The end of 2013

At the end of 2013 I can't say I'm Ok how 2013 was. To many unfinished things left open.

When I do some analyses basically I've spent 50% of all my working time on EnCase, actually preparing and testing class setups and materials. This is the trend which goes with EnCase v7 since it first day, it simply shows development cycle is yet not finished, there are rumors about v8 coming soon in 2014.
Rest of my time is spread over other preparations, other tools and training itself.  

What is missing from 2013 is enterprise level forensics for me. Since EnCase v7 done some drastic changes in user interface and functionality enterprise version went into stall in our patch of EMEA.  Hopefully there will be revival especially since with v7.05 and v7.08 some important improvements were introduced.

My favorite tool in 2013 was Silent Runner from Acess Data which was prepared and delivered during last quarter of 2013. It was a story for itself, when I think twice very typical for environment, country and whole digital forensic/security business.

Plenty of things can be said about digital forensics and security definitely there is a lot to be done. Tools, practice, industry, lack of standardization,  ideas .. to much resembles on networking ideas in pre-tcpip days
also there is a clash among forensic part and digital / computer part in digital forensic. I assume one key missing point in digital forensic is a digital forensic language (programming language) designed to describe digital forensic tasks and procedures, but this is issue for more elaborate discussion.



 

EnCase Macintosh-Linux Examinations - Guidance Software training

Recently I was in Slough on this training, it is very comprehensive one, where actual matter is always in front of printed materials .. 

Maybe a good idea is to do a two or even three separate training each dealing with closer to subject, like Mac only, Linux only and UNIX server systems. It is same core idea but approach, requirements are different so it needs different tools and approach.  

Olaf training

I'm doing training for OLAF program in Opatija, currently my courses are EnCase Forensic II and
EnCase Mac and Linux Forensics.  Preparations for this event was my occupation for last few weeks.

There are some very interesting experiences related to machines tools used. It is about 200 PC machines with same HW and SW configuration (there are difference in number of disks since EnCase v7 requires 3 disks to work efficiently). It a good statistical test sample actually. What is interesting is variations in the behavior of the forensic tools. HW is practically from same batch of serial numbers and SW is cloned installation  it is interesting to see how tools are acting, especially how reported errors are influencing outcomes of forensics tasks.  Up to this  moment we have only two such situations first when partition finder script failed and when evidence processor module reported error and were unable to finish processing and create required records folders. It was about 25% percent machines which had impact on correctness of the results.

LNK file and conditions in EnCase v7

Windows lnk files are very useful source of forensic data. It is not easy to get in analyzed and ordered on their attributes. Traditionally we are usually looking for volume serial numbers to corelate evidence. So how we can do that in ENCase v7 ? Here is the example based on Forensic II training evidence files which I am often using in training Forensic II sessions to extend the idea of condition and filters. I often find people are not thinking in condition way when they are using EnCase.

On the picture is link file „Final Cawin Weapons Purchase Order 2-7-2011.ppdf.LNK“ shown with its attribute bar expanded to „Link Data“ folder. There are two columns automatically populated by encase, “Name” and  “Value” for attribute pairs parsed out of file content. Since this view is available under attribute tab we can create condition based on this values and find which link files has same set of attributes like pointing to the file system with same serial number. Basically we have to ask two things Attribute name is „Serial Number“ and Attribute value is „6A97-109C“  this should return a list of lnk files which points to same file system For that we can create a new condition but there is a catch, since a attributes and not listed in table view column names but in view pane we have to go trough filters in conditions to get a new function which will address attributes name.

This is the result of our action, in filters for AttributeValueRoot we created new filter ValueFS.

If we edit ValueFS filter we see it has exactly the same logic as we noted before (Attribute name is „Serial Number“) and (Attribute value is „6A97-109C“). This values are easily copied from EnCase, but I suggest to save attribute view into txt file and do copy out from there.

Here is this filter applied in condition wizard, it is called as always filters are called trough „equal to“ construct to catch that entries on which filter return hit.

This condition works as any other condition, called from condition tab. It is a good idea to put some meaningful name to results like „Volume Serial XX“ so it is easy to follow what it is.

If you keep you conditions for future use it is a good idea to check ask for value and value required buttons, so you'll be able to reuse it for different combination of attributes and values.

Here we actually insert both values for attribute name and its value into condition box.

Results are as we expected list of lnk files which points to file system with same serial number.

This method can be applied to other objects which has attributes In Encase manual and on the excellent Lance Mueller site you can learn a lot more about conditions, filters and Enscript programming. http://www.forensickb.com/

Here is condition source code

class MainClass {

  class ValueFSClass {

    typedef String[] Array1;

    class FilterDialogClass: DialogClass {

      ArrayEditClass  Variable1;

      StringEditClass Variable2;

      FilterDialogClass(DialogClass parent, ValueFSClass v):

        DialogClass(parent, "Edit Conditions"),

          Variable1(this, "Value matches", START, NEXT, 200, 102, 0, v.Variable1, REQUIRED),

        Variable2(this, "Name equal to", START, NEXT, 200, DEFAULT, 0, v.Variable2, 512, REQUIRED)

      {

      }

    }

    Array1     Variable1;

    String     Variable2;

    ValueFSClass():

      Variable1{"6A97-109C"},

      Variable2 = "Serial Number"

    {

      FilterDialogClass dialog(null, this);

      if (dialog.Execute() != SystemClass::OK)

        SystemClass::Exit();

    }

    bool Main(AttributeValueClass e) {

      return Variable1.Find(e.Value()) >= 0 && e.Name().Compare(Variable2) == 0;

    }

  }

  ValueFSClass ValueFSData;

  bool ValueFS(AttributeValueClass root) {

    forall (AttributeValueClass e in root)

      if (ValueFSData.Main(e))

        return true;

    return false;

  }

  MainClass():

EnCase Enterprise v7 training and education

At the moment I'm involved in preparing training for EnCase  Enterprise product, training is EnCase  Enterprise Examinations for v7 . Clients are not from IT company but from one to the neighboring countries ministry of finance. It is a long, long project delayed with budget problems finally comes to conclusion. Schedule was changed so many times that EnCase  evolved from version 7.05 to 7.08.1 with all new training changes and new software features and of course bugs. Key differences are case processor on separates nodes and non-safe servlet (FIM replacement). Also VMware products are with new versions and sometimes there are compatibility issues.

Preparation is always a bit of lengthily process since I don't have a dedicated classroom or dedicated machines but multipurpose ones which had to be tailored for each training. EnCase  v7 is very resource hungry, when we are talking about enterprise version where training include simulated network of several machines the resource bill is extremely high. Since most of trainings are on client premises we use strong laptops with a lot of external disks to fulfill the role. Priorities are disks, RAM, CPU, network.  For acceptable performance quad core I5 64bit laptop with 16GB+ ram and three sata/ esata disks is enough (xpress card with two esata ports are here extremely useful but on some machines especially Dell can be problems). This configuration has enough power for EnCase  evidence processor and also gives you three or more disks to spread load of virtual machines. In theory training can be provided on customer machines but in practice this  fails since configuration and system administration problems, the best way is to bring your own devices and configured it by yourself.

As for real EnCase  Enterprise training what is important to take into concern is versatility of EnCase  Enterprise. Lance Mueller describes this in his paper with precisely defining main areas of EnCase Enterprise usage. Current training is too much condensed and gives you intro into all capabilities where actually attendee in advance should be able to understand how EE will be used in their work. This is by my experience too optimistic approach since attendees usually does not have much EnCase  experience. Initially EE training was in two separate weeks but later it was changed to one week with idea of unification of EE and Forensic product. Basically this proves as a problem since no one can force customers to get Forensic courses as preparation for Enterprise (problem is always a limitation of their budget) so we usually lack a good understanding of EnCase  forensic abilities. I always suggest to attendees if they are without Forensic training to at least look at free v7 intro online training  but that is often not enough.  The workaround is to extend introduction and add tailored points in the aspects where they’ll work. As we are here talking about financial regulator the stress should be on e-discovery process, then on standard forensic investigation and at the end on the incident response. For each of this tasks different configuration and tools in EnCase , also different user roles are required. Actually very good material for discussion is on the International competition network in the “ Anti-Cartel Enforcement Manual” It puts all this into some defined process close to those which attendees have experience with. From that point we can discuss ideas of e-discovery which is almost unknown idea in our part of Europe.

Mobile forensic education and training

It si a good news that Celebrite http://www.cellebrite.com has started to formalise training process and procedures. As I have been with their mobile forensic product UFED since 2010 I had some very frustrating experiences delivering UFED trainings, hopefully this is past. Trainign is formalised, well described http://www.cellebritelearningcenter.com/mod/page/view.php?id=16 and finally should provide official edu materials. This will provide us with reference materials which can be translated also hopefully someone will keep documentation in sync with software releases. Horrors of having manuals beeing version 2.4 while software is 3.6 is hopefully behind us.
Requests for trainer certification is finally defined, as for “Cellebrite Certified Instructor Certifications”, still they have some topics to cover. Mobile forensic is young field and vendors has not yet grasped fact about standardisation of interfaces and formats. On the training website one thing is missing, Python programing with physical analyzer product. By my opinion this is maybe too advanced for everyday users but course should be available.

Micro systemation http://www.msab.com/ has such traings approach for quite a long time. Traings are well defined http://www.msab.com/training/training-overview. With other vendors are more or less same, depends how deep vendors grabs mobile forensics. Ill fated Encase Neutrino had once its own very good training. Today Accessdata has its own MPE+ Mobile Forensics product, http://www.accessdata.com/training with elaborate training.
As some other available things and sources for mobile forensics my favourite is http://my.safaribooksonline.com/book/networking/forensic-analysis/9781597495967 “Digital Triage Forensics: Processing the Digital Crime Scene”, By: Stephen Pearson perfect intro into classic mobile devices forensic and Paraben tools.

LTEC 2013 Prag

This is a bit late post about Prag forensic conference LTEC 2013 http://www.lawtecheuropecongress.com/. It is a nice conference with goal to bringing digital forensic practinioer and law practitioners into contact. A lot of panels workshops and presentations, many presenters local and world wide vendors.

My task there was to have a small 2 hour workshop on Encase Forensic v7, to present how things are done in latest Encase, to show some basic set of features , about 20% of functionality.

Slides are on the slideshare http://www.slideshare.net/DamirDelijadamirdeli/ltec-2013-encase-v70801-presentation. It was supposed to be 20 people attending so nice cozy working environment.  Required PCs were supposed to provided by local conference partner in Prag, while we provide EnCase. As it goes in real world delivered workshop machines were so weak and undersized,  it was not possible to run workshop , to be worse machines were delivered late, just evening before start of LTEC. So I've canceled the workshop and went to just doing live presentation of scenario workshop, My colleague  Davorka Foit kept her part on EnCase reporting also as presentation.

Steve Gregory from GuidanceSoftware had very interesting presentation on the TD3 forensic duplicator http://www.tableau.com/index.php?pageid=products&model=TD3 by Tableau. It was masterly done even when IT infrastructure, especially power was giving some troubles. Whole presentation was  about network access to TD3 in write blocking mode, this feature was a bit buggy before last firmware update, but know works perfect. It is interesting idea by FBI, which actually shows reality in the digital forensic field, not enough trained people to go. Steve also helped us with borrowing us one of his usb write blokers for modified workshop/presentation.  

Just to expand my digital forensic knowledge I visited a museum related to historical fact finding methods http://www.museumtortury.cz/en/index.html. It gives a very interesting ideas to solve problems with misdelivered equipement.