Difference between pages "Upcoming events" and "BitLocker: how to image"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
(On-going / Continuous Training)
 
(Traditional Imaging)
 
Line 1: Line 1:
<b>PLEASE READ BEFORE YOU EDIT THE LISTS BELOW</b><br>
 
Events should be posted in the correct section, and in date order.  An event should NEVER be listed in more than one section (i.e. Ongoing/Continuous events should not be listed in Scheduled Training).  When events begin the same day, events of a longer length should be listed first.  New postings of events with the same date(s) as other events should be added after events already in the list. If a provider offers the same event at several locations simultaneously, the listing should have a single (ONE) entry in the list with the date(s) and ALL locations for the event. Please use three-letter month abbreviations (i.e. Sep, NOT Sept. or September), use two digit dates (i.e. Jan 01 NOT Jan 1), and use date ranges rather than listing every date during an event(i.e. Jan 02-05, NOT Jan 02, 03, 04, 05).<br>
 
<i>Some conferences or training opportunities may be <u>limited</u> to <b>Law Enforcement Only</b> or to a specific audience.  Such restrictions should be noted when known.</i>
 
  
This is a BY DATE listing of upcoming conferences and training events relevant to [[digital forensics]].  It is not an all inclusive list, but includes most well-known activities.  Some events may duplicate events on the generic [[conferences]] page, but entries in this list have specific dates and locations for the upcoming event.
+
= Imaging Options =
  
This listing is divided into four sections (described as follows):<br>
+
There are multiple ways to image a computer with bitlocker security in place.
<ol><li><b><u>Calls For Papers</u></b> - Calls for papers for either Journals or for Conferences, relevant to Digital Forensics (Name, Closing Date, URL)</li><br>
+
<li><b><u>Conferences</u></b> - Conferences relevant for Digital Forensics (Name, Date, Location, URL)</li><br>
+
<li><b><u>On-Going / Continuous Training</u></b> - Training opportunities that are either always available online/distance learning format or that are offered the same time every month (Name, date-if applicable, URL)</li><br>
+
<li><b><u>[[Scheduled Training Courses]]</u></b> - Training Classes/Courses that are scheduled for specific dates/locations.  This would include online (or distance learning format) courses which begin on specific dates, instead of the "start anytime" courses listed in the previous section. (Name, Date(s), Location(s), URL) (''note: this has been moved to its own page.'')<br></li></ol>
+
  
The Conference and Training List is provided by the American Academy of Forensic Sciences (AAFS) Digital and Multimedia Sciences Section Listserv. 
+
== Traditional Imaging ==
<i> (Subscribe by sending an email to listserv@lists.mitre.org with message body containing SUBSCRIBE AAFS-DIGITAL-MULTIMEDIA-LIST)</i>
+
Requests for additions, deletions or corrections to this list may be sent by email to David Baker <i>(bakerd AT mitre.org)</i>.
+
  
== Calls For Papers ==
+
One can make a traditional image with the image containing encrypted information.
{| border="0" cellpadding="2" cellspacing="2" align="top"
+
|- style="background:#bfbfbf; font-weight: bold"
+
! Title
+
! Due Date
+
! Website
+
|-
+
|2009 DOD Cyber Crime Conference
+
|Jul 01, 2008
+
|http://www.dodcybercrime.com/9CC/call_for_papers.asp
+
|-
+
|ANZFSS - 19th International Symposium on the Forensic Sciences
+
|Jul 06, 2008
+
|http://www.anzfss2008.org.au/content/view/56/63/
+
|-
+
|DeepSec 2008
+
|Jul 15, 2008
+
|https://deepsec.net/cfp/
+
|-
+
|American Academy of Forensic Sciences Annual Meeting
+
|Aug 01, 2008
+
|http://www.aafs.org/default.asp?section_id=meetings&page_id=aafs_annual_meeting
+
|-
+
|24th Annual ACM Symposium on Applied Computing - Computer Forensics Track
+
|Aug 09, 2008
+
|http://comp.uark.edu/~bpanda/sac2009cfp.pdf
+
|-
+
|5th Annual IFIP WG 11.9 International Conference on Digital Forensics
+
|Oct 15, 2008
+
|http://www.ifip119.org/Conferences/WG11-9-CFP-2009.pdf
+
|-
+
|-
+
|3rd Edition of Small Scale Digital Device Forensics Journal
+
|Jan 31, 2009
+
|http://www.ssddfj.org/Call.asp
+
|}
+
  
== Conferences ==
+
Options to offline decrypt the information, provided the password or recovery password is available, exists some are:
{| border="0" cellpadding="2" cellspacing="2" align="top"
+
* [http://www.hsc.fr/ressources/outils/dislocker/ dislocker]
|- style="background:#bfbfbf; font-weight: bold"
+
* [[EnCase]] (as of version 6) with the (optional) encryption module
! Title
+
* [[libbde]]
! Date/Location
+
! Website
+
|-
+
|International Association of Forensic Sciences Annual Meeting
+
|Jul 21-26, New Orleans, LA
+
|http://www.iafs2008.com/
+
|-
+
|17th USENIX Security Symposium
+
|Jul 28-Aug 01, San Jose, CA
+
|http://www.usenix.org/events/sec08/
+
|-
+
|Blackhat USA 2008 Briefings & Training
+
|Aug 02-07, Las Vegas, NV
+
|http://www.blackhat.com/html/bh-link/briefings.html
+
|-
+
|2nd International Workshop on Computational Forensics
+
|Aug 07-08, Washington, DC
+
|http://iwcf08.arsforensica.org
+
|-
+
|Defcon 16
+
|Aug 08-10, Las Vegas, NV
+
|http://www.defcon.org
+
|-
+
|Digital Forensic Research Workshop
+
|Aug 11-13, Baltimore, MD
+
|http://www.dfrws.org
+
|-
+
|International Workshop on Digital Crime and Forensics in conjunction w/4th International Conference on Intelligent Information Hiding and Multimedia Signal Processing
+
|Aug 15-17, Harbin, China
+
|http://www.dcs.warwick.ac.uk/~ctli/CFP_IWDCF2008.html
+
|-
+
|2nd French-Speaking Days on Digital Investigations - Journées Francophones de l'Investigation Numérique 2008
+
|Sep 03-05, Vandoeuvre-lès-Nancy, France
+
|http://www.afsin.org/
+
|-
+
|1st Workshop on Open Source Software for Computer and Network Forensics
+
|Sep 07-10, Milan Italy
+
|http://conferenze.dei.polimi.it/ossconf/index.php
+
|-
+
|11th International Symposium on Recent Advances in Intrusion Detection
+
|Sep 15-17, Cambridge, MA
+
|http://www.ll.mit.edu/IST/RAID2008/
+
|-
+
|4th International Conference on IT Incident Management & IT Forensics
+
|Sep 23-25, Mannheim,  Germany
+
|http://www.imf-conference.org/
+
|-
+
|VB2008 anti-malware conference
+
|Oct 01-03, Ottawa, Canada
+
|http://www.virusbtn.com/conference/vb2008/
+
|-
+
|ANZFSS - 19th International Symposium on the Forensic Sciences
+
|Oct 06-09, Melbourne, Australia
+
|http://www.anzfss2008.org.au/
+
|-
+
|13th European Symposium on Research in Computer Security
+
|Oct 06-08, Malaga, Spain
+
|http://www.isac.uma.es/esorics08/
+
|-
+
|Economic and High Tech Crime Summit 2008
+
|Oct 07-08, Memphis, TN
+
|http://summit.nw3c.org/
+
|-
+
|3nd International Annual Workshop on Digital Forensics & Incident Analysis
+
|Oct 09, Malaga, Spain
+
|http://www.icsd.aegean.gr/wdfia08/
+
|-
+
|Anti-Phishing Working Group eCrime Researchers Summit
+
|Oct 15-16, Atlanta, GA
+
|http://www.ecrimeresearch.org/
+
|-
+
|2008 HTCIA International Training Conference
+
|Oct 22-28, Atlantic City, NJ
+
|http://www.htcia.org/conference.shtml
+
|-
+
|DeepSec 2008
+
|Nov 11-14, Vienna, Austria
+
|https://deepsec.net/
+
|-
+
|2009 DoD Cyber Crime Conference
+
|Jan 24-30, St. Louis, MO
+
|http://www.dodcybercrime.com/
+
|-
+
|5th Annual IFIP WG 11.9 International Conference on Digital Forensics
+
|Jan 25-28, Orlando, FL
+
|http://www.ifip119.org/Conferences/
+
|-
+
|American Academy of Forensic Sciences Annual Meeting
+
|Feb 16-21, Denver, CO
+
|http://www.aafs.org/default.asp?section_id=meetings&page_id=aafs_annual_meeting
+
|-
+
|24th Annual ACM Symposium on Applied Computing - Computer Forensics Track
+
|Mar 08-12, Honolulu, HI
+
|http://www.acm.org/conferences/sac/sac2009
+
|-
+
|2009 Techno Security Conference
+
|May 31- Jun 03, Myrtle Beach, SC
+
|http://www.techsec.com/index.html
+
|-
+
|Mobile Forensics World 2009
+
|Jun 01 - Jun 06, Chicago, IL
+
|http://www.mobileforensicsworld.com
+
|}
+
  
== On-going / Continuous Training ==
+
The recovery password is a long series of digits broken up into 8 segments.
{| border="0" cellpadding="2" cellspacing="2" align="top"
+
<pre>
|- style="background:#bfbfbf; font-weight: bold"
+
123456-123456-123456-123456-123456-123456-13456-123456
! Title
+
</pre>
! Date/Location or Venue
+
! Website
+
|-
+
|Basic Computer Examiner Course - Computer Forensic Training Online
+
|Distance Learning Format
+
|http://www.cftco.com
+
|-
+
|Computer Forensics Training and CCE&trade; Testing for Litigation Support Professionals
+
|Third weekend of every month (Fri-Mon), Dallas, TX
+
|http://www.md5group.com
+
|-
+
|Evidence Recovery for Windows Vista&trade;
+
|First full week every month, Brunswick, GA
+
|http://www.internetcrimes.net
+
|-
+
|Evidence Recovery for Windows Server&reg; 2003 R2
+
|Second full week every month, Brunswick, GA
+
|http://www.internetcrimes.net
+
|-
+
|Evidence Recovery for the Windows XP&trade; operating system
+
|Third full week every month, Brunswick, GA
+
|http://www.internetcrimes.net
+
|-
+
|Linux Data Forensics Training
+
|Distance Learning Format
+
|http://www.crazytrain.com/training.html
+
|-
+
|MaresWare Suite Training
+
|First full week every month, Atlanta, GA
+
|http://www.maresware.com/maresware/training/maresware.htm
+
|-
+
|SANS On-Demand Training
+
|Distance Learning Format
+
|http://www.sans.org/ondemand/?portal=69456f95660ade45be29c00b0c14aea1
+
|-
+
|}
+
  
==[[Scheduled Training Courses]]==
+
Note that there is no white space in the recovery password including not at the end, e.g. EnCase does not accept the recovery password if there is trailing white space.
 +
 
 +
The recovery password can be recovered from a BitLocker enabled computer provided it can be logged into or if stored in escrow.
 +
 
 +
The basic steps are:
 +
 
 +
# Make a "traditional" full disk image.
 +
# Recover the password, this can be done by booting the original computer, or by creating a clone and booting the clone.  (booting from a clone has not been tested at this time.)
 +
## Once booted log into the computer
 +
## Use the BitLocker control panel applet to display the password.  This can also be done from the command-line.
 +
## record the password
 +
#:
 +
# For EnCase v6 or higher with the encryption module installed
 +
## Load the image into EnCase
 +
## You will be prompted for the password.  Simply enter it and continue.
 +
## If you prefer to have an un-encrypted image to work with other tools or share with co-workers, you can "re-acquire" the image from within EnCase.  The new image will have unencrypted data.
 +
## After adding the encrypted image into your case, simply right click on the drive in the left panel and select acquire.  Select "do not add to case".  You will be presented a dialog window to enter new information about the image.  Make sure the destination you select for your new image does not exist.
 +
 
 +
== Live Imaging ==
 +
 
 +
=== FTK Live Imaging of a physical drive ===
 +
 
 +
Using FTK Imager lite, it was determined a live image of the physical system disk resulted in an image with an encrypted bitlocker container on it.
 +
 
 +
Note that the phrase "physical" here corresponds directly with FTK Imagers use of the term in their image acquire menu.
 +
 
 +
=== FTK Live Imaging of a logical partition ===
 +
 
 +
This has not been verified to work or fail at this time.
 +
 
 +
Note that the phrase "logical" here corresponds directly with FTK Imagers use of the term in their image acquire menu.
 +
 
 +
=== FTK Live Files and Folders collections ===
 +
 
 +
This was not attempted, but it seems reasonable to assume this will collect unencrypted files.
 +
 
 +
== See Also ==
 +
* [[BitLocker Disk Encryption]]
 +
* [[Defeating Whole Disk Encryption]]
 +
 
 +
[[Category:Disk encryption]]
 +
[[Category:Windows]]

Revision as of 02:03, 15 July 2013

Imaging Options

There are multiple ways to image a computer with bitlocker security in place.

Traditional Imaging

One can make a traditional image with the image containing encrypted information.

Options to offline decrypt the information, provided the password or recovery password is available, exists some are:

The recovery password is a long series of digits broken up into 8 segments.

123456-123456-123456-123456-123456-123456-13456-123456

Note that there is no white space in the recovery password including not at the end, e.g. EnCase does not accept the recovery password if there is trailing white space.

The recovery password can be recovered from a BitLocker enabled computer provided it can be logged into or if stored in escrow.

The basic steps are:

  1. Make a "traditional" full disk image.
  2. Recover the password, this can be done by booting the original computer, or by creating a clone and booting the clone. (booting from a clone has not been tested at this time.)
    1. Once booted log into the computer
    2. Use the BitLocker control panel applet to display the password. This can also be done from the command-line.
    3. record the password
  3. For EnCase v6 or higher with the encryption module installed
    1. Load the image into EnCase
    2. You will be prompted for the password. Simply enter it and continue.
    3. If you prefer to have an un-encrypted image to work with other tools or share with co-workers, you can "re-acquire" the image from within EnCase. The new image will have unencrypted data.
    4. After adding the encrypted image into your case, simply right click on the drive in the left panel and select acquire. Select "do not add to case". You will be presented a dialog window to enter new information about the image. Make sure the destination you select for your new image does not exist.

Live Imaging

FTK Live Imaging of a physical drive

Using FTK Imager lite, it was determined a live image of the physical system disk resulted in an image with an encrypted bitlocker container on it.

Note that the phrase "physical" here corresponds directly with FTK Imagers use of the term in their image acquire menu.

FTK Live Imaging of a logical partition

This has not been verified to work or fail at this time.

Note that the phrase "logical" here corresponds directly with FTK Imagers use of the term in their image acquire menu.

FTK Live Files and Folders collections

This was not attempted, but it seems reasonable to assume this will collect unencrypted files.

See Also