Digital Forensics by William C. Barker (NIST)
•Download as PPTX, PDF•
8 likes•16,082 views
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Digital Forensics by William C. Barker (NIST)
Similar to Digital Forensics by William C. Barker (NIST) (20)
More from AltheimPrivacy
More from AltheimPrivacy (11)
Recently uploaded
Recently uploaded (20)
Digital Forensics by William C. Barker (NIST)
- 1. Digital Forensics NIST Information Technology Laboratory William C Barker October 23, 2012 Forensic science is generally defined as the application of science to the law.
- 2. Examples of digital forensic Some examples of data types: evidence: • Standard computer systems • Electronic mail messages • Networking equipment • Video/photo/audio attachments • Computing peripherals • Unstructured data • Mobile devices • Protocol information such as • Consumer electronic devices IP addresses • GPS data • Various types of media • Cell phone data • Metadata • Internet history • Deleted data residues in various types of IT devices. 2
- 3. Some Uses of Digital Forensics Techniques • Investigating crimes and internal policy violations, • Pre-trial e-discovery in civil litigations, • Reconstructing computer security incidents, • Troubleshooting operational problems, and • Recovering from accidental system damage. 3
- 4. Performing Digital Forensics Phases specified in NIST’s Guide To Integrating Forensic Techniques Into Incident Response • Collection: identifying, labeling, recording, and acquiring data from the possible sources of relevant data, while following procedures that preserve the integrity of the data. • Examination: forensically processing collected data using a combination of automated and manual methods, and assessing and extracting data of particular interest, while preserving the integrity of the data. • Analysis: analyzing the results of the examination, using legally justifiable methods and techniques, to derive useful information that addresses the questions that were the impetus for performing the collection and examination. • Reporting: reporting the results of the analysis, which may include describing the actions used, explaining how tools and procedures were selected, determining what other actions need to be performed (e.g., forensic examination of additional data sources, securing identified vulnerabilities, improving existing security controls), and providing recommendations for improvement to policies, procedures, tools, and other aspects of the forensic process. 4
- 5. Policies and Procedures for Digital Forensics • Organizations should ensure that their policies contain clear statements addressing all major forensic considerations, such as contacting law enforcement, performing monitoring, and conducting regular reviews of forensic policies and procedures. • Organizations should create and maintain procedures and guidelines for performing forensic tasks, based on the organization’s policies and all applicable laws and regulations. • Organizations should ensure that their policies and procedures support the reasonable and appropriate use of forensic tools. Policies and procedures should clearly explain what forensic actions should and should not be performed under various circumstances, as well as describing the necessary safeguards for sensitive information that might be recorded by forensic tools, such as passwords, personal data, and the contents of e-mails. • Legal advisors should carefully review all forensic policy and high-level procedures. • Organizations should ensure that their IT professionals are prepared to participate in forensic activities.IT professionals throughout an organization, especially incident handlers and other first responders to incidents, should understand their roles and responsibilities for forensics, receive training and education on forensics-related policies and procedures. 5
- 6. Chain of Evidence Maintaining source and content integrity of forensics information Electronic authentication, access control mechanisms, and audit trails are needed for: • Control of forensic data • To record generation of forensic data • Access to forensic data • Change management for forensic data. Cryptographic technologies such as time stamped digital signature or signed hashes, can be employed to identify the source of forensic data, establish the time(s) at which each access to the data occurred and by whom, and whether or not modifications to the information has occurred (and, if so, at which point in the chain). 6
- 7. Overview of Existing NIST Computer Forensics Work Overall NIST ITL Forensics Program Lead: Martin Herman, martin.herman@nist.gov http://www.nist.gov/itl/ssd/computerforensics.cfm. Current Projects: – Computer Forensics Tool Testing (including mobile device tool testing) – National Software Reference Library, and – Computer Forensic Reference Data Sets. Initiating projects on: – Performing forensics as part of incident response – Cloud forensics (e.g., when a cloud computing environment is used by criminals for their illegal activities such as child pornography, or when there is an attack on a cloud computing). Privacy is a huge 7 issue here because clouds are typically multi-tenants.
- 8. Computer Forensics Tool Testing (CFTT) • Goal: Establish a methodology for testing computer forensic software tools by development of general tool specifications, test procedures, test criteria, test sets, and test hardware. • The Computer Forensics Tool Testing Project Handbook is now available in PDF format for downloading (http://www.cftt.nist.gov/CFTT-Booklet- Revised-02012012.pdf). • A description of NIST mobile device forensics tool testing activity is now available at (http://www.cftt.nist.gov/documents/MobileDeviceForensics- MFW08.pdf). Rick Ayers (richard.ayers@nist.gov) is a good resource for additional information on this topic. 8
- 9. Sample Case: Problems Facing Deleted Files Recovery Tools (http://www.cftt.nist.gov/DFR-req-1.1-pd-01.pdf) • The files that have been deleted have to be identified and located. Although this could be as simple as scanning directory entries for a particular key (e.g. ‘0xE5’ in Fat 32), it may be a more complex process. • From a file system perspective, the data to be recovered is latent, and needs the assistance of a tool to recover the data. As with most other latent data recovery, since the results depend on the output of a particular tool, the tool must be shown to operate correctly (i.e., undelete files correctly). • The potential uncertainty present in any recovery effort leads to a reduced level of confidence in the information recovered. Specifically with deleted file recovery, the data recovered may be commingled with data from other deleted files, allocated files, or even from non- 9 allocated space.
- 10. National Software Reference Library (NSRL) Goal: Promote efficient and effective use of computer technology in the investigation of crimes involving computers. • The Reference Data Set (RDS) is a collection of digital signatures of known, traceable software applications . • The NSRL is designed to collect software from various sources and incorporate file profiles computed from this software into Reference Data Sets of information. • The NSRL RDS is released four times each year - in March, June, September and December. The current release, June 2012 RDS 2.37, contains 26,911,012 unique entries. 10
- 11. Computer Forensic Reference Data Sets(CFReDS) • Computer Forensic Reference Data Sets provide to an investigator documented sets of simulated digital evidence for examination. • Applications for Computer Forensic Reference Data Sets: - Data sets for tool testing need to be completely documented. The user of the data set needs to know exactly what is in the data set and where it is located. These data sets should also provide specification for a set of explicit tests. Examples of focused function areas are string searching, deleted file recovery and email extraction. - Data sets for equipment check out need to focus on issues in acquisition, access and restoration of data. These data sets might need to have a strong procedural component. - Data sets for staff training are primarily investigation scenario based tests intended to give a real flavor to the data set (similar to the data sets for proficiency testing). - Proficiency Testing and Skill Testing data sets are primarily investigation scenario based tests designed to give a real flavor to the data set (for example, a data set that would require the examiner to demonstrate some system skill such as loading a new font onto an analysis computer). 11
- 12. Some Other NIST Computer Forensics Publications Guide to SIMfill Use and Development, NIST IR-7658, February 2010, Wayne Jansen, AurelienDelaitre. Mobile Forensic Reference Materials: A Methodology and Reification, NIST IR-7617, October 2009, Wayne Jansen, AurélienDelaitre. Forensic Protocol Filtering of Phone Managers, International Conference on Security and Management (SAM'08), July 2008. Wayne Jansen, AurelienDelaitre Overcoming Impediments to Cell Phone Forensics, Hawaii International Conference on System Sciences (HICSS), January 2008. Wayne Jansen, AurelienDelaitre, LudovicMoenner. Reference Material for Assessing Forensic SIM Tools, International Carnahan Conference on Security Technology, October 2007. Wayne Jansen, AurelienDelaitre. Guidelines on Cell Phone Forensics, SP 800-101, May 2007, Wayne Jansen, Rick Ayers. Cell Phone Forensic Tools: An Overview and Analysis Update, NISTIR 7387, March 2007. Rick Ayers, Wayne Jansen, LudovicMoenner, AurelienDelaitre. Guide to Integrating Forensic Techniques into Incident Response, SP 800-86, August 2006, Karen Kent, Suzanne Chevalier, Tim Grance, Hung Dang. Forensic Software Tools for Cell Phone Subscriber Identity Modules, Conference on Digital Forensics, Association of Digital Forensics, Security, and Law (ADFSL), April 2006. Wayne Jansen, Rick Ayers. Cell Phone Forensic Tools: An Overview and Analysis, NISTIR 7250, October 2005. Rick Ayers, Wayne Jansen, Nicolas Cilleros, Ronan Daniellou. An Overview and Analysis of PDA Forensic Tools, Digital Investigation, The International Journal of Digital Forensics and Incident Response, Volume 2, Issue 2, April 2005. Wayne Jansen, Rick Ayers. Guidelines on PDA Forensics, SP 800-72, November 2004. Wayne Jansen, Rick Ayers. PDA Forensic Tools: An Overview and Analysis, NISTIR 7100, August 2004. Rick Ayers, Wayne Jansen. 12
Editor's Notes
- Regardless of the data sources, effective use of forensic information requires maintaining the source and content integrity of the information - that is, maintaining the integrity of the chain of evidence. Electronic authentication, access control mechanisms, and audit trails are needed to control and record generation of, access to, and change management for forensic data. Cryptographic technologies such as time stamped digital signature or signed hashes, can be employed to identify the source of forensic data, establish the time(s) at which each access to the data occurred and by whom, and whether or not modifications to the information has occurred (and, if so, at which point in the chain).
- Existing computer forensics work in NIST’s Information Technology Laboratory includes Computer Forensics Tool Testing (including mobile device tool testing), the National Software Reference Library, and Computer Forensic Reference Data Sets. The forensics program manager at the Information Technology Laboratory is also interested in initiating more work in cybersecurity forensics, which involves performing forensics as part of incident response. The Laboratory is also starting a project in cloud forensics, which involves forensics activities when a cloud computing environment is used by criminals for their illegal activities (e.g., child pornography), or when there is an attack on a cloud computing system and we want to use forensics as part of incident response. Certainly privacy is a huge issue here because clouds are typically multi-tenants. The overall NIST Information Technology Laboratory forensics program is coordinated by Dr. Martin Herman.
- There is a critical need in the law enforcement community to ensure the reliability of computer forensic tools. The results provide the information necessary for toolmakers to improve tools, for users to make informed choices about acquiring and using computer forensics tools, and for interested parties to understand the tools capabilities. A capability is required to ensure that forensic software tools consistently produce accurate and objective test results. Our approach for testing computer forensic tools is based on well-recognized international methodologies for conformance testing and quality testing. Frequently during a forensic examination, data is discovered on the target media that is not part of any active or visible file. Although this data can still be examined such as by string searching, if the data associated with a particular file could be identified and recovered in its original form, this could provide additional useful information. An example of this would be where a graphics file, if undeleted and recovered, could be viewed—potentially providing more information than a simple string search.
- Many of the forensic tools used by investigators identify files that have been deleted, and allow the operator to undelete them. This may allow the investigator to examine the file in the original format such as a graphics file viewer, or identify when a particular file was deleted and its original location. To reconstruct deleted files within a forensic setting, three fundamental problems have to be addressed by a deleted file recovery (DFR) tool. A NIST document Active File Identification & Deleted File Recovery Tool Specification, currently out for public comment, defines functional requirements for tools used within forensic investigations to address these issues associated with identifying active files, deleted files and to reconstruct deleted files.
- The National Software Reference Library project is supported by the U.S. National Institute of Justice and by Federal, state, and local law enforcement organizations.The Reference Data Sets can be used by law enforcement, government, and industry organizations to review files on a computer by matching file profiles, or “hashes” in the sets. This will help alleviate much of the effort involved in determining which files are important as evidence on computers or file systems that have been seized as part of criminal investigations. There are application hash values which may be considered malicious in the profiles, such as for steganography tools and hacking scripts, but there are no hash values of illicit data, such as child abuse images.
- NIST is also developing Computer Forensic Reference Data Sets for digital evidence.. Since the sets would have documented contents, such as target search strings seeded in known locations of reference data sets, investigators could compare the results of searches for the target strings with the known placement of the strings.Investigators could use these sets in several ways including validating the software tools used in their investigations, equipment check out, training investigators, and proficiency testing of investigators as part of laboratory accreditation.The site contains test images and resources to aid in creating tailored test images. These aids will be in the form of interesting data files, software tools and procedures for specific tasks.The four most obvious applications for these data sets are testing forensic tools, establishing that lab equipment is functioning properly, testing proficiency in specific skills, and training laboratory staff. Each type of data set has slightly different requirements, and most data sets can be used for more than one function.Prototype data sets are available for public comment. For more information contact Jim Lyle at jlyle@nist.gov.