An Evaluation of Forensic Tools for Linux Master Thesis 60 Credits Bård
Total Page：16
File Type：pdf, Size：1020Kb
UNIVERSITY OF OSLO Department of Informatics An Evaluation of Forensic Tools for Linux Emphasizing EnCase and PyFlag Master thesis 60 credits Bård Egil Hermansen November 8, 2010 Acknowledgements First and foremost, I would like to thank my advisors for providing insight and expertise, for lending necessary equipment, hardware and literature, for guiding me in the right direction when I needed it, and for reviewing this document. The thesis would not be the same without your input (in alphabetical order): • Anders Skolseg Bruvik • Audun Jøsang • Bente Christine Aasgard • Margrete Raaum I would also like to thank Guidance Software for providing a copy of EnCase Forensics, which was indispensable for this paper. Thanks to my friends and family for all the support and encouragement during the writing of this thesis, especially my friends Eivind Bergstøl for voluntarily offering to review this document, even though he was not required to, and Martin Wam for providing technical input during debugging of PyFlag. Finally I want to thank my grandmother, a kind and caring woman, Karen Helene Hermansen, who passed away while I was working on this thesis. – Bård i Abstract This thesis presents an in-depth assessment and comparison of several digital forensic tools, with a special emphasis on two particular tool kits. The first one called EnCase Forensics is a commercially available toolkit used by a large number of law enforcement around the world. The second one called PyFlag is an open source alternative used with great success in the winning contribution to the highly acclaimed Digital Forensics Research Workshop (DFRWS) anno 2008. Although tool kits are evaluated as a whole, the main focus is key evidence discovery capabilities. Considering that most research in this field is based on the Microsoft Windows platform, while little research has been published regarding analysis of a Linux system, we investigate these tool kits primarily in a Linux environment. We conduct real world forensic acquisition and analysis of a Linux file system using the aforementioned tool kits, along with a Linux acquisition tool called dd. During the course of this thesis we have specified testing procedures, problems encountered during testing, and the final results. iii Contents Acknowledgements . i Abstract . iii 1 Introduction 1 1.1 Main Contributions . 1 1.2 Scope of Thesis . 1 1.3 The Importance of Digital Forensics . 2 1.4 Introduction to Digital Forensics . 2 1.5 Categories of Cybercrime . 3 1.6 Three Different Scientific Methods . 4 1.6.1 Theory . 4 1.6.2 Abstraction . 4 1.6.3 Design . 4 1.7 Discussion and Selection of Scientific Method . 5 2 Background 7 2.1 Why Tools are Needed . 7 2.2 Common Practice Digital Forensics Procedure . 9 2.2.1 The National Institute of Justice model . 9 2.2.2 The Model Taught at the Norwegian Police Academy . 9 2.2.3 The Model Proposed by Brian Carrier . 10 2.2.4 Comparison of the Three Models . 11 2.2.5 General Guidelines for Digital Forensics Procedures . 13 2.2.6 Digital Forensics in Practice at New York State Police . 14 2.2.7 Why This is Relevant . 15 2.3 The Process of Digital Forensics . 15 2.3.1 Preparation . 16 2.3.2 Document the Crime Scene . 16 2.3.3 Decision: Live- or Post Mortem Analysis . 17 2.3.4 How to Power Down a Suspect Computer . 17 2.3.5 Create Forensic Copy . 17 2.3.6 Copy to a Forensically Wiped Hard Drive . 18 2.3.7 Compute CRC and Hash . 18 2.3.8 Evidence Searching and Analysis . 18 2.3.9 Event Reconstruction . 19 2.3.10 Documentation . 19 2.4 Where to Look for Evidence . 20 2.4.1 Disk Forensics . 20 2.4.2 Network Forensics . 31 2.4.3 Memory Forensics . 32 2.5 Forensics Equipment . 32 2.5.1 Portable Hard Disk Duplicators . 33 2.6 Analysis Environments and Modes . 33 2.6.1 Trusted Environments . 33 2.6.2 Untrusted Environments . 33 2.7 Admissibility of Evidence . 34 v CONTENTS 2.8 An Introduction to Tools . 35 2.8.1 Two Categories . 35 2.8.2 Acquisition Tools . 36 2.8.3 Analysis Tools . 38 3 Test Specifications 41 3.1 Basis for Selecting Test Specifications . 41 3.1.1 Additional Basis . 41 3.2 Selection of Test Specifications . 42 3.2.1 Acquisition . 42 3.2.2 Automation . 45 3.2.3 Evidence Searching . 46 3.2.4 Expandability . 51 3.2.5 Performance . 51 3.2.6 Extensiveness . 53 3.2.7 Memory Extraction . 53 3.2.8 Usability . 54 3.2.9 Deterministic . 54 3.2.10 Accuracy . 54 4 Toolkit Functionality 55 4.1 EnCase . 55 4.1.1 EnCase Evidence File Format . 55 4.1.2 Layout and Usability . 56 4.1.3 File System Support . 58 4.1.4 Acquisition . 58 4.1.5 Searching for Evidence in EnCase . 59 4.1.6 Automation Tools . 61 4.1.7 Recovery . 61 4.1.8 Additional Analysis Features . 62 4.2 PyFlag . 64 4.2.1 Layout and Usability . 64 4.2.2 File System Support . 65 4.2.3 Acquisition . 66 4.2.4 Searching for Evidence in PyFlag . 66 4.2.5 Automation Tools . 67 4.2.6 Additional Analysis Features . 69 4.2.7 Architecture . 70 4.2.8 The Sleuth Kit . 75 5 Testing 77 5.1 Test Preparations . 77 5.1.1 Send and Receive E-mail . 77 5.1.2 Populate Browser History . 77 5.1.3 Insert Various File Types for Report Generation . 79 5.1.4 Create Compressed File Archives . 79 5.1.5 Rename Files . 79 5.1.6 Create Deleted Files . 79 5.2 Acquisition . 80 5.2.1 Preparing to run LinEn and dd . 80 5.2.2 Pre-acquisition Hash Calculation . 82 5.2.3 Running LinEn . 82 5.2.4 Post-acquisition Hash Verification for Linen . 83 5.2.5 Running dd . 83 5.2.6 Verify Number of Blocks Acquired . 83 5.2.7 Post-acquisition Hash Verification for dd . 83 vi CONTENTS 5.2.8 Case creation . 83 5.2.9 Problems During Preparation . 84 5.2.10 Suggestions for Improvement . 85 5.3 Analysis . 85 5.3.1 Hash Analysis . ..