Slide khóa học pháp lý chương 6 current computer forensics tools

.c om du o ng th an co ng Guide to Computer Forensics and Investigations Fourth Edition cu u Chapter Current Computer Forensics Tools Last modified 10-4-10 11:40 am CuuDuongThanCong.com https://fb.com/tailieudientucntt .c om Objectives cu u du o ng th an co ng • Explain how to evaluate needs for computer forensics tools • Describe available computer forensics software tools • List some considerations for computer forensics hardware tools • Describe methods for validating and testing computer forensics tools CuuDuongThanCong.com https://fb.com/tailieudientucntt .c om ng co cu u du o ng th an Evaluating Computer Forensics Tool Needs CuuDuongThanCong.com https://fb.com/tailieudientucntt .c om Evaluating Computer Forensics Tool Needs ng th an co OS File system(s) Script capabilities Automated features Vendor’s reputation for support du o – – – – – ng • Look for versatility, flexibility, and robustness cu u • Keep in mind what application files you will be analyzing CuuDuongThanCong.com https://fb.com/tailieudientucntt .c om Types of Computer Forensics Tools ng • Hardware forensic tools th an co – Range from single-purpose components to complete computer systems and servers du o – Types ng • Software forensic tools Logicube Talon (link Ch 7a) cu u • Command-line applications • GUI applications – Commonly used to copy data from a suspect’s disk drive to an image file CuuDuongThanCong.com https://fb.com/tailieudientucntt .c om Tasks Performed by Computer Forensics Tools u du o ng th an co Acquisition Validation and discrimination Extraction Reconstruction Reporting cu – – – – – ng • Five major categories: CuuDuongThanCong.com https://fb.com/tailieudientucntt .c om Acquisition u du o ng th an Physical data copy Logical data copy Data acquisition format Command-line acquisition GUI acquisition Remote acquisition Verification cu – – – – – – – co ng • Making a copy of the original drive • Acquisition subfunctions: CuuDuongThanCong.com https://fb.com/tailieudientucntt .c om Acquisition (continued) co ng • Two types of data-copying methods are used in software acquisitions: th an – Physical copying of the entire drive – Logical copying of a disk partition du o ng • The formats for disk acquisitions vary cu u – From raw data to vendor-specific proprietary compressed data • You can view the contents of a raw image file with any hexadecimal editor CuuDuongThanCong.com https://fb.com/tailieudientucntt .c om ng co an th ng du o u cu CuuDuongThanCong.com https://fb.com/tailieudientucntt .c om Acquisition (continued) th an co ng • Creating smaller segmented files is a typical feature in vendor acquisition tools • All computer forensics acquisition tools have a method for verification of the data-copying process cu u du o ng – That compares the original drive with the image CuuDuongThanCong.com https://fb.com/tailieudientucntt .c om Forensic Workstations (continued) ng • Police agency labs an co – Need many options – Use several PC configurations th • Private corporation labs ng – Handle only system types used in the organization cu u du o • Keep a hardware library in addition to your software library CuuDuongThanCong.com https://fb.com/tailieudientucntt ng co • Not as difficult as it sounds • Advantages c om Building your Own Forensic Workstation du o • Disadvantages ng th an – Customized to your needs – Save money cu u – Hard to find support for problems – Can become expensive if careless • Also need to identify what you intend to analyze CuuDuongThanCong.com https://fb.com/tailieudientucntt .c om Purchasing a Forensic Workstation co ng • You can buy one from a vendor as an alternative • Examples ng th an – F.R.E.D – F.I.R.E IDE cu u du o • Having vendor support can save you time and frustration when you have problems • Can mix and match components to get the capabilities you need for your forensic workstation CuuDuongThanCong.com https://fb.com/tailieudientucntt .c om Using a Write-Blocker ng • Write-blocker co – Prevents data writes to a hard disk an • Software-enabled blockers ng th – Software write-blockers are OS dependant – Example: PDBlock from Digital Intelligence du o • DOS only, not Windows (link Ch 6f) u • Hardware options cu – Ideal for GUI forensic tools – Act as a bridge between the suspect drive and the forensic workstation CuuDuongThanCong.com https://fb.com/tailieudientucntt .c om Using a Write-Blocker (continued) an co ng • Can navigate to the blocked drive with any application • Discards the written data th – For the OS the data copy is successful du o ng • Connecting technologies cu u – FireWire – USB 2.0 – SCSI controllers CuuDuongThanCong.com https://fb.com/tailieudientucntt .c om Recommendations for a Forensic Workstation co ng • Determine where data acquisitions will take place • Data acquisition techniques ng th an – USB 2.0 – FireWire cu u du o • Expansion devices requirements • Power supply with battery backup • Extra power and data cables CuuDuongThanCong.com https://fb.com/tailieudientucntt .c om Recommendations for a Forensic Workstation (continued) an co ng • External FireWire and USB 2.0 ports • Assortment of drive adapter bridges • Ergonomic considerations du o ng th – Keyboard and mouse – A good video card with at least a 17-inch monitor cu u • High-end video card and monitor • If you have a limited budget, one option for outfitting your lab is to use high-end game PCs CuuDuongThanCong.com https://fb.com/tailieudientucntt .c om ng co cu u du o ng th an Validating and Testing Forensic Software CuuDuongThanCong.com https://fb.com/tailieudientucntt .c om Validating and Testing Forensic Software cu u du o ng th an co ng • Make sure the evidence you recover and analyze can be admitted in court • Test and validate your software to prevent damaging the evidence CuuDuongThanCong.com https://fb.com/tailieudientucntt .c om Using National Institute of Standards and Technology (NIST) Tools co ng • Computer Forensics Tool Testing (CFTT) program an – Manages research on computer forensics tools ng th • NIST has created criteria for testing computer forensics tools based on: cu u du o – Standard testing methods – ISO 17025 criteria for testing items that have no current standards – ISO 5725 CuuDuongThanCong.com https://fb.com/tailieudientucntt .c om Using National Institute of Standards and Technology (NIST) Tools (continued) u du o ng th an co Establish categories for computer forensics tools Identify computer forensics category requirements Develop test assertions Identify test cases Establish a test method Report test results cu – – – – – – ng • Your lab must meet the following criteria • Also evaluates drive-imaging tools – See link Ch 7g CuuDuongThanCong.com https://fb.com/tailieudientucntt .c om Using National Institute of Standards and Technology (NIST) Tools (continued) co ng • National Software Reference Library (NSRL) project th an – Collects all known hash values for commercial software applications and OS files du o ng • Uses SHA-1 to generate a known set of digital signatures called the Reference Data Set (RDS) cu u – Helps filtering known information – Can use RDS to locate and identify known bad files CuuDuongThanCong.com https://fb.com/tailieudientucntt ng co • Always verify your results • Use at least two tools c om Using Validation Protocols th an – Retrieving and examination – Verification u du o ng • Understand how tools work • One way to compare results and verify a new tool is by using a disk editor cu – Such as Hex Workshop or WinHex – But it won't work with encrypted or compressed files CuuDuongThanCong.com https://fb.com/tailieudientucntt .c om Using Validation Protocols (continued) ng • Disk editors th an co – Do not have a flashy interface – Reliable tools – Can access raw data ng • Computer Forensics Examination Protocol du o – Perform the investigation with a GUI tool u • Usually FTK or EnCase cu – Verify your results with a disk editor – If a file is recovered, compare hash values obtained with both tools CuuDuongThanCong.com https://fb.com/tailieudientucntt .c om Using Validation Protocols (continued) ng • Computer Forensics Tool Upgrade Protocol co – Test th an • New releases • OS patches and upgrades du o ng – If you find a problem, report it to forensics tool vendor u • Do not use the forensics tool until the problem has been fixed cu – Use a test hard disk for validation purposes – Check the Web for new editions, updates, patches, and validation tests for your tools CuuDuongThanCong.com https://fb.com/tailieudientucntt ... how to evaluate needs for computer forensics tools • Describe available computer forensics software tools • List some considerations for computer forensics hardware tools • Describe methods for... Types of Computer Forensics Tools ng • Hardware forensic tools th an co – Range from single-purpose components to complete computer systems and servers du o – Types ng • Software forensic tools. .. an Computer Forensics Hardware Tools CuuDuongThanCong.com https://fb.com/tailieudientucntt co ng • Technology changes rapidly • Hardware eventually fails c om Computer Forensics Hardware Tools