available through URLs http://www.nsrl.nist.gov/, http://sourceforge.net/projects/autopsy/files/NSRL/. VirusShare URL: https://virusshare.com/hashes.4n6.

Module: File Type Identification

• Checks file types: according to characteristics and collects metadata.
• Uses Tika: (http://tika.apache.org/) as an indexing module.
• Generates information: for other modules, including Extension Mismatch Detector and Keyword Search.

Module: Embedded File Extraction

• Uncompresses files: like ZIP, RAR and embedded files (DOC, DOCX, PPT, PPTX, XLS, XLSX).
• Processing: Process files again, enabling analysis of files within compressed/embedded files.
• Results: displayed under results → Archives.

Module: EXIF Parser

• Extracts EXIF data: (Exchangeable Image File Format) for images.
• Data included: Geolocation, date/time, camera model, setup, resolution, etc.
• Results: Displayed in the "Extracted Content" area under "EXIF Metadata".

Module: Keyword Search

• Searches by keywords: During initial or on-demand processing.
• Extract text: from files and adds to the index (Solr).
• Supported formats: Text, MS Office, PDF, Emails.
• String Extraction Algorithm: Identifies encodings and languages for non-supported formats.
• Default lists: include web addresses (URLs), IP addresses, phone numbers, email addresses.

Module: Email Parser

• Identifies and processes: Emails in MBOX, PST files.
• Processes: emails and their attachments.

Module: Extension Mismatch Detector

• Identifies files: with mismatched file patterns and filename extensions, potentially camouflaging malicious code.
• Possible false positives: May result in identifying valid files incorrectly.

Module: E01 Verifier

• Verifies EWF files: Calculates the hash of EWF file data and compares it to metadata in the E01 file. Identifies corrupted EWF files and prevents automated process issues.

Module: Interesting Files Identifier

• Detects specific files: and folders based on characteristics (type, size, extension, name, MIME type).
• Generates alerts: for files and folders matching the specified criteria.

Module: PhotoRec Carver

• Extracts files: from unallocated disk space.
• Multiple file types: Supported including recently deleted files.
• Custom file patterns: Allows custom inclusion of file types.
• "Process Unallocated Space" option needed for activation.

Module: Virtual Machine Extractor

• Identifies virtual machine disks: which are added as new data sources.
• Supports different formats: Including VMWare (vmdk) and Microsoft Virtual Hard Drives (vhd).
• Conversion capability: FTK Imager can convert virtual disks to E01 format.

Report Generation

• Types available:
  • Results: Applied to the items.
  • Tagged: Applied to tagged items.
  • Files: List of files under analysis.
  • KML: GPS Coordinates in Google Earth format.
  • TSK: MAC timeline of all files.
  • STIX: Compares results to a threat file.
• Other functions: can include filtering and advanced artifact selection options for reports.

Labeling

• Tagging results for future reference.
• Enables marking files and results.
• Tag names are set by the investigator.
• Tags appear in the results view.

Timelines

• Created using: Event dates.
• Recognizes various: Event types: Files (modification, access, creation, change); Internet access (downloads, cookies, bookmarks, searches, browser history); Other events (messages, phone calls, emails, GPS tracks, etc.).
• Visualizations: Including histograms and detailed views.
• Filter options: Allowing reduction of elements.

Exporting Evidences

• Exporting file types (PDF, Plain Text, Rich Text, Executable, Deleted Files): analysis with external tools, comparisons, or archival purposes.

Bibliography and Credits

• Autopsy User's Guide available at https://github.com/sleuthkit/autopsy/tree/release-4.7.0/docs/doxygen-user.
• Autopsy Forensic Browser User Guide (2013), author: Julia Keffer. Available at https://juliakeffer.files.wordpress.com/2013/06/autopsy_user_guide.pdf.
• The slides' original author is António Pinto.
• The document was translated, adapted, and updated by Miguel Frade.