Forensics Wiki - User contributions [en]

Talk:Forensic Live CD issues

2012-10-07T09:42:07Z

.FUF: /* List of Live CD distros that ARE forensically sound? */

Just putting all discovered stuff together in one article. [[User:.FUF|.FUF]] 21:29, 3 February 2010 (UTC)

== List of Live CD distros that '''''ARE''''' forensically sound? ==

This is an incredibly useful article. However, with a quick glance through the listed offenders, one might walk away with the impression that '''all''' of the 'major' forensics Live CD distros might corrupt the target drive. Or worse, someone may falsely believe that if their favorite flavor was not mentioned in the article, then it must be safe.

Further still, the sentence, "Each problem is followed by an up to date list of distributions affected" is a pretty bold statement, especially in light of the fact that this article hasn't been updated in 15 months...

I'm just wondering if anyone has re-tested any '''newer''' versions of the listed offenders since this article was written? Or perhaps whether the specific developer teams might have self-declared that these issues are "fixed" as of a particular release? Or if anyone is aware of '''other''' forensic Live CD distros that have been verified as 'safe' from these problems? Hoping to avoid reinventing the wheel here... either way, if I learn of anything in my travels, I'll post an update...

--[[User:Grolltech|Grolltech]] 21:19, 11 September 2011 (PDT)

: Runtime options to mount can be changed at will by UID=0 no matter which options are chosen as defaults. This really begs the question of "Who is responsible" during an investigation. To me it seems the answer is "the investigator", not "the distro". I'm still learning the process of investigation but they I understand it, its processes and chain of custody demand that an investigator is skilled with the distro, not merely acquainted. (And the scope needs to include the entire OS/distro not merely the Linux kernel). [[User:John Crout|John Crout]] 12:26, 25 December 2011 (PST)

: Hello, unfortunately I don't have much free time to keep these lists up to date. But a quick checking of most recent distros (latest CAINE and DEFT) showed that some issues are back, due to regression [[User:.FUF|.FUF]] 02:42, 7 October 2012 (PDT)

Forensic Live CD issues

2012-10-07T09:28:40Z

.FUF: /* Journaling file system updates */

== The problem ==

[[Live CD|Forensic Live CDs]] are widely used during computer forensic investigations. Currently, many vendors of such Live CD distributions spread false claims that their distributions "do not touch anything", "write protect everything" and so on. Unfortunately, community-developed distributions are no exception here. Finally, it turns out that many Linux-based forensic Live CDs are not tested properly and there are no suitable test cases published.

== Another side of the problem ==

Another side of the problem of insufficient testing of forensic Live CDs is that many users do not know what happens "under the hood" of the provided operating system and cannot adequately test them.

=== Example ===

For example, [http://forensiccop.blogspot.com/2009/10/forensic-cop-journal-13-2009.html ''Forensic Cop Journal'' (Volume 1(3), Oct 2009)] describes a test case when an Ext3 file system was mounted using "-o ro" mount flag as a way to write protect the data. The article says that all tests were successful (i.e. no data modification was found after unmounting the file system), but it is known that damaged (i.e not properly unmounted) Ext3 file systems cannot be write protected using only "-o ro" mount flags (write access will be enabled during file system recovery).

And the question is: will many users test damaged Ext3 file system (together with testing the clean one) when validating their favourite forensic Live CD distribution? My answer is "no", because many users are unaware of such traits.

== Problems ==

Each problem is followed by an up to date list of distributions affected.

=== Journaling file system updates ===

When mounting (and unmounting) several journaling file systems with only "-o ro" mount flag a different number of data writes may occur. Here is a list of such file systems:

{| class="wikitable" border="1"
|-
! File system
! When data writes happen
! Notes
|-
| Ext3
| File system requires journal recovery
| To disable recovery: use "noload" flag, or use "ro,loop" flags, or use "ext2" file system type
|-
| Ext4
| File system requires journal recovery
| To disable recovery: use "noload" flag, or use "ro,loop" flags, or use "ext2" file system type
|-
| ReiserFS
| File system has unfinished transactions
| "nolog" flag does not work (see ''man mount''). To disable journal updates: use "ro,loop" flags
|-
| XFS
| Always (when unmounting)
| "norecovery" flag does not help (fixed in recent 2.6 kernels). To disable data writes: use "ro,loop" flags.
|}

Incorrect mount flags can be used to mount file systems on evidentiary media during the boot process or during the file system preview process. As described above, this may result in data writes to evidentiary media. For example, several Ubuntu-based forensic Live CD distributions mount and recover damaged Ext3/4 file systems on fixed media (e.g. hard drives) during execution of [http://en.wikipedia.org/wiki/Initrd ''initrd''] scripts (these scripts mount every supported file system type on every supported media type using only "-o ro" flag in order to find a root file system image).

[[Image:ext3 recovery.png|thumb|right|[[Helix3]]: damaged Ext3 recovery during the boot]]

List of distributions that recover Ext3 (and sometimes Ext4) file systems during the boot:

{| class="wikitable" border="1"
|-
! Distribution
! Version
|-
| Helix3
| 2009R1
|-
| SMART Linux (Ubuntu)
| 2010-01-20
|-
| FCCU GNU/Linux Forensic Boot CD
| 12.1
|-
| SPADA
| 4
|-
| DEFT Linux
| 7
|}

=== Root file system spoofing ===

Most Ubuntu-based forensic Live CD distributions use Casper (a set of scripts used to complete initialization process during early stage of boot). Casper is responsible for searching for a root file system (typically, an image of live environment) on all supported devices (because a bootloader does not pass any information about device used for booting to the kernel), mounting it and executing ''/sbin/init'' program on a mounted root file system that will continue the boot process. Unfortunately, Casper was not designed to meet computer forensics requirements and is responsible for damaged Ext3/4 file systems recovery during the boot (see above) and root file system spoofing.

[[Image:Grml.png|thumb|right|[[grml]] mounted root file system from the [[hard drive]]]]

Currently, Casper may select fake root file system image on evidentiary media (e.g. [[Hard Drive|HDD]]), because there are no authenticity checks performed (except optional UUID check for a possible live file system), and this fake root file system image may be used to execute malicious code during the boot with root privileges. Knoppix-based forensic Live CD distributions are vulnerable to the same attack.

List of Ubuntu-based distributions that allow root file system spoofing:

{| class="wikitable" border="1"
|-
! Distribution
! Version
|-
| Helix3
| 2009R1
|-
| Helix3 Pro
| 2009R3
|-
| CAINE
| 1.5
|-
| DEFT Linux
| 5
|-
| Raptor
| 2.0
|-
| BackTrack
| 4
|-
| SMART Linux (Ubuntu)
| 2010-01-20
|-
| FCCU GNU/Linux Forensic Boot CD
| 12.1
|}

Vulnerable Knoppix-based distributions include: SPADA, LinEn Boot CD, BitFlare.

[http://anti-forensics.ru/ Anti-Forensics.Ru project] [http://digitalcorpora.org/corp/images/aor/ released several ISO 9660 images] used to test various Linux Live CD distributions for root file system spoofing (description for all images is [http://anti-forensics.ru/casper/ here]).

=== Swap space activation ===

''Feel free to add information about swap space activation during the boot in some distributions''

=== Incorrect mount policy ===

==== rebuildfstab and scanpartitions scripts ====

Several forensic Linux Live CD distributions (Helix3 2009R1, Helix3 Pro 2009R3, old versions of CAINE, old versions of grml) use rebuildfstab and scanpartition scripts to create entries for attached devices in ''/etc/fstab''. Some versions of these scripts use wrong wildcards while searching for available block devices (''/dev/?d?'' instead of ''/dev/?d*''), this results in missing several "exotic" devices (like /dev/sdad, /dev/sdad1, etc) and in data writes when mounting them (because fstab lacks of read-only mount options for these devices).

=== Incorrect write-blocking approach ===

Some forensic Linux Live CD distributions rely on [[hdparm]] and [[blockdev]] programs to mount file systems in read-only mode (by setting the underlying block device to read-only mode). Unfortunately, setting the block device to read-only mode does not guarantee that [http://archives.free.net.ph/message/20090721.105120.99250e3f.en.html no write commands will be passed to the drive].

== External links ==

* [http://www.computer-forensics-lab.org/pdf/Linux_for_computer_forensic_investigators_2.pdf Linux for computer forensic investigators: problems of booting trusted operating system]
* [http://www.computer-forensics-lab.org/pdf/Linux_for_computer_forensic_investigators.pdf Linux for computer forensic investigators: «pitfalls» of mounting file systems]

[[Category:Live CD]]

User talk:Bethan Williams

2012-02-16T18:26:37Z

.FUF: Welcome!

'''Welcome to ''Forensics Wiki''!'''
We hope you will contribute much and well.
You will probably want to read the [[Help:Contents|help pages]].
Again, welcome and have fun! [[User:.FUF|.FUF]] 10:26, 16 February 2012 (PST)

User:Bethan Williams

2012-02-16T18:26:36Z

.FUF: Creating user page with biography of new user.

Bethan is Head of Marketing at CY4OR and has worked for the Company for 5 years. With over 12 years experience in both B2B and B2C market sectors, I have a varied skill set ranging from more traditional marketing techniques through to online and social media campaign management.

At CY4OR I am responsible for creating, communicating and delivering customer value through creative sales and marketing .

User talk:Cmpnerd

2012-02-16T18:26:16Z

.FUF: Welcome!

User:Cmpnerd

2012-02-16T18:26:15Z

.FUF: Creating user page with biography of new user.

I hereby license all my contributions to this wiki (before and after February 16th, 2011) under the Creative Commons Attribution-ShareAlike license. Developer and Forensic Examiner, plenty of certs and real world experience. Hold a Masters in Computer Science. No other info needs to be applied nor do I want to publically have available.

User talk:Ryan

2012-02-16T18:26:04Z

.FUF: Welcome!

User:Ryan

2012-02-16T18:26:03Z

.FUF: Creating user page with biography of new user.

I am a student in the small scale cyber forensics class at Purdue University. Interests are in mobile development and mobile malware/spyware. I plan on documenting malware/spyware on this wiki. I will be graduating Purdue in May of 2012 from the Computer and Information Technology program with a focus on information systems.

User talk:Rob Emme

2012-02-16T07:12:59Z

.FUF: Welcome!

User:Rob Emme

2012-02-16T07:12:59Z

.FUF: Creating user page with biography of new user.

I am currently a senior at Purdue majoring in CNIT with a specialization in information systems. I am planning to graduate in May 2012. This semester I am enrolled in CNIT 421. This semester I am planning to research mobile malware, and contribute to this wiki so that it may be of use to future students and staff.

User talk:Patrick Olsen

2012-02-06T17:32:47Z

.FUF: Welcome!

User:Patrick Olsen

2012-02-06T17:32:46Z

.FUF: Creating user page with biography of new user.

Twitter Account and Website/Blog

Twitter: @patrickrolsen
Website/Blog: http://www.sysforensics.org

Education/Certifications/Software

Bellevue University (12/01/2004 - 06/24/2006), Bellevue, Nebraska
Bachelors of Science (BS) - Security Management

Certified Information System Security Professional - CISSP
Certified Ethical Hacker – CEH
Windows 7 Configuration (Computing Environment (CE) Certified)
SANS Computer Forensic Investigations - Windows In-Depth Training
Security+
DISA HBSS 4.5 Administration and Advanced Training

Forensics Software: SANS SIFT Kit, Helix Pro., FTK Imager, dd/moonsols, The Sleuth Kit (TSK), X-Ways Forensics/Win-Hex, Volatility Memory Analysis, basic batch scripting knowledge, Browser Analysis, RegRipper, Foremost/Scalpel

Security/Hacking Software: Backtrack 5, Metasploit tool suite, Nmap, Social Engineering Toolkit (SET), Nikto, Hydra-gtk, John the Ripper, enum, hping, Xprobe, Nessus, Aircrack-ng, Kismet, and others.

User talk:NetGrab Ltd

2012-02-01T16:44:35Z

.FUF: Welcome!

User:NetGrab Ltd

2012-02-01T16:44:34Z

.FUF: Creating user page with biography of new user.

NetGrab Ltd is a new small startup focusing on easy to use network forensics and cyber security tools. It's website is available at www.netgrab.co.uk, and it's first tool is NetSleuth. A free tool, released under the GPL, to ade with Network Forensics specifically the triage process. It can identify hosts, silently, from sniffing live on the network - or analyse data from pcap files (a common format for many IDS and firewall logging products).

User talk:Rob watson

2012-01-30T13:14:39Z

.FUF: Welcome!

User:Rob watson

2012-01-30T13:14:36Z

.FUF: Creating user page with biography of new user.

I am a computer forensic investigator employed by 7Safe / PA Consulting. I undertake examinations of computer systems, from stand alone computers to servers and systems. My primary work has been law enforcement (as I was Police Officer in the UK for thirteen years), however I am now becoming involved in more corporate work and some eDiscovery work.

User talk:Martin Gengenbach

2012-01-30T07:33:39Z

.FUF: Welcome!

User:Martin Gengenbach

2012-01-30T07:33:38Z

.FUF: Creating user page with biography of new user.

I am a graduate student in the School of Information and Library Science at the University of North Carolina at Chapel Hill, working toward a Master of Science in Library Science. I am interested in the application of digital forensic tools and processes to the field of digital preservation/digital curation.

User talk:Michael Cotgrove

2012-01-27T08:28:07Z

.FUF: Welcome!

User:Michael Cotgrove

2012-01-27T08:28:05Z

.FUF: Creating user page with biography of new user.

Degree in Electronic, 1975 Southampton University, UK
Hardware development
Software Development 1978 till present day using C and C++, and Microsoft Visual Studio
Owner of InterMedia Graphic Systems Ltd
Worked for eMag Solutions - Senior Vice President of Software Development
Owner CnW Recovery

Main development is data recovery by software from hard drives, CDs/DVDs, and memory chips with a strong emphasis on processing fragmented files. All recovery is logged in a forensically secure way. Member of UK First Forensic Forum, F3

User talk:Adrian Santangelo

2012-01-03T09:15:36Z

.FUF: Welcome!

User:Adrian Santangelo

2012-01-03T09:15:34Z

.FUF: Creating user page with biography of new user.

I have over a decade of forensic experience, with deep roots in information security. I've been a self-employed computer security and forensic consultant all my adult life and love what I do. Plenty of information is readily available about me with a simple Google search. Bonus points if you can find my online aliases! (Much of my security history online has been done under one of them. Shouldn't be hard to find.)

User talk:Computer Forensic Analyst

2011-12-30T07:47:49Z

.FUF: Welcome!

User:Computer Forensic Analyst

2011-12-30T07:47:48Z

.FUF: Creating user page with biography of new user.

I am Forensic Computer Analyst, my main job is make computer forensic analyst and make reports from sd cards, personal computer, Mac computer, and telephony.
I am using free tool software like the tools from The Sleuth Kit, also i worked with winhex and enCase, but i prefere free software.

User talk:Johny Ryder

2011-12-22T16:23:13Z

.FUF: Welcome!

User:Johny Ryder

2011-12-22T16:23:10Z

.FUF: Creating user page with biography of new user.

Data expert, tech lover, privacy protector. I started using computers and the internet early 1994. And I can not imagine how I would ever be able to communicate with my friends and family without these products.

It is great to be able to share through the internet. But (semi) public sharing has its downsides too. I like to read about and work on keeping the protection of private information something individuals can control themselves.

But sometimes it is good that there are forensic tools available. Just as long these tools are used properly. I hope people are aware of the possibilities to protect their privacy, and protectors of the public domain are aware of the forensic tools available, and use them properly.

User talk:Evan H. Dygert

2011-12-20T12:37:58Z

.FUF: Welcome!

User:Evan H. Dygert

2011-12-20T12:37:56Z

.FUF: Creating user page with biography of new user.

Instead of repeating what is already on LinkedIn, just view my LinkedIn profile at http://www.linkedin.com/in/evandygert. I have earned the CCE, GCFE, GCFA forensic certifications as well as numerous other security related certifications (CISSP, GSEC, etc). In addition to being a software developer for many years, I have worked on intellectual property cases involving trade secrets and patent, trademark, copyright infringement.

User talk:Marc Yu

2011-12-12T09:24:07Z

.FUF: Welcome!

User:Marc Yu

2011-12-12T09:24:06Z

.FUF: Creating user page with biography of new user.

Worked in the IT field for 20 years for the Democratic National Committee, USA Today, and Florida Office of the Attorney General's Child Predator Cybercrime Unit. I am Microsoft-certified. I also have a Bachelor's degree in Information Technology. I am currently running my own e-Discovery and computer forensics business in Pensacola, Florida.

User talk:Arunshory

2011-12-10T07:46:45Z

.FUF: Welcome!

User:Arunshory

2011-12-10T07:46:44Z

.FUF: Creating user page with biography of new user.

I am a software engineer.I have completed B.tech:IT in information technology in mount zion college of engineering and technology at pudukkottai.There are four members in my family.Father,mother,me and my brother.In my childhood i have lot of interested in computer.In my free time i was do some other work in computer.Downloading the lots of softwares,os and security software from internet and then to installing my computer to check them the performance.
Now i am working as search engine optimization in attotel company.

User:Frank Griffitts

2011-12-10T07:46:41Z

.FUF: Creating user page with biography of new user.

Frank is currently assigned to the Scottsdale Police Department Computer Crimes Unit.
He has been a law enforcement officer since 2002. He has been in investigations since 2008.
Frank has been conducting hard drive forensic examinations since 2009.
He is an AccessData Certified Examiner, as well as CompTia A+ and Network+ certified. He has also attended basic and advanced training at NCFI in Hoover, Alabama.

User talk:Frank Griffitts

2011-12-10T07:46:41Z

.FUF: Welcome!

User talk:Asigel

2011-12-10T07:46:39Z

.FUF: Welcome!

User:Asigel

2011-12-10T07:46:38Z

.FUF: Creating user page with biography of new user.

IT forensic specialist, based in Cologne, Germany, with 20y experience in IT and 5+ in ITFOR at big4 and independent consultant. these are the padding characters to fulfill the requirement of 50 characters min length of bio, and in case this is still too short I simply add more words until this stupid button will allow me to improve your pages. joking :-)

User talk:Docbit

2011-11-28T07:46:28Z

.FUF: Welcome!

User:Docbit

2011-11-28T07:46:27Z

.FUF: Creating user page with biography of new user.

my main job is computer forensic
my other works are the same i mean that i alwaya work in the field of forensic computer in differenst firms
i like forensic computer but i hope that some day win a lottery and no work ever ;)
I hope too that all people help me in the way of knowledge

User talk:Joshua

2011-11-14T12:31:54Z

.FUF: Welcome!

User:Joshua

2011-11-14T12:31:52Z

.FUF: Creating user page with biography of new user.

I am a researcher and lecturer of digital forensics, live data forensics and investigation techniques at University College Dublin, Ireland. My interests are in investigation process models, human inference and automation. I have participated in the development of several investigation tools, and currently lead the Rapid Evidence Acquisition Project for Event Reconstruction.

User talk:Erdem U. Altinyurt

2011-11-14T12:31:49Z

.FUF: Welcome!

User:Erdem U. Altinyurt

2011-11-14T12:31:47Z

.FUF: Creating user page with biography of new user.

Author of wxHexEditor, DivFix++, Meteorie MKV Repair tool.
Also SamyGO.tv Hacker.
I don't know what to write here.
So I try to hack it via entering this un meaningful words for fill fifty word count.
a b c d s d f g d d e d 3w e a a d fe fr fe.

User talk:Christopher Triplett

2011-11-08T19:57:41Z

.FUF: Welcome!

User:Christopher Triplett

2011-11-08T19:57:40Z

.FUF: Creating user page with biography of new user.

Christopher Triplett is a forensic analyst, mobile forensics researcher, and also heads the training division of viaForensics. He has pioneered new methods for gaining access to NAND memory on Android devices and has incorporated this knowledge into the viaForensics Android training programs. Chris works closely with law enforcement agencies around the world and has spoken at forensic conferences on Android forensics and advanced recovery topics.

User talk:Bill Nelson

2011-11-08T04:20:00Z

.FUF: Welcome!

User:Bill Nelson

2011-11-08T04:19:58Z

.FUF: Creating user page with biography of new user.

Business and Professional Development Manager Edit Security University

November 2011 – Present (1 month) Tampa/St. Petersburg, Florida Area

Sleep peacefully, knowing that your IT staff has been professionally trained and certified in ethical hacking, penetration testing, Security+, CISSP and a host of other IT security related disciplines.
What?!? Your staff has not been trained and certified in these must have certifications? Then call or email me now and let me help you schedule your staff in the next available class.
Ph: 727-498-8799
BillNelson@SecurityUniversity.net

Ask for recommendations
Senior Sales Consultant Edit ExamForce
Privately Held; 51-200 employees; E-Learning industry

April 2006 – November 2011 (5 years 8 months)

Responsibilities include: Sales team training for LearnForce Partners including ExamForce, LearnKey, and Lambers product lines. New/Existing account management, customer service, research and development.

9 visible recommendations for this position, 1 new recommendation for this position Manage

Executive Producer Edit Clear Channel

November 1999 – May 2006 (6 years 7 months)

Provide a brief description Ask for recommendations
General Manager Edit CDB Insurance

September 1995 – October 1999 (4 years 2 months)

Provide a brief description Ask for recommendations

User:C Andras Moritz

2011-11-05T08:26:18Z

.FUF: Creating user page with biography of new user.

Expert in security and nanoscale fabrics, circuits, architectures.
Founder of BlueRISC (hardware assisted anti tamper and security space, with security processor and compiler) and WindowsSCOPE (memory forensics, live forensics, cyber security space, hardware assisted cyber security and forensics space). Professor in electrical and computer engineering at UMass in Amherst. Associate editor IEEE Transactions on Nano, Theme leader FENA/FCRP Nano center, and CHM/NSEC center. Member of several Executive Committees. Winner of five Best Paper/Poster awards and inventor of several patents.

User talk:C Andras Moritz

2011-11-05T08:26:18Z

.FUF: Welcome!

User talk:Danielle DiBruno

2011-11-05T08:26:06Z

.FUF: Welcome!

User:Danielle DiBruno

2011-11-05T08:26:05Z

.FUF: Creating user page with biography of new user.

Prior law enforcement working as an undercover Special Agent investigating computer crimes- primarily focus Internet crimes against children. Worked as an investigative analyst for NCMEC's Cybertipline which acted as the "911" for the Internet involving all types of child exploitation- mostly involving child pornography cases on the Internet.

Currently I work as a forensic analyst for a private company that handles all types of cyber threats involving major businesses and corporations. I am looking to expand my knowledge base of various types of cyber crimes.

User talk:Connor Gilbert

2011-11-05T08:25:53Z

.FUF: Welcome!