11 th National Investigations Symposium

Transcription

1 11 th National Investigations Symposium Making the most of electronic data How Computer Forensics can assist investigations 10 November 2016 David Sinden Electronic Evidence Specialist

2 Introduction 10 years Computer Forensics 8 years private sector Global Fraud, Bribery and Corruption cases Last 18 months at NSW ICAC 2

3 Objective Insight into the wealth of electronic information available for investigations How to make most of it and where it is located Focus on and Mobile Phones Hints & Tips 3

4 Electronic Data Overview Growing phenomenally IBM 2.5 exabytes (2 billion gigabytes) was generated every day in per cent of the data in the world today has been created in the last two years World s data volume expected to grow 40 per cent per year, and 50 times by

5 5 Electronic Data Growth

6 Electronic Data More systems Interconnected Greater data sharing IoT devices Cameras, Fridges etc. Car Infotainment Systems 6

7 Digital Forensic Challenges Subjects wiser, cover trail App developers starting to use encryption Technology and platforms change at rapid pace 7

8 Forensics

9 Corporate Systems Microsoft Exchange/Outlook Lotus Domino/Notes Novell GroupWise 9

10 Applications Outlook Express Windows Mail Mozilla Thunderbird Windows Live Mail Pegasus 10

11 Applications Fox mail SeaMonkey Mail The Bat! 11

12 Apple Mac Mail eml, emlx Mbox Eudora Microsoft Entourage Outlook for Mac Different storage formats 12

13 Microsoft Exchange/Outlook EDB database hierarchical Public and Private Mail stores Private contains user mailboxes Found on servers Tip: Should be dismounted before collecting 13

14 Outlook Data Files Found on local computer PST Personal Storage Table OST Offline Storage Table Synchronised copy downloaded to computer can still read and compose messages if connection interrupted Restored messages are synchronised 14

15 Microsoft Exchange/Outlook What happens when a user deletes a message? Delete - Deleted items folder Soft delete deleted items folder to Recoverable Items folder. Also covers shift + Delete 15

16 Microsoft Exchange/Outlook Dumpster Recoverable items Retention Policy based Purge after 14 days (default), 28 days or never! 16

17 Microsoft Exchange/Outlook Other ways to recover deleted s? EDB, OST, PST are databases Carving looking for message structures I still can t find that deleted ? 17

18 Journaling Systems MailMarshall IronPort 18

19 Archiving Systems Commvault, Enterprise Vault etc.. May separate attachments from s Leave behind a stub file with a link Tip: Extracts don t always provide all the information look for missing attachments 19

20 Tape Backups Snapshot based Understand the backup schedule daily, weekly, monthly Takes time to restore and fails often 20

21 Where is technology heading? Cloud Service Office 365 Built in legal hold and discovery feature Virtual Machines VM - Emulation Web based mail difficult to see on a local computer Mobile Device Apps 21

22 Mobile Forensics

23 23 Smartphone Evolution 1994 IBM Simon

24 Ericsson R380

25 Palm Treo

26 Blackberry

27

28 Smartphone Platforms Android (Marshmallow, Nougat next) Apple ios (10) Windows 10 Mobile Blackberry 10 All are enhancing security 28

29 Apple ios Interesting fact non public code names Mainly ski resorts 9.1 Boulder 9.2 Castlerock 9.3 Eagle 10.0 Whitetail 29

30 Apple ios Protected by passcode Simple V Complex No Passcode? Lockdown trust file from computer 30

31 itunes Backups Local PC and Cloud Copy of everything on device Automatic sync on computers with itunes software installed (unless disabled) 31

32 itunes Backup Location Mac: ~/Library/Application Support/MobileSync/Backup/ Windows XP: \Documents and Settings\(username)\Application Data\Apple Computer\MobileSync\Backup\... Windows Vista, Windows 7,8 and 10: \Users\(username)\AppData\Roaming\Apple Computer\MobileSync\Backup\ 32

33 itunes Backups UDID Unique identifier Matches folder name 33

34 itunes Backups Non readable format Uniquely named files 40 digit alphanumeric hex value no file extension 34

35 itunes Backups 35 SHA1 hash value of the file path appended to respective domain name and - e.g.homedomain-library/sms/sms.db Consistent across phones unless apple changes the architecture How to decode these filenames and the data?

36 itunes Backups 4 Metadata files 36

37 itunes Backups Info.plist Device details name, IMEI Manifest.mbdb Info about all other files Manifest.plist Passcode set, encrypted, last backup computer name, date Status.plist Details about the backup, state, date and version 37

38 itunes Backups What about encrypted backups? Password only entered once and oft forgotten 38

39 itunes Backups Attacks: brute force, dictionary Word list from computer Acquire memory 39

40 40 Passwords.

41 Passwords Apple Mac Keychain Password management system Stores passwords for applications, servers, web sites, WiFi Passwords, even itunes Keychain Access GUI OS X Encrypted normally password of the computer Windows need alternative tools to view 41

42 42 Mac OS X Keychain App

43 icloud Cloud credentials recovered from phone or backup Many tools that can acquire data from the cloud with credentials Appropriate Legal authority required Where is the data even stored? 43

44 itunes Backups The itunes Backup might have been deleted, what now? 44

45 Volume Snapshot Service (VSS) VSS Volume Snapshot Service Backup feature included in Microsoft Windows Vista, 7,8,10 and Server 2008,

46 VSS Right click volume (C) Select properties Previous Versions tab 46

47 47 VSS

48 VSS Each backup can be viewed on machine it was created on Third party tools can parse them Not all files backed up e.g. OST You might find itunes backups that were thought deleted 48

49 itunes Backups Tip: Delete button doesn t appear to delete data 49

50 Other Challenges for Investigations Non searchable documents Optical Character Recognition (OCR) OCR not perfect not brilliant with handwriting Never assume every piece of data is searchable 50

51 Other Challenges for Investigations Screenshots SMS messages 51

52 52 Any questions?