WebCase Version 1.9b E v a l u a t i o n R E p o R t May 2012

Size: px

Start display at page:

Download "WebCase Version 1.9b E v a l u a t i o n R E p o R t May 2012"

Nora Sparks
5 years ago
Views:

1 WebCase Versio 1.9b E v a l u a t i o R e p o r t May 2012

2 NIJ Electroic Crime Techology Ceter of Excellece 550 Marshall St., Suite B Phillipsburg, NJ NIJ ECTCoE Testig ad Evaluatio Project Staff Robert J. O Leary, CFCE; DFCP Doald Stewart, CFCE; ACE Victor Fay-Wolfe, Ph.D. Russell Yaw, CFCE Rady Becker, CFCE Kriste McCooey, CCE; ACE Chester Hosmer Jacob Foseca Laurie A O Leary Mark Davis, Ph.D. Michael Termielli, ACE

3 Cotets i i i Table of Cotets Itroductio... 1 Overview... 3 Product Iformatio... 3 Product Descriptio... 3 Special Features... 3 System Requiremets... 4 Hardware Miimum Requiremets... 4 Test Bed Cofiguratio... 5 Istallatio of WebCase... 5 Iitial Cofiguratio... 5 Admiistrative Cofiguratio... 6 Evaluatio ad Testig of WebCase Testig Focus... 7 Startig a Ivestigatio... 7 Test: WebCase Stadard Operatio... 8 Results Test: Evidece Itegrity Results Test: Evidece Itegrity # Results Coclusio WebCase Versio 1.9b

5 Itroductio 1 Itroductio T he Natioal Istitute of Justice (NIJ) Electroic Crime Techology Ceter of Excellece (ECTCoE) has bee assiged the resposibility of coductig electroic crime ad digital evidece tool, techology ad traiig testig ad evaluatios i support of the NIJ Research, Developmet, Testig ad Evaluatio (RDT&E) process. The Natioal Istitute of Justice RDT&E process helps esure that NIJ s research portfolios are aliged to best address the techology eeds of the crimial justice commuity. The rigorous process has five phases: Phase I: Determie techology eeds pricipally i partership with the Law Eforcemet ad Correctios Techology Advisory Coucil (LECTAC) ad the appropiate Techology Workig Group (TWG). NIJ idetifies crimial justice practitioers fuctioal requiremets for ew tools ad techologies. (For more iformatio o LECTAC ad the TWGs, visit Phase II: Develop techology program plas to address those eeds. NIJ creates a multiyear research program to address the eeds idetified i Phase I. Oe of the first steps is to determie whether products that meet those eeds curretly exist or whether they must be developed. If a solutio is already available, Phases II ad III are ot ecessary, ad NIJ moves directly to demostratio, testig ad evaluatio i Phase IV. If solutios do ot curretly exist, they are solicited through aual, competitively awarded sciece ad techology solicitatios ad TWG members help review the applicatios. Phase III: Develop solutios. Appropriate solicitatios are developed ad gratees are selected through a ope, competitive, peer-reviewed process. After grats are awarded, the gratee ad the NIJ program maager the work collaboratively to develop the solutios. Phase IV: Demostrate, test, evaluate ad adopt potetial solutios ito practice. A potetial solutio is tested to determie how well it addresses the iteded fuctioal requiremet. NIJ the works with first-adoptig agecies to facilitate the itroductio of the solutio ito practice. After adoptio, the solutio s impact o practice is evaluated. Durig the testig ad evaluatio process, performace stadards ad guides are developed (as appropriate) to esure safety ad effectiveess; ot all ew solutios will require the publicatio of ew stadards or guides. Phase V: Build capacity ad coduct outreach to esure that the ew tool or techology beefits practitioers. NIJ publishes guides ad stadards ad provides techology assistace to secod adopters. 1 The High Priority Crimial Justice Techology Needs are orgaized ito five fuctioal areas: Protectig the Public. Esurig Officer Safety. Cofirmig the Guilty ad Protectig the Iocet. Improvig the Efficiecy of Justice. Eablig Iformed Decisio-Makig. The NIJ ECTCoE tool, techology ad traiig evaluatio ad testig reports support the NIJ RDT&E process, which addresses high priority eeds for crimial justice techology. 1 Natioal Istitute of Justice High-Priority Crimial Justice Techology Needs, March 2009 NCJ WebCase Versio 1.9b

7 Overview 3 Overview Curret ivestigative methods for doig live olie ivestigatios are limited. The Prit Scree optio shows oly a web page, ot whether it was altered or eve whe it was collected, ad a maually writte report ca cotai errors. WebCase simplifies ad streamlies the ivestigative process by icludig critical details i reports. Product Iformatio The followig is take from the Vere Software website, the compay that developed WebCase Olie Ivestigatio Maagemet Tool 2 : WebCase was desiged by experieced law eforcemet professioals to help you collect Iteret iformatio i a usable, evidetial, reportable maer. Built to maage the cases you iitiate. The WebCase software is list priced at $995 per licesed dogle. Icluded is the security dogle alog with a CD that cotais the software, a user maual, referece material ad videos o usig the WebCase software. There are o reewal fees oce you purchase the software ad there are multiple user optios with a sigle licese. Product Descriptio The followig was take from the Vere Software website: The ivestigator utilizes the evidece collectio cosole to record ad maage olie ivestigative activity. The saved data is hashed ad stored i a secure eviromet withi the tool. Reports based o the collected evidece ca the be prited or published to CD/DVD for distributio. WebCase eables its users to search for, collect, preserve ad report ay ad all olie data, icludig: Web captures. Video recordigs. TCIP/IP collectio. Image capture. Attached files. Keystroke loggig. Automatic domai lookups. Automatic Geo-locatio of IP addresses. Special Features The followig list of special features was take from the product website: Simplify the olie evidece collectio process. Aid the ivestigator to preserve olie evidece. Provide for the proper collectio of legal defesible evidece. Offer complete udercover idetity ad suspect iformatio cotrol. Provide reports i a usable, uderstadable format. Full scree capture. HTML capture. 2 WebCase Versio 1.9b

8 4 Overview 64-bit compatibility. Supports Widows Operatig Systems: XP to Widows 7 ad Iteret Explorer 6 through 8. System Requiremets The followig system requiremets are take from the WebCase web page 3 : WebCase curretly operates oly o Microsoft Widows operatig system versios XP, Vista ad Wi 7 Microsoft 32 bit ad 64 bit systems. The software requires Microsoft.NET versio 2.0 framework or later. If you do t have it, the WebCase istaller provides it durig istallatio. WebCase is compliat with Iteret Explorer 6, 7 ad 8. Iteret access is required to receive software updates ad to capture active web pages. WebCase ca be used to record applicatios that do ot require a Iteret coectio. Hardware Miimum Requiremets A Itel-based PC with a miimum of a Petium 4 or equivalet processor. 100 MB of disk space. 1 GB of RAM. Curretly WebCase does ot support Apple OS. Curretly WebCase oly supports Iteret Explorer 6 through NLECTC Crimial Justice Electroic Crime Techology Ceter of Excellece

Test Bed Cofiguratio 5 Test Bed Cofiguratio The followig is the system used for testig: Computer: o Gateway Mid Tower PC (Gateway Test PC): o Hewlett-Packard 64-bit. o AMD Athlo II X 4 2.90 GHz. o 6.

9 Test Bed Cofiguratio 5 Test Bed Cofiguratio The followig is the system used for testig: Computer: o Gateway Mid Tower PC (Gateway Test PC): o Hewlett-Packard 64-bit. o AMD Athlo II X GHz. o 6.0 GB Ram istalled. o Operatig system: Microsoft Widows 7 Service pack 1 Home Editio. Istallatio of WebCase Prior to istallig the WebCase software, the WebCase User Maual was dowloaded ad reviewed. The 97-page maual is iformative, icludes clear scree shots of the applicatio ad detailed descriptios of the istallatio process. The istallatio istructios address cofiguratio of ativirus software to allow the WebCase program ad its compoets to access the Iteret. It also provides istructios to adjust user settigs for both Widows 7 ad Widows Vista. Durig the istallatio the WebCase software will istall the followig compoets o the ivestigatio computer: WebCase software. Security dogle drivers. Vere software toolbar. Data Burer ActiveX Cotrol. 7-Zip compressio tool. HASP ru-time drivers. Followig the istructios provided, WebCase was istalled successfully ad the test computer was restarted, completig the istallatio process. Iitial Cofiguratio After rebootig the computer, the WebCase software must be cofigured ad registered prior to iitiatig a ivestigatio. The ivestigator must have the Aladdi security dogle iserted ito the ivestigative computer to eable the WebCase software. If the security dogle is ot iserted the followig alert will be displayed. WebCase requires cofiguratio by a WebCase admiistrator. The admiistrator will create, maage ad cofigure settigs for ivestigator profiles. The poit of cotact for WebCase updates for the licesig agecy or idividual must also be completed. The default password provided for the admiistrator accout may be chaged oce the admiistrator logs o. The admiistrator selects the appropriate time zoe ad WebCase will syc with the Natioal Istitute of Stadards ad Techology (NIST) atomic clock, eablig WebCase to accurately display the date ad time stamp associated with ay ivestigatio. WebCase Versio 1.9b

6 Test Bed Cofiguratio As part of the cofiguratio of the WebCase software, the ivestigator is asked to select a hash algorithm, which WebCase will use to secure ad autheticate the evidece that is

Upo completio of the admiistrator setup, WebCase performs a system test to make sure all the compoets were cofigured ad work properly.

The WebCase user maual states that for the WebCase video fuctio to work properly, a microphoe ad speakers must be plugged ito the ivestigative PC durig WebCase istallatio ad use.

10 6 Test Bed Cofiguratio As part of the cofiguratio of the WebCase software, the ivestigator is asked to select a hash algorithm, which WebCase will use to secure ad autheticate the evidece that is collected i the case. The followig hash algorithms are available to choose from, MD5, SHA1, SHA256, SHA384 ad SHA512. The default hash is MD5 ad was used i this testig. Upo completio of the admiistrator setup, WebCase performs a system test to make sure all the compoets were cofigured ad work properly. Note: If the ivestigator is usig a PC for the ivestigatio, a error message idicatig the istallatio failed will display if the ivestigatio computer is ot cofigured with a microphoe ad audio device. The WebCase user maual states that for the WebCase video fuctio to work properly, a microphoe ad speakers must be plugged ito the ivestigative PC durig WebCase istallatio ad use. A simple USB headset with a microphoe will suffice. If usig a laptop with a built-i microphoe as the ivestigatig computer, WebCase does ot display the error message. Whe the WebCase software is properly istalled ad the testig has successfully completed, the followig otificatio scree will be displayed. admiistrative Cofiguratio The WebCase Software icludes a robust set of cofiguratio optios. Prior to usig WebCase to coduct a ivestigatio, WebCase requires the admiistrator to create ivestigator accouts. The admiistrator is able to maage ad moitor all ivestigator accouts. Oce the admiistrator has cofigured the software, the selected optios are saved i the Admiistrators Pael. Whe this step is completed, the admiistrator has the optio to assig ivestigators ad begi a ivestigatio or to log off of the WebCase software. NLECTC Crimial Justice Electroic Crime Techology Ceter of Excellece

Evaluatio ad Testig of WebCase 7 Evaluatio ad Testig of WebCase Testig focus The followig WebCase data collectio, preservatio ad presetatio fuctios were tested: Key Loggig of a Iteret ivestigatio

Domai registratio. Locatio iformatio of the Iteret Protocol Address. Capture a video recordig of a web page/chat coversatio. Attachig a file to the case.

11 Evaluatio ad Testig of WebCase 7 Evaluatio ad Testig of WebCase Testig focus The followig WebCase data collectio, preservatio ad presetatio fuctios were tested: Key Loggig of a Iteret ivestigatio activity. 3. I the Ivestigatio Maagemet widow, selectig the New Ivestigatio displays the followig widow. Archivig of a web page. Web page scree capture. Report geeratio. HTML/Source code capture. Domai registratio. Locatio iformatio of the Iteret Protocol Address. Capture a video recordig of a web page/chat coversatio. Attachig a file to the case. Loggig ad securig evidece collected i the case. startig a Ivestigatio To start a ivestigatio usig WebCase, the ivestigator selects the WebCase Ico. 1. The log o scree will appear. 4. The ivestigator fills i the iformatio for the case ame, a udercover idetity if required, the suspect(s) ivolved ad a descriptio of the case. Evidece Verificatio Optios, such as hash algorithm or Video/Recordig, may also be adjusted. 5. Oce the case optios are cofigured, evidece ca be collected. Selectig the Save optio saves the case data. Selectig the Start Evidece Collectio optio opes the WebCase Evidece Collectio Cotrol Pael iterface iitiatig the ivestigatio. 2. The logi ID field lists the ivestigator accouts previously created by the WebCase admiistrator. WebCase Versio 1.9b

12 8 Evaluatio ad Testig of WebCase Whe cotiuig a existig ivestigatio, WebCase will display the Ope Existig Ivestigatio widow. This widow displays optios for the ivestigator to maage the ivestigatio, such as addig ad editig suspect iformatio or a udercover idetity. These optios are explaied i detail i the WebCase User Maual. 7. To start the key loggig fuctio of WebCase, the Start Loggig tab was selected from the Web- Case Collect Evidece Cotrol Pael. The loggig display widow cofirmed the applicatio was ruig. Detailed descriptios of each of the fuctios of the Evidece Cotrol Pael are cotaied i the WebCase User Maual. Test: WebCase Stadard Operatio The followig steps were performed to test WebCase usig the website: 1. Logged i as the admiistrator. 2. Created a ew ivestigator ame. Oce created, the admiistrator was logged off ad the ivestigator accout was logged o. 3. Created a suspect amed Joh Doe. 4. Created a ew case amed TEST The default MD5 hash was selected for evidece verificatio. 6. Selected Ope Existig Ivestigatio optio ad selected the ivestigatio amed TEST 1 to start the evidece collectio process, at which time the WebCase Evidece Collectio iterface was displayed. The Start loggig tab activates two separate fuctios withi WebCase: a key logger ad a TCP/IP logger. These features add a form of verificatio to the evidece collected durig the ivestigatio. The key logger records the ivestigator s keystrokes durig the logged sessio. Mouse movemets ad clicks are ot collected. The TCP/IP logger records all data received via the Iteret coectio. This fuctio was tested by typig the followig terms ito the Big search egie field o the Iteret Explorer Web browser: Google.com. 50 ways to. Esp. Hackig facebook. <Backspace> <backspace> <backspace>. Note: These are actual key presses of Backspace o the keyboard. 8. The WebCase Lauch optio was selected from the Collect Evidece Cotrol Pael ad the Iteret Explorer browser was selected from the drop dow widow. Iteret Explorer is the oly Web browser that is compatible with WebCase at this time. Iteret Explorer opeed up i the WebCase Cotrol Pael. NLECTC Crimial Justice Electroic Crime Techology Ceter of Excellece

Evaluatio ad Testig of WebCase 9 9. The URL www.justet.org was typed i the address bar of Iteret Explorer. The Justet.org home page was displayed i the WebCase cotrol Pael. 10.

The Archive feature i the Collect Evidece Cotrol Pael was selected to archive the www. Justet.org web page. The archived page was the saved as evidece ad stored i the Web- Case evidece locker.

13 Evaluatio ad Testig of WebCase 9 9. The URL was typed i the address bar of Iteret Explorer. The Justet.org home page was displayed i the WebCase cotrol Pael. 10. The Save Widow Ifo to Locker feature was accessed to capture the iformatio gathered. The iformatio was the hashed by WebCase, ad placed i the WebCase Evidece locker. 11. The Archive feature i the Collect Evidece Cotrol Pael was selected to archive the www. Justet.org web page. The archived page was the saved as evidece ad stored i the Web- Case evidece locker. The collected items widow i the cotrol pael widow cofirmed the page was saved. The Collect Evidece Cotrol Pael was populated with the followig iformatio: 12. The Start Video feature was selected to test the WebCase video recordig ad scree capture fuctios. A 10-secod video of the Justet You- Tube chael was captured from the homepage. After capturig the video, it was saved i Web- Case i the.flv format. 13. The Start Video feature was agai selected to test the recordig of a ogoig live chat sessio. To simulate a chat sessio betwee a ivestigator ad a suspect, two Yahoo chat accouts were created. After loggig o to Yahoo, the Start Recordig tab was accessed ad a chat sessio was recorded. 14. The Start Video/Scree Capture feature was selected agai to test the WebCase scree capture capability. The Justet.org website homepage was captured ad saved ito the WebCase evidece locker. 15. The HTML feature was selected to collect the HTML data of the Justet.org website. This iformatio was the saved to the WebCase evidece locker. 16. The Thumbail feature was selected to capture a thumbail image of the Justet.org homepage. The evidece was the saved i the WebCase evidece locker. 17. WebCase offers the feature of addig files to the case. Selectig Attach File displays a widow to avigate to the file to be added. A image ame wave4w.jpg i the pictures folder was selected. WebCase Versio 1.9b

10 Evaluatio ad Testig of WebCase WebCase hashed the file ad cofirmed it was Selectig a evidece item displays the iformatio saved i the collected items widow.

date ad time the evidece was collected, the ame assiged to the evidece, a lik to ope ad view the evidece ad the hash value WebCase geerated for that piece of evidece. 19.

The Build Report optio was selected ad WebCase geerated a HTML report.

Results The report was used to verify each idividual sectio of this test.

14 10 Evaluatio ad Testig of WebCase WebCase hashed the file ad cofirmed it was Selectig a evidece item displays the iformatio saved i the collected items widow. associated with that evidece item, icludig the 18. After collectig the evidece ad cofirmig it was listed i the Collected Items widow, the Doe optio was selected, closig the curret ivestigatio. date ad time the evidece was collected, the ame assiged to the evidece, a lik to ope ad view the evidece ad the hash value WebCase geerated for that piece of evidece. 19. I the Ivestigatio Maagemet Widow, the Geerate Report optio was selected ad case items were displayed. At this step, items ca be selected ad added to the report. 20. The Build Report optio was selected ad WebCase geerated a HTML report. The WebCase report is HTML based ad the user must permit the Active X cotrols ad allow blocked cotet i Iteret Explorer for the report to display properly. Results The report was used to verify each idividual sectio of this test. The followig is a list of those results: Key Loggig After opeig the key log evidece item, it was cofirmed that WebCase captured the key strokes used i the ivestigatio. The iitial WebCase Report HTML page opes i the default Web browser ad displays the details of the ivestigatio icludig the case ad Ivestigator iformatio ad the evidece collected durig the case. The Evidece list idetifies the date ad time the evidece was collected. TCP/IP The TCP/IP reports cofirmed that all the ports were workig properly o the ivestigatio computer ad were accessig the website that was uder ivestigatio. WebCase displays this iformatio i a text format. N L E C T C C r i m i al Justice Electroic Crime Techology Ceter of Excellece

Evaluatio ad Testig of WebCase 11 Video Capture The video capture feature of WebCase successfully

Scree Capture The WebCase report showed that the scree capture was successful i capturig a scrollig jpeg

home page. WebArchive WebCase captured the etire scrollig page of Justet.org.

displays the curret versio Thumbail Image Capture WebCase successfully captured a thumbail homepage.

15 Evaluatio ad Testig of WebCase 11 Video Capture The video capture feature of WebCase successfully captured the video selected from the Justet.org homepage ad successfully captured the chat sessio. Scree Capture The WebCase report showed that the scree capture was successful i capturig a scrollig jpeg image of the Justet.org home page. WebArchive WebCase captured the etire scrollig page of Justet.org. If the ivestigatio computer is coected to the Iteret whe the archived web page is viewed, the hyperlik displays the curret versio Thumbail Image Capture WebCase successfully captured a thumbail image of the Justet.org homepage. of the website from the Iteret, ad ot the versio archived i the WebCase report. It is recommeded that the ivestigatio computer is discoected from the Iteret whe viewig the WebCase report. WebCase Versio 1.9b

1 2 Evaluatio ad Testig of WebCase HTML Capture WebCase successfully captured the HTML code for the Justet.org website ad displayed the iformatio i text format.

Test: Evidece Itegrity Whois Iformatio ad Domai registratio iformatio WebCase displays the domai registratio iformatio i text format, ad cofirmed that the URL address for Justet.

16 1 2 Evaluatio ad Testig of WebCase HTML Capture WebCase successfully captured the HTML code for the Justet.org website ad displayed the iformatio i text format. Attached File The Attached Image file, wave4w.jpg, was accessed i the WebCase report. The file was correctly attached to the report ad displayed properly. Test: Evidece Itegrity Whois Iformatio ad Domai registratio iformatio WebCase displays the domai registratio iformatio i text format, ad cofirmed that the URL address for Justet.org is registered to LOCKHEED MARTIN ASPEN SYSTEMS CORPORATION. WebCase also supplies the phoe umber, street address ad iformatio for the registrat from the Whois database etry. WebCase secures the evidece collected by usig a date ad time via the atomic clock at NIST. The evidece gathered i each ivestigatio is date ad time stamped at the time it is captured ad the hashed usig the algorithm that was selected by the ivestigator i the WebCase set up procedure. The evidece is the stored i a cotaier ad caot be accessed by ormal meas. WebCase also copies files to a Evidece Locker folder so that idividual files ca be viewed by the ivestigator. The followig steps were performed to verify that WebCase maitais the itegrity of the evidece gathered. The file to be tested for itegrity is a image file amed wave4w.jpg, which was attached to the case earlier i the testig process. The followig procedure was coducted to determie if the itegrity of the collected evidece is maitaied whe accessig the Evidece Locker folder: 1. Accessed the Evidece Locker folder. 2. Opeed the image file amed wave4w.jpg with Widows Live Photo Gallery. 3. Iverted the image usig the editig fuctio ad saved it back to the Evidece Locker folder, leavig the same file ame. 4. Closed all ope folders ad lauched the Web- Case software. NLECTC Crimial Justice Electroic Crime Techology Ceter of Excellece

17 Evaluatio ad Testig of WebCase Geerated the evidece report for the case. 6. Opeed the case report ad accessed the evidece image item wave4w.jpg. Results It was cofirmed that the evidece image item wave4w.jpg did retai its origial properties ad o maipulatio of the photo was detected. The hash values i the WebCase report cofirmed that the attached file was ot altered. Test: Evidece Itegrity #2 The followig steps were performed to esure that WebCase did ot use the files from the Evidece Locker Folder: 1. Accessed the Evidece Locker folder. 2. Deleted file amed wave4w.jpg from the evidece locker folder. 3. Closed all ope folders ad lauched the Web- Case software. 4. Geerated the evidece report for the case. 5. Opeed the case report ad accessed the evidece image item wave4w.jpg. Results It was cofirmed that the evidece image item wave4w.jpg was properly displayed i the report ad the hash value cofirmed that the image wave4w.jpg was ot altered. WebCase Versio 1.9b

19 Coclusio 1 5 Coclusio The tested features of the WebCase Olie Foresic Tool performed as advertised i the Web- Case documetatio ad website. The software is desiged to capture olie chat coversatios, web pages ad social etworkig sites as they appeared at the time a ivestigator viewed them. WebCase uses a hash algorithm to esure the itegrity of evidece collected i a case. The istallatio ad use of the software is simple. A seasoed ivestigator most likely would ot require traiig for the operatio of WebCase. If eeded, the developer offers traiig opportuities ad a olie elearig page cotaiig istructioal videos o the operatio of the software. The multiuser capabilities with a sigle licese are a valuable feature for a agecy with multiple ivestigators, eablig both joit ad idepedet ivestigatios. The WebCase program geerates a easy to read HTML report that ca be copied to CD, DVD or other media. WebCase Versio 1.9b

SFP1215W Forensic Pouch E V A L U A T I O N R E P O R T

SFP1215W Forensic Pouch E V A L U A T I O N R E P O R T E V A L U A T I O N R E P O R T April 2012 NIJ Electroic Crime Techology Ceter of Excellece 550 Marshall St., Suite B Phillipsburg, NJ 08865 www.ectcoe.org NIJ ECTCOE TESTING AND EVALUATION PROJECT STAFF