24) Type a note then click the OK button to save the note. This is a good way to keep notes on items of interest.

Size: px

Start display at page:

Download "24) Type a note then click the OK button to save the note. This is a good way to keep notes on items of interest."

Constance Lynch
6 years ago
Views:

Click on each of the columns to have the sort order by ascending and descending of the contents displayed.

1 23) Click File Analysis Tab - This allows forensic investigators to look for files on the system as they would on a regular system. Key file attributes are provided to assist the investigator (file size, MACE time/date stamps, etc.). Click on each of the columns to have the sort order by ascending and descending of the contents displayed. The Name column provides the name of the file in the file system of the image. Click on the name of a URL to browse that directory or file as indicated by blue text. Click Add Note 24) Type a note then click the OK button to save the note. This is a good way to keep notes on items of interest. Forensic Analysis with Autopsy Copyright UMUC 2015 Page 18 of 33

2 25) Click the Generate MD5 List Of Files button to generate an MD5 hash of all files currently displayed. 26) This can be useful for comparison to other hash databases or when attempting to find the same file that has been on another system, renamed, etc. Click back to the first tab in the web browser to return. Forensic Analysis with Autopsy Copyright UMUC 2015 Page 19 of 33

27) Clicking on a file will produce a list of contents in the file displayed in ASCII text format in the bottom view pane. What is displayed varies based on file type.

3 27) Clicking on a file will produce a list of contents in the file displayed in ASCII text format in the bottom view pane. What is displayed varies based on file type. A list of clickable link options will also appear (ASCII display/report, Hex display/report, ASCII Strings display/report, Export, Add Note) along with text indicating the File Type: <text_descriptor>. 28) Click ASCII Report Forensic Analysis with Autopsy Copyright UMUC 2015 Page 20 of 33

Click on the Hex display and report links.

4 29) Autopsy will produce a new tab in the browser with a report detailing information about that file with an ASCII rendering of the contents. 30) Click back to the first tab. The same can be done in Hex format. Click on the Hex display and report links. The ASCII Strings (display report) link will show the ASCII strings only within the file along with relevant data about the file (hash, time/date stamps, type, etc.). Forensic Analysis with Autopsy Copyright UMUC 2015 Page 21 of 33

5 31) Now click on the Export option will allow the investigator to export the file from the image format to the native Helix file system for review with third party tools. We will not be exporting, you may click cancel. Forensic Analysis with Autopsy Copyright UMUC 2015 Page 22 of 33

6 32) In the Autopsy File Analysis browser RED and BLUE text is used to indicate if the file has been deleted or not. Blue is for non-deleted files. Bright red indicates that the file has been marked for deletion, but the space wasn t reallocated by the operating system thus is likely the exact data before it was deleted Darker red indicates the file was deleted and some or all of the data originally allocated for the file has been overwritten with other data. This is possible because files are marked for reuse by the operating system when a user hits delete, but are not actually deleted. The operating system simply says the space can be overwritten or allocated again if needed. Often all or some of the data remains unless it was securely deleted. Note: Within the 'Directory Seek' pane to the left, find and click the 'All Deleted Files' button toward the bottom (you may need to scroll down to see the button). Forensic Analysis with Autopsy Copyright UMUC 2015 Page 23 of 33

7 33) Click on the Keyword Search button at the top of the screen to use the Keyword Search analysis tool. The Keyword Search analysis tools allow full searching of the forensic image and the individual files/directories that are contained within the image. Keyword searches are one of the key investigative techniques for finding evidence of interest. With this tool investigators can: Specify regular expressions (a language to automate or express searching of text with variability). Search for ASCII or Unicode formatted strings. Use built-in or Predefined Searches along with any Previous Searches conducted in this case on this host with this particular image. Use the Extract Strings and Extract Unallocated options, which can assist in speeding up text search by investing time and disk storage space up front. Searches can take a long time (hours) to conduct depending on the word. The results will be displayed in a new screen showing the occurrences in the left navigation frame. Searches that result in more than 1000 hits will be found in at the location of our evidence:/sdb1/evidence/autopsy/lab 2/ Lab a/output/Lab 2_2007_1001a.img-<uniqueSearchID>.srch file that can be viewed with the more or gedit commands (If the drive icons appear on the desktop, you know that your command was correct) (Take screenshot of VM window and paste into your report on your local computer for deliverable Part 1A3) 34) Click on the File Type button for file type analysis within Autopsy. This allows easy sorting and viewing of files within the file system of the forensically imaged media, which Forensic Analysis with Autopsy Copyright UMUC 2015 Page 24 of 33

8 can be useful for investigators to quickly find files of certain types that maybe of interest (Excel, Word, PowerPoint, Adobe PDF, HTML, Outlook PST, etc.). Don t click on Sort Files by Type link in the left hand navigation frame to have Autopsy analyze the image by file type (Autopsy uses file extension and header/footer analyses) as this will take too long for our lab. Normally an investigator will have to select a few options. Checkbox for Sort Files into categories by type is recommended along with any others. The Save a copy of files and Save ONLY graphic images will take a lot of disk space and processing time. Checkbox Extension and File Type Validation to have Autopsy compare the file extension to signatures of the footer/headers within the file. This option takes longer to run/compute. Do NOT click OK. Just move on to the next step. (Take screenshot of VM window and paste into your report on your local computer for deliverable Part 1A4) 35) Click the Autopsy Image Details analysis tool allows investigators to view detailed information about the image(s) imported into the Case for the Host. A list of information Forensic Analysis with Autopsy Copyright UMUC 2015 Page 25 of 33

about the system such as file system type, metadata information, content information, etc. is provided in a text report format. This is useful for documenting the suspect evidence system type.

9 about the system such as file system type, metadata information, content information, etc. is provided in a text report format. This is useful for documenting the suspect evidence system type. The format of the file system and other details can help perform more advanced types of analysis as well. 36) Click to the Autopsy Meta Data analysis tool allows investigators to examine the image by the file system s metadata structures on the disk. Every file system has metadata Forensic Analysis with Autopsy Copyright UMUC 2015 Page 26 of 33

10 about the files within the system. This is useful for advance recovery, analysis, and getting details about particular files. Click the Allocation List button to see a clickable list of all metadata allocations on the file system. Click on an allocation entry to see a detailed report of the contents in the right corner navigation frame. 37) Click on an allocation entry to see a detailed report of the contents in the right corner navigation frame 38) Click the Data Unit tab, this tool allows investigators to review individual data units on a disk. Each file system will have different names for this, but these units comprise of Forensic Analysis with Autopsy Copyright UMUC 2015 Page 27 of 33

deleted data 39) After exploring this area click the Close X button to return to the Host

11 everything that was collected on the media when forensically imaged. This mode of review provides raw details and is useful for advanced file recovery or analysis of deleted data 39) After exploring this area click the Close X button to return to the Host Manager screen for the next step. 40) Click on the Event Sequencer Forensic Analysis with Autopsy Copyright UMUC 2015 Page 28 of 33

12 41) The Autopsy Event Sequencer analysis tool allows investigators to create a timeline of events and create a sequence. Evidence found within an image usually does not happen Forensic Analysis with Autopsy Copyright UMUC 2015 Page 29 of 33

13 in sequence and is not found that way by an investigator. By adding notes about evidence of interest along with a time/date stamp for that piece of evidence investigators can use this Autopsy tool to sort the events noted of interest to the investigation. An event can be added based on a file s MACE time/date stamp or a manual entry by the investigator. A list of saved events will be displayed in a table format in the top navigation frame. Click the Close button to return to the main screen. 42) Click the View Notes button in the Host Manager screen Forensic Analysis with Autopsy Copyright UMUC 2015 Page 30 of 33

43) This allows investigators to view their notes saved during other forensic analyses. Click the Close button in the web browser to return to the Host Manager screen.

14 43) This allows investigators to view their notes saved during other forensic analyses. Click the Close button in the web browser to return to the Host Manager screen. (Take screenshot of VM window and paste into your report on your local computer for deliverable Part 1A4) Forensic Analysis with Autopsy Copyright UMUC 2015 Page 31 of 33

15 44) Click the Image Integrity button 45) The Image Integrity Tool is used to calculate MD5 hashes of the image and various evidence files. The Calculate button will have Autopsy calculate an MD5 hash for that item. The Validate button will have Autopsy calculate the hash of the item and compare it to the already specified value to ensure they match. A hash mis-match would indicate the integrity of that evidence file has been altered since the last time it was hashed. You may take a screenshot here to help answer the lab questions in Part II. Click the Close button to return back. Forensic Analysis with Autopsy Copyright UMUC 2015 Page 32 of 33

16 46) Click the power button and shutdown Forensic Analysis with Autopsy Copyright UMUC 2015 Page 33 of 33

Digital Forensics Practicum CAINE 8.0. Review and User s Guide

Digital Forensics Practicum CAINE 8.0 Review and User s Guide Ana L. Hernandez Master of Science in Cybersecurity Digital Forensics Concentration University of South Florida 12-8-2017 Table of Contents