Week 3 - Creating & Testing a LDF Toolkit Flashcards
Summarise the key things to think about when considering your tools in a live environment
- It is an UNTRUSTED environment.
Cannot trust output of native programs (for example the suspect could have changed the command ip config to be a wiping tool that wipes all data).
Cannot trust libraries on the native system - Use TRUSTED tools
Use own pre-tested tools
Use write protected media
Determine linked libraries - Determine the environment
What operating system is is running
What service pack is installed
32 or 64 bit
How will you save the aquired data
Dependencies - what are they?
Dependencies are external software components or libraries that a program needs in order to function correctly. Dependencies can include a wide range of elements, such as:
Libraries: Prewritten code or modules that provide specific functionality (e.g., mathematical functions, data handling, etc.). Programs often depend on external libraries like Python’s requests library for making HTTP requests.
Frameworks: A collection of libraries and tools that provide a structured way to build applications (e.g., React for JavaScript web development, Django for Python web applications). Operating System Dependencies: Specific features or versions of an operating system that the software needs (e.g., a program requiring Windows 10 or macOS). Other Applications: Some software relies on other programs to be installed. For example, a Java application needs a Java Runtime Environment (JRE) to run. Environment Variables: Programs may need certain environment settings or variables to locate resources or configure the application properly.
Dependencies - All about Static Libraries
- Static Libraries (also called Static Builds)
Where all the necessary dependencies are included directly into the executable file at compile time, as opposed to dynamically linking them at runtime (when you start the program).
The executable is a stand-alone file (doesn’t need any other file or library)
Advantages of Static Libraries/Builds:
-No External Dependencies: Once compiled, the program doesn’t need any external libraries, making it easier to distribute.
-Performance: Since everything is compiled together, static builds can sometimes be faster because there’s no need to load external libraries dynamically.
-Version Consistency: The program always uses the same version of the library that it was compiled with, avoiding version conflicts at runtime.
Disadvantages of Static Libraries/Builds:
-Larger File Size: The final executable is larger because it includes the entire code of the libraries, even if only a small part is used.
-No Updates: If a bug or security flaw is discovered in a statically linked library, you would need to recompile and redistribute the entire application to apply the fix.
-Memory Usage: If multiple programs use the same static library, each one will have its own copy in memory, leading to higher memory consumption compared to dynamic linking
Dependencies - all about Shared Libraries
A shared library (also known as a dynamic library) is a collection of precompiled functions or code that can be used by multiple programs during runtime, without being embedded directly into the executable. Instead of including the library code during compilation (as with static libraries), a program dynamically loads the shared library into the memory at runtime.
Therefore:
- requires the library at run time
- must be able to find the library
- the static path to the library is in the executable
- the name of the library is int he executable. The operating system finds the library and provides it to the program.
How to determine linked libraries - on Windows
Various tools.
Free tool is Dependency Walker. Gives you all linked libraries that the computer is using.
Another tool is Anywhere PE Viewer (jre - uses a java runtime environment) - also runs on Mac & linux
Windows linked libraries are called Dynamic Link Library (.dll extension)
How to determine linked libraries - on Mac OSX
Use Otool. The the -L command you can find all linked libraries.
In Mac OSX the linked libraries are called Dynamic Link Library (same as windows) but have a .dylib file extension
How to determine linked libraries - on Linux
Use Ldd tool (available in most linux distributions)
Linux uses more linked libraries than in Mac OSX
In Linux linked libraries are called Shared Objects and have the .so file extension
What to do when dealing with a tool that calls for a shared library
- Is the tool open source? Maybe you can re-compile the tool with the modules included into a standalone version. But if you do recompile make sure you have a licence to do so.
- Use a different tool that doesn’t use a shared library.
- If you cannot do either of these things then only option is to run it anyway and note the dependencies in your report.
Setting up your tool kit - Scope
To set up your tool kit you have to identify the SCOPE.
Scope is determind by the pre-search plan
For each pre-defined scenario:
- what data is required?
- what data is commonly collected?
- why is the data collected?
- local or remote collection
Order data by how CRITICAL it is to the investigation (because we then need to consider how INTRUSIVE gethering it will be)
Once the data scope is identified, tools can be evaluated.
What are your considerations when looking at evaluating tools to use?
- What tool is best for each particular situation? (may need multiple)
- Reliability of tool
- how comprehensive is the tool?
- how intrusive is the tool? (minimal footprint)
- speed
- cost / availability / support
Media Preparation
2 main types of storage:
- Attached local storage (USB - handy but limited space / speed. Or redundant external storage RAID, lots of space but not as portable. Fast speed and big storage). If using USB then speed is a key factor - ideally USB 3.0. Faster = less change to suspect device.
- Network pipe technique (a method of data transfer over a network, where the term “pipe” is metaphorical, describing how data flows between two points. It allows a continuous stream of data to move between two systems or processes, either locally or across a network). Can even aqcuire machines across the internet. Can get data fast. But needs preparing beforehand, and potentially anyone (incl. suspect) can see where evidence is being copied to.
For writable attached storage there is the potential for viral contamination between machines.
Other preparation - Interfaces. What interfaces are available on the suspect computer?
Hardware interface options (physical ports include):
-USB (a, b c)
-Thunderbolt (A high-speed interface that combines data, video, and power in a single connection. Thunderbolt ports often share the same connector as USB-C)
-HDMI
-Firewire (An older standard used for connecting peripherals like external hard drives and digital cameras, largely replaced by USB and Thunderbolt
-eSATA (An external version of SATA, used for connecting external storage devices with faster speeds than USB 2.0)
-Ethernet (RJ45)
- 3.5mm audio jack
Other Preparation - Interfaces. What should a LDF examiner do / think about in terms of interfaces?
-Be prepared. Take adapters and various cables.
-Be aware of speed limitations. If too slow then you may need to make quick alternative decisions 9incl netw.
-Be aware of data transfer limitations. USB specs do not guarantee successful comprehensive data transfer or control speed. Fireware & SATA have more stable protocols.
- Plugging indevices to the suspect’s interfaces will change their system (registry) and must be included in your report.
Interface Preparation - USB devices
USB.
- use devices with large capacity, ideally 64GB or 128 GB or more where possible.
- For acquisition tasks use high speed devices
- Mainly useful for storage of tools & physical memory
- For use of storing trusted tools look for devices that can be write protected. Can be done with a USB 3.0 device that ahs the option to create one part that is read only for yopur tools, and a data partion for the actual acquired evidence. Means there is less chance your trusted tools will be changed.
Interface Preparation - CD / DVD
CD / DVD
- use validated forensic collections / suites like Helix, Deft or Kali or make your own
- CD / DVD could be used to both boot a suspect system (cold forensics) or for LDF purposes depending on the tools you want to use.
- Expand these tools to your own needs / update or add as needed
- CD / DVD is write protected so the tools can be trusted.
