EnCase training changes

Looks like GuidanceSoftware or now GUID decided to close down its network of international training partners (ATP). There were also some internal reduction since Chicago training center was closed in 2016. Now 90 day closing period is on , by end of April 2017 it all should be closed.
I suppose that will be harsh option for police forces of smaller  no-english speaking countries, Training will probably has  translators service involved ...

Graduation exams at VSITE

Last week I've been on a few final graduation exams. One of the candidates Antonio Zekić did perfectly. His thesis "Forenzička analiza malicioznih programa" was under done my mentorship, I had hardy anything to do, just to enjoy reading

Here is summary  and keywords of the thesis:

"This thesis briefly describes the process of identifying, documenting and collecting data which is subject to forensic analysis. Techniques described include the process of proactive data collection, forensic hard drive duplication and collection of other key evidence.

The thesis also presents methods used in forensic analysis of collected data and key evidence which includes analysis of the file system, memory image, Registry database, Prefetch files, scheduled tasks and Event log entries. Most commonly used malware persistence mechanisms are described along with dynamic and static analysis of malicious software.

The thesis concludes with the practical work based on an the actual case in a which pre-prepared computer is infected with malicious software. The process of forensic analysis presented in the practical work includes analysis of memory image using the Volatility tool and its modules as well as file system analysis which is carried out using the Autopsy tool. The thesis also describes the techniques of dynamic and static analysis of malicious programs conducted in order to collect the information about the malicious program itself, its functions and purpose."

Keywords: Forensic analysis, malware, memory analysis, hard disk analysis, static analysis, dynamic analysis, Volatility, Autopsy

It was done from the real life everyday work practice, we are thinking of extending our lab exercises based on this paper because our current materials are bit old, The problem we have with RFOR curriculum at Vsite is cronical lack of trained  people so materials and equipment stays unchanged for a long time.

Urgent Issue with Encase v8 and Windows 10

It was just announced with v8.02.01, there is  a big problem with foreign languages (no plain English), indexing is not working correctly.

In the "EnCase Forensic Version 8.02.01 Release Notes October 25, 2016 Found in Version 8.02.01";
Quote: "FOR-5348: Foreign languages are not properly indexed when running EnCase Forensic on a Microsoft Windows 10 operating system."

To make things worse Microsoft stops selling windows 7 and 8, so all new sells installations are now in Limbo.

Work around is not using windows 10, or using virtualization  on windows 10 if it is not possible to install windows 7 on your machine.  Actually for any stronger machine more than 8 cores and more than 64 GB of RAM the good idea is virtualization, since most of forensic software can not utilize full resources.


6.11.2016

There wa also additional problem which is looks like solved now,  Initial distribution of v8.02.01 was done without correct certificate for dongles, result was EnCase starting in acquisition mode, accessing and reading licence dongle correctly but being unable to register with it. Debug output from codemeter shows that straight. It was about two days to get correct certificates distributed. In mean time v7.14.01 get out too I have not even touch it yet.

I have a horrible wooden feeling of deja-vu on early days of v7 ..

The good news is that keyword / raw search in now how it was to be in v6, with even conditions and filters able to work on search results. Still there is no method of accessing code of default conditions, Copy feature is not yet implemented, you have to do like this How to edit or reuse system provided condition code in EnCase v8

19.12.2016

Since all this start we have v8.03 roll out, with  programmable pathways, and still issues with indexing and keyword searches. I've noticed that keyword search can't be updated till at least one keyword search was successful, or at least it behaves in that way in my environment. I have not yet check indexing but there is a lot of yammer on forum about indexing troubles.
Programmable pathways looks a bit unfinished and rough, it all boils down to to create simple investigation workflow or a high level program ... I'm tired of pointing finger on such issue and concept well known from other area of computing science :) :)
Instead of using wizard to copy from one pane to another why not to write

open investigation "myinvestigation" by template "basic"
add evidece file x.ex01
do processing
do indexing
do find partiotins and mount findings
tag search by keyowrdlist "listone"
bookmark findings
end

20.12.2016

I forget to mention issues with new licence manager schema :) there are so many issues now that it is easy to forget about some of them. GuidanceSoftware did some licence technology change in version 8, probably with some good reason, but that caused a lot of problems (I've posted few lines about it and v8.02.01 and first roll out) . At the moment SAFE and NAS are separated into two distinctive services SAFE and LM (licence manager) we have a lot of problems in one university classroom with this "migration" process. There is hugely ovecomplicated procedure how to do migration from v7 safe/nas to v8 safe/lm  but it does not correctly  cover educational licences.. Here is the link to official procedure.

At the end after detailed testing and checkup it was working, but we get into one of the features :) The final LM issues was Tools->options ->Licence manger entry about IP address. It was a chain of events. Form documentation it is not clear that you have to put there not only IP address of LM but a TCP port too. Also looks like there is no validation on input values for that field.  So we have first failure of putting only IP, support suggested to add port to, and here the second error fired, during copy paste somehow one blank before IP was copied into filed and that was enough to break it. so instead of "IP:PORT" it was " IP:PORT" invisible error and a lot of figuring out what is wrong...

This is how it should be, without any leading invisible chars ..

22.3.2017
Again almost a nightmare with classroom at one of our educational clients, with edu licencees now on the  LM. It was renewed and forms for safe/lm arrived, actually a links to upload page. We followed procedure and get new safe/lm certificates.  Everything works and looks magnificent but only one thing was bothering me, a expiration time visible trough help->about was same as before renewal, a possible quirk ..   In fact it was not quirk, renewal failed, since Guid was unable to send to us a real dongle extension certificate. A lot of chatting with tech support to find out what was wrong, we got apologize but also a living fear about upgrades and new versions...

29.3,2017
Correct dongle certificate arrived,with apologize, but now safe/lm is not working almost unbelievable situation. Looks like whole Guid certificate generation system was broken when we send request to  Guidance.  So back to support portal to get all this was Guidance messed up.

6.4.2017
Mess is finally over, with latest dongle extension certificate, for forensic v8,  LM and SAFE can not be on the same machine, even if in SAFE a.03 installer there is an recommended configuration to use both SAFE and LM, but this is for Enterprise version. So we got instruction what to do, uninstall safe, enable LM and it is working.

11.4.2018
A year later, with licence upgrade same torture again ..opentextguidance send wrong certificate ..

How to edit or reuse system provided condition code in EnCase v8

It is a bit strange combination since v8 EnCase returned back condition/enscript pane from v6, but with unexpected twist. Why to be simple if it can force you to hack your way.
Probably because in v6 users were able to modify system provided conditions and render it useless now it is impossible for user to see edit/open code of condition and use it as template for further development. You can only execute code and hope it is what you think it is since you can see what it is doing :)

Fortunately conditions and rest are still plain txt files somewhere on your disk and you can basically copy it from system provided path into your own user path and edit it. Plainly it is manipulation trough file system. Remember it is in internal format not easily readable by plain humans.

Conditions pane now contains two folders:

1. Default
2. User

Default folder contains all system provide conditions, while User is for your development, to edit anything you have to be in User sub folders, since User is also system folder and no-editable for users.

So how to simply hack this this to see code and reuse it ?

1) open condition pane and in "User" sub folder add new sub folder, this is only place where you are allowed to make folder as user or add new condition. It is on right-click action on your mouse

2)find in the Default folder condition you like to edit/analyze and right-click "Browse" on it. This will open widows explorer in folder containing your chosen condition.
Select your chosen condition and copy it by CRTL-C  or right-click copy option, than
close explorer window

3) In condition pane go to "User" folder, select you folder you created there in step (1) and right-clik browse on it. This will open windows explorer window where you can paste your chosen condition.
Close explorer window

4) Condition pane, on "User" folder right-click "refresh" that will show your condition in your sub folder,

5) choose your condition and right-clink "Edit" on it, you can edit and see how it works!!!!!

All this will be unneeded if copy function is still there in condition pane ...

Ages ago I've mentioned that it will be very good to force practice of standardized help or man page for each enscript or condition or filter but it will be never done.

PS: I'm quite sure this works for filters too

25.10.2016

To do things in more efficient way you can copy/paste whole condition tree from default folder to user folder, obviously conditions will be available only for user who does copy/paste.

The default condition are in installation folder in condition subfolder "C:\Program Files\EnCase8.01\Condition", so you just copy it content into your user condition folder:  "C:\Users\\Documents\EnCase\Condition". 
If Encase is running you'll have to restart Encase  to see the change

Looks like in v8.02 or later we will have copy ability in condition interface in encase, so we will not have to do dumb things like this workaround

FSEC 2016

My mistake, I forget to put link to presentation for FSEC 2016, but somehow it goes with other developement. It was nice in Opera House in Varazdin, food was perfect, day was wonderful but in our track lectures were derailed because of sounds system failure. Than for second day we have to change our plans. To be honest it all started when our colleague who was supposed to go there went to Ireland, it was a change and we decided to put another lecture, this time about "Remote Digital Forensic" It was logical developement after I had serious discusion about enterprise network as part of forensic investigation

Introducing myself into EnCase v8

Since we finally get workable dongles I've started to get into v8 to see it, feel it myself and
find possible drawbacks.
Since experience with introduction of v7 there is no enough testing.

 There are already some very good comparative testing done with earlier versions and other forensic tools like this one
I'd like to try it on configurations have close and how different version influence each other, especially since there are issues with v7 and new v8 dongles.

I've noticed two things, on very low end configuration v8 gets about 25% improvement in case processing speed, what looks related to improvement in disk access. The other thing is that if you change dongle to v7 and start v7 it hangs if it was done after using v8, reboot helps . This is consistent with problems in version licencing differences.

At the moment I' using tdurden evidence file which comes with intro self trainign for v7. I'll post configurations and results later.
After playing with tdurden I'll go for new versions of EnCase training and try to see if all works as it should be. After that I'll go to try some NIST materials to see how that work too.

My first impressions are not very dramatic, it is interface polish with appearance change but again with some important issues missed, still no conditions in bookmark view and for some strange reason renaming records view into artifacts.

24th Sep. 2017
I forget to mention most of old scripts which works in recent v7 version also works in v8, shame for this is not true for regripper wrpapper.

Videos of old public lectures on FER

I was not aware that some video material is posted on youtube, some old lectures I've done on FER Zagreb ages ago.

It is on the  CIS channel, two of them :

 2:45:08

Damir Delija - Tajne računalne forenzike

 1:30:07

Damir Delija - Moć forenzičkih alata

Here is the link on initial reference to "Moć forenzičkih alata"