Chapter 13: Performing Forensic Analysis and Techniques for Incident Response

Question 1

Building a Forensic Toolkit

Answer 1

The following components are common to most forensic toolkits that will allow you to perform forensic investigations:

Digital Forensics Workstation
* Can be desktops, laptops, or even servers
* A good forensic workstation is designed to allow for data capture and analysis, and those tasks can benefit from a powerful, multicore CPU with plenty of RAM
* Having a lot of fast, reliable storage is also important since large investigations deal with TB of data
* Always ensure it’s cut off from the internet

Forensic Investigation Suite or Forensic Software
* FTK Imager (.aff file extension), EnCase (.e01 file extension), the SANS Investigative Forensic Kit (SIFT), or The Sleuth Kit (TSK)
* Provides the ability to capture and analyze forensic images as well as track forensic investigations

Write Blockers
* Ensure that drives connected to a fornesic system or device can’t be written to
* Ensures the integrity of the forensic investigation
* Having file access times changed, or having the system that’s analyzing the data modify the content of the files on the drive, can ruin your forensic evidence

Forensic Drive Duplicators
* Designed to copy drives for forensic investigation and then provide validation that the original drive and the content of the new drive match
* Many forensic tools and suites offer this, but a dedicated cloning device can be useful and make it easier to prove the duplication process was completed in a forensically sound manner

Wiped Drives and Wiped Removable Media
* Needs to be of sufficient capacity to handle any drive or system that you’re likely to encounter
* Large SATA HD, portable NAS devies, and large SSDs make it easier to capture and transport multiple forensic images
* Removable media like USB drives, Blu-ray or DVDs, or flash media can also be valuable for transporting forensic data or sending it to other orgs when necessary

Cables and Drive Adapters
* Have various types to ensure thatr you can connect to most types of devices

Camera
* To document system configurations, drive labels, and other information
* They can speed up data recording and provide a visual record of a system or device

Labeling and Documentation Tools
* Label maker, labels, indelible pens, etc
* Helps with chain of custody and forensic process documentation

Notebooks and Prepared Documentation Forms and Checklists
* To record forensic investigation proceses and notes
* Common forms include chain of custody forms, incident response forms, incident response plans, incidnet forms, escalation lists or call lists of people to call during a response
* Soimetimes replaced by a forensic recording software package or tool that provides ways to validate log entries and track changes

Question 2

Understanding Forensic Software

Answer 2

There are many types of forensic software, randing from purpose-built suits and tools to utilities:
* FTK
* EnCase
* CAINE
* Autopsy
* SIFT
* DumpIt
* Memoryze

There are also many common Linux and Windows utilities that have forensic applications like:
* dd
* WinDdg

Page 450

Question 3

Capabilities and Application

Answer 3

Key forensic tool capabilities to include in a forensic toolkit include:
* Imaging
* Analysis
* Hashing and validation
* Process and memory dump analysis
* Password cracking
* Log viewers

Question 4

Imaging Media and Drives

Answer 4

The first step in many forensic investigations is to create copies of the media or disks that may contain useful data

This is done with an imageing utility, which can create a forensic image of a complete disk, a disk partition, or a logical volume

Forensic images exactly match the original source drive, volume, partition, or device (including slack and unallocated space)

Slack Space
* The space left when a file is written
* This unused space can contain fragments of files previously written to the space or even files that have been intentionally hidden

Unallocated Space
* Space that hasn’t been partitioned

NOTE: Forensic copies and drive wiping programs may not properly handle spare sectors and bad sectors on traditional spinning disks, or reserved space retained to help with wear leveling for SSDs—it’s possible to miss potentially useful forensic data, and it’s something you should be aware of when wiping disks

Question 5

Analysis Utilities

Answer 5

Forensic analysis utilities provide a number of useful capabilities that can help offer insight into what occurred on a system, like:
* Timelines of system changes
* Validation tools that check known, good versions of files against those found on a system
* Filesystem analysis capabilities that can look at filesystem metadata (like the Windows Master File Table for NTFS) to identify file changes, access, and deletions
* File carving tools that allow the recovery of files without the filesystem itself available
* Windows Registry analysis
* Log file parsing and review

Question 6

Carving

Answer 6

File carving is the process of extracting data from a computer when that data has no associated file system metadata—it attemps to piece together data fragments from unallocated and slack space to reconstruct deleted files or at least parts of those files

When data is recovered as part of forensic analysis, the original filesystem may no longer be intact

In this scenario, or in any where the original filesystem can’t be used, file carving tools are necessary

They look at data on a block-by-block basis, looking for information like file headers and other indicators of file structure

When they find them, they attempt to recover complete or partial files

Three common types of file carving methods:
* Header and footer based carving, which foucses on headers like those found in JPEGs—JPEGs can be found by looking for \ xFF \ xD8 in the header and \ xFF \ xD9 in the footer
* Content based carving techniques look for information about the content of a file such as character counts and text recognition
* File structure based carving techniques that use information about the structure of files

Page 453 image example (JPEG carving with HxD)

Question 7

Chain of Custody Tracking

Answer 7

Support for properly maintaining chain of custody documentation in an automated and logged manner is part of a forensic suite, and it’s a crucial part of their documented forensic procedures for many orgs

Maintaining chain of custody documentation ensures that drive images and other data, as well as actions taken using the suite, are properly validated and available for review—reduces the potential for legal challenges based on poor custodial practices

Question 8

Hashing and Validation

Answer 8

Hashing utilities built into a forensic suite or run independently will produce a hash that can validate the contents of a copy

The goal of this is to ensure that the copy exactly matches the source drive or device—forensic image formats like EnCase’s .e01 format provide built in hashing as part of the tile

In cases where formats like these aren’t used, both MD5, SHA1, and SHA2 hashes are frequently used for this purpose

Hashing large drives can take a lot of time, even with faster algorithms like MD5, but it’s a relatively simple process
* EX: md5sum /dev/sda1—this provids an MD5 hash of a volume mounted on a Linux system

Hashing is also used to validate binaries and other app related files to detect changes to the binaries

Manual checksums using MD5 or SHA1 utilities can be used to check if a file matches a knonw good version or one from a backup, or it can be chekced against a provided checksum from a vendor or other source

Question 9

Endpoint Forensics

Answer 9

The majority of forensics take place on physical endpoints like desktops, laptops, servers, and mobile devices

But as orgs move to the cloud, forensic activity is happening there as well

Page 455

Question 10

OS, Process, and Memory Dump Analysis

Answer 10

Information about the stae of the OS, including data that’s stored in memory by processes, can be important to both forensic investigations and investigations of malware or compromise

Data that is otherwise kept encrypted is often accessible in memory to processes, or the encryption keys used to access data are available

OS analysis can provide key data about what was occuring on a system during the timeframe targeted by an investigation

Memory dump analysis can be particularly valuable when recovering decryption keys for FDE products like BitLocker

Hibernation files and crash dumps can both contain the data needed to decrypt the drive, which makes accessing an unlocked machine critically important for a forensic practitioner

Question 11

Disk Forensics

Answer 11

The most common forensic activity for endpoints is disk, or storage based analysis

This can range from manual inspection of files to complete imaging and analysis of entire disks or volumes—current, deleted, or hidden files

There are three options for disk forensics:

Live acquisition
* Capturing the contents of the disk drive while the computer is still running
* You sometimes have to do this, like if the disk is normally encrypted—it will be unencrypted during use
* While you’re capturing data, the contents could be changed

Static Acquisition by Shutting Down
* The computer is properly shut down through the OS and then the disk is acquired
* Some malware can detect the shutdown and perform antiforensics

Static Acquisition by Pulling the Plug
* The system’s power is disconnected by removing the power plug from the wall socket
* Nobody can change files if you unplug immediately, and malware can’t perform antiforensics
* Risk that you can corrupt the drive

Question 12

Memory Forensics

Answer 12

Requires either running live forensic analysis on a running machine or making a copy of live memory to point in time forensic memory analysis

Tools like Volatilty, an open source memory forensics framework, can capture and analyze memory

Volatility Framework
Open source memory forensics tool that has a wide range of plug in commands like:
* The ability to detect API hooks
* Read the keyboard buffer
* Grab Windows clipboard
* Look for live TCP connections
* Scan for driver objects
* Command prompt history
* Web browser history
* And more
* EX Use from Dion: Look at the processes, the files, and then netscan

NOTE: If there’s data accessible in live memory in an unencrypted form, assume it can be recovered—if it’s encrypted, the encrypted version can be accessed and potentially decrypted if key is available

Memory forensics are particularly useful when attempting to recover security artifcats stored in memory when in use, like encryption keys or passwords

Remember that system crash dumps often contain a copy of live memory, making it an attractive target for both practitioners and attackers

Question 13

Mobile Devices and Cell Phone Forensics

Answer 13

Due to security features of mobile device OS, commercial forensic suites often have specialized decryption or brute forcing capabilities that allow them to capture data from a locked and encrypted phone or phone volume

Phone backup forensic capabilities are also useful—backups might not have all current data, but they can contain older data that was deleted and may not have the same level of security the phone itself does

Question 14

Password Crackers and Password Recovery

Answer 14

Given the increase in drives and devices that are encrypted or password protected, password crackers are very useful for forensic examiners

Common places to discover password protection beyond the OS and account level:
* MS Office files
* PDFs
* ZIP folders
* RAR compressed files

Tools like Elcomsoft’s Advanced Office Password Recovery help accomplish this challenging task with brute force breaking for a range of filetyeps

Question 15

Cryptography Tools

Answer 15

Common tools to protect forensic data as well as to protect data and apps from forensics

Forensic tools often have encryption capabilities to ensure that sensitive data under forensic investigation isn’t breached when drives or files are transferred, or if the forensic environment is compromised

Encryption tools are also needed to handle encrypted drives and network protocols, like handling BitLocker, Microsoft Office, and other common encryption mechanisms

Malware Investigations
* Encryption is often used to prevent code analysis of malware
* Many malware packages use tools called packers, that protect them from reverse engineering
* These packers make direct analysis of the code difficult or sometimes impossible
* Some forensic tools provide support for unpacking and decoding from packing techniques

Question 16

Log Viewers

Answer 16

Forensic suites typically build in log viewers that can match log entries to other forensic information, but specialized logs may require additional tools

Question 17

Performing Cloud Service Forensics

Answer 17

This is challenging and sometimes impossible—shared tenant models mean that forensic data can be hard to get and often require the CSP to participate in the investigation

If a cloud service is part of your investigation, do the following:
* Determine what your contract says about investigations
* Determine what legal recourse you have with the vendor
* Identify the data that you need and whether it’s available via methods you or your org controls
* Work with the vendor to identify a course of action if you don’t control the data

Three Main Points About Difficulty of Cloud Forensics
1. Forensics in a public cloud is complicated by the access permitted by the cloud provider’s SLA
2. Instances are created and quickly destroyed due to elasticity, making forensic recovery difficult
3. Issues with chain of custody since investigators must rely on CSPs to provide the data

Question 18

Performing Virtualization and Container Forensics

Answer 18

Virtualization Forensics
* Somewhat less complex than forensics on a hosted environment
* Virtualized systems can be copied and moved to a secure environment for analysis
* Always keep in mind your forensic goals and incident response vs legal case—the way you handle everything is different
* Process and memory analysis can be performed by VM introspection or analyzing save state files
* VM Introspection (VMI): Using tools installed in the hypervisor to retrieve pages of memory for analysis
* Saved State Files: Files that are written during VM suspension
* Persistent Data Acquisition: Acquiring data from persistent devices, such as virtual HDs and other virtualized mass storage devices to an image-based format
* File Carving: Carve a VM’s virtualized HD to identify files in the slack and unallocated space—challenging to do because of VM save formats
* Lost System Logs: When a VM is destroyed after no longer needed, logs are too—configure VMs to log events to a remote logging server

Container Forensics
* Creates some unique issues
* Containers are designed to be disposable, so if something goes wrong many orgs will have automated or semiautomated processes in place to shut down, destroy, and rebuild the container
* Forensic artifacts can be lost because of this
* Internal lots and filesystem artifacts are ephemeral
* Containers communicate over SDN that change frequently as containers are brought online, taken offline, and moved
* Security contexts are dynamically modified by the containerization orchestration tool
* If you have to respond to container issues, make sure you preplan to capture the data you need

Question 19

Forensic Procedures

Answer 19

Forensic analysis, also called forensic investigation, can take many forms and there are many formal models, but the basic process remains the same:

1) Determine What You’re Trying to Find Out
* This forms the problem statement that helps define what forensic activities you’ll take

2) Outline the Locations and Types of Data
* All the information that will help you answer questions from step 1
* Know where and how you need to collect data
* You may not know the specific hardware or log locations, but you should be able to come up with the types of data and systems you need to capture data from

3) Document
* Document and review your plan

4) Acquire and Preserve Evidence
* Acquisition process may require cloning media, seizing systems or devices, or making live memory images
* Ensure that no information is lost when a system is powered off

5) Perform Initial Analysis
* Carefull track your actions, the systems and data you work with, your findings, and any questions you need to answer

6) Use the Initial Analysis to Guide Further Work
* Review where the initial analysis pointed to additional data or where information is missing that’s needed to answer your original questions

7) Report
* Report on the findings of the investigation

Question 20

Order of Volatility

Answer 20

1. CPU cache and registers
2. Routing table, ARP cache, process table, kernel stats
3. System memory and RAM
4. Temporary files and swap space
5. Data on the hard disk
6. Remote logs
7. Backups

NOTE:
* While most of the Windows Registry is stored on the HD, some keys (like HKLM\Hardware) are only stored in the memory
* You should analyze the Registry via a memory dump
* After you do the memory dump, go back and do it off the HD afterwards
* EX: The \Hardware has every disk connected to or taken out of that computer

Question 21

Forensic Copies

Answer 21

You can’t simply copy and paste, that doesn’t work

Forensic copies retain the exact same layout and content for the entire device or drive, including the contents of empty space, unallocated space, and the slack space that remains when a file doesn’t fill all the space in a cluster

You need to use an imaging tool to create forensic images, like FTK Imager—bit-by-bit copies

Question 22

Imaging with dd

Answer 22

The Linux dd utility is often used to clone drives in RAW bit-by-bit format

dd provides a number of useful flags to ensure imaging is done quickly and correctly:
* bs: Sets the block size, defined in bytes—by default uses a 512-byte block size, but this is far smaller than the block size of most modern disks—bs=64k
* if: Sets the input file—if=/dev/disk/sda1
* of: Sets the output file—of=/mnt/usb/

NOTE:
* It’s critical that you verify the input and output locations set with the dd command
* List drives in Linux with fdisk -l or lsblk
* lsblk –output NAME, FSTYPE, LABEL, UUID, MODE will show the device name, filesystem name, label, UUID, and mode it’s mounted in
* Always review the command closely before pressing enter
* This is where write blockers can save your life

Question 23

Write Blockers

Answer 23

Hardware Write Blockers
* Prevent writes from occurring while a drive is connected through them
* The hardware write blocker can be certified to a NIST standard, and testing information is available with the NIST Computer Forensics Tool Testing program

Software Write Blockers
* Less popular than hardware
* Due to the possibility of problems, hardware are more frequently used when preventing writes

Question 24

Imaging Live Systems

Answer 24

When systems are using FDE, or when apps, malware, or software is memory-resident without a copy on the disk, you need to collect the image while the system is running

Be aware that live imaging may not obtain some desirable data:
* Can leave remnants due to the imaging utility being mounted from a removable drive or installed
* The contents of a drive or memory may change during the imaging process
* Malware or other software may be able to detect the imaging tool and take action to avoid or disable it
* Live images typically don’t include unallocated space

Question 25

Reimaging

Answer 25

Reinstalling a system or device

In IR scenarios, drives are often wiped rather than simply being reformatted before reimaging to ensure that no remnant data or malicious files remain

Reimaging will eliminate forensic artifacts and make it difficult or impossible to recover forensic information on the system or device

Forensic copies must be acquired before reimaging happens

Question 26

Acquiring and Reviewing Log Data

Answer 26

Often stored remotely and may not be accurate in the case of a compromised machine, or if an admin was taking ations they wanted to conceal

To preserve and analyze logs:
* Determine where the log resides and what format they’re stored in
* Determine the time period that you need to preserve—remember: you may want to obtain logs from a longer period in case you find an issue or compromise started before you initially suspected
* Work with system or device admins to obtain a copy of the logs and document how they were obtained—checksums or other validation are often appropriate
* Identify items of interest identified in your scope, including actions, user IDs, event IDs, timeframes, etc
* Use log analysis tools like Splunk, Sawmill, Event Log Analyzer, or even a text editor to search and review the logs

Question 27

Viewing USB Device History

Answer 27

Windows tracks the history of USB devices connected to a system, providing a useful forensic record of thumb drives and other devices

4Discovery’s USB Historian can be used to review this based on a mounted drive image

During an investigation, it can provide key data like:
* Match an inventory of drives to those used on a computer
* Verify whether specific drives were in use at a given time
* System name
* Device name
* Serial number
* Time it was in use
* Vendor ID of the device
* What type of device it is
* And so much more

Page 471 image example

Question 28

Capturing Memory-Resident Data

Answer 28

Shutting down a system results in the loss of data stored in memory—browser cache, program states, etc

There are a number of tools that can help you capture memory in the moments when you absolutely need to:

fmem and LiME
* Linux kernel modules that allow access to physical memory
* fmem is designed to be used with dd or similar tools
* LiME directly copies data to a designated path and file

DumpIt
* Windows memory capture tool that copies a system’s physical memory to the folder where the DumpIt program is
* Allows easy capture to a USB drive and makes it a useful part of a forensic capture kit

The Volatility Framework
* Supports a broad range of OS including Windows, MacOS, and Linux
* Has a range of capabilities like tools to extract encryption keys and passphrases, user activity analysis, rootkit analysis

EnCase and FTK
* Built in memory capture and analysis capabilities

Memoryze and F-Response TACTICAL
* Both are tools that can capature memory contents live, but they must be included as part of your workstation builds so they’re ready before you need them

Question 29

Crash Dumps, Hibernation Files, Pagefile / Swapfile

Answer 29

Crash Dumps
In addition to memory images, core dumps and crash dump files can provide useful forensic information for criminal and malware investigations

Since they contain the contents of live memory, they can include data that might not otherwise be accessible on the drive of a system like:
* Memory-resident encryption keys
* Malware running in memory only (fileless)
* Other items not typically stored to the disk

The Windows crash dump file can be found by checking:
* Control panel
* System and security
* System
* Advanced security settings
* Startup and recovery
* Settings

Typically, crash dump files will be located in the system root directory:
* %SystemRoot%\MEMORY.DMP

Windows memory dupm files can be analyzed with WinDbg

Hibernation File
* A file that’s written to the disk when the workstation is put into a sleep state
* Some malware can detect a sleep state and will perform antiforensics to hide themselves

Pagefile (Swapfile)
* File that stores pages of memory in use that exceed the capacity of the host’s physical RAM modules
* EX: You only have 4GB RAM, so what happens is that the computer will go into pagefile which is written on the HD to put things that exceed your RAM
* This data is written to the HD though, which stays there once the computer it’s turned off
* Only 1 page of memory at a time, not the whole thing, so use strings to look for things

Question 30

Acquisitions from Mobile Devices

Answer 30

Mobile device forensic acquisition starts with:
* Disabling the device’s network connectivity
* Ensuring that access to the device is possible by disabling passcodes and screen lock functionality

Once that’s done:
* Physical acquisition of the SIM card
* Media cards
* Device backups

Then, the device is imaged

There are four primary modes of data acquisition from mobile devices:
* Phsyical / Call Data: By acquisition of the SIM card, memory cards, or backups
* Logical: Usually requires a forensic tool to create an image of the logical storage volumes
* Manual Access: Involves reviewing the contents of the live, unlocked phone and taking pictures and notes about what’s found
* Filesystem: Provides details of deleted files as well as existing files and directories

Tools
* Cellebrite
* Mobile Phone Examiner Plus (MPE+)
* EnCase Portable

Carrier Provider Logs
* Any records of device activity that can be acquired from the mobile device’s service provider with a warrant
* PII ha a short retention period due to privacy laws
* You can get call details, voicemail details, SMS details, images sent over MMS, IP destination, session information, geolocation data

Question 31

Forensic Investigation: An Example

Answer 31

See the basics of a forensic analysis using FTK

Starting from a previously acquired forensic image, this example includes the following:
* Import the data into FTK, including indexing and case management
* Evidence of the data leakage
* Email communication with third parties about the files
* Web browser information pointing to antiforensic activities
* Evidence of application installs
* Evidence of filesystem changes, including renaming files

NOTE: Remember that a full forensic examination of a system will involve more than this example shows—the scope and direction of the investigation will help determine what those tasks are

Page 472 example begin—read it all and know it

Question 32

Reporting

Answer 32

The final stage in forensic investigatio is preparing and presenting a report that includes three major components:
1. Goals and scope of the investigation
2. Target or targets of the forensic activities, including all systems, devices, and media
3. Complete listing of the findings and results

Question 33

Goals of the Investigation

Answer 33

Include the goals of your investigation, including the initial scope statement for the forensic activities

This section will also include information about the person or org that asked for the investigation

EX:
* John Smith, the Director of HR, requested that we review Alice Potter’s workstation, email, and the systems she administers to ensure that the data that was recently leaked to a competitor wasn’t sent from her email account or workstation

Question 34

Targets

Answer 34

The report should include a list of all the devices, systems, and media that was captured and analyzed

Targets should all be listed in your tracking notes and chain of custody forms

EX:
* Alice Potter’s workstation, internal inventory number 6108, Lenovo W540 laptop, with Samsung SSD serial number S12KMFBD644850, item number 344

Question 35

Findings and Analysis

Answer 35

Findings are the most critical part of the document and should list what was discovered, how it was discovered, and why it’s important

Question 36

RCA

Answer 36

Root cause analysis is used to identify why a problem, incident, or issue occurred

The typical steps in a RCA include:
* Defining the event or incident that’s going to be analyzed
* Identifying the causes or contributing factors to the event, including building a timeline or process flow
* Finding the underlying or root cause, often by mapping each identified cause or effect and asking what led to it
* Identifying solutions to the root cause
* Implementing controls, fixes, or other changes to address the root cause
* Validating the fixes have been effective
* Reporting