computer forensics principles and practices l.
Download
Skip this Video
Loading SlideShow in 5 Seconds..
Computer Forensics Principles and Practices PowerPoint Presentation
Download Presentation
Computer Forensics Principles and Practices

Loading in 2 Seconds...

play fullscreen
1 / 32

Computer Forensics Principles and Practices - PowerPoint PPT Presentation


  • 141 Views
  • Uploaded on

Computer Forensics Principles and Practices. by Volonino, Anzaldua, and Godwin. Chapter 7: Investigating Windows, Linux, and Graphics Files. Objectives. Conduct efficient and effective investigations of Windows systems Find user data and profiles in Windows folders

loader
I am the owner, or an agent authorized to act on behalf of the owner, of the copyrighted work described.
capcha
Download Presentation

Computer Forensics Principles and Practices


An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.


- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -
Presentation Transcript
computer forensics principles and practices

Computer ForensicsPrinciples and Practices

by Volonino, Anzaldua, and Godwin

Chapter 7: Investigating Windows, Linux, and Graphics Files

objectives
Objectives
  • Conduct efficient and effective investigations of Windows systems
  • Find user data and profiles in Windows folders
  • Locate system artifacts in Windows systems
  • Examine the contents of Linux folders

© Pearson Education Computer Forensics: Principles and Practices

objectives cont
Objectives (Cont.)
  • Identify graphic files by file extensions and file signatures
  • Identify what computer forensics graphic tools and techniques can reveal and recover

© Pearson Education Computer Forensics: Principles and Practices

introduction
Introduction

In many cases you may have gigabytes or even terabytes of data that must be searched for evidence. This chapter helps maximize efficiency of the search by showing default locations of file storage and hiding techniques of wrongdoers.

© Pearson Education Computer Forensics: Principles and Practices

investigating windows systems
Investigating Windows Systems
  • Activities of the user result in user data
    • User profiles
    • Program files
    • Temporary files (temp files)
    • Special application-level files

© Pearson Education Computer Forensics: Principles and Practices

investigating windows systems cont
Investigating Windows Systems(Cont.)
  • System data and artifacts are generated by the operating system
    • Metadata
    • Windows system registry
    • Event logs or log files
    • Swap files
    • Printer spool
    • Recycle Bin

© Pearson Education Computer Forensics: Principles and Practices

hidden files
Hidden Files
  • Files that do not appear by default are hidden files
  • These can be viewed through the following steps:
    • Open Windows Explorer
    • Go to Tools > Folder Options > View > Hidden files and folders
    • Select Show hidden files and folders
    • Click OK

© Pearson Education Computer Forensics: Principles and Practices

investigating windows systems cont8
Investigating Windows Systems (Cont.)
  • Data and user authentication weaknesses of FAT
    • Userids are not required
    • Only attributes are associated with files or folders
  • Data and user authentication improvements in NTFS
    • Separation of duties
    • Anonymity of the user

© Pearson Education Computer Forensics: Principles and Practices

investigating windows systems cont9
Investigating Windows Systems (Cont.)
  • Identify the operating systems of a target hard drive by:
    • Operating system folder names
    • The folder for the Recycle Bin
    • The construction of the user root folders because of the differences in the way user data is kept

© Pearson Education Computer Forensics: Principles and Practices

finding user data and profiles in windows folders
Finding User Data and Profiles in Windows Folders
  • Documents and Settings folder
    • Contains a user root folder for each user account created on the computer
    • Windows NT and above automatically install
      • Administrator
      • All users
      • Default user (hidden)

© Pearson Education Computer Forensics: Principles and Practices

finding user data and profiles in windows folders cont
Finding User Data and Profiles in Windows Folders (Cont.)
  • Data stored in the user root folder:
    • Desktop settings, such as wallpaper, screensavers, color schemes, and themes
    • Internet customizations, such as the homepage, favorites, and history
    • Application parameters and data, such as e-mail and upgrades
    • Personal files and folders, such as My Documents, My Pictures, and so on

© Pearson Education Computer Forensics: Principles and Practices

finding user data and profiles in windows folders cont12
Finding User Data and Profiles in Windows Folders (Cont.)
  • Some of the subfolders in the user root folder include:
    • Application data (hidden)
    • Cookies
    • Desktop
    • Favorites
    • Local Settings (hidden)
    • My Documents
    • NetHood (hidden)

© Pearson Education Computer Forensics: Principles and Practices

location of user root folders
Location of User Root Folders

© Pearson Education Computer Forensics: Principles and Practices

in practice temp internet files provide valuable e evidence
In Practice: Temp Internet Files Provide Valuable E-Evidence
  • Data stored in the Temporary Internet Files folder can be valuable supporting evidence, even if deleted
  • Statute 18 U.S.C. §2256(8) rules as pornography any data stored on computer disk that can be converted into a visual image

© Pearson Education Computer Forensics: Principles and Practices

investigating system artifacts
Investigating System Artifacts
  • Types of metadata
    • Descriptive: describes a resource for purposes such as discovery and identification
    • Structural: indicates how compound objects are put together
    • Administrative: provides information to help manage a resource, such as when it was created, last accessed, and modified
  • Be alert for alternate data streams (ADS)

© Pearson Education Computer Forensics: Principles and Practices

in practice searching for evidence
In Practice: Searching for Evidence
  • Do not use the suspect system itself to carry out a search for evidence
  • Using Windows to search and open files can change the file’s metadata
  • Such changes may cause evidence to be disallowed in court

© Pearson Education Computer Forensics: Principles and Practices

investigating system artifacts cont
Investigating System Artifacts(Cont.)
  • Registry
    • Can reveal current and past applications, as well as programs that start automatically at bootup
    • Viewing the registry requires a registry editor
  • Event logs track system events
    • Application log tracks application events
    • Security log shows logon attempts
    • System log tracks events such as driver failures

© Pearson Education Computer Forensics: Principles and Practices

investigating system artifacts cont18
Investigating System Artifacts(Cont.)
  • Swap file/page file
    • Used by the system as virtual memory
    • Can provide the investigator with a snapshot of volatile memory
  • Print spool
    • May contain enhanced metafiles of print jobs
  • Recycle Bin/Recycler
    • Stores files the user has deleted

© Pearson Education Computer Forensics: Principles and Practices

shredding data
“Shredding” Data
  • Third-party software packages can be used to delete data and actually overwrite the information, essentially shredding the data

© Pearson Education Computer Forensics: Principles and Practices

investigating linux systems
Investigating Linux Systems
  • Windows can have many users with administrator access, but Linux has only one administrative account, called root
  • Root account has complete control of the system
  • In Linux, all devices, partitions, and folders are seen as a unified file system
  • A typical installation creates three partitions: the root, boot, and swap partitions

© Pearson Education Computer Forensics: Principles and Practices

investigating linux systems cont
Investigating Linux Systems(Cont.)
  • The Linux file system includes the data structure as well as the processes that manage the files in the partition
  • Linux’s virtual file system provides a common set of data structures:
    • Superblock
    • Inode
    • Dentry
    • Data block

© Pearson Education Computer Forensics: Principles and Practices

investigating linux systems cont22
Investigating Linux Systems (Cont.)
  • Seven different file types available in Linux:
    • Normal files
    • Directories
    • Links
    • Named pipes
    • Sockets
    • Block devices
    • Character devices

© Pearson Education Computer Forensics: Principles and Practices

investigating linux systems cont23
Investigating Linux Systems (Cont.)
  • Default Linux installations generally include system directories such as the following:
    • /boot
    • /dev
    • /etc
    • /home
    • /lib
    • /lost+found
    • /mnt
  • /proc
  • /root
  • /sbin
  • /tmp
  • /usr
  • /var

© Pearson Education Computer Forensics: Principles and Practices

investigating linux systems cont24
Investigating Linux Systems (Cont.)
  • Key Linux files and directories to investigate:
    • /etc/passwd
    • /etc/shadow
    • /etc/hosts
    • /etc/sysconfig/
    • /etc/syslog.conf

© Pearson Education Computer Forensics: Principles and Practices

investigating linux systems cont25
Investigating Linux Systems (Cont.)
  • Deleted files
    • Check the Trash can for each login user for deleted files that can be recovered
  • Using grep to search file contents
    • Grep allows for sophisticated character-based data searches
  • Compressed files
    • Some Linux applications such as OpenOffice automatically compress data files

© Pearson Education Computer Forensics: Principles and Practices

graphic file forensics
Graphic File Forensics
  • The investigator can use file signatures to determine where data starts and ends and the file type
    • File extension (such as .jpg) one way to identify a graphic file
    • A user can easily change the file extension, but the data header does not change
    • Forensic tools can resolve conflicts between file extensions and file types

© Pearson Education Computer Forensics: Principles and Practices

graphic file forensics cont
Graphic File Forensics (Cont.)
  • The process of retrieving all relevant pieces of a file is called data carving or data salvaging
  • An investigator may have to reconstruct the data header using file signature information
  • Layered graphic files (such as Photoshop or Corel) can hide information behind layers
  • Graphics saved as JPEG, TIFF, GIF, or BMP do not have layers

© Pearson Education Computer Forensics: Principles and Practices

graphic file forensics cont28
Graphic File Forensics (Cont.)
  • Steganography is a form of data hiding in which a message is hidden within another file
    • Data to be hidden is the carrier medium
    • The file in which the data is hidden is the steganographic medium
  • Both parties communicating via steganography must use the same stego application

© Pearson Education Computer Forensics: Principles and Practices

graphic file forensics cont29
Graphic File Forensics (Cont.)
  • Steganography is difficult to detect; the following clues may indicate stego use
    • Technical capabilities or sophistication of the computer’s owner
    • Software clues on the computer
    • Other program files that indicate familiarity with data-hiding methods
    • Multimedia files
    • Type of crime being investigated

© Pearson Education Computer Forensics: Principles and Practices

in practice child pornography
In Practice: Child Pornography
  • Hiding criminal content within “innocent” files can allow perpetrators such as child pornographers to exchange information
  • A scenario is described by which child pornographers can easily pass information to others in the ring

© Pearson Education Computer Forensics: Principles and Practices

summary
Summary
  • Search times can be reduced through the use of default folders and operating system artifacts
  • The skill level of the user will determine whether this is an effective use of time in the case

© Pearson Education Computer Forensics: Principles and Practices

summary cont
Summary (Cont.)
  • A savvy user can hide data through:
    • Nonstandard file folders
    • Renaming file types
    • Using layered graphics
    • Masquerading data with steganographic techniques

© Pearson Education Computer Forensics: Principles and Practices