Forensic Blogs

An aggregator for digital forensics blogs

by

DFIR: A New Scope

As we reach the end of the third week of our internship in the Munich Cyber Security Program (led by ComCode), we have continued to research the best tools and practices available to help tackle the problem of doing forensics analysis on terabytes worth of data. Due to the lack of complete and publicly available research into big data forensics, we have conducted extensive research into the more broad categories of digital forensics in the hopes to find tools and techniques that may already exist without the “Big Data” label. Categories such as image forensics, malware forensics, threat intelligence, open-source intelligence, IOC/threat hunting, and more were included in our goal to help find or create a solution. As imagined, this ended up being an overwhelming amount of information. The scope was constantly shifting as new things were discovered, ruled out due to time restraints, or were decided to be too broad to be worth pursuing.

Research has been equally divided between the two of us based upon areas of strength (Ian taking care of Malware Analysis and Threat Intelligence, while Kaya handled Hard Drive/RAM Imaging and Artifact Analysis/Management). This has kept us from going off the deep end with niche research we were largely unfamiliar with. It has also allowed for shared reports to be quickly thrown together, reworked into different formats, and delivered in a legible format. The research has ranged from the broad overview of our preferred topics to the minute details of possible tools and duties which are necessary for that particular area of forensic analysis. This has allowed us to easily switch gears into our new project goal; a comprehensive to-do guide for forensic analysts dealing with a Big Data incident.  

The original plan for this summer was to find a working solution for big data in incident response. Daunting from the beginning, it was decided this past week that the best course of action wouldn’t be to “solve” this, but rather to make a to-do guide for incident response analysts when they walk into a case. A rough draft in progress, we have started outlining best practices, known tools, and methodologies, as well as considerations one has to take while handling an incident. Even without the change in the final product, there have been numerous challenges to our research; the biggest being that both of us come from a more criminal law-related forensic background, while this project requires us to think from a true (network) incident response background. We are working on changing the way we think and view things while adapting to a finalized project end goal that originally wasn’t in the cards. What we got out of this week is that you have to be flexible and be able to shake things off as they happen, because in a field as volatile as this, what you read last week is probably already obsolete or proven otherwise.

Follow us for more updates on this project!

For further questions about Munich Cyber Security Program, or this project please feel free to contact mcsp@comcode.de

-Written by Kaya Overholtzer ‘22 //Digital Forensics & Cybersecurity & Ian Eubanks '21 // Computer & Digital Forensics

The post DFIR: A New Scope appeared first on The Leahy Center for Digital Forensics & Cybersecurity.

by

Big Data Forensics Introduction

When one hears forensics, they often jump right into the fantasy of crime shows, bad guys, and analyzing biological evidence in a lab. Occasionally there’s a plot point of using cell records to shatter someone’s alibi, but very rarely is there any true deep dive on what it takes to analyze a computer, cell phone, tablet, server, cloud, whole social media account, or even Fitbit. Despite the lack of visibility, there isn’t a day that goes by where one can escape hearing about a data leak, ransomware scenario, hacking, privacy and security laws, or how technology will somehow be the downfall of society. Digital evidence is beginning to outweigh all other types of evidence in criminal, enterprise, and civil matters. The proper handling, analysis, and knowledge of the digital landscape are of the utmost importance in handling and responding to most issues. 

I think it’s important to quickly go over the current standard and best practices of forensic analysis. The National Institute of Standards and Technology (NIST) has broken it down into 4 basic steps when it comes to handling digital evidence. 

Identification: Being able to identify what evidence (or device) is relevant to the investigation Collection: Copying the evidence in a way that is forensically sound and admissible in court (using write blockers, or taking a copy in such a way that doesn’t disturb the original)Analysis: Using a suite of tools and methodologies to analyze what was collectedPresentation: Creating a deliverable that contains all evidence gathered, how it was gathered, and proof of its existence

An important part of the analysis process is being able to make connections. If you have a phone, smartwatch, PC, and a user’s Twitter account, how do you put them all together to prove that a crime was committed? If you have four different file servers, an email server, and an active directory server, and 300 user accounts, how do you put all of the logs together to figure out where the data breach was? Typically, you would analyze each separately (usually with a different tool or methodology), and then manually and painstakingly put it all together to create a timeline of what happened. There are a handful of tools that boast about being able to make connections (such as Cellebrite’s UFED suite), but none can connect every single artifact in a way that is meaningful to examiners. 

On its own, this is a clear issue. The individual analysis of sources takes up substantial amounts of time, even with multiple examiners. Then you add in that the lack of centralization of tools means that most places don’t have a way of splitting up work between analysts easily. This process further complicates investigations by combining multiple people’s results. To make matters even more challenging, the amount of data being analyzed is not getting any smaller. The International Data Corporation estimates that the average person created ~1.7 megabytes per second in 2020. According to a survey done by Forensics Focus in 2013 (the latest figure I was able to find), over half of the investigators said that at least half of their investigations involved more than a terabyte of data and that nearly 20% of all cases involved more than five terabytes of data. Considering the age of this data, and the fact that you can now buy cell phones with one terabyte of data from mainstream companies such as Samsung, I have to assume this figure is on the much higher side now. 

The goal of my research this summer is to attempt to find a solution, or a set of solutions to address the issues of Big Data in forensics. I will be looking at open-source, commercial, and even built-in tools within server environments to find a tool or suite of tools that can help examiners tackle large amounts of data in practical ways. This is a very large task, which is why I am working with Ian Eubanks in this endeavor as we both work to find an answer to this. 

Some issues already run into during this process is the lack of prior research into this topic. There are plenty of forum posts asking about tips and tools to handle large amounts of data, some small undergrad thesis’ that attempt to address this broadly, and a handful of small hour-long presentations from security experts that talk about the issue in general but offer no real solutions. What little information there is seems to be locked behind a paywall (SANS mostly). Since starting, most time spent has been on research and getting used to working outside of my room and plotting how to best tackle this project.

STAY UP TO DATE WITH TWITTER, INSTAGRAM, FACEBOOK, AND LINKEDIN SO YOU KNOW WHAT WE’RE UP TO!

-Written by Kaya Overholtzer ‘22 //Digital Forensics & Cybersecurity

The post Big Data Forensics Introduction appeared first on The Leahy Center for Digital Forensics & Cybersecurity.

by

So you Think your Data is Safe?

On March 26, 2015, Leahy Center for Digital Investigation Director, Jonathan Rajewski, presented to an audience at the Data4Decisions Conference in Raleigh, NC. His talk focused on big data, analytics and how data security / breach are areas that must be “top of mind” of every employee at an organization. In his presentation, Rajewski stressed that […]

The post So you Think your Data is Safe? appeared first on Computer & Digital Forensics Blog.