Florida State University Libraries Electronic Theses, Treatises and Dissertations The Graduate School 2015 Building an Intelligent Assistant for Digital Forensics Umit Karabiyik Follow this and additional works at the FSU Digital Library. For more information, please contact [email protected] FLORIDA STATE UNIVERSITY COLLEGE OF ARTS AND SCIENCES BUILDING AN INTELLIGENT ASSISTANT FOR DIGITAL FORENSICS By UMIT KARABIYIK A Dissertation submitted to the Department of Computer Science in partial fulfillment of the requirements for the degree of Doctor of Philosophy 2015 Copyright c 2015 Umit Karabiyik. All Rights Reserved. Umit Karabiyik defended this dissertation on July 13, 2015. The members of the supervisory committee were: Sudhir Aggarwal Professor Directing Dissertation Simon Foo University Representative Zhenhai Duan Committee Member Xiuwen Liu Committee Member The Graduate School has verified and approved the above-named committee members, and certifies that the dissertation has been approved in accordance with university requirements. ii This dissertation is dedicated to my beloved wife Tu˘gba and our lovely daughter Azra Hamide iii ACKNOWLEDGMENTS First of, I would like to express my deepest appreciation to my advisor and major professor Dr. Sudhir Aggarwal. I cannot admit how much I learned from him and how he inspired me during my studies. Specifically, I appreciate the patient guidance, advice and motivation that Dr. Aggarwal provided me during our meetings and would like to thank him for being very supportive and understanding over the past 5 years. Without his guidance and persistent help this dissertation would not have been possible. I feel very fortunate to have had the opportunity of working with him. I would like to extend my appreciation to my committee members Dr. Xiuwen Liu, Dr. Zhenhai Duan and the university representative Dr. Simon Foo, for their valuable time and recommendations during my studies. I would also thank my friends Dr. Elvan Aktas, Dr. Fatih Oncul and Dr. Kemal Akkaya for their motivation and giving me excellent suggestions about the academic life in the USA. I also would like to thank my fellow friend Shiva Houshmand for her friendship and collaborations in several projects. I also extend my thanks to Clayton Butler for his assistance and the time that he spend with me to test my system at the ECIT lab. I also express my gratitude to the FSU Department of Computer Science support staff. I particularly thank Eleanor McNealy, Daniel Clawson and Edwina Hall for their assistance handling many administrative issues at both department and university level. I would also like to thank all the FSU Global Engagement administrative staff, particularly to my exchange visitor adviser Tanya Schaad, for their support and help for dealing with all the immigration bureaucracy in the US. I would like to thank my parents for believing in me and supporting me in every aspect for many years. I would also like to thank all my loyal friends in the US and in Turkey. Last and certainly not least, I would like to thank my beloved wife Tu˘gba Karabiyik and my lovely daughter Azra Hamide Karabiyik, for filling my life with energy, peace and love. iv TABLE OF CONTENTS ListofTables.......................................... vii ListofFigures ......................................... viii Abstract............................................. ... x 1 Introduction 1 2 Related Work 5 3 Background and Literature Review 8 3.1 DigitalForensics .................................... 8 3.1.1 Digital Forensics Phases . 8 3.1.2 Digital Forensics Branches . 10 3.1.3 Computer Forensics . 10 3.1.4 Other Digital Forensics Branches . 19 3.1.5 Digital Forensics Tools . 21 3.1.6 CurrentProblems ................................. 25 3.2 ArtificialIntelligence ............................... 27 3.2.1 Knowledge Representation . 28 3.2.2 ExpertSystems................................... 28 4 AUDIT: Automated Disk Investigation Toolkit 31 4.1 Preliminary Design of AUDIT . 31 4.2 Building the Knowledge Base for AUDIT . 34 4.2.1 Investigator Level Knowledge . 35 4.2.2 Tools Level Knowledge . 36 4.3 Configuration, Parameterization and Integration of Tools . 37 4.4 WorkingwithAUDIT ................................... 39 4.5 TestingAUDIT...................................... 42 4.5.1 GraphicFilesSearch................................ 42 4.5.2 SensitiveNumberSearch ............................. 43 5 Advanced Automated Disk Investigation Toolkit 45 5.1 New High-Level Design of AUDIT . 45 5.1.1 Database Component . 46 5.1.2 Knowledge Base Component . 48 5.1.3 Core Engine Component . 49 5.1.4 ExpertSystemDesigninJess. 50 5.2 Model of Hierarchical Disk Investigation . 52 5.2.1 TheModel ..................................... 53 5.3 ReportinginAUDIT................................... 58 v 6 Evaluation & Experimental Results 61 6.1 ExperimentalSetup ................................. 61 6.2 TestingPart1...................................... 64 6.3 TestingPart2...................................... 66 7 Conclusion 70 7.1 SummaryoftheProblem ................................. 70 7.2 Solution: Automated Disk Investigation Toolkit . 71 7.3 Contributions...................................... 71 7.4 FutureDirections.................................. 72 Appendix A Copyright Permission 74 Bibliography .......................................... 75 BiographicalSketch ..................................... 81 vi LIST OF TABLES 5.1 Schema of the tools table in the AUDIT database . 47 6.1 Extension type and quantity of files in dataset . 62 6.2 Size, type and quantity of horse pictures . 63 6.3 Number of files in each space on the disk . 64 6.4 Finding graphics and email files . 64 6.5 Hidden document files and their locations . 65 6.6 Results of CCN, SSN and email address search . 65 6.7 Analysis times with and without AUDIT . 66 6.8 Sample benchmark disk images . 66 6.9 Type and fragmentation information for documents files . 68 6.10 Type and fragmentation information for graphics files . 69 vii LIST OF FIGURES 3.1 The digital forensics investigative process . .......... 9 3.2 Digital forensics branches . 11 3.3 Internal structure of a hard disk drive [58] . 12 3.4 A hard disk divided up into partitions and volumes . 13 3.5 Example hard disk volume organized into three partitions . 14 3.6 Disk layout and master boot record (MBR) space . 16 3.7 Volume slack on hard disk . 17 3.8 Partition slack on hard disk . 17 4.1 High-level design of AUDIT . 32 4.2 The tools table in the AUDIT database . 33 4.3 Simple Example of a CLIPS Rule in AUDIT . 35 4.4 Salience declaration rule . 35 4.5 Facts initially added to the knowledge base . 36 4.6 New facts added to the knowledge base . 36 4.7 Therulerunsforcreditcardsearch . 37 4.8 Facts assumed to be added to de knowledge base . 39 4.9 Function used for invoking scalpel for graphic file carving . 40 4.10 Starting screen of the user interface of AUDIT . 41 4.11 Popup showing files recovered from unallocated space . 43 4.12 Find SSNs output report for Credit Card and Social Security Numbers . 44 5.1 High-level design of AUDIT . 46 5.2 Sample entries in the new tools table in the AUDIT database . 47 5.3 A rule used for updating the knowledge base . 48 5.4 Original fact before updating . 48 viii 5.5 Modifiedfactafterupdating ............................ 49 5.6 A rule used for updating the database . 49 5.7 CreatingaJesstemplateinJava . 51 5.8 A rule used in AUDIT for email address search . 51 5.9 Executing bulk extractor for email address search . 52 5.10 Model of hierarchical disk analyses . 54 5.11 Command line for TestDisk and sample output . 55 5.12 Command line for gpart and sample output . 55 5.13 Partial output of fsstat . 56 5.14 Outputofmmls ...................................... 56 5.15 Example of a hierarchical disk analysis . 58 5.16 Partial examination report of a single partition disk image . 59 5.17 Partial inference report for slack space extraction . 60 6.1 Directorytreestructureintestdiskimages . 62 6.2 Filehidingprocess................................ 63 6.3 Sample of non ASCII file names . 67 6.4 Layoutoftestdisk1................................... 67 6.5 Layoutoftestdisk2................................... 67 6.6 Layout of nps-2010-emails.E01 disk image . 69 ix ABSTRACT Software tools designed for disk analysis play a critical role today in digital forensics investigations. However, these digital forensics tools are often difficult to use, usually task specific, and generally require professionally trained users with IT backgrounds. The relevant tools are also often open source requiring additional technical knowledge and proper configuration. This makes it difficult for investigators without some computer science background to easily conduct the needed disk analysis. In this dissertation, we present AUDIT, a novel automated disk investigation toolkit that sup- ports investigations conducted by non-expert (in IT and disk technology) and expert investigators. Our system design and implementation of AUDIT intelligently integrates open source tools and guides non-IT professionals while requiring minimal technical knowledge about the disk structures and file systems of the target disk image. We also present a new hierarchical disk investigation model which leads AUDIT to systematically examine the disk in its totality based on its phys- ical and logical structures. AUDIT’s capabilities as an intelligent digital assistant are evaluated through a series of experiments comparing it with a human investigator as well as against standard benchmark disk images.