Difference between pages "Word Document (DOCX)" and "First Responder's Evidence Disk"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
(External Links)
 
 
Line 1: Line 1:
DOCX is the file format for Microsoft Office 2007 and later.  
+
{{Infobox_Software |
 +
  name = FRED |
 +
  maintainer = Jesse Kornblum |
 +
  os = {{Linux}}, {{Windows}} |
 +
  genre = {{Incident response}} |
 +
  license = {{commercial}} |
 +
  website = [http://darkparticlelabs.com/projects darkparticlelabs.com/projects] |
 +
}}
  
DOCX should not be confused with [[DOC]], the format used by earlier versions of Microsoft Office.
+
The First Responder's Evidence Disk, or FRED, is a script based [[Incident Response|incident response]] tool. It was designed to capture volatile information from a computer system for later analysis without modifying anything on the victim. It consists of a batch file used to execute a set of known good tools that gather the state of a victim computer system. It was similar to the [[IRCR]] program and has been widely imitated by other tools. Many other incident response tools used names similar to FRED.
  
= Container Format =
+
== Usage ==
  
DOCX is written in an XML format, which consists of a [[ZIP archive]] file containing [[XML]] and binaries. Content can be analysed without modification by unzipping the file (e.g. in WinZIP) and analysing the contents of the archive.
+
The program was distributed as a compressed 1.44 MB floppy image. The examiner runs this image on a safe system and writes the FRED program out to a piece of removable media such as a floppy disk or USB device. The examiner then connects this device to the victim machine. When run, the FRED program writes information out to an audit file on the removable device. The examiner takes this audit file back to the safe system for later analysis. The audit file can also be sent to other investigators if desired.
  
The file _rels/.rels contains information about the structure of the document.  It contains paths to the metadata information as well as the main XML document that contains the content of the document itself.
+
== History ==
  
Metadata information are usually stored in the folder docProps. Two or more XML files are stored inside that folder, app.xml that stores metadata information extracted from the Word application itself and core.xml that stores metadata from the document itself, such as the author name, last time it was printed, etc.
+
FRED was developed by [[Jesse Kornblum]] for the [[Air Force Office of Special Investigations]] starting in the fall of 2000 and was first released in 2001. The tool was publicly unveiled the following year at the [[Digital Forensic Research Workshop|DFRWS Conference]]. Although the component parts of FRED were not released, mostly due to licensing restrictions, Kornblum did present a paper, ''[http://dfrws.org/2002/papers/Papers/Jesse_Kornblum.pdf Preservation of Fragile Digital Evidence by First Responders]'', that included the FRED script.  
  
Another folder contains the actual content of the document, in a Word document, or an .docx document the folder's name is word.  A XML file called document.xml is the main document, containing most of the content of the document itself.
+
A version of the FRED script was later incorporated into the [[Helix]] disk.  
  
= Relationship to OOXML =
+
There was a proposal for a program to process the audit files into [[HTML]], but this never came to fruition.
  
Office Open XML is an open XML standard developed by Microsoft for word processing documents, spreadsheets, presentations and charts. The OOXML standard was submitted to the ISO for approval. After initially being rejected over technical concerns, the ISO approved a modified version as ISO/IEC 29500:2008. Microsoft intended to use the OOXML standard for its Office suite. However, Office does not support the standard that the ISO approved, it only supports the standard that was originally rejected by the ISO[http://arstechnica.com/microsoft/news/2010/04/iso-ooxml-convener-microsofts-format-heading-for-failure.ars]. As of Office 2010, Microsoft has still not brought its software into compliance with the standard.
+
Since 2004 FRED has been maintained by the [[Air Force Computer Emergency Response Team]]. The current version of FRED (version 4) has been redesigned as a single executable, with remote collection capabilities, and uses Native API functions. The audit file uses PKI for encryption to protect the contents from tampering and disclosure. The publicly available version has the remote functionality as well as the PKI encryption capabilities turned off.
  
For most purposes OOXML may be considered a subset of DOCX (DOCX contains additional features, like OLE serialization).
+
== Trivia ==
  
Documentation on OOXML may provide a guide to analysing a DOCX file.
+
The desire for a recursive [[MD5]] program for FRED inspired the development of [[md5deep]].
  
= Metadata =
+
== See Also ==
 +
* [[IRCR]]
 +
* [[COFEE]]
  
== Core (Document) Properties ==
+
== External Links ==
<pre>
+
* [http://darkparticlelabs.com/projects Project site]
docProps/core.xml
+
</pre>
+
 
+
<pre>
+
&lt;?xml version="1.0" encoding="UTF-8" standalone="yes"?&gt;
+
&lt;cp:coreProperties xmlns:cp="http://schemas.openxmlformats.org/package/2006/metadata/core-properties"
+
    xmlns:dc="http://purl.org/dc/elements/1.1/"
+
    xmlns:dcterms="http://purl.org/dc/terms/"
+
    xmlns:dcmitype="http://purl.org/dc/dcmitype/"
+
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"&gt;
+
&lt;dc:creator&gt;User 1&lt;/dc:creator&gt;
+
&lt;cp:lastModifiedBy&gt;User 2&lt;/cp:lastModifiedBy&gt;
+
&lt;cp:revision&gt;3&lt;/cp:revision&gt;
+
&lt;dcterms:created xsi:type="dcterms:W3CDTF"&gt;2012-11-07T23:29:00Z&lt;/dcterms:created&gt;
+
&lt;dcterms:modified xsi:type="dcterms:W3CDTF"&gt;2013-08-25T22:18:00Z&lt;/dcterms:modified&gt;
+
&lt;/cp:coreProperties&gt;
+
</pre>
+
 
+
= External Links =
+
 
+
* [http://msdn.microsoft.com/en-us/library/aa338205.aspx Introducing the Office (2007) Open XML File Formats], by [[Microsoft]], May 2006
+
* [http://dublincore.org/documents/2012/06/14/dcmi-terms/?v=elements# DCMI Metadata Terms]
+
* [http://www.simson.net/clips/academic/2009.IEEE.DOCX.pdf The new XML Office Document Files: Implications For Forensics], [[Simson L. Garfinkel]] and James Migletz
+
* [http://blog.kiddaland.net/2009/06/office-2007-metadata/ Perl script that displays metadata information that is extracted from an OpenXML document], by [[Kristinn Gudjonsson]], June 2009
+
* [http://blog.kiddaland.net/2009/07/antiword-for-office-2007/ Perl script that displays the content of a Docx document, similar to Antiword], by [[Kristinn Gudjonsson]], July 2009
+
* [http://computer-forensics.sans.org/blog/2009/07/10/office-2007-metadata/ Office 2007 Metadata], by [[Kristinn Gudjonsson]], July 10, 2009
+
 
+
[[Category:File Formats]]
+

Latest revision as of 05:35, 18 January 2014

FRED
Maintainer: Jesse Kornblum
OS: Linux,Windows
Genre: Incident Response
License: Commercial
Website: darkparticlelabs.com/projects

The First Responder's Evidence Disk, or FRED, is a script based incident response tool. It was designed to capture volatile information from a computer system for later analysis without modifying anything on the victim. It consists of a batch file used to execute a set of known good tools that gather the state of a victim computer system. It was similar to the IRCR program and has been widely imitated by other tools. Many other incident response tools used names similar to FRED.

Usage

The program was distributed as a compressed 1.44 MB floppy image. The examiner runs this image on a safe system and writes the FRED program out to a piece of removable media such as a floppy disk or USB device. The examiner then connects this device to the victim machine. When run, the FRED program writes information out to an audit file on the removable device. The examiner takes this audit file back to the safe system for later analysis. The audit file can also be sent to other investigators if desired.

History

FRED was developed by Jesse Kornblum for the Air Force Office of Special Investigations starting in the fall of 2000 and was first released in 2001. The tool was publicly unveiled the following year at the DFRWS Conference. Although the component parts of FRED were not released, mostly due to licensing restrictions, Kornblum did present a paper, Preservation of Fragile Digital Evidence by First Responders, that included the FRED script.

A version of the FRED script was later incorporated into the Helix disk.

There was a proposal for a program to process the audit files into HTML, but this never came to fruition.

Since 2004 FRED has been maintained by the Air Force Computer Emergency Response Team. The current version of FRED (version 4) has been redesigned as a single executable, with remote collection capabilities, and uses Native API functions. The audit file uses PKI for encryption to protect the contents from tampering and disclosure. The publicly available version has the remote functionality as well as the PKI encryption capabilities turned off.

Trivia

The desire for a recursive MD5 program for FRED inspired the development of md5deep.

See Also

External Links