Forensic Blogs

An aggregator for digital forensics blogs

November 15, 2018 by LCDI

SIFT Update 2

Introduction

This month at the Senator Leahy Center for Digital Investigation, we started analyzing our data. As a part of the SIFT research team, we used our knowledge of digital forensics to scan through files in order to find artifacts that would help us put our criminal behind bars. After we found artifacts, we went on to conduct keyword searches where we found very useful evidence for our investigation.

Experience

We have learned so much over the past month about SIFT. SIFT allows for artifact gathering, and keyword searching. Artifact gathering involves going into the imaged drive and gathering potentially incriminating files, or anything that could be useful to a digital investigators analysis. Pair that with keyword searching and a strong case can be built and argued in criminal court.

Originally SIFT had major issues in the srch_strings function within Autopsy. This was a major issue because srch_strings is used for keyword searching, an essential part of a digital investigator’s case.  Being new to SIFT was difficult because as a team we did not know how to fix this problem. Eventually, we learned the issue occurred because SIFT runs an older, unsupported version of Autopsy (Autopsy 2.24). The only way to fix this was to import a new version of srch_strings into SleuthKit. After importing the new version, we managed to get keyword searching to work with up to three characters, and on the letter “e” alone, got 3 million hits.

For our project, our data gen had us searing for “cyanide”. Therefore, a keyword search for “cyanide” would be useful in finding files that contain information about the poisoning.

Conclusion

Finding artifacts and searching for keywords are extremely important to a digital investigator. Within the coming weeks, we are going to be recovering deleted files from the disk image. Stay tuned for our next blog about recovering deleted files.

The post SIFT Update 2 appeared first on The Leahy Center for Digital Investigation.

Read the original at: The Leahy Center for Digital InvestigationFiled Under: Digital Forensics, Uncategorized Tagged With: Autopsy, Blog Post, Champlain College, cyanide, Digital forensics, files, forensics, investigator, LCDI, Projects, SIFT, Sleuthkit, Student Work

About

This site aggregates posts from various digital forensics blogs. Feel free to take a look around, and make sure to visit the original sites.

  • Contact
  • Aggregated Sites

Suggest a Site

Know of a site we should add? Enter it below

Sending

Jump to Category

All content is copyright the respective author(s)