The Basics of Digital Forensics (Syngress)

The Basics of Digital Forensics The Primer for Getting Started in Digital Forensics Page left intentionally blank The Basics of Digital Forensics The Primer for Getting Started in Digital Forensics Second Edition John Sammons AMSTERDAM BOSTON HEIDELBERG LONDON NEW YORK OXFORD PARIS SAN DIEGO SAN FRANCISCO SINGAPORE SYDNEY TOKYO Syngress is an Imprint of Elsevier Acquiring Editor: Chris Katsaropoulos Editorial Project Manager: Benjamin Rearick Project Manager: Surya Narayanan Jayachandran Designer: Mathew Limbert Syngress is an imprint of Elsevier 225 Wyman Street, Waltham, MA 02451, USA Copyright © 2015 Elsevier Inc. All rights reserved. No part of this publication may be reproduced or transmitted in any form or by any means, elec- tronic or mechanical, including photocopying, recording, or any information storage and retrieval system, without permission in writing from the publisher. Details on how to seek permission, further information about the Publisher’s permissions policies and our arrangements with organizations such as the Copyright Clearance Center and the Copyright Licensing Agency, can be found at our website: www.elsevier.com/permissions. This book and the individual contributions contained in it are protected under copyright by the Pub- lisher (other than as may be noted herein). Notices Knowledge and best practice in this field are constantly changing. As new research and experience broaden our understanding, changes in research methods, professional practices, or medical treat- ment may become necessary. Practitioners and researchers must always rely on their own experience and knowledge in evaluating and using any information, methods, compounds, or experiments described herein. In using such information or methods they should be mindful of their own safety and the safety of others, includ- ing parties for whom they have a professional responsibility. To the fullest extent of the law, neither the Publisher nor the authors, contributors, or editors, assume any liability for any injury and/or damage to persons or property as a matter of products liability, negligence or otherwise, or from any use or operation of any methods, products, instructions, or ideas contained in the material herein. British Library Cataloguing-in-Publication Data A catalogue record for this book is available from the British Library Library of Congress Cataloging-in-Publication Data A catalog record for this book is available from the Library of Congress ISBN: 978-0-12-801635-0 For information on all Syngress publications visit our website at http://store.elsevier.com/ To Lora, Abby, and Rae for making me a truly blessed and lucky man. To my Aunt Ruth, whose love, support, and encouragement means so much. To my mother, Juanita, and my grandmother, Grace, for the many sacrifices you made and the example you set … I miss you. v Page left intentionally blank Contents Preface.......................................................................................................................xv Acknowledgments....................................................................................................xix CHAPTER 1 Introduction.................................................................................. 1 What is Forensic Science?............................................................... 2 What is Digital Forensics?............................................................... 2 Uses of Digital Forensics................................................................. 3 Criminal Investigations.............................................................3 Civil Litigation..........................................................................4 Intelligence................................................................................ 5 Administrative Matters............................................................. 5 The Digital Forensics Process.........................................................7 Locard’s Exchange Principle........................................................... 9 Scientific Method........................................................................... 10 Organizations of Note....................................................................10 Scientific Working Group on Digital Evidence......................10 American Academy of Forensic Sciences............................... 11 American Society of Crime Laboratory Directors/Laboratory Accreditation Board............................. 11 National Institute of Standards and Technology.....................12 American Society for Testing and Materials...........................12 Role of the Forensic Examiner in the Judicial System.................. 12 The CSI Effect........................................................................ 13 References...................................................................................... 14 CHAPTER 2 Key Technical Concepts........................................................15 Bits, Bytes, and Numbering Schemes............................................ 15 Hexadecimal........................................................................... 16 Binary to Text: ASCII and Unicode........................................17 File Extensions and File Signatures............................................... 17 Storage and Memory...................................................................... 18 Magnetic Disks....................................................................... 19 Flash Memory......................................................................... 20 Optical Storage.......................................................................20 Volatile versus Nonvolatile Memory.......................................20 Computing Environments..............................................................21 Cloud Computing.................................................................... 21 vii viii Contents Data Types.....................................................................................22 Active Data.............................................................................22 Latent Data.............................................................................. 22 Archival Data.......................................................................... 23 File Systems................................................................................... 23 Allocated and Unallocated Space.................................................. 24 Data Persistence...................................................................... 24 How Magnetic Hard Drives Store Data.........................................25 References...................................................................................... 29 CHAPTER 3 Labs and Tools..........................................................................31 Forensic Laboratories.................................................................... 31 Virtual Labs.............................................................................32 Lab Security............................................................................ 32 Evidence Storage.................................................................... 33 Policies and Procedures................................................................. 34 Quality Assurance.......................................................................... 34 Tool Validation........................................................................35 Documentation........................................................................ 35 Digital Forensic Tools....................................................................37 Tool Selection.........................................................................38 Hardware.................................................................................38 Software..................................................................................40 Additional Resources..................................................................... 41 Open Source Tools..................................................................41 Alert!.............................................................................................. 42 Dependence on the Tools........................................................42 Accreditation.................................................................................. 43 Accreditation versus Certification........................................... 44 References...................................................................................... 45 CHAPTER 4 Collecting Evidence................................................................ 47 Crime Scenes and Collecting Evidence......................................... 48 Removable Media...................................................................48 Cell Phones............................................................................. 49 Alert!.............................................................................................. 50 Protecting Cell Phones from Network Signals....................... 50 Alert!.............................................................................................. 50 Power...................................................................................... 50 Order of Volatility...................................................................51 Documenting the Scene................................................................. 51 Contents ix Photography............................................................................ 52 Notes....................................................................................... 52 Chain of Custody........................................................................... 53 Marking Evidence................................................................... 54 Cloning.......................................................................................... 54 Purpose of Cloning................................................................. 55 The Cloning Process............................................................... 56 Forensically Clean Media....................................................... 56 Forensic Image Formats..........................................................57 Risks and Challenges.............................................................. 57 Value in eDiscovery................................................................57 Alert!.............................................................................................. 58 Sanctions in Electronic Discovery.......................................... 58 Live System versus Dead System..................................................58 Live Acquisition Concerns......................................................58 More Advanced..............................................................................59 Preserving Evidence in Ram................................................... 59 Advantage of Live Collection.................................................59 Principles of Live Collection.................................................. 59 Alert!.............................................................................................. 60 Evidence in Ram..................................................................... 60 Conducting and Documenting a Live Collection.................... 60 Hashing.......................................................................................... 61 Types of Hashing Algorithms.................................................61 Hashing Example.................................................................... 61 Uses of Hashing...................................................................... 62 Final Report................................................................................... 62 References...................................................................................... 64 CHAPTER 5 Windows System Artifacts....................................................65 Deleted Data.................................................................................. 66 More Advanced..............................................................................66 File Carving................................................................................... 66 Hibernation File (Hiberfile.sys)..................................................... 66 Sleep........................................................................................ 67 Hibernation............................................................................. 67 Hybrid Sleep........................................................................... 67 Registry..........................................................................................67 Registry Structure................................................................... 68 Attribution...............................................................................71 External Drives.......................................................................72 x Contents Print Spooling................................................................................ 72 Recycle Bin....................................................................................73 Alert!.............................................................................................. 73 Recycle Bin Function.............................................................. 73 More Advanced..............................................................................74 Recycle Bin Bypass................................................................ 74 Metadata........................................................................................ 75 Alert!.............................................................................................. 76 Date and Time Stamps............................................................76 Removing Metadata................................................................ 76 Thumbnail Cache........................................................................... 78 Most Recently Used....................................................................... 78 Restore Points and Shadow Copy..................................................79 Restore Points......................................................................... 79 Shadow Copies........................................................................ 79 Prefetch.......................................................................................... 80 Link Files....................................................................................... 81 Installed Programs.................................................................. 81 References...................................................................................... 82 CHAPTER 6 Anti-Forensics........................................................................... 83 Hiding Data.................................................................................... 84 Encryption............................................................................... 85 What is Encryption?................................................................ 85 Early Encryption..................................................................... 85 Algorithms.............................................................................. 86 Key Space...............................................................................88 Some Common Types of Encryption......................................88 Breaking Passwords................................................................90 Password Attacks...........................................................................91 Brute Force Attacks................................................................. 91 Password Reset.......................................................................91 Dictionary Attack.................................................................... 91 Additional Resources..................................................................... 93 Encryption............................................................................... 93 Steganography...............................................................................93 Data Destruction............................................................................ 95 Drive Wiping...........................................................................96 More Advanced..............................................................................96 Defragmentation as Anti-Forensic Technique.........................96 References.................................................................................... 101 Contents xi CHAPTER 7 Legal...........................................................................................105 The Fourth Amendment...............................................................106 Criminal Law—searches without a Warrant................................106 Reasonable Expectation of Privacy.......................................106 Private Searches.................................................................... 107 E-mail.................................................................................... 107 The Electronic Communications Privacy Act.......................107 Exceptions to the Search Warrant Requirement...................107 More Advanced............................................................................108 Consent Forms...................................................................... 108 Alert!............................................................................................ 110 Cell Phone Searches: The Supreme Court Weighs In...........110 Searching with a Warrant.............................................................111 Seize the Hardware or Just the Information?........................ 111 Particularity........................................................................... 111 Establishing Need for Offsite Analysis................................. 112 Stored Communications Act................................................. 113 Electronic Discovery....................................................................113 Duty to Preserve.................................................................... 114 Private Searches in the Workplace........................................115 Alert!............................................................................................ 115 International e-Discovery...................................................... 115 Expert Testimony.........................................................................116 Additional Resources................................................................... 117 Expert Testimony..................................................................117 References.................................................................................... 117 CHAPTER 8 Internet and E-mail................................................................ 119 Internet Overview........................................................................119 Additional Resources................................................................... 120 Web Technology...................................................................120 Peer-to-peer (P2P).................................................................121 More Advanced............................................................................121 Gnutella Requests................................................................. 121 The INDEX.DAT file............................................................121 Web Browsers—Internet Explorer...............................................122 Cookies................................................................................. 122 Temporary Internet Files, a.k.a. Web Cache.........................122 Internet History..................................................................... 123 More advanced.............................................................................124 The NTUSER.DAT File........................................................124 xii Contents Internet Explorer Artifacts in the Registry............................124 Chat Clients........................................................................... 125 Internet Relay Chat............................................................... 126 “I Seek You”..........................................................................126 E-mail.......................................................................................... 127 Accessing E-mail.................................................................. 127 E-mail Protocols...................................................................127 E-Mail as Evidence............................................................... 128 E-Mail—Covering the Trail..................................................128 Alert!............................................................................................ 128 Shared E-Mail Accounts....................................................... 128 Tracing E-Mail...................................................................... 129 Reading E-Mail Headers....................................................... 129 Social Networking Sites..............................................................130 Additional Resources................................................................... 130 Casey Anthony Trial Testimony............................................ 130 References.................................................................................... 131 CHAPTER 9 Network Forensics................................................................. 133 Introduction.................................................................................. 133 Social Engineering................................................................ 134 Network Fundamentals................................................................134 Network Types......................................................................135 Network Security Tools...............................................................136 Network Attacks..........................................................................137 Alert!............................................................................................ 138 Inside Threat.........................................................................138 Incident Response........................................................................ 139 Network Evidence and Investigations.........................................140 Network Investigation Challenges........................................142 Additional Resources................................................................... 143 Training and Research.......................................................... 143 References.................................................................................... 143 CHAPTER 10 Mobile Device Forensics.....................................................145 Cellular Networks........................................................................146 Cellular Network Components.............................................147 Types of Cellular Networks..................................................148 Operating Systems....................................................................... 149 Cell Phone Evidence.................................................................... 150 Call Detail Records............................................................... 151 Contents xiii Collecting and Handling Cell Phone Evidence..................... 152 Subscriber Identity Modules................................................. 154 Cell Phone Acquisition: Physical and Logical...................... 154 Cell Phone Forensic Tools...........................................................155 Global Positioning Systems......................................................... 157 References.................................................................................... 160 CHAPTER 11 Looking Ahead: Challenges and Concerns...................163 Standards and Controls................................................................ 163 Cloud Forensics...........................................................................165 What Is Cloud Computing?.................................................. 165 Additional Resources................................................................... 165 Public Clouds........................................................................ 165 Benefits of the Cloud............................................................ 166 Cloud Forensics and Legal Concerns....................................166 Alert!............................................................................................ 166 Cloud Persistence—Dropbox...............................................166 Solid State Drives........................................................................167 How Solid State Drives Store Data.......................................167 More Advanced............................................................................168 File Translation Layer...........................................................168 The Problem: Taking out the Trash.......................................168 Speed of Change.......................................................................... 168 Additional Resources................................................................... 169 Twitter...................................................................................169 References.................................................................................... 170 Index....................................................................................................................... 173 Page left intentionally blank Preface Seal Team Six tore the hard drives from Osama bin Laden’s computers. Some of Michael Jackson’s final words were captured on an iPhone. Google searches for chloroform played a central role in the trial of Casey Anthony. This list could go on and on. Digital forensics is used to keep us safe, and to ensure justice is done and company and taxpayer resources aren’t abused. This book is your first step into the world of digital forensics. Welcome! Digital forensics is used in a number of arenas, not just in catching identity thieves and Internet predators. For example, it’s being used on the battlefields of Afghanistan to gather intelligence. The rapid exploitation of information pulled from cell phones and other devices is helping our troops identify and eliminate terrorists and insurgents. It’s being used in the multibillion-dollar world of civil litigation. Gone are the days when opposing parties exchanged boxes of paper memos, letters, and reports as part of the litigation process. Today, those documents are written in 1s and 0s rather than ink. They are stored on hard drives and backup tapes rather than in filing cabinets. Digital forensics helps combat the massive surge in cybercrime. Identity thieves, child pornographers, and “old school” criminals are all using and leveraging technol- ogy to facilitate their illegal activities. Finally, it’s being used in the workplace to help protect both companies and gov- ernment entities from the misuse of their computer systems. INTENDED AUDIENCE As the title suggests, this is a beginner’s book. The only assumption is that you have a fundamental understanding of or familiarity with computers and other digital devices. If you have a moderate or advanced understanding of digital forensics, this book may not be for you. As part of Syngress’s “Basics” series, I wrote this book more as a broad introduction to the subject rather than an all-encompassing tome. I’ve tried to use as much “Plain English” as possible, making it (hopefully) an easier read. I’d like to emphasize that this is an introductory book that is deliberately limited in length. Given that, there is much that couldn’t be covered in depth or even covered at all. Each chapter could be a book all by itself. There are many wonderful books out there that can help further your understanding. I sincerely hope you don’t stop here. xv xvi Preface ORGANIZATION OF THIS BOOK The book is organized in a fairly straightforward way. Each chapter covers a specific type of technology and begins with a basic explanation of the technology involved. This is a necessity to really understand the forensic material that follows. To help reinforce the material, the book also contains stories from the field, case examples, and Q and As with a cryptanalyst and a specialist in cell phone forensics. CHAPTER 1–INTRODUCTION What exactly is digital forensics? This chapter seeks to define digital forensics and examine how it’s being used. From the battlefield to the boardroom to the courtroom, digital forensics is playing a bigger and bigger role. CHAPTER 2–KEY TECHNICAL CONCEPTS Understanding how computers create and store digital information is a perquisite for the study of digital forensics. It is this understanding that enables us to answer ques- tions like “How was that artifact created?” and “Was that generated by the computer itself, or was it a result of some user action?” We’ll look at binary, how data are stored, storage media, and more. CHAPTER 3–LABS AND TOOLS In “Labs and Tools,” we look at the digital forensic environment and hardware and software that are used on a regular basis. We will also examine standards used to accredit labs and validate tools. Those standards are explored along with quality as- surance, which is the bedrock of any forensic operation. Quality assurance seeks to ensure that results generated by the forensic examination are accurate. CHAPTER 4–COLLECTING EVIDENCE How the digital evidence is handled will play a major role in getting that evidence admitted into court. This chapter covers fundamental forensically sound practices that you can use to collect evidence and establish a chain of custody. CHAPTER 5–WINDOWS SYSTEM ARTIFACTS The overwhelming odds are that you have a Windows-based computer on your desk, in your briefcase, or both. It’s a Windows world. (No disrespect, Mac people. I’m one of you.) With a market share of more than 90%, it clearly represents the bulk of our work. This chapter looks at many of the common Windows artifacts and how they are created. Preface xvii CHAPTER 6–ANTI-FORENSICS The word is out. Digital forensics is not the secret it once was. Recovering digital evidence, deleted files, and the like is now commonplace. It’s regularly seen on such shows as NCIS and CSI. The response has been significant. They are now many tools and techniques out there that are used to hide or destroy data. These are examined in this chapter. CHAPTER 7–LEGAL Although a “forensic” science, the legal aspects of digital forensics can’t be divorced from the technical. In all but certain military/intelligence applications, the legal au- thority to search is a perquisite for a digital forensics examination. This chapter ex- amines the Fourth Amendment, as well as reasonable expectations of privacy, private searches, searching with and without a warrant, and the Stored Communications Act. CHAPTER 8–INTERNET AND E-MAIL Social networks, e-mail, chat logs, and Internet history represent some of the best evidence we can find on a computer. How does this technology work? Where is this evidence located? These are just a few of the questions we’ll answer in this chapter. CHAPTER 9–NETWORK FORENSICS We can find a network almost anywhere, from small home networks to huge corpo- rate ones. As with computers and cell phones, we must first understand how these work. To that end, this chapter begins with networking basics. Next, we start looking at how networks are attacked and what role digital forensics plays in not only the response, but in how perpetrators can be traced. CHAPTER 10–MOBILE DEVICE FORENSICS Small-scale mobile devices such as cell phones and GPS units are everywhere. These devices are, in many respects, pocket computers. They have a huge potential to store evidence. Digital forensics must be as proficient with these devices as they are with desktop computers. We’ll look at the underlying technology powering cell phones and GPS units, as well as the potential evidence they could contain. CHAPTER 11–LOOKING AHEAD: CHALLENGES AND CONCERNS Two “game-changing” technologies are upon us that will have a huge impact on not only the technical aspect of digital forensics but the legal piece as well. The technol- ogy driving solid state hard drives negates much of the traditional “bread and butter” of digital forensics. That is our ability to recover deleted data. As of today, there is no answer to this problem. xviii Preface Cloud computing creates another major hurdle. In the cloud, data are stored in a complex virtual environment that could physically be located anywhere in the world. This creates two problems; from a technical standpoint, there is an alarming lack of forensic tools that work in this environment, an deleted files are also nearly impos- sible to recover. Legally, it’s a nightmare. With data potentially being scattered across the globe, the legal procedures and standards vary wildly. Although steps are being taken to mitigate this legal dilemma, the situation still persists today. Being in its infancy, the digital forensics community still has work to do regard- ing how it conducts its business, especially in relation to the other more traditional disciplines. This chapter will explore this issue. Acknowledgments Although my name may be on the cover, this book would not have been possible without the help and support of many people. First, I’d like to thank my family, par- ticularly my wife Lora and my two girls, Abby and Rae. Their patience, understand- ing, and willingness to “pick up my slack” while I wrote was invaluable. Thank you, ladies. Next I’d like to thank Nick Drehel, Rob Attoe, Lt. Lannie Hilboldt, Chris Vance, and Nephi Allred for sharing their expertise and experiences. I have no doubt their contributions made this a better book. My previous chair, Dr. Mike Little, and my dean, Dr. Charles Somerville, also helped make this book a reality. It would have been impossible for me to write this book and still do my “day job” without their support and assistance. Thank you, gentlemen. I’d like to thank Ben Rearick and Chris Katsaropoulos from Syngress for keeping me on task, as well as for their support and encouragement. Thanks to my tech editor, Jonathan Rajewski, for keeping me on point. Many thanks go to Bryanne Edmonds, Jennifer Rehme, and Jonathan Sisson. These current and former Marshall University students proved invaluable in the cre- ation of this book. I have no doubt that each will be a successful contributor to the forensic science community. I wish all of you nothing but continued success. xix Page left intentionally blank CHAPTER Introduction 1 “Each betrayal begins with trust.” —“Farmhouse” by the band Phish INFORMATION IN THIS CHAPTER: What is Forensic Science? What is Digital Forensics? Uses of Digital Forensics Role of the Forensic Examiner in the Judicial System INTRODUCTION Your computer will betray you. This is a lesson that many CEOs, criminals, politi- cians, and ordinary citizens have learned the hard way. You are leaving a trail, albeit a digital one; it’s a trail nonetheless. Like a coating of fresh snow, these 1s and 0s capture our “footprints” as we go about our daily life. Cell phone records, ATM transactions, web searches, e-mails, and text messag- es are a few of the footprints we leave. As a society, our heavy use of technology means that we are literally drowning in electronically stored information. And the tide keeps rolling in. Don’t believe me? Check out these numbers from the research company IDC: The digital universe (all the digital information in the world) will reach 1.2 million petabytes in 2010. That’s up by 62% from 2009. If you can’t get your head around a petabyte, maybe this will help: “One petabyte is equal to: 20 million, four-drawer filing cabinets filled with text or 13.3 years of HD-TV video” (Mozy, 2009). The impact of our growing digital dependence is being felt in many domains, not the least of which is the legal system. Everyday, digital evidence is finding its way into the world’s courts. This is definitely not your father’s litigation. Gone are the days when records were strictly paper. This new form of evidence presents some very significant challenges to our legal system. Digital evidence is considerably different from paper documents and can’t be handled in the same way. Change, therefore, is The Basics of Digital Forensics 1 Copyright © 2015 Elsevier Inc. All rights reserved. 2 CHAPTER 1 Introduction inevitable. But the legal system doesn’t turn on a dime. In fact, it’s about as nimble as the Titanic. It’s struggling now to catch up with the blinding speed of technology. Criminal, civil, and administrative proceedings often focus on digital evidence, which is foreign to many of the key players, including attorneys and judges. We all know folks who don’t check their own e-mail or even know how to surf the Internet. Some lawyers, judges, businesspeople, and cops fit squarely into that category as well. Unfortunately for those people, this blissful ignorance is no longer an option. Where law-abiding society goes, the bad guys will be very close behind (if not slightly ahead). They have joined us on our laptops, cell phones, iPads, and the In- ternet. Criminals will always follow the money and leverage any tools, including technology, that can aid in the commission of their crimes. Although forensic science has been around for years, digital forensics is still in its infancy. It’s still finding its place among the other more established forensic dis- ciplines, such as DNA and toxicology. As a discipline, it is where DNA was many years ago. Standards and best practices are still being developed. Digital forensics can’t be done without getting under the hood and getting your hands dirty, so to speak. It all starts with the 1s and 0s. This binary language under- pins not only the function of the computer but how it stores data as well. We need to understand how these 1s and 0s are converted into the text, images, and videos we routinely consume and produce on our computers. WHAT IS FORENSIC SCIENCE? Let’s start by examining what it’s not. It certainly isn’t Humvees, sunglasses, and expensive suits. It isn’t done without lots of paperwork, and it’s never wrapped up in 60 minutes (with or without commercials). Now that we know what it isn’t, let’s examine what it is. Simply put, forensics is the application of science to solve a legal problem. In forensics, the law and science are forever integrated. Neither can be ap- plied without paying homage to the other. The best scientific evidence in the world is worthless if it’s inadmissible in a court of law. WHAT IS DIGITAL FORENSICS? There are many ways to define digital forensics. In Forensic Magazine, Ken Zatyko defined digital forensics this way: “The application of computer science and investigative procedures for a legal purpose involving the analysis of digital evidence after proper search authority, chain of custody, validation with mathematics, use of validated tools, repeatabil- ity, reporting, and possible expert presentation” (Zatyko, 2007). Digital forensics encompasses much more than just laptop and desktop computers. Mobile devices, networks, and “cloud” systems are very much within the scope of Uses of digital forensics 3 the discipline. It also includes the analysis of images, videos, and audio (in both ana- log and digital format). The focus of this kind of analysis is generally authenticity, comparison, and enhancement. USES OF DIGITAL FORENSICS Digital forensics can be used in a variety of settings, including criminal investiga- tions, civil litigation, intelligence, and administrative matters. CRIMINAL INVESTIGATIONS When you mention digital forensics in the context of a criminal investigation, people tend to think first in terms of child pornography and identity theft. Although those investigations certainly focus on digital evidence, they are by no means the only two. In today’s digital world, electronic evidence can be found in almost any criminal investigation. Homicide, sexual assault, robbery, and burglary are just a few of the many examples of “analog” crimes that can leave digital evidence. One of the major struggles in law enforcement is to change the paradigm of the police and get them to think of and seek out digital evidence. Everyday digital de- vices such as cell phones and gaming consoles can hold a treasure trove of evidence. Unfortunately, none of that evidence will ever see a courtroom if it’s not first recog- nized and collected. As time moves on and our law enforcement agencies are replen- ished with “younger blood,” this will become less and less of a problem. Bind, torture, kill The case of Dennis Rader, better known as the BTK killer, is a great example of the critical role digital forensics can play in a criminal investigation. This case had national attention and, thanks to digital forensics, was solved 30 years later after it occurred. To all who knew him before his arrest, Dennis Rader was a family man, church member, and dedicated public servant. What they didn’t know was that he was also an accomplished serial killer. Dennis Rader, known as Bind, Torture, Kill (BTK), murdered ten people in Kansas from 1974 to 1991. Rader managed to avoid capture for more than 30 years until technology betrayed him. After years of silence, Rader sent a letter to the Wichita Eagle newspaper declaring that he was responsible for the 1986 killing of a young mother. The letter was received by the Eagle on March 19, 2004. After conferring with the FBI’s Behavioral Analysis Unit, the police decided to attempt to communicate with BTK through the media. In January 2005, Rader left a note for police, hidden in a cereal box in the back of a pickup truck belonging to a Home Depot employee. In the note, he said: “Can I communicate with Floppy and not be traced to a computer. Be honest. Under Miscellaneous Section, 494, (Rex, it will be OK), run it for a few days in case I’m out of town-etc. I will try a floppy for a test run some time in the near future-February or March.” 4 CHAPTER 1 Introduction The police did the only thing they could. They lied. As directed, they responded (via an ad in the Eagle) on January 28. The ad read: “Rex, it will be ok, Contact me PO Box 1st four ref. numbers at 67202.” On February 16, a manila envelope arrived at KSAS-TV, the Fox affiliate in Wichita. Inside was a purple floppy disc from BTK. The disc contained a file named “Test A.rtf.” (The.rtf extension stands for “Rich Text Format”). A forensic exam of the file struck gold. The file’s metadata (the data about the data) gave investigators the leads they had been waiting more than 30 years to find. In addition to the “Date Created” (Thursday, February 10, 2005 6:05:34 PM) and the “Date Modified” (Monday, February 14, 2005 2:47:44 PM) were the “Title” (Christ Lutheran Church) and “Last Saved By:” (Dennis). Armed with this information, investigators quickly logged on to the Christ Lu- theran Church website. There they found that Dennis Rader was the president of the church’s Congregation Council. The noose was tightening, but it wasn’t tight enough. Investigators turned to DNA to make the case airtight. Detectives obtained a DNA sample from Rader’s daughter and compared it to DNA from BTK. The results proved that BTK was her father. On February 25, three days after the DNA sample arrived at the lab, Rader was arrested, sealing the fate of BTK. He is currently serving ten consecutive life sentences (Wichita Eagle). CIVIL LITIGATION The use of digital forensics in civil cases is big business. In 2011, the estimated total worth of the electronic discovery market was somewhere north of (780 million (Global EDD Group). As part of a process known as electronic discovery (eDiscov- ery), digital forensics has become a major component of much high-dollar litigation. eDiscovery “refers to any process in which electronic data is sought, located, se- cured, and searched with the intent of using it as evidence in a civil or criminal legal case” (TechTarget, 2005). In a civil case, both parties are generally entitled to examine the evidence that will be used against them before trial. This legal process is known as “discovery.” Previously, discovery was largely a paper-based exercise, with each party exchang- ing reports, letters, and memos; however, the introduction of digital forensics and eDiscovery has greatly changed this practice. The proliferation of the computer has rendered that paper-based practice nearly ex- tinct. Today, parties no longer talk about filing cabinets, ledgers, and memos; they talk about hard drives, spreadsheets, and file types. Some paper-based materials may come into play, but that’s more the exception than the rule. Seeing the evidentiary landscape rapidly changing, the courts have begun to modify the rules of evidence. The rules of evidence, be they state or federal, govern how digital evidence can be admitted during civil litigation. The Federal Rules of Civil Procedure were changed in December 2006 to specifically address how electronically stored information is to be handled in these cases. Digital evidence can quickly become the focal point of a case, no matter what kind of legal proceeding it’s used in. The legal system and all its players are strug- gling to deal with this new reality. Uses of digital forensics 5 INTELLIGENCE Terrorists and foreign governments, the purview of our intelligence agencies, have also joined the digital age. Terrorists have been using information technology to communicate, recruit, and plan attacks. In Iraq and Afghanistan, our armed forces are exploiting intelligence collected from digital devices brought straight from the bat- tlefield. This process is known as Document and Media Exploitation (DOMEX). DOMEX is paying large dividends by providing actionable intelligence to support the soldiers on the ground (U.S. Army). Moussaoui and 9-11 It’s well documented that the 9-11 hijackers sought out and received flight training to facilitate the deadliest terrorist attack ever on U.S. soil. Digital forensics played a role in the investigation of this aspect of the attack. On August 16, 2001, Zacarias Moussaoui was arrested by INS agents in Eagan, Minnesota, for overstaying his visa. Agents also seized a laptop and floppy disk. After obtaining a search warrant, the FBI searched these two items on September 11, 2001. During the analysis, they found evidence of a Hotmail account (pilotz123@ hotmail.com) used by Moussaoui. He used this account to send e-mail to the flight school as well as other aviation organizations. For those not familiar with Hotmail, it’s a free e-mail service offered by Micro- soft, similar to Yahoo( and Gmail. Hotmail addresses are quite easy to get and only require basic subscriber information. This information is essentially meaningless, because none of the information is verified. During the examination of Moussaoui’s e-mail, agents were also able to analyze the Internet protocol (IP) connection logs. One of the IP addresses identified was assigned to “PC11” in a computer lab at the University of Oklahoma. The investigation further showed that Moussaoui and the rest of the nineteen 9-11 hijackers made extensive use of computers at a variety of Kinko’s store lo- cations in other cities. Agents arrived at the Kinko’s in Eagan hoping to uncov- er evidence. They were disappointed to learn that this specific Kinko’s makes a practice of erasing the drives on its rental computers every day. At 44 days after Moussaoui’s visit, the agents felt the odds of recovering any evidence would be somewhere between slim and none. They didn’t bother examining the Kinko’s computer. The Eagan store isn’t alone. Other locations make a routine practice of erasing or reimaging the rental computers as well. This is done periodically, some as soon as every 24 hours, others as long as every 30 days. The drives are erased to improve the performance and reliability of the computers, as well as to protect the privacy of customers (Lawler, 2002). ADMINISTRATIVE MATTERS Digital evidence can also be valuable for incidents other than litigation and matters of national security. Violations of policy and procedure often involve some type of elec- tronically stored information; for example, an employee operating a personal side 6 CHAPTER 1 Introduction business, using company computers while on company time. That may not constitute a violation of the law, but it may warrant an investigation by the company. Securities and Exchange Commission In 2008, while the economy was in the beginning of its historic downward spiral, the Securities and Exchange Commission (SEC) should have been policing Wall Street. Instead, many of its staffers were spending hours of their days watching pornogra- phy. Computer forensics played heavily in this administrative investigation. In August 2007, the SEC’s Office of the Inspector General (OIG) officially opened an investigation into the potential misuse of governmental computers. The OIG was alerted to a potential problem after firewall logs identified several users who had received access denials for Internet pornography. The SEC firewall was configured to block and log this kind of traffic. The logs showed that this employee attempted to visit sites such as www.thefetishvault.com, www.bondagetemple.com, www.rape-cartoons.com, and www.pornobaron.com. On September 5, 2007, the OIG notified the regional director that one of his employ- ees was the focus of an investigation regarding the misuse of a government computer. On September 19 this same employee reported that her laptop hard drive suddenly crashed. She was issued a replacement drive and went back to work. A forensic analy- sis of her hard drive found 592 pornographic images (in her temporary Internet files) along with evidence that she had attempted to bypass the SEC’s Internet filters. The scope of this investigation eventually expanded considerably, identifying several more employees or contractors who were viewing pornography on their gov- ernmental computers while at work. After further investigation, the OIG found that: A regional staff accountant received more than 16,000 access denials for pornographic websites in a single month. A senior counsel for the Division of Enforcement accessed pornography from his SEC laptop computer on multiple occasions. His hard drive contained 775 pornographic images. A senior attorney at headquarters downloaded so much pornography that he literally ran out of disk space. The report went on to list the policies that prohibited these behaviors. It says in part: “SECR 24-4.3 TK IIIC, provides that ‘[m]isuse or inappropriate personal use of government office equipment includes the creation, download, viewing, stor- age, copying, or transmission of materials related to gambling, weapons, terrorist activities, and any other illegal activities or activities otherwise prohibited etc’ id at 3. The cover memorandum to SEC employees accompanying SECR 24-4.3 states that employees are prohibited from “accessing materials related to illegal or prohibited activities, including sexually explicit materials.” In the end, as this was not considered to be a crime, the entire matter was referred to the SEC administration for disposition (U.S. Securities and Exchange Commission). The digital forensics process 7 THE DIGITAL FORENSICS PROCESS Much has been written about the manner in which digital forensics examinations are done. The digital forensic process can be boiled down into a series of steps or phases. These breakdowns and models are generally similar, some with more steps and some with fewer. In the end they cover much of the same ground. Below you will find the process as laid out by Ken Zatyko in a 2007 article in Forensic Magazine. This eight-phase process provides a good frame of reference from which to begin. The eight phases are: 1. Search Authority 2. Chain of Custody 3. Imaging/Hashing Function 4. Validated Tools 5. Analysis 6. Repeatability (Quality Assurance) 7. Reporting 8. Possible Expert Presentation Let’s look at each phase in more detail. 1. Search Authority Search authority is always the first step any forensic process. Without the proper search authority, any evidence you recover (no matter how compelling) will very likely be suppressed. Search authority can take many forms. In a criminal case, a search warrant, subpoena, or consent could suffice. In civil cases, parties could consent to a search or one could be ordered by the court. It’s important to note that this first step only applies in a legal context. There may be situations where there are no legal concerns (such as a cell phone seized from the battlefield). There may also be exigent circumstances where legal consequences become secondary to obtaining the evidence (such as when a child is missing and in danger). 2. Chain of Custody A well-documented chain of custody is essential to maintain the integrity of the evidence. The chain of custody accounts for each evidence item from the time it’s collected to the time it’s presented in court (should that become necessary). Typically the chain of custody is documented via forms, reports, evidence receipts, notes, and marking the actual evidence item itself. Each time the evidence changes hands it should be recorded. That’s because, should the chain be broken, the evidence could be excluded from trial. 3. Imaging/Hashing Examining the original media is something that should be absolutely avoided if at all possible. The danger is that the original evidence could very well be modified in some way or even destroyed outright. Preferably, a forensic image is made and all examinations are made on this duplicate, rather than on the original. A forensic clone, also known as a bitstream image, is an exact copy of every bit 8 CHAPTER 1 Introduction (1 or 0) that is on the media. The process of creating a bitstream image is called imaging. In a legal setting, the original evidence is always preferred over a copy. At first glance, this seems to create a major conflict when it comes to digital evidence: On one hand, working on a forensic copy is the preference while on the other, copies are unacceptable. What gives? Enter the hash function. Hashing is a mathematical process (via an algorithm) that produces a unique value that is essentially the digital “fingerprint” or “DNA” of a particular file, piece of media, etc. This digital fingerprint can be used to compare the original evidence to the forensic image. These two values should match exactly. If they do, then, for all intents and purposes, they are identical. Courts have repeatedly accepted forensic images since these can be shown to be mathematically identical. Hashing is discussed in more detail in Chapter Four. 4. Validated Tools In forensics, nothing is taken for granted. That includes the proper functioning of the tools. Forensic tools, be they hardware or software, must be tested before they are used to verify the accuracy of their results. Both new tools and updates should be validated. This validation process should be documented every time it’s done. In forensics, the documentation never stops. 5. Repeatability (Quality Assurance) A hallmark of a true forensic process is an accurate result. Painstaking care is taken from beginning to end to make certain the results are correct. The results of a forensic examination (and the process used to reach them) should be able to be duplicated. A separate examiner should be able to repeat the process using the same evidence, the same steps, and the same tool(s), and come up with the same result. Quality assurance is a collection of practices and procedures, encompassing the forensic process in its entirety, that help to guarantee the accuracy of any findings. Quality assurance addresses a multitude of issues, all of which affect the forensic process. These include elements such as the skill and training of the examiners, security of the evidence and the facility, reliability of the tools, case processing, infrastructure, and much more. 6. Analysis Examiners use their skills, experience, and tools to locate and interpret artifacts found on the media being analyzed. The analysis depends on the facts and circumstances of the investigation. Some may be fairly short and straightforward. Others could be quite complicated and time-consuming. For example, an analysis could include: Linking some activity with a specific user account Establishing a timeline of events Determining whether a USB storage device was connected to the machine Breaking encryption Identifying relationships/connections between individuals (i.e., suspect and victim) Identifying websites that have been visited Determining whether certain files were opened or downloaded Locard’s exchange principle 9 Identifying what search engine queries have been entered Locating contraband (such as child pornography) Determining what applications have been installed or uninstalled Recovering deleted files Determining whether or not the system has been compromised in some way At the conclusion of the analysis, examiners will render an opinion. Often, this opinion is expressed in degrees of likelihood (e.g., highly unlikely, unlikely, likely, highly likely, etc.) rather than a definitive “yes” or “no” answer. The analysis culminates in our next step, the report. 7. Reporting In almost every context where digital forensics is used, some type of report is likely to be required. Reports can (and do) take many forms. Some are quite long and detailed (reaching over 100 pages or more). Others are less so (even as few as one or two pages). The report length and format will be dictated by the organization or client. Many forensic tools (all of the major commercial ones) have robust reporting functionality built-in. As you process the case, you’re able to select specific artifacts, files, etc., to include in the report. Other reports are written by the examiner, rather than the tool. One major issue with reports generated by the tools is that they are quite often very technical. This is good unless you’re a non-techie trying to decipher what all that “gobbledygook” means. These technical reports are great, but really shouldn’t stand-alone. Always think about your intended audience when creating your report. A more user- friendly report, without all that technical “noise,” should be included as well. Some of the information to include is an executive summary, list of the evidence items examined, the methods and tools used to perform the analysis, findings, conclusion, and any relevant exhibits. 8. Possible Expert Presentation In a purely legal context, the pinnacle of the forensic process is the presentation of the findings to a judge or a jury. Explaining complex technology to non- technical people (such as a judge or a jury) is no easy feat. An expert is not necessarily an expert witness. Too often, experts give trial testimony that is high on jargon and low on useful explanations. The outcome of a trial could very well come down to the judge’s or jury’s understanding of a specific piece of technology or technical process. A failure at this juncture could completely negate all the good work done to that point. Anyone who’s ever explained some aspect of technology to a novice knows what a challenge this can be. LOCARD’S EXCHANGE PRINCIPLE Locard’s exchange principle says that, in the physical world, whenever perpetrators enter or leave a crime scene, they will leave something behind and take something with them. Examples include DNA, latent prints, hair, and fibers (Saferstein, 2006). 10 CHAPTER 1 Introduction The same holds true in digital forensics. Registry keys and log files can serve as the digital equivalent to hair and fiber (Carvey, 2005). As with DNA, our ability to detect and analyze these artifacts relies heavily on the technology available at the time. Look at the numerous cold cases that are being solved now as a result of the sig- nificant advances in DNA science. Viewing a device or incident through the “lens” of Locard’s principle can be very helpful in locating and interpreting not only physical but digital evidence as well. SCIENTIFIC METHOD As an emerging discipline in forensic science, digital forensics is undergoing some expected growing pains. As of today, digital forensics lacks the vast foundation and long-term track record set by forensic DNA. DNA is now considered by many to be the “gold standard” of the forensic sciences. Digital forensics simply lacks the years of development, testing, refining, and legal challenges that DNA analysis has under- gone since its inception. Plotting the course forward are several organizations that are looked on to es- tablish the protocols, standards, and procedures that will push digital forensics ahead. The following sections provide more information about these important or- ganizations. ORGANIZATIONS OF NOTE Several organizations make significant contributions to the discipline of digital fo- rensics year in and year out. These organizations not only set standards and establish best practices, they provide leadership as well. Examiners should be familiar with these entities, the roles they play, and the contributions they make. As professionals, it’s our responsibility to participate in one or more of these organizations. SCIENTIFIC WORKING GROUP ON DIGITAL EVIDENCE Standards and techniques are an essential part of valid and accurate forensic science. They are its foundation, its core. Along with other federal agencies, the FBI has supported the formation and efforts of a wide range of Scientific Working Groups (SWGs) and Technical Working Groups (TWGs) (Federal Bureau of Investigation) (FBI, 2011). These collaborative groups draw their members from “forensic, industri- al, commercial, academic and in some cases international communities” (FBI, 2011). Some examples include the Scientific Working Group for DNA Analysis Methods (SWGDAM) and the Scientific Working Group for Firearms and Toolmarks (SWG- GUN). Digital evidence has now joined the party with the formation of SWGDE. For more information visit: http://www.swgde.org/. Organizations of note 11 Formed in 1998, the Scientific Working Group on Digital Evidence (SWGDE) is made up of “...all levels of government, legal community, private industry, academia involved in digital and multi-media forensic profession” (SWGDE). The mission of SWGDE is as follows: “Brings together organizations actively engaged in the field of digital and multimedia evidence to foster communication and cooperation as well as ensuring quality and consistency within the forensic commu- nity” (SWDGE). AMERICAN ACADEMY OF FORENSIC SCIENCES The American Academy of Forensic Sciences (AAFS) is considered the premier fo- rensic organization in the world. Members of the Academy work for the National Institute of Standards and Technology (NIST) and National Academy of Sciences (NAS). The directors of most federal crime labs are members of AAFS. Members of AAFS are also active in the various Scientific Working Groups including SWGDE. The Academy plays a critical role in developing consensus standards of practice for the forensic community. For more information visit: http://www.aafs.org/. The Forensic Science Education Programs Accreditation Commission (FEPAC) was created by the AAFS to ensure quality forensic science education and back- ground for future forensic scientists. The AAFS has approximately 6,000 members and is divided into “eleven sections spanning the forensic enterprise.” The Academy comprises “physicians, attorneys, dentists, toxicologists, physical anthropologists, document examiners, psychiatrists, physicists, engineers, criminalists, educators, digital evidence experts, and others.” Despite the name, the reach of the AAFS is truly global, representing more than sixty countries around the world (American Academy of Forensic Sciences). The Digital & Multimedia Sciences of the AAFS section represents digital foren- sics. As of November 3, 2010, the Digital Evidence section had 118 members. AMERICAN SOCIETY OF CRIME LABORATORY DIRECTORS/ LABORATORY ACCREDITATION BOARD The American Society of Crime Laboratory Directors/Laboratory Accreditation Board (ASCLD/LAB; pronounced as-clad lab) is to forensic laboratories what Un- derwriters Labs is to household products. ASCLD/LAB is the “oldest and most well known crime/forensic laboratory accrediting body in the world.” ASCLD/LAB-ac- credited labs are the “gold standard” in the world of forensics. A lab becomes ac- credited only after successfully meeting all of the standards and requirements set forth in the ASCLD/LAB accreditation manual. These requirements and standards cover every aspect of a lab’s operation and must be strictly followed. Adherence to these standards must be thoroughly and completely documented (American Society of Crime Laboratory Directors/Laboratory Accreditation Board). For more informa- tion visit: http://www.ascld-lab.org/index.htm. 12 CHAPTER 1 Introduction NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY The National Institute of Standards and Technology (NIST) was founded in 1901 and is part of the U.S. Department of Commerce. It was the first federal physical science research laboratory. Some of NIST’s areas of focus include bioscience and health, chemistry, physics, math, quality, and information technology (NIST). For more in- formation visit: http://www.nist.gov/itl/ssd/computerforensics.cfm. NIST is heavily involved in digital forensics. Some of its programs and projects include: National Initiative Cyber Security Education (NICE)—A national cybersecurity education program teaching sound cyber practices that will improve the country’s security. National Software References Library—A collection of known software file signatures that can be used by examiners to quickly exclude files that have no investigative value. This would include items such as operating system files. Excluding such files can significantly reduce the time spent on an examination. Computer Forensic Tool Testing—Intended to develop testing methodologies and standards for forensic hardware and software. AMERICAN SOCIETY FOR TESTING AND MATERIALS Another major player in the development of standards is the American Society for Testing and Materials (ASTM). ASTM is a global organization that has developed approximately 12,000 standards that are used to “improve product quality, enhance safety, facilitate market access and trade, and build consumer confidence.” ASTM, founded in 1898, has about 30,000 members broken into 141 committees. The Fo- rensics Sciences committee, known as E30, is further divided into several subcom- mittees. The Digital and Multimedia Evidence subcommittee is known as E30.12 (ASTM). For more information visit: http://www.astm.org/Standards/E2763.htm. ROLE OF THE FORENSIC EXAMINER IN THE JUDICIAL SYSTEM The digital forensics practitioner most often plays the role of an expert witness. What makes this different from nonexpert witnesses? Other witnesses can only testify to what they did or saw. They are generally limited to those areas and not permitted to render opinions. Experts, by contrast, can and often do give their opinion. What makes someone an “expert”? In the legal sense, it’s someone who can assist the judge or jury to understand and interpret evidence they may be unfamiliar with. To be considered an expert in a court of law, one doesn’t have to possess an advanced aca- demic degree. An expert simply must know more about a particular subject than the average layperson. Under the legal definition, a doctor, scientist, baker, or garbage Role of the forensic examiner in the judicial system 13 collector could be qualified as an expert witness in a court of law. Individuals are qualified as experts by the court based on their training, experience, education, and so on (Saferstein, 2011). What separates a qualified expert from a truly effective one? It is the ability to communicate with the judge and jury. Experts must be effective teachers. The vast majority of society lacks technical understanding to fully grasp this kind of testimo- ny without at least some explanation. Digital forensic examiners must carry out their duties without bias. Lastly, a digital forensics examiner must go where the evidence takes them without any preconceived notions. THE CSI EFFECT It seems that everyone either does or has watched one or more versions of the popular TV series CSI. These shows and others like it tend to convince jurors that some form of forensic science can solve any case. In other words, they now expect it. These un- reasonable expectations can lead to incorrect verdicts. The jury could acquit a guilty defendant simply because no scientific evidence was presented, the presumption be- ing that if the defendant was guilty, there would be some kind of scientific evidence to prove it (Saferstein, 2011). SUMMARY In this chapter, we looked at what forensic science, particularly digital forensics, is and is not. Forensic sciences aren’t the fast-paced crime-solving dramas that we watch on television, but a scientific method of collection, investigation and analysis used to solve some kind of legal problem. Digital forensics isn’t limited to comput- ers. It encompasses any kind of electronic device that can store data. These devices include cell phones, tablets, and GPS units just to name a few. Digital forensics is applicable well beyond criminal investigations. It’s used rou- tinely in civil litigation, national and military intelligence matters as well as the pri- vate sector. Several organizations help establish the standards and best practices used in digital forensics. These organizations include the American Academy of Forensic Sciences, Scientific Working Group on Digital Evidence, and American Society for Testing Materials. As a practitioner, communication skills are extremely important. You will spend a significant amount of time explaining your findings to police officers, attorneys, and clients. Most important, you must be able to explain those findings to judges and ju- ries. All of these stakeholders must be able to understand your methods and findings. Like all scientific evidence, digital evidence can be quite confusing and overwhelm- ing. With this kind of testimony, it’s very easy to lose people. Losing a judge or jury in a trial can have disastrous consequences, such as having your findings ignored or misunderstood. 14 CHAPTER 1 Introduction REFERENCES American Academy of Forensic Sciences, 2011. About AAFS. Retrieved from: (accessed 11.02.11.). Anon., 2011. Retrieved from: (accessed 11.0211.). ASTM, 2011. ABOUT ASTM. (accessed 11.02.11.). Carvey, H., 2005. Locard’s Exchange Principle in the Digital World: Windows Incident Response. (accessed 11.02.11.). Federal Bureau of Investigation, 2011. Scientific Working Groups: Federal Bureau of Investi- gation. (accessed 11.02.11.). Lawler, B.A., 2011. Government’s Response to Court’s Order on Computer and Email Evidence. Retrieved from: (accessed 09.13.11). Mozy, 2009.. http://searchfinancialsecurity.techtarget.com/definition/electronic-discovery http://www.ascld-lab.org/ http://www.kansas.com/ http://www.nist.gov/. (accessed 11.02.11.). Phish, 1999. Hampton Comes Alive. Elektra Records, CD. Saferstein, R., 2011. Criminalistics: An Introduction to Forensic Science 101E. Prentice Hall, Saddle River, New Jersey. Scientific Working Group on Digital Evidence, 2011. Scientific Working Group on Digital Evidence—About Us. (accessed 11.02.11.). U.S. Army, 2011. Document and Media Exploitation (DOMEX): 2010 Army Posture Statement. (accessed 11.02.11.). www.secgov/about/offices/oig/reports/reppubs/2010/semi10.pdf. Zatyko, K., 2011. Commentary: Defining Digital Forensics. Retrieved from: (accessed 11.02.11.). CHAPTER Key technical concepts 2 “To the mother of all machines, all machines, 1 0 0 1 0 0 1, SOS, 1 0 0 1 0 0 1, In distress, 1 0 0 1 0 0…” – “The Body Electric” by the band Rush INFORMATION IN THIS CHAPTER: Basic Computer Operation Bits and Bytes File Extensions and File Signatures How Computers Store Data Random Access Memory Volatility of Data The Difference Between Computer Environments Active, Latent, and Archival Data The Difference Between Allocated and Unallocated Space Computer File Systems INTRODUCTION Intimate knowledge of the inner workings of a computer is critical for the digital foren- sics practitioner. It’s this knowledge that permits us to conduct a thorough examination of the evidence and render an accurate opinion. Simply put, we can’t do our job without it. Not all processes and hardware hold the same value forensically. Memory and stor- age play a major role in almost any examination. The processor or CPU, by contrast, plays little if any role. This chapter takes a broad look at some of the technical details of basic computing. Its focus will be on the major areas that affect an investigation. There is no substitute for the mastery of this material. Our responsibilities as an expert witness include explaining technical subject matter in a way that the average person is able to understand. BITS, BYTES, AND NUMBERING SCHEMES To the computer, things are pretty black and white. It’s all about the 1s and 0s. Comput- ers use a language called binary. In binary, there are only two possible outcomes: a 1 The Basics of Digital Forensics 15 Copyright © 2015 Elsevier Inc. All rights reserved. 16 CHAPTER 2 Key technical concepts or a 0. Each 1 or 0 is called a bit. In mathematical terms, binary is classified as a base 2 numbering system. In comparison, we use a base 10 numeral system known as decimal. Decimal uses numerals 0–9. To speed things up, computers work with larger collections of bits. These larger chunks of data are called bytes. A byte is made up of eight bits. It looks like this: 01101001. How do bytes relate to letters and numbers? Each letter, number, space, and special character is represented by a single byte. For example, using the ASCII character set 01000001 represents an uppercase “A,” while a lowercase “a” is 01100001. Let’s do a little experiment so you can see this in action. Open a new text document (using a Plain Text editor, not a word processing application like Mi- crosoft Word) on your computer and type the phrase “Marshall University Digi- tal Forensics.” Now, count all the letters and spaces. Next, save and close the new text file to your desktop. Right-click on the file and select properties. What’s the file size? It should be 26 bytes, which is also the exact number of letters and spaces. To get a broader perspective, let’s look at all of the binary necessary to represent our sample phrase “Marshall University Digital Forensics”: 0100110101100001011100100111001101101000011000010110 110001101100001000000101010101101110011010010111011 0011001010111001001110011011010010111010001111001001 0000001000100011010010110011101101001011101000110000 1011011000010000001000110011011110111001001100101011 0111001110011011010010110001101110011 At first glance, that’s a little tough to read, no doubt. Fortunately, there is a shorthand that we can use to make this more readable. This shorthand is called hexa- decimal. HEXADECIMAL Hexadecimal, or hex, is a base 16 system that is an expedient way to express bi- nary numbers. Hex is expressed using the numerals 0–9 and the letters A–F. An uppercase “M” is expressed as 4D in hexadecimal. A lowercase “a” is 61. Quite often, you will see a hexadecimal number expressed with the prefix 0x. This prefix or the suffix “h” is used to designate or identify it as a hexadecimal or base 16 number. Here is the same phrase (Marshall University Digital Forensics) expressed in hexadecimal: 4d 61 72 73 68 61 6D 6C 20 55 6E 69 76 65 72 73 69 74 79 20 44 69 67 69 74 61 6D 20 46 6F 72 65 6E 73 69 63 73 If you look closer, you’ll see the number “20” repeated throughout the string. The number 20 in hex represents a space. File extensions and file signatures 17 BINARY TO TEXT: ASCII AND UNICODE How do these 1s and 0s end up as As and Bs? Computers use encoding schemes to convert binary into something humans can read. There are two encoding schemes we need to be concerned with: ASCII and Unicode. ASCII—the American Standard Code for Information Interchange—is the encoding scheme used for the English language. ASCII defines 128 characters, of which only 94 are actually printable. The rest are control characters used for spacing and processing. In contrast, Unicode is intended to represent all of the world’s languages and consists of thousands of char- acters (Unicode Inc., 2010). How is this relevant to digital forensics? In many instances, examiners must look at the data at the bit and byte levels to find, extract, and interpret evidence. This is most noticeable in a process called file carving. File carving is done to locate and mine out files from amorphous blobs of data, such as unallocated space (also known as drive-free space). The first step in the file carving process is to identify the potential file. Normally, the file is identified by the header, if it has one. Once the footer is found, the file can be extracted through a simple copy-and-paste as long as it is continuous. A fragment- ed file is far more difficult to recover (Casey, 2011). Having the ability to interpret binary and hex makes file carving possible. FILE EXTENSIONS AND FILE SIGNATURES Fundamentally, files are strings or sequences of bits and bytes. Identifying a file can be done in a couple of different ways. File extensions are the most common. File extensions are the suffixes added to the end of a computer file name, indicating its format. Examples would include.docx and.pptx (for the latest versions of Microsoft Word and Power- Point, respectively). As users, we often identify the file type by the file extension, if the system is configured. An operating system can be set so that file extensions are hidden. For our purposes, a file extension isn’t the most reliable way to identify a given file. The file extension is very easily changed, requiring only a mouse click and a couple of keystrokes. You can try this yourself. In Windows, simply right-click on a file name and rename it, changing the extension. Let’s say we change the extension of a Word file to that of an image—JPEG, for example. This is easily accomplished. On a Windows machine, simply click, pause for a moment, and click again. On a Mac, it’s click+Return. What happens when we try to open that file? Nothing. It won’t open. Change it back and it opens right up. Some people will attempt to take advantage of this ability to change file extensions as a way to conceal data, hiding them in plain sight. Forensically, this approach is not very effective. Forensic tools identify files based on the header, not the file extension. Many tools will even separate out those files whose headers do not match their extensions, making them easily discovered. This comparison is generally known as file signature analysis. Figures 2.1 and 2.2 illustrate what happens when a file extension is changed. 18 CHAPTER 2 Key technical concepts FIGURE 2.1 Here we’ve changed the file extension on “Smoking Gun.docx” to.mp3. Note that the icon has changed. Graphic courtesy of Jonathan Sisson. FIGURE 2.2 Here is the hexadecimal view of “Smoking Gun.mp3.” Note the highlighted file header showing this is actually a Word document. Graphic courtesy of Jonathan Sisson. STORAGE AND MEMORY Where and how data are stored and written is one of the major fundamental concepts that must be learned. There is more than one way to write data. Today, data are gener- ally created in three ways: electromagnetism, microscopic electrical transistors (flash), and reflecting light (CDs, DVDs, etc.). Storage locations inside a computer serve dif- ferent purposes. Some are for the short term, to temporarily hold the data that the computer is using at the moment. The other is for more permanent, long-term keeping. Storage and memory 19 MAGNETIC DISKS Most drives in today’s computers read and write data magnetically. They will render each particle as either magnetized or not magnetized. If the particle is magnetized, it’s read as a 1. If not, it’s read as a 0. The drives themselves are usually made up of aluminum platters coated with a magnetic material. These platters spin at very high speeds—in the neighborhood of 7,000 rpm to 15,000 rpm. The speed could even be greater for high-end drives. These heavy-duty drives are typically found in servers or professional-grade workstations. From a forensic standpoint, faster drive speeds can result in faster acquisition of data. Let’s look at the major parts of a standard hard drive. The platters revolve around a small rod called a spindle. The data are physically written to the platter using a read/write head attached to an actuator arm, which is powered by the actuator itself. The actuator arm moves the head across the platter(s), reading and writing data. The read/write head, as it’s called, floats on a cushion of air. The read/write head barely floats above the platter surface, at a height of less than the diameter of a human hair. These devices are really pretty amazing. Figure 2.3 shows us the inside of a typical magnetic drive. We can clearly see the platters, actuator arm, and the read/write head. FIGURE 2.3 The inside of a typical magnetic drive. 20 CHAPTER 2 Key technical concepts FLASH MEMORY Flash memory is used in a wide range of devices. Thumb drives and memory cards provide reliable storage in a very portable package, allowing us to take a lot of pic- tures and take our files on the road. Unlike other kinds of memory, flash memory retains our data even without electricity. Flash is made up of transistors. Each transis- tor is either carrying an electric charge or it isn’t. When the transistor is charged, it is read as a 1; without a charge it’s read as a 0. Flash-based hard drives are starting to become more and more common. Unlike magnetic drives, flash drives are solid state, meaning that they have no moving parts. Such a drive is often referred to as an SSD or Solid State Drive. They offer several significant advantages, including increased speed, less susceptibility to shock, and lower power consumption. SSDs will play a major role in computing and digital forensics in the future. Although these devices offer improved performance, they also present a major chal- lenge to digital forensics. We’ll take a deeper look at the momentous challenge pre- sented by SSDs in Chapter Eleven. OPTICAL STORAGE Optical media read and write data using a laser light along with a reflective material incorporated into optical discs. Optical discs are made of a polycarbonate base cov- ered by a thin layer of aluminum. The disc is then coated with a clear acrylic mate- rial for protective purposes. During the manufacturing process, the disc’s surface is embossed with tiny bumps. This series of bumps forms one long, single, spiral track. A laser projects a highly focused beam of light onto the track. The light is reflected differently from the bumps and the spaces in between, called lands. This change in reflectivity is what the system reads as binary (Brain). The most common types of optical storage media include CDs, DVDs, and Blu-ray discs (Brain). VOLATILE VERSUS NONVOLATILE MEMORY Memory and storage are two terms that are somewhat synonymous when it comes to computers. They both refer to internal places where data are kept. Memory is used for short-term storage, while storage is more permanent. No matter what you call it, there is a significant difference between the two, especially from a forensic perspec- tive. That difference lies in the data’s volatility. Data in RAM exist only as long as power is supplied. Once the power is removed (i.e., the machine is turned off), the data start to disappear. This behavior makes this kind of memory volatile. In contrast, files saved on your hard drive remain even after the computer is powered down, mak- ing them nonvolatile (Cooper, 2004). RAM stores all the data that are currently being worked on by the Central Pro- cessing Unit (CPU). Data are fed from the RAM to the CPU, where they are ex- ecuted. Traditionally, forensic analysis of a computer focused on the hard drive, as much of the evidence can be found there. Today, we’re finding that’s not always the Computing environments 21 case. Some instant messaging applications, for example, don’t write to the hard drive unless the logging feature is turned on. AOL Instant Messenger and MSN fall into that category. If logging is off (which it is by default), the only evidence will be found in RAM while the machine is running. COMPUTING ENVIRONMENTS Not all computing “environments” are created equal. There are substantial differ- ences between them. We can encounter individual computers, networks of various sizes, or even more-complex systems. These disparities will have a significant impact on your collection process, where you look for data, the tools you will use, and the level of complexity required. An accurate clarification of the environment is useful to have right from the start of an investigation, even before you respond to a scene. Environments can be broken down into four categories: stand alone, networked, mainframe, and the cloud. A stand-alone computer is one that is not connected to another computer. These are the easiest to deal with and investigate. Possible locations for evidence are rea- sonably confined. Stand-alone systems are routinely encountered in residences such as apartments and houses. A networked computer is connected to at least one other computer and potentially many, many others. This escalates the complexity as well as the places evidence could be found. We now can see files and artifacts normally found on the local ma- chine spread out to servers or other machines. This environment introduces a variety of variables into the equation. Even though networks are more commonly found in a business setting, they are found more and more in homes. Unlike a stand-alone machine, a mainframe system centralizes all of the comput- ing power into one location. Processors, storage, and applications can all be located and controlled from a single location. CLOUD COMPUTING You may not be familiar with the term “cloud computing,” but, if you use Gmail, Facebook, or Twitter, you’re already using it. Cloud computing is a hot topic these days, garnering much attention from both the IT and business communities. This “new” model of computing is very similar in many respects to the mainframe sys- tems of old. As with the mainframe, the computing resources are moved from the local machine to some other centralized place. The cloud model presents some very interesting features that make it attractive to businesses, especially from a cost perspective. The cloud offers software a

The Basics of Digital Forensics (Syngress)

Document Details

Tags

Related

Summary

Full Transcript

Upgrade to continue