Page 2
Practical Digital Forensics Get started with the art and science of digital forensics with this practical, hands-on guide! Richard Boddington BIRMINGHAM - MUMBAI www.allitebooks.com
Document content
Page 3
Practical Digital Forensics Copyright © 2016 Packt Publishing All rights reserved. No part of this book may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, without the prior written permission of the publisher, except in the case of brief quotations embedded in critical articles or reviews. Every effort has been made in the preparation of this book to ensure the accuracy of the information presented. However, the information contained in this book is sold without warranty, either express or implied. Neither the author, nor Packt Publishing, and its dealers and distributors will be held liable for any damages caused or alleged to be caused directly or indirectly by this book. Packt Publishing has endeavored to provide trademark information about all of the companies and products mentioned in this book by the appropriate use of capitals. However, Packt Publishing cannot guarantee the accuracy of this information. First published: May 2016 Production reference: 1200516 Published by Packt Publishing Ltd. Livery Place 35 Livery Street Birmingham B3 2PB, UK. ISBN 978-1-78588-710-9 www.packtpub.com [ FM-2 ] www.allitebooks.com
Page 4
Credits Author Project Coordinator Richard Boddington Judie Jose Reviewer Proofreader Colin J. Armstrong Safis Editing Commissioning Editor Indexer Veena Pagare Hemangini Bari Acquisition Editor Graphics Divya Poojari Jason Monteiro Content Development Editor Production Coordinator Sanjeet Rao Aparna Bhagat Technical Editor Cover Work Vishal K. Mewada Aparna Bhagat Copy Editor Madhusudan Uchil [ FM-3 ] www.allitebooks.com
Page 5
About the Author Richard Boddington commenced general policing with the London Metropolitan Police in 1968 and joined the Royal Hong Kong Police in 1971, later serving as a chief inspector in the Special Branch. In 1980, Richard moved to Australia and worked as a desk officer and case officer with the Australian Security Intelligence Organization. He later worked in several federal and state government agencies, including the Western Australia Department of Treasury and Finance, as a senior intelligence officer. In 2008, he commenced developing and coordinating information security and digital forensics undergraduate and postgraduate courses at Murdoch University, where he was responsible for the creation of a digital forensic and information security degree offering. He provided a unique online virtual digital forensics unit for postgraduate students at the University of Western Australia in 2014. Between 1991 and 2015, Richard was a security analyst and digital forensic practitioner, providing independent consultancy services for legal practitioners and organizations requiring independent digital forensic examinations and reports. This included analyzing case evidence in criminal and civil cases heard at Magistrate, District and Commonwealth Courts. His work included the compilation of digital forensic reports and testifying as an expert witness on complex technical matters to assist the jury in understanding digital evidence presented during trial. Recent forensic examinations undertaken by him include analyzing digital evidence recovered from computers, mobile phones, and other digital devices and then preparing expert testimony relating to a broad range of criminal and civil cases, including: • Child pornography and child exploitation • Cyberstalking • Aggravated burglary and false imprisonment • Analysis of CCTV video digital evidence of assault and rape cases • Alleged homicide, suicide, and other crimes of violence [ FM-4 ] www.allitebooks.com
Page 6
• Bomb threats • Family law disputes and Australian Vietnamese Relief Organization (AVRO) breaches • Workers' compensation disputes • Suspected forgery or manipulation of digital video and mobile phone evidence • Industrial espionage and sabotage and intellectual property theft Since 2015, Richard has continued his digital forensics examinations on behalf of TSW Analytical Pty Ltd in Western Australia, where he now heads the Digital Forensics and Data Recovery Team. He is also the General Manager for Research and Training at eReveal Technologies Pty Ltd (TSW Global Company) and is responsible for designing and coordinating online digital forensics, multimedia forensics, and e-discovery training courses for a broad range of organizations. Richard is presently developing online digital forensics and e-discovery academic postgraduate course for the evolving Institute for Applied Forensic Science, associated with TSW Analytical, as part of broader postgraduate forensic course offerings in Australasia and overseas. In 2010, Richard authored two digital forensics chapters in Digital Business Security Development: Management Technologies. He has also written a number of journal articles on the validation of digital evidence, his ongoing research area. In 2015, he authored an online video cast series, Emerging Forensic Tools for Locating and Analyzing Digital Evidence, on behalf of IGI Global Video Lecture E-Access Videos (http://www.igi-global.com/video/emerging-forensic-tools-locating- analyzing/134946). [ FM-5 ] www.allitebooks.com
Page 7
Acknowledgment I would like to acknowledge the constant love, support, and faith shown to me from my beautiful wife, Meiling, and our close family unit, which has helped me throughout my research and writing of the book, which I now dedicate to them. The inspiration, technical brilliance, and forensic expertise of Jim Baker of Xtremeforensics and my colleague-at-arms, Dr. Richard Adams, have been the driving force behind my renewed dedication to digital forensics that has resulted in the writing of this book. James McCutcheon's leading work in testing forensic image containers was inspirational and I am pleased to share some of his grossly unrecognized research along with Dr. Adams' work on the ADAMS model. I hope some small but important mention of their work in this book goes some way to publicizing their research. I hope it will encourage other like-minded practitioners to get involved in some really helpful and needed research for the discipline. Dr. Colin Armstrong's help in the technical review of the book has always been positive and encouraging and helped me reach my final goal, and I thank Colin for his time and constructive feedback to the publishers. Finally, I am grateful for the support and encouragement from the academics and forensic practitioners and technicians at TSW, who had implicit faith in my forensic experience and provided me with a supportive environment in which to complete the book. [ FM-6 ] www.allitebooks.com
Page 8
About the Reviewer Colin J. Armstrong has extensive business experience in communications and information technology, information systems and services, security, and forensic science education, spanning the aviation, transport, hotel and catering, tertiary education, and charitable industries. His experience derives not only from industry roles, but studies acquiring bachelor, masters, and doctoral degrees, participation in the Australian Standards Expert Committee, memberships to various professional industry bodies, board memberships, and company directorships. [ FM-7 ] www.allitebooks.com
Page 9
www.PacktPub.com eBooks, discount offers, and more Did you know that Packt offers eBook versions of every book published, with PDF and ePub files available? You can upgrade to the eBook version at www.PacktPub.com and as a print book customer, you are entitled to a discount on the eBook copy. Get in touch with us at customercare@packtpub.com for more details. At www.PacktPub.com, you can also read a collection of free technical articles, sign up for a range of free newsletters and receive exclusive discounts and offers on Packt books and eBooks. TM https://www2.packtpub.com/books/subscription/packtlib Do you need instant solutions to your IT questions? PacktLib is Packt's online digital book library. Here, you can search, access, and read Packt's entire library of books. Why subscribe? • Fully searchable across every book published by Packt • Copy and paste, print, and bookmark content • On demand and accessible via a web browser [ FM-8 ] www.allitebooks.com
Page 10
Table of Contents Preface ix Chapter 1: The Role of Digital Forensics and Its Environment 1 Understanding the history and purpose of forensics – specifically, digital forensics 2 The origin of forensics 3 Locard's exchange principle 3 The evolution of fingerprint evidence 4 DNA evidence 4 The basic stages of forensic examination 5 Defining digital forensics and its role 6 Definitions of digital forensics 7 Looking at the history of digital forensics 8 The early days 8 A paucity of reliable digital forensic tools 9 The legal fraternity's difficulty understanding digital evidence 10 More recent developments in digital forensics 11 Studying criminal investigations and cybercrime 12 Outlining civil investigations and the nature of e-discovery 13 The role of digital forensic practitioners and the challenges they face 14 The unique privilege of providing expert evidence and opinion 14 Issues faced by practitioners due to inadequate forensics processes 17 Inferior forensics tools confronting practitioners 18 The inadequate protection of digital information confronting practitioners 19 The tedium of forensic analysis 19 Qualities of the digital forensic practitioner 20 Determining practitioner prerequisites 20 [ i ] www.allitebooks.com
Page 11
Table of Contents Case studies 21 The Aaron Caffrey case – United Kingdom, 2003 22 The Julie Amero case – Connecticut, 2007 22 The Michael Fiola case – Massachusetts, 2008 22 References 22 Summary 23 Chapter 2: Hardware and Software Environments 25 Describing computers and the nature of digital information 26 Magnetic hard drives and tapes 26 Optical media storage devices 27 Random-access memory (RAM) 27 Solid-state drive (SSD) storage devices 28 Network-stored data 28 The cloud 29 Operating systems 30 Connecting the software application to the operating system 31 Connecting the software application to the operating system and a device 31 Describing filesystems that contain evidence 32 The filesystem category 34 The filename category 35 The metadata category 36 The content category 39 Locating evidence in filesystems 39 Determining the means of transgression 40 Determining opportunity to transgress 41 Determining the motive to transgress 42 Deciding where to look for possible evidence 42 Indexing and searching for files 45 Unallocated data analysis 47 Explaining password security, encryption, and hidden files 48 User access to computer devices 48 Understanding the importance of information confidentiality 48 Understanding the importance of information integrity 49 Understanding the importance of information availability 49 User access security controls 49 Encrypted devices and files 50 Case study – linking the evidence to the user 51 References 53 Summary 54 [ ii ]
Page 12
Table of Contents Chapter 3: The Nature and Special Properties of Digital Evidence 55 Defining digital evidence 56 The use of digital evidence 56 The special characteristics of digital evidence 64 The circumstantial nature of digital evidence 65 File metadata and correlation with other evidence 66 The technical complexities of digital evidence 71 The malleability of digital evidence 72 Metadata should not be taken at face value 72 Recovering files from unallocated space (data carving) 76 Date and time problems 79 Determining the value and admissibility of digital evidence 80 Explaining the evidentiary weight of digital evidence 81 Understanding the admissibility of digital evidence 82 Defining the lawful acquisition of digital evidence 83 Emphasizing the importance of relevance in terms of digital evidence 84 Outlining the reliability of digital evidence 85 The importance of the reliability of forensic tools and processes 85 Evaluating computer/network evidence preservation 86 Corroborating digital evidence 87 Case study – linking the evidence to the user 88 References 89 Summary 90 Chapter 4: Recovering and Preserving Digital Evidence 91 Understanding the chain of custody 92 Describing the physical acquisition and safekeeping of digital evidence 94 Explaining the chain of custody of digital evidence 95 Outlining the seizure and initial inspection of digital devices 98 Recovering digital evidence through forensic imaging processes 105 Dead analysis evidence recovery 106 Write-blocking hardware 106 Write-blocking software 110 Enhancing data preservation during recovery 114 Recovering remnants of deleted memory 115 Acquiring digital evidence through live recovery processes 115 The benefits of live recovery 116 The challenges of live recovery 116 [ iii ]
Page 13
Table of Contents The benefits of volatile memory recovery 117 Isolating the device from external exploits 119 Outlining the efficacy of existing forensic tools and the emergence of enhanced processes and tools 120 Standards for digital forensic tools 121 The reliability of forensic imaging tools to recover and protect digital evidence 123 Case studies – linking the evidence to the user 126 References 127 Summary 128 Chapter 5: The Need for Enhanced Forensic Tools 129 Digital forensics laboratories 130 The purpose of digital forensics laboratories 130 Acceptance of, consensus on, and uptake of digital forensics standards 131 Best practices for digital forensics laboratories 133 The physical security of digital forensic laboratories 134 Network and electronic requirements of digital forensic laboratories 135 Dilemmas presently confronting digital forensics laboratories 136 Emerging problems confronting practitioners because of increasingly large and widely dispersed datasets 137 Debunking the myth of forensic imaging 138 Dilemmas presently confronting digital forensics practitioners 139 Processes and forensic tools to assist practitioners to deal more effectively with these challenges 140 E-discovery evidence recovery and preservation 140 Enhanced digital evidence recovery and preservation 143 The benefits of enhanced recovery tools in criminal investigations 147 Empowering non-specialist law enforcement personnel and other stakeholders to become more effective first respondents at digital crime scenes 149 The challenges facing non-forensic law enforcement agents 150 Enhancing law enforcement agents as first respondents 150 The challenges facing IT administrators, legal teams, forensic auditors, and other first respondents 153 Enhancing IT administrators, legal team members, and other personnel as first respondents 155 Case study – illustrating the challenges of interrogating large datasets 157 The setting of the crime 158 [ iv ]
Page 14
Table of Contents The investigation 158 The practitioner's brief 159 The available evidence 159 The data extraction process 160 The outcome of the recovery and examination 161 Conclusion 162 References 162 Summary 162 Chapter 6: Selecting and Analyzing Digital Evidence 165 Structured processes to locate and select digital evidence 165 Locating digital evidence 168 Search processes 168 Searching desktops and laptops 169 Selecting digital evidence 182 Seeking the truth 183 More effective forensic tools 187 Categorizing files 187 Eliminating superfluous files 190 Deconstructing files 191 Searching for files 192 The Event Analysis tool 193 The Cloud Analysis tool 195 The Lead Analysis tool 197 Analyzing e-mail datasets 201 Detecting scanned images 203 Volume Shadow Copy analysis tools 203 Timelines and other analysis tools 205 Case study – illustrating the recovery of deleted evidence held in volume shadows 207 Summary 209 Chapter 7: Windows and Other Operating Systems as Sources of Evidence 211 The Windows Registry and system files and logs as resources of digital evidence 212 Seeking useful leads within the Registry 213 Mapping devices through the Registry 216 Detecting USB removable storage 218 User activity 219 Reviewing Most Recently Used and Jump List activity 219 [ v ]
Page 15
Table of Contents Detecting wireless connectivity 219 Observing Windows Event Viewer logs 220 Recovery of hidden data from a VSS 221 Examining prefetch files 224 Pagefiles 226 Hibernation and sleep files 226 Detecting steganography 227 Apple and other operating system structures 228 Examining Apple operating systems 228 The Linux operating system 231 Remote access and malware threats 233 Remote access 233 Detecting malware attacks and other exploits 234 The prevalence of anti-forensics processes and tools 235 Case study – corroborating evidence using Windows Registry 236 References 239 Summary 240 Chapter 8: Examining Browsers, E-mails, Messaging Systems, and Mobile Phones 241 Locating evidence from Internet browsing 242 Typical web-browsing behavior 242 Recovering browsing artifacts from slack and unallocated space 246 Private browsing 251 Messaging systems 253 Examining Skype and chat room artifacts 254 The invisible Internet 255 E-mail analysis and the processing of large e-mail databases 258 Recovering e-mails from desktop and laptop computers 258 Recovering and analyzing e-mails from larger datasets 263 Searching for scanned files 264 The growing challenge of evidence recovery from mobile phones and handheld devices 265 Extracting data from mobile devices 267 Managing evidence contamination 279 Concealing illegal activities 282 Extracting mobile data from the cloud 282 Analyzing GPS devices and other handheld devices 282 Case study – mobile phone evidence in a bomb hoax 283 Summary 290 [ vi ]
Page 16
Table of Contents Chapter 9: Validating the Evidence 291 The nature and problem of unsound digital evidence 292 Challenges explaining the complexity of digital evidence 294 The immaturity of the forensic subdiscipline 294 The ineffective security integrity of computers and networks 295 Evidence contamination 296 Impartiality in selecting evidence 296 Meaning is only clear in context 298 Faulty case management and evidence validation 298 The structured and balanced analysis of digital evidence 300 Developing hypotheses 300 Modeling arguments 301 The Toulmin model of argumentation 301 Formalizing the validation of digital evidence 303 The perceived benefits of a formalized validation process 303 Rationale for selection 304 The conceptual framework of the model 306 The validation process 308 Applying Bayesian reasoning to the analysis of validation 309 The comparative simplicity of the analysis of legal admissibility 309 More complex components requiring scientific measurement 311 Determining prior probability 315 Setting post probabilities 315 Checking whether the remote access application was running at the time of the transgression 318 Present limitations and scoping 319 The presentation of digital evidence 320 Preparing digital forensics reports 320 Court appearances 322 Ethical issues confronting digital forensics practitioners 324 Case study – presumed unauthorized use of intellectual property 325 The background to the case 325 The forensic recovery 326 The forensic examination 326 Linking the suspect to the device and the device to the server 327 Analyzing the downloaded files 328 Connected storage devices 328 The illicit copying of data 329 The outcome 329 Summary 330 [ vii ]
Page 17
Table of Contents Chapter 10: Empowering Practitioners and Other Stakeholders 333 The evolving nature of digital evidence vis-à-vis the role of the practitioner 333 Solutions to the challenges posed by new hardware and software 335 More efficacious evidence recovery and preservation 336 Challenges posed by communication media and the cloud 337 Mobile phone evidence recovery 337 The cloud - convenient for users but problematic for practitioners 338 The need for effective evidence processing and validation 338 Contingency planning 339 References 341 Summary 341 Index 343 [ viii ]
Page 18
Preface This book will provide you with a clear understanding of digital forensics, from its relatively recent emergence as a sub-discipline of forensics to its rapidly growing importance alongside the more established forensic disciplines. It will enable you to gain a clear understanding of the role of digital forensics practitioners and their vital work in cybercrime and corporate environments, where they recover evidence of criminal offences and civil transgressions. Examples of real case studies of digital crime scenes will help you understand the complexity typical of many cases and the challenges digital evidence analysis poses to practitioners. During the past 10 years or so, there has been a growing interest in digital forensics as part of tertiary courses and as a career path in law enforcement and corporate investigations. New technologies and forensic processes have developed to meet the growing number of cases relying on digital evidence. However, it has been apparent that the increasing complexity, size, and number of cases is creating problems for practitioners, who also face resource and costing restrictions and a shortage of well-trained and experienced personnel. The book will describe these challenges and offer some solutions, which hopefully will assist and empower current and prospective practitioners to manage problems more effectively in the future. These are truly exciting and challenging times for practitioners seeking to enhance their skills and experience in recovering evidence and assisting the legal fraternity in making sense of their important findings. For those wishing to enter the discipline, they do so at a time when banality, complacency, and fatigue are disappointingly quite common. The enthusiasm of entering the profession can rapidly dissipate because of tedium and heavy caseloads, notwithstanding the inherently exciting and important nature of the work. Presented in this book are new and more effective ways to reduce tedium and time wastage, reinvigorate practitioners, and restore the excitement of the hunt for evidence heralded by fresh winds of change. [ ix ]
Page 19
Preface What this book covers Chapter 1, The Role of Digital Forensics and Its Environment, describes the digital forensics environment—an emerging discipline within the broader field of forensic science. It outlines the main digital forensics environments of criminal and civil law cases and describes the role of digital forensics practitioners. Chapter 2, Hardware and Software Environments, presents the basic working of computer hardware, operating systems, and application software and describes the nature of recovered digital evidence. A basic introduction to filesystems and files commonly recovered during forensics examination is given as well as an insight into file encryption and password protection. Chapter 3, The Nature and Special Properties of Digital Evidence, describes the special characteristics of digital evidence, including the nature of files, file metadata, and timestamps, which form an essential part in the reconstruction of suspected offences. The complex nature of digital evidence is introduced, and the expectations of the courts as to its admissibility in legal hearings is explained. Chapter 4, Recovering and Preserving Digital Evidence, explains the importance of preserving digital evidence in accordance with legal conventions. It describes forensic recovery processes and tools used to acquire digital evidence without undue contamination under different forensic conditions. Chapter 5, The Need for Enhanced Forensic Tools, emphasizes the redundancy of conventional forensic imaging and the indexing of increasingly larger datasets and introduces new forensic processes and tools to assist in sounder evidence recovery and better use of resources. The chapter introduces the disruptive technology now challenging established digital forensic responses and the overreliance on forensic specialists, who are themselves becoming swamped with heavier caseloads and larger, more disparate datasets. Chapter 6, Selecting and Analyzing Digital Evidence, introduces the structure of digital forensic examinations of digital information through the iterative and interactive stages of selecting and analyzing digital evidence that may be used in legal proceedings. The chapter introduces the stages of digital evidence selection and analysis in line with acceptable forensic standards. Chapter 7, Windows and Other Operating Systems as Sources of Evidence, provides you with an understanding of the complexity and nature of information processed on computers that assist forensic examinations. The chapter looks at the structure of typical Windows, Apple, and other operating systems to facilitate the recreation of key events relating to the presence of recovered digital evidence. It touches on malware attacks and the problems encountered with anti-forensics tactics used by transgressors. [ x ]
Page 20
Preface Chapter 8, Examining Browsers, E-mails, Messaging Systems, and Mobile Phones, looks at Internet browsers, e-mail and messaging systems, mobile phone and other handheld devices, and the processes of locating and recovering digital evidence relating to records of personal communications such as e-mails, browsing records, and mobile phones. The value of extracting and examining communications between persons of interest stored on computer and mobile phones is described. Chapter 9, Validating the Evidence, emphasizes the importance of validating digital evidence to ensure that as thorough as possible an examination of the evidence is undertaken to test its authenticity, relevance, and reliability. Some common pitfalls that diminish the admissibility of digital evidence, as well as the evidentiary weight or value of evidence, are discussed, as is the need for open-minded and unbiased testing and checking of evidence to be a routine matter. The presentation of digital evidence and the role of the forensic expert is outlined in the chapter. Chapter 10, Empowering Practitioners and Other Stakeholders, provides a summary of the book and reflects on the changes presently occurring within the discipline. It offers some new processes and tools that enhance the work of practitioners and reduce the time spent on each case as well as untangling the complexity of analyzing large datasets. What you need for this book No software is required for the book. Who this book is for This book is for anyone who wants to get into the field of digital forensics. Prior knowledge of programming languages may be helpful but is not required and is not a compulsory prerequisite. This is a helpful guide for readers contemplating becoming a digital forensic practitioner and others wishing to understand the nature of recovering and preserving digital information that may be required for legal or disciplinary proceedings. The book will appeal to a range of readers requiring a fundamental understanding of this rapidly evolving discipline, including: • Police, law enforcement, and government investigative bodies • Corporate investigators • Banking, business, and forensic auditors • Security managers and investigators • IT security professionals • Taxation compliance investigators [ xi ]
Showing the first 20 pages. Download the document to see it all.
Comments (0)
No comments yet. Be the first!