Computer forensic science

Transcription

1 Computer forensic science November 10, 2017 Administrative submittal instructions answer the lab assignment s questions in written report form, as a text, pdf, or Word document file (no obscure formats please) to csci530l@usc.edu exact subject title must be forensicslab deadline is start of your lab session the following week reports not accepted (zero for lab) if late you did not attend the lab (except DEN or prior arrangement) subject title deviates 1

2 Administrative employment CS530 will be next offered Fall 2018 lab graders will be needed you are the automatically ideal candidates you must remain a student in Fall 2018 contact me with expression of interest now, or subsequently hiring can only take place next August-September Details: Administrative this is our final lab 2

3 This drive has been victimized! Mallory CS530 students must help! CS530 students What happened?! 3

4 Every student gets a copy Forensic science it s detective work 4

5 Aspects of traditional forensics pathology handwriting fire scenes death scenes medical decomposition toxicology genetic signatures - DNA fingerprints firearms residues, casings document science forgery law Computer forensic science 5

6 Not enough drives for everybody would you accept a (large) file?* dd if=drive of=file drive.image * a file instead of a drive is realistic. Recovered drives are first imaged, the investigation works with that copy, never the original. This week s s exercise shared with us by UCLA professors Peter A. H. Peterson and Peter Reiher (for which, thanks!) they had a corrupted/hacked/victimized drive they dd ed it to a file they named that file act2.img every student gets a copy 6

7 disks Distinguish: disks, partition tables, partitions, filesystems,, files partition tables a virgin hard disk (maybe by Western Digital) filesystems a partition table written within an MBR or GPT (maybe by grub; on the disk) partitions a filesystem written (maybe by mkfs, in the partition) files a partition defined (maybe by fdisk/gdisk; in the partition table files created (maybe by vi, in the filesystem) (a) /dev/hda Naming of disks and partitions: as if devices ( /dev/ ) (b) disk (d) MBR/GPT (c) /dev/hda /dev/hda1 filesystem (e) partition files 7

8 Q. how can you use your files? A. mount their containing filesystem into a hierarchical file tree / mountpoint What does mount mount? mount mounts filesytesms mount does not mount anything else not disks not partitions not files give mount the name of the filesystem to mount but filesystems don t have their own names! so instead we give mount the name of a partition that contains the filesystem to mount 8

9 Q. how can you mount a filesystem? A. by referencing its containing partition* mount /dev/hda1 /mountpoint /dev/hda1 * Mount then understands a filesystem to be inside the partition, and that s what it s supposed to mount. It will a) do so if a filesystem is in there, or b) give an error message if not. The name of the partition is a surrogate for the (nonexistent) name of the filesystem. Beef Filesystems it s s what s s for dinner* it s s what mount mounts!! looks like mount mounts devices But: * widespread 1990s U.S. promotional ad slogan seeking to identify beef with dinner 9

10 little disk Copy/dd whole partition into a file partition copy lacks a device name to mount by give it one with losetup big disk File boundaries are dark blue rectangles File contents are rectangles interiors Copy/dd whole disk into a file (on a bigger disk) little disk disk copy lacks a device name give it one with losetup big disk File boundaries are dark blue rectangles File contents are rectangles interiors 10

11 Obtaining your disk using losetup and mount associate /dev/loop0 with data now de-associate associate with other data Loop device boundaries are red rectangles Loop device contents are rectangles interiors on DETER ~ is persistent while associated, treat /dev/loop0 as if a device, holding the loop-associated data as the device s content First, fdisk worked with /dev/loop0 because the data associated with it was that of a disk, and fdisk works with disks Later, mount worked with /dev/loop0 when the data associated with it was that of a filesystem, and mount works with filesystems Distinguish among machines 3 computers workbench.cfs.usccsci530.isi.deterlab.net (yours) users.isi.deterlab.net (holds export-mounted parts of your filesystem) the one whose corrupted disk we re analyzing pathnames are confusing don t look at the logs in /var/log for example look at those in ~/sda1/var/log 11

12 Software tools Peterson & Reiher s instructions document numerous commands as potential tools I found these particularly useful/essential sudo history e2undel strings; xxd and hexedit sudo use liberally you can t but root can sudo s config file Everybody can do everything as root provided they do it through sudo 12

13 history use cat not history command Must be some sensitive data in here e2undel recover to a persistent place OK on mounted image, no need to umount try the different time periods when deletions may have occurred Chose something to recover Then look at it 13

14 Binary file contents strings, xxd strings extracts just ascii portions xxd and hexedit show each byte twice, as both hex and ascii symbol (if any,. otherwise) scp secure remote file copy no files start with pass on aludra we have one locally scp puts one there and now there it is 14

15 System log files start here The assignment write a report it was 15

16 USC s s #2 department: CS USC s s #1 department: Admissions! 16

17 Thank you I have enjoyed the opportunity to be the lab instructor for your class Applause I applaud your effort, interest, ability best of luck in your academic and career futures 17