Bachelor’s thesis Bachelor of Engineering, Information and Communications Technology 2020 Perla Rocío Ramírez Sanabria DIGITAL FORENSICS – Guidelines and Tools for a Digital Evidence Investigation Process. A Case Study for a Business Data Leak BACHELOR’S THESIS | ABSTRACT TURKU UNIVERSITY OF APPLIED SCIENCES Bachelor of Engineering, Information and Communications Technology 2020 | 45, 79 Perla Rocío Ramírez Sanabria DIGITAL FORENSICS • Guidelines and Tools for a Digital Evidence Investigation Process. A Case Study for a Business Data Leak The objective of this thesis was to provide a suitable and admissible analytical framework for a digital forensic analysis carried out by an investigator. In this thesis these concepts are explained in-depth to provide what could be considered as a guide for the execution of a digital evidence investigation. It is important to note that this investigation can usually, or rather must, end in a judicial process. The theoretical framework of this thesis has been developed by consulting books written by specialists in the field of digital forensics, ISO/IEC standard documents, as well as models described by different government organizations and user guides for the required tools. In the case study, the concepts explained previously are exposed in the case of an insider threat performing a data leak to a company in the competition. After performing the analysis of the evidence acquired for the case, it was possible to determine that a data breach performed by an insider threat took place. The results of the practical analysis are decisive in a judicial court if the procedures of the analysis have been followed, hence the importance of the proper application of the methods and use of the tools. KEYWORDS: Digital Forensics, Cybersecurity, Expert Examiner, Investigation, Digital Evidence, Cybercrime CONTENTS 1 INTRODUCTION 6 1.1 Cybercrime 7 1.2 Digital Forensics 8. PI 2 DIGITAL EVIDENCE 10 2.1 Locard’s Principle 10 2.2 Best Evidence Rule 11 2.3 Hearsay 11 2.4 Characteristics of Digital Evidence 12 2.5 Chain of Custody 13 3 DIGITAL EVIDENCE INVESTIGATION PROCESS 14 3.1 Phases 15 3.1.1 Evidence Preparation. Policy and Procedure Development 15 3.1.2 Evidence Assessment 16 3.1.3 Evidence Acquisition 18 3.1.4 Evidence Examination 19 3.1.5 Documenting and Reporting 21 3.2 Methods 22 3.2.1 RFC 3227 22 3.2.2 ISO/IEC 27037:2012 22 3.2.3 ISO/IEC 27041:2015 24 3.2.4 ISO/IEC 27042:2015 24 3.2.5 ISO/IEC 27043:2015 25 3.2.6 ISO/IEC 27050 25 4 TOOLS FOR DIGITAL FORENSICS ANALYSIS 27 4.1 Autopsy 27 4.2 PhotoRec 29 4.3 FTK Imager 29 4.4 The Volatility Framework 30 4.5 Advanced Digital Forensics Workstations 31 4.5.1 Ondata 31 4.5.2 ADALID 33 4.6 Portable Hardware Devices for Digital Forensics 35 4.6.1 Logicube: Forensic Talon Ultimate 35 4.6.2 Tableau Forensic Imager TX1 36 4.6.3 Ditto Forensic FieldStation by CRU 36 5 CASE STUDY: INSIDER THREAT – DATA LEAK 37 5.1 Description of the case 37 5.2 Assessment 37 5.2.1 Materials 37 5.2.2 Insider Threat: Definition and Indicators 38 5.3 Acquisition: Disk Image creation with FTK Imager 39 5.4 Examination: Data analysis with Autopsy 39 5.4.1 Web Search 40 5.4.2 Web Downloads 40 5.4.3 Web History 41 5.4.4 Windows Artifacts 42 5.4.5 E-Mail Messages 46 5.4.6 Tags 47 5.5 Reporting 48 6 DISCUSSION 49 7 CONCLUSION 50 REFERENCES 51 APPENDICES Appendix 1. NIST: Computer Forensics Tools and Techniques Catalog Appendix 2. Other Forensics Tools Appendix 3. Autopsy – Installation, Features, User Guide Appendix 4. PhotoRec – Operating Systems, File Systems, File Formats Appendix 5. FTK Imager – Installation, Features, User Guide Appendix 6. Volatility – Operating Systems, Formats Appendix 7. RFC 3227 – Guidelines for Evidence Collection and Archiving Appendix 8. Talon Ultimate – Datasheet Appendix 9. Tableau Forensic Imager TX1 – Datasheet Appendix 10. Ditto Forensic FieldStation – Datasheet Appendix 11. Report generated by FTK Imager Appendix 12. Report generated by Autopsy FIGURES Figure 1. Graphical representation of the Locard's Principle (Casey, 2011) ................ 11 Figure 2. Two files on a Windows machine that differ by only one letter have significantly different MD5 Values (Casey, 2011) ........................................................ 12 Figure 3. A comparison of terminology related to digital investigation process models. (Casey, 2011) ............................................................................................................. 14 Figure 4. Application of different ISO/IEC standards in the phases of a digital forensics investigation ................................................................................................................ 22 Figure 5. Zeus workstation .......................................................................................... 34 Figure 6. Hades workstation ....................................................................................... 34 Figure 7. Poseidon workstation ................................................................................... 35 Figure 8. Talon Ultimate Imaging Device .................................................................... 35 Figure 9. Tableau Forensic Imager TX1 ...................................................................... 36 Figure 10. Ditto Forensic FieldStation ......................................................................... 36 Figure 11. Tree Viewer of the case in Autopsy ............................................................ 40 Figure 12. Web Search in Autopsy ............................................................................. 40 Figure 13. Web Downloads in Autopsy ....................................................................... 41 Figure 14. Web History in Autopsy .............................................................................. 41 Figure 15. Open/Save MRU Artifact in Autopsy .......................................................... 42 Figure 16. Table ’Activity’: Opening original downloaded files ............................... 43 Figure 17. Table ’Activity’: Opening renamed files and modifying ’random 2’ ........ 43 Figure 18. Table ’Activity’: Encryption with PGP Tool ............................................ 44 Figure 19. Table ’Activity’: Outlook usage ............................................................. 44 Figure 20. Table ’Activity_PackageID’ ................................................................. 44 Figure 21. Table ’Activity_PackageID’ ................................................................. 44 Figure 22. Last-Visited MRU Artifact in Autopsy ......................................................... 45 Figure 23. Shortcut (LNK) Files Artifact in Autopsy ..................................................... 45 Figure 24. LNK Files extracted from Autopsy in the investigator’s system .................. 46 Figure 25. Sent E-Mail Message by the suspect: Encrypted Data ............................... 46 Figure 26. Sent E-Mail Message by the suspect: Public and Private Keys .................. 46 Figure 27. Sent E-Mail Message by the suspect: Passphrase..................................... 47 Figure 28. Tags in Autopsy ......................................................................................... 47 Figure 29. Report Generating Wizard in Autopsy ........................................................ 48 Figure 30. Autopsy Workflow ........................................................................................ 2 Figure 31. Timeline Analysis’ First Interface. Picture downloaded from https://www.sleuthkit. org/autopsy/timeline.php ............................................................. 3 Figure 32. Timeline Analysis’ Second Interface. Picture downloaded from https://www. sleuthkit.org/autopsy/timeline.php ................................................................................. 4 Figure 33. Autopsy’s User Interface .............................................................................. 8 Figure 34. Tree Viewer example ................................................................................... 9 Figure 35. Single File Extraction ................................................................................... 9 Figure 36. Example of "Thumbnail Results Viewer" .................................................... 10 Figure 37. Example of "Table Results Viewer" ............................................................ 11 Figure 38. Example of "Result Content Viewer" .......................................................... 11 Figure 39. Example of "Hex Content Viewer" .............................................................. 12 Figure 40. Example of "Media Content Viewer"........................................................... 12 Figure 41. Example of "String Content Viewer" ........................................................... 13 Figure 42. Example of "Text Content Viewer" ............................................................. 13 Figure 43. Lists tab in the Keyword Search Configuration Dialog ................................ 14 Figure 44. String Extraction tab in the Keyword Search Configuration Dialog ............. 15 Figure 45. General tab in the Keyword Search Configuration Dialog........................... 15 Figure 46. Modules Pipelines ...................................................................................... 16 Figure 47. Ingest Modules Configuration .................................................................... 17 Figure 48. Ingest Box .................................................................................................