Graduation exams at VSITE

Last week I've been on a few final graduation exams. One of the candidates Antonio Zekić did perfectly. His thesis "Forenzička analiza malicioznih programa" was under done my mentorship, I had hardy anything to do, just to enjoy reading

Here is summary  and keywords of the thesis:

"This thesis briefly describes the process of identifying, documenting and collecting data which is subject to forensic analysis. Techniques described include the process of proactive data collection, forensic hard drive duplication and collection of other key evidence.

The thesis also presents methods used in forensic analysis of collected data and key evidence which includes analysis of the file system, memory image, Registry database, Prefetch files, scheduled tasks and Event log entries. Most commonly used malware persistence mechanisms are described along with dynamic and static analysis of malicious software.

The thesis concludes with the practical work based on an the actual case in a which pre-prepared computer is infected with malicious software. The process of forensic analysis presented in the practical work includes analysis of memory image using the Volatility tool and its modules as well as file system analysis which is carried out using the Autopsy tool. The thesis also describes the techniques of dynamic and static analysis of malicious programs conducted in order to collect the information about the malicious program itself, its functions and purpose."

Keywords: Forensic analysis, malware, memory analysis, hard disk analysis, static analysis, dynamic analysis, Volatility, Autopsy

It was done from the real life everyday work practice, we are thinking of extending our lab exercises based on this paper because our current materials are bit old, The problem we have with RFOR curriculum at Vsite is cronical lack of trained  people so materials and equipment stays unchanged for a long time.

Urgent Issue with Encase v8 and Windows 10

It was just announced with v8.02.01, there is  a big problem with foreign languages (no plain English), indexing is not working correctly.

In the "EnCase Forensic Version 8.02.01 Release Notes October 25, 2016 Found in Version 8.02.01";
Quote: "FOR-5348: Foreign languages are not properly indexed when running EnCase Forensic on a Microsoft Windows 10 operating system."

To make things worse Microsoft stops selling windows 7 and 8, so all new sells installations are now in Limbo.

Work around is not using windows 10, or using virtualization  on windows 10 if it is not possible to install windows 7 on your machine.  Actually for any stronger machine more than 8 cores and more than 64 GB of RAM the good idea is virtualization, since most of forensic software can not utilize full resources.


6.11.2016

There wa also additional problem which is looks like solved now,  Initial distribution of v8.02.01 was done without correct certificate for dongles, result was EnCase starting in acquisition mode, accessing and reading licence dongle correctly but being unable to register with it. Debug output from codemeter shows that straight. It was about two days to get correct certificates distributed. In mean time v7.14.01 get out too I have not even touch it yet.

I have a horrible wooden feeling of deja-vu on early days of v7 ..

The good news is that keyword / raw search in now how it was to be in v6, with even conditions and filters able to work on search results. Still there is no method of accessing code of default conditions, Copy feature is not yet implemented, you have to do like this How to edit or reuse system provided condition code in EnCase v8

19.12.2016

Since all this start we have v8.03 roll out, with  programmable pathways, and still issues with indexing and keyword searches. I've noticed that keyword search can't be updated till at least one keyword search was successful, or at least it behaves in that way in my environment. I have not yet check indexing but there is a lot of yammer on forum about indexing troubles.
Programmable pathways looks a bit unfinished and rough, it all boils down to to create simple investigation workflow or a high level program ... I'm tired of pointing finger on such issue and concept well known from other area of computing science :) :)
Instead of using wizard to copy from one pane to another why not to write

open investigation "myinvestigation" by template "basic"
add evidece file x.ex01
do processing
do indexing
do find partiotins and mount findings
tag search by keyowrdlist "listone"
bookmark findings
end

20.12.2016

I forget to mention issues with new licence manager schema :) there are so many issues now that it is easy to forget about some of them. GuidanceSoftware did some licence technology change in version 8, probably with some good reason, but that caused a lot of problems (I've posted few lines about it and v8.02.01 and first roll out) . At the moment SAFE and NAS are separated into two distinctive services SAFE and LM (licence manager) we have a lot of problems in one university classroom with this "migration" process. There is hugely ovecomplicated procedure how to do migration from v7 safe/nas to v8 safe/lm  but it does not correctly  cover educational licences.. Here is the link to official procedure.

At the end after detailed testing and checkup it was working, but we get into one of the features :) The final LM issues was Tools->options ->Licence manger entry about IP address. It was a chain of events. Form documentation it is not clear that you have to put there not only IP address of LM but a TCP port too. Also looks like there is no validation on input values for that field.  So we have first failure of putting only IP, support suggested to add port to, and here the second error fired, during copy paste somehow one blank before IP was copied into filed and that was enough to break it. so instead of "IP:PORT" it was " IP:PORT" invisible error and a lot of figuring out what is wrong...

This is how it should be, without any leading invisible chars ..

22.3.2017
Again almost a nightmare with classroom at one of our educational clients, with edu licencees now on the  LM. It was renewed and forms for safe/lm arrived, actually a links to upload page. We followed procedure and get new safe/lm certificates.  Everything works and looks magnificent but only one thing was bothering me, a expiration time visible trough help->about was same as before renewal, a possible quirk ..   In fact it was not quirk, renewal failed, since Guid was unable to send to us a real dongle extension certificate. A lot of chatting with tech support to find out what was wrong, we got apologize but also a living fear about upgrades and new versions...

29.3,2017
Correct dongle certificate arrived,with apologize, but now safe/lm is not working almost unbelievable situation. Looks like whole Guid certificate generation system was broken when we send request to  Guidance.  So back to support portal to get all this was Guidance messed up.

6.4.2017
Mess is finally over, with latest dongle extension certificate, for forensic v8,  LM and SAFE can not be on the same machine, even if in SAFE a.03 installer there is an recommended configuration to use both SAFE and LM, but this is for Enterprise version. So we got instruction what to do, uninstall safe, enable LM and it is working.

11.4.2018
A year later, with licence upgrade same torture again ..opentextguidance send wrong certificate ..