Digital Forensics with Open Source Tools This page intentionally left blank Digital Forensics with Open Source Tools Cory Altheide Harlan Carvey Technical Editor Ray Davidson AMSTERDAM • BOSTON • HEIDELBERG • LONDON NEW YORK • OXFORD • PARIS • SAN DIEGO SAN FRANCISCO • SINGAPORE • SYDNEY • TOKYO Syngress is an imprint of Elsevier Acquiring Editor: Angelina Ward Development Editor: Heather Scherer Project Manager: Andre Cuello Designer: Joanne Blank Syngress is an imprint of Elsevier 225 Wyman Street, Waltham, MA 02451, USA © 2011 Elsevier, Inc. All rights reserved. No part of this publication may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or any information storage and retrieval system, without permission in writing from the publisher. Details on how to seek permission, further information about the Publisher’s permissions policies and our arrangements with organizations such as the Copyright Clearance Center and the Copyright Licensing Agency, can be found at our website: www.elsevier.com/permissions. This book and the individual contributions contained in it are protected under copyright by the Publisher (other than as may be noted herein). Notices Knowledge and best practice in this field are constantly changing. As new research and experience broaden our understanding, changes in research methods or professional practices, may become necessary. Practitioners and researchers must always rely on their own experience and knowledge in evaluating and using any information or methods described herein. In using such information or methods they should be mindful of their own safety and the safety of others, including parties for whom they have a professional responsibility. To the fullest extent of the law, neither the Publisher nor the authors, contributors, or editors, assume any liability for any injury and/or damage to persons or property as a matter of products liability, negligence or otherwise, or from any use or operation of any methods, products, instructions, or ideas contained in the material herein. Library of Congress Cataloging-in-Publication Data Application submitted British Library Cataloguing-in-Publication Data A catalogue record for this book is available from the British Library. ISBN: 978-1-59749-586-8 Printed in the United States of America 11 12 13 14 10 9 8 7 6 5 4 3 2 1 Typeset by: diacriTech, India For information on all Syngress publications visit our website at www.syngress.com Contents About the Authors �����������������������������������������������������������������������������������������������������xi Acknowledgments ...................................................................................................xiii Introduction ..............................................................................................................xv CHAPTER 1 Digital Forensics with Open Source Tools ��������������������������������� 1 Welcome to “Digital Forensics with Open Source Tools” ..............1 What Is “Digital Forensics?” ..........................................................1 Goals of Forensic Analysis .........................................................2 The Digital Forensics Process ....................................................3 What Is “Open Source?” .................................................................4 “Free” vs. “Open”.......................................................................4 Open Source Licenses ................................................................5 Benefits of Open Source Tools ........................................................5 Education ....................................................................................5 Portability and Flexibility ...........................................................6 Price ............................................................................................6 Ground Truth ..............................................................................7 Summary .........................................................................................7 References .......................................................................................8 CHAPTER 2 Open Source Examination Platform ������������������������������������������ 9 Preparing the Examination System .................................................9 Building Software.......................................................................9 Installing Interpreters ...............................................................10 Working with Image Files ........................................................10 Working with File Systems ......................................................10 Using Linux as the Host ................................................................10 Extracting Software ..................................................................11 GNU Build System ...................................................................12 Version Control Systems ..........................................................16 Installing Interpreters ...............................................................16 Working with Images ...............................................................19 Using Windows as the Host ..........................................................26 Building Software.....................................................................26 Installing Interpreters ...............................................................27 Working with Images ...............................................................31 Working with File Systems ......................................................34 Summary .......................................................................................37 References .....................................................................................37 vi Contents CHAPTER 3 Disk and File System Analysis ����������������������������������������������� 39 Media Analysis Concepts ..............................................................39 File System Abstraction Model ................................................40 The Sleuth Kit ...............................................................................41 Installing the Sleuth Kit ............................................................41 Sleuth Kit Tools ........................................................................42 Partitioning and Disk Layouts .......................................................52 Partition Identification and Recovery .......................................52 Redundant Array of Inexpensive Disks ....................................53 Special Containers .........................................................................54 Virtual Machine Disk Images ...................................................54 Forensic Containers ..................................................................55 Hashing .........................................................................................56 Carving ..........................................................................................58 Foremost ...................................................................................59 Forensic Imaging ...........................................................................61 Deleted Data .............................................................................61 File Slack ..................................................................................62 dd ..............................................................................................64 dcfldd ........................................................................................65 dc3dd ........................................................................................66 Summary .......................................................................................67 References .....................................................................................67 CHAPTER 4 Windows Systems and Artifacts ��������������������������������������������� 69 Introduction ...................................................................................69 Windows File Systems ..................................................................69 File Allocation Table ................................................................69 New Technology File System ...................................................71 File System Summary ..............................................................77 Registry .........................................................................................78 Event Logs ....................................................................................84 Prefetch Files .................................................................................87 Shortcut Files ................................................................................89 Windows Executables ...................................................................89 Summary .......................................................................................93 References .....................................................................................93 CHAPTER 5 Linux Systems and Artifacts ��������������������������������������������������� 95 Introduction ...................................................................................95 Linux File Systems ........................................................................95 Contents vii File System Layer .....................................................................96