IJoFCS (2006) 1, 41-44 The International Journal of FORENSIC COMPUTER SCIENCE
www.IJoFCS.org
Computer Forensics with The Sleuth Kit and The Autopsy Forensic Browser
Ricardo Kléber Martins Galvão
Abstract - Computer invasions, with the purpose of extinguishing data, are on the rise. To retrieve erased data system audits, a computer must recover and identify the extinguished data content. For these types of inquiries, UNIX-like machines can utilize The Coroner’s Toolkit (TCT). However, because this solution has limits regarding auditing partitions, UNIX appears to necessitate similar tools that investigate other types of archives systems. The set of tools presented in this article supplants this lack of recognizing and investigating partitions NTFS, FAT, UFS, EX2 and EXT3, generating reports detailed in a browser, beyond the resources already implemented for the TCT.
Key Words: Computer Forensics, Network Security.
I.INTRODUCTION Data retrieval, conducted with the unrm tool, is a straightforward process. The device under The use of TCT tools (unrm + Lazarus) for investigation must be informed about the file to investigating free blocks in EXT2 partitions is which will be generated the image of the non- desirable for visualizing the data browser with allocated blocks, as in Figure 2. This example hyperlinks, indicating potential recovered file illustrates an IDE hard disk that is mounted as types with labels (letters → file type), as described slave and its first partition (hdb1) is investigated. in Figure 1. unrm /dev/hdb1 >> imagem_hd.out Fig. 2. Example: Non-allocated blocks retrieved with the TCT/unrm tool.
The resulting image is then submitted to the Lazarus tool (Figure 3) which interprets it to generate the HTML files to be viewed by any browser, as shown in Figure 5.
lazarus -h -D . –H . -w . \ imagem_disquete.out Figura: 1 Labels of the report presented by TCT/Lazarus tool. Figura 3 Example: Using the TCT/Lazarus tool to generate visualization for the browser. 42 Computer Forensics with The Sleuth Kit and The Autopsy Forensic Browser
Main parameters used by Lazarus are described The new EXT3 features, when compared to in Figure 4. EXT2, have caused system administrators to switch to this file system, thus reducing the number of -h creates a HTML document (viewed by any browser); computers that are amenable to investigation -D
b) The web interface is not user-friendly Despite labels and colors used to identify the block types identified by Lazarus (Figure 5), the web interface lacks familiarity and ease-of-use due to assuming label knowledge and not providing additional information about the data.
III. Sleuth Kit + The Autopsy Forensic Browser
3.1 Sleuth Kit
The Sleuth Kit open source tool kit for digital forensics developed by Brian Carrier to be used in UNIX systems (Linux, OS X, FreeBSD, OpenBSD and Solaris) is capable of analyzing NTFS, FAT, UFS, EXT2 and EXT3 file systems. Figura 5: Example of browser visualization of a result In its first version, the Sleuth Kit was called generated by TCT/Lazarus The @stake Sleuth Kit (TASK). TASK consists of a collection of commands based on the TCT II. TCT ANALYSIS command line. With this kit, the user can examine the computer By critically analyzing TCT and its unrm file systems through a non-intrusive approach and Lazarus tools, we identified two negative that is not dependent on the investigated machine factors, with regard to efficiency, that should operating system to process the file system, be considered when adopting them as a main deleted and hidden from files DOS, BSD, Mac, Sun solution for uncovering erased data system and Linux partitions. audits. Specifically, these include: The results generated by Sleuth Kit tools are used by another tool – The Autopsy Forensic Browser – which presents such details as a) The investigated partition type is limited image integrity, keyword searches and other The TCT tools do not recognize NTFS, FAT or automatized operations about the investigated EXT3 partitions, making them of little use when partition through a graphical interface. performing forensic investigations in machines with Microsoft Windows and/or Linux operating systems with EXT3 file systems. http://www.sleuthkit.org http://www.sleuthkit.org/autopsy Ricardo Kléber Martins Galvão 43
3.1.1 Data Input Features ffind: Searches for file names allocated and 1. The Sleuth Kit analyzes the file system images non-allocated from a point in the metadata generated by the dd command – found structure; on every UNIX and available for Microsoft fls: Lists named file and directories from an Windows – in a non-proprietary format; analyzed image. 2. The data format of the investigated partition Metadata tools: Conduct the processing of the (NTFS, FAT, UFS, EXT2 or EXT3) does not metadata structure, storing details about the files. depend on the operating system of the icat: Extracts data units from a file specified by machine on which the Sleuth Kit is run; a metadata address (i-node number); 3. The Sleuth Kit can be run from a UNIX system ifind: Searches for a metadata structure; during an incident response, showing files ils: Lists a metadata structure and its content in that might be hidden by running rootkits a pipe-delimited format; without modifying the files (not even A- istat: Shows the statistics and details about a Time) under investigation. metadata structure (i-nodes) in a human-reading format. 3.1.2 Search Techniques Data Unit tools: Conducts the processing of the Deleting and allocating file names listings; data units in which the file contents are saved (FAT Showing details and content of all NTFS and NTFS clusters, and UFS, EXT2 and EXT3 blocks/ attributed (including Alternate Data fragments). 10 Streams); dcat : Extracts the content of a file unit; 11 Showing file system details and meta-data dls : Lists details about data units and can structure; extract the non-allocated space from a file Creating file activity timelines that can also system; 12 be imported by spreadsheets for creating dstat : Shows statistics about a file unit in graphics and reports; human-reading format; 13 Visualizing hash files in a hash database, dcalc : Calculates where the data of an image customizing databases that can be created of non-allocated spaces (generated from a DLL) with the md5sum tool; are in the original image. This tool is used when Filetype-based organizing (grouping, evidence is found in a non-allocated space. for example, executables, images and Media management tools: These tools receive a documents). Can also generate thumbnails disk image as input and analyze the management of the images that were found for a quicker structure on which they are organized. 14 analysis. mmls : Shows a disk layout, including non- allocated spaces. The output identifies a partition type and its size, in order to ease the 3.1.3 General Features use of dd to extract partitions. The output is The Sleuth Kit was written in C and Perl and classified based on a boot sector in order to uses an aspect of the TCT code. It has been tested ease identification on layout. under Linux, Mac OS X, Open & FreeBSD, Solaris and Other tools: CIGWIN platforms. The information written herein hfind15: Uses a binary classification algorithm refers to version 1.70 of July/02/2004. There to find hashes; are add-ons on the project’s website that can be mactime16: Uses fsl and isl tools output as input applied as patches to improve certain Sleuth Kit to create a timeline of a file activity; features. fFor example, showing Unicode names in NTFS partitions and image indexing by name. http://www.sleuthkit.org/sleuthkit/man/ffind.html http://www.sleuthkit.org/sleuthkit/man/fls.html 3.1.4 Details on Sleuth Kit tools http://www.sleuthkit.org/sleuthkit/man/icat.html File system tools: These conduct the general http://www.sleuthkit.org/sleuthkit/man/ifind.html processing of data from file systems, including http://www.sleuthkit.org/sleuthkit/man/ils.html http://www.sleuthkit.org/sleuthkit/man/istat.html layout and allocation structures. 10 http://www.sleuthkit.org/sleuthkit/man/dcat.html fstat: Shows details of the file system and 11 http://www.sleuthkit.org/sleuthkit/man/dls.html statistics, including layout, size and labels. 12 http://www.sleuthkit.org/sleuthkit/man/dstat.html File Names tools: Conduct the processing of the file 13 http://www.sleuthkit.org/sleuthkit/man/dcalc.html 14 http://www.sleuthkit.org/sleuthkit/man/mmls.html names structure, typically found in parent directories. 15 http://www.sleuthkit.org/sleuthkit/man/hfind.html 16 http://www.sleuthkit.org/sleuthkit/man/mactime.html http://www.sleuthkit.org/sleuthkit/man/fsstat.html 44 Computer Forensics with The Sleuth Kit and The Autopsy Forensic Browser
sorter17: Classifies files based on their type IV. Running Sleuth Kit + The Autopsy and executes extension checks and hash da- Forensic Browser from a CD tabase checks. Most auditing procedures of suspect and/ 3.2 The Autopsy Forensic Browser or compromised machines must be conducted This Open Source tool written in Perl provides a without removing the hard drive. As you HTML-based graphical interface for Sleuth Kit that cannot trust the analyzed machine operating is similar to a file manager, showing details about system, it is recommended that the user deleted data and file system structures, with results implements a live-CD prepared for this task, that can be accessed using a HTML browser. which contains basic UNIX tools that are as Distinct from Lazarus, Autopsy does not require long as Sleuth Kit, Autopsy and other auditing any tool to be executed previously. It can work tools. directly over mounted partitions or over image files Some distributions have CD ISO generated by the dd command. images with this goal, making it easier for Autopsy can be considered an interface for the user to conduct forensic jobs. Two of Sleuth Kit, as everything done through its interface these distributions are presented below: generates Sleuth Kit commands which are interpreted Professional Hackers Linux Assault Kit and shown again by Autopsy. (http://www.phlak.org) Running Autopsy is simple; after its installed, to Morphix-based, created by Alex de the user runs the autopsy binary that will indicate Landgraaf. the address/port to be accessed by a browser. These Knoppix security tools distribution (http:// data can be customized in an Autopsy config file. www.knoppix-std.org) Knoppix-based, with light window managers; 3.2.1 Additional Features ideal for forensics use in older machines. When being run, Autopsy asks for the creation of a new Case or to open a previous Case. Each References created Case is saved as a directory to make it easier to search for audits that it created. [1] CARRIER, Brian. File Activity Timelines. Available online on One or more Hosts must be specified inside September/2006 at URL http://www.sleuthkit.org/sleuthkit/docs/ref_ each Case, and these hosts will be sub-directories timeline.html. of Cases which specify, for example, more than [2] CARRIER, Brian. The FAT File System – Sleuth Kit Implementation Notes (SKINs). Available online on September/2006 at URL http:// one machine being audited in the same process. www.sleuthkit.org/sleuthkit/docs/skins_fat.html. After this, all menus present Sleuth Kit [3] CARRIER, Brian. The NTFS File System – Sleuth Kit Implementation functions to be invoked at each request by the Notes (SKINs). Available online on September/2006 at URL http:// web interface. www.sleuthkit.org/sleuthkit/docs/skins_ntfs.html. [4] CARRIER, Brian. The Sleuth Kit Informer – Issue #13 - UNIX Incident Verification with Autopsy. Available online on September/2006 at URL http://www.sleuthkit.org/informer/sleuthkit-informer-13.txt. 17 http://www.sleuthkit.org/sleuthkit/man/sorter.html [5] LUCAS, Charles. Running Sleuthkit and Autopsy Under Windows. Available online on September/2006 at URL http://www.memophage. net/Running_Sleuthkit_and_Autopsy_Under_Windows.pdf.