Introduction to Volume Analysis, Part I: Foundations, The Sleuth Kit and Autopsy. Digital Forensics Course* Leonardo A. Martucci *based on the book:

Transcription

1 Part I: Foundations, Introduction to Volume Analysis, The Sleuth Kit and Autopsy Course* Leonardo A. Martucci *based on the book: File System Forensic Analysis by Brian Carrier LAM /12h

2 Outline Part I: Foundations Digital Investigations Foundations Computer Foundations Hard Disk Acquisition Part II: Volume Analysis Volume Analysis Appendix A The Sleuth Kit and Autopsy LAM /12h

3 Digital Investigation Foundations Digital Investigation process test hypotheses that answer questions about events digital evidence hypothesis try to falsify it with more evidence digital object that contains reliable info that support/refute an hypothesis both legal and investigative uses digital investigation + legal requirements = digital forensics LAM /12h

4 Crime Scene Investigation Process System Preservation Evidence Search Event Reconstruction for both live analysis - use resources from the suspected system dead analysis - run trusted applications in a trusted OS LAM /12h

5 General Guidelines for Investigation Preservation Isolation Correlation Logging copy the data / save originals & calculate hash of important data / write-block device to prevent rewriting / minimize # of files created to protect yourself from the suspect data / network isolation correlate data with independent sources reduce risk of forgery document your own actions LAM /12h

6 Data Analysis App. / OS Analysis Swap Space Analysis File System Analysis Database Analysis Volume Analysis Memory Analysis PHY Storage Analysis Network Analysis LAM /12h

7 The Process of Analyzing Data HD Physical Media Analysis Sectors of Data Volume Analysis Volume File System Analysis File Application Analysis LAM /12h

8 Essential and Nonessential Data Essential data data that can be trusted filename and file content Nonessential data data that cannot be trusted (might be forged, might be correct) LAM /12h

9 Computer Foundations Data Organization a long intro about bits, bytes, hex and decimal numbers big-endian and little-endian Strings, Character Encoding, Data Structures and Flags ASCII and Unicode (UTF) Booting process BIOS checks HW and looks for the 1 st sector of boot code CPU process the partition table and locate the bootable partition LAM /12h

10 Hard Disk Technology Hard disks most common source of digital evidence cylinder (C) heads (H) platters sectors (S) CHS addressing C 10 / H 8 / S 6 (Old BIOS) and C 16 / H 4 / S 8 (original ATA) LBA addressing 2 28 max addressing space 2 24 max addressing space LAM /12h

11 Hard Disks Hidden Areas Host Protected Access (HPA) can be used to save (and hide) data 0 m n user addressable sectors HPA ATA command identity_device read_native_max_address set_max_address Device Configuration Overlay (DCO) 0 m n user addressable sectors HPA DCO p ATA command device_configuration_identify LAM /12h

12 Accessing the Hard Disk through the BIOS it already knows the hardware details of installed disks loads the interrupt table INT13h (and extended INT13h) supports many disks functions the BIOS might not see the entire disk through Direct Access require knowledge about the hardware fastest to access data LAM /12h

13 Hard Disk Data Acquisition Preservation purposes make sector by sector copy of the hard disk dead analysis dead acquisition - copy data without using the suspected OS live acquisition - copy data using the suspected OS error handling bad sectors replaced by zeroes (keep size intact) check existence of HPA and DCO disk write blockers software - usually monitors INT13h hardware - more effective LAM /12h

14 Writing the Output Data Destination Location disk (duplicate copy) difficult to tell exactly where the disk ends file (duplicate image) most common Image File Format RAW only data from source device different disk geometries embedded data from source + additional description data hash values, dates, times Compressing Image File save space, but analysis tool must support it LAM /12h

15 Volume Analysis data structures involved with partitioning and assembling bytes in the storage space so that to acquire the volumes Volume == collection of addressable sectors that an OS or app uses to store data Partitions are identified by the partition table stores the start points and endpoints of the partitions no other identification on border sectors physical address addressing scheme logical disk volume address logical partition volume address LAM /12h

16 Volume Analysis Basic Partition tables must be analyzed identify the partition layout for non-assigned sectors provide the partition layout to a file system analysis tool Partition consistency check check each partition relative to other partitions Extract partition content Recover deleted partitions LAM /12h

17 The Sleuth Kit and Autopsy The Sleuth Kit +20 command line tools in 4 categories disk tools - stats about ATA disks volume tools - list disk partitions file system tools - the bulk of TSK searching tools - binary search Autopsy html-based front-end to TSK for both live and dead analysis works as a web server (allows a remote repository of images) LAM /12h

18 End of Seminar 1 LAM /12h