Investigating and Implementing an Email Forensic Readiness Architecture

Investigating and Implementing an Email Forensic Readiness Architecture by F.R. Van Staden Submitted in fulfilment of the requirements for the degree Magister Scientiae (Computer Science) in Faculty of Engineering, Built-Environment and Information Technology at the University of Pretoria August 2017 Investigating and Implementing an Email Forensic Readiness Architecture by F.R. Van Staden supervised by Prof H.S. Venter Department of Computer Science Abstract Email forensic investigations rely on the collection and analysis of digital forensic evidence collected from email systems. Problems arise when the digital forensic evidence needed for the email forensic investigation is no longer available or there is a huge amount of email data that can be collected which take time to sift through to find the digital forensic evidence that is actually needed. The email digital forensic readiness (eDFR) architecture, as proposed in this dissertation, endeavours to address these problems. The eDFR architecture is based on the digital forensic readiness process described in ISO 27043. To ensure that the collected email data can be used as digital forensic evidence a process to validate the collected email data was created. The validation process uses data collected from the email IP headers to validate the data in the SMTP headers ensuring that the SMTP header data was not spoofed or in any way changed. The IP header data is stored in an audit database together with the email data so that the validation process can be executed at any time. An audit database is used to store the collected data to ensure that once the data is stored it cannot be tampered with. The digital forensic evidence collected using the eDFR architecture was found to be useable as part of an email forensic investigation. It was also found to be useful for other processes such as creating a graph representation of email sent and received by an email system or a group of email systems. It was shown that implementing the eDFR architecture could be achieved in an economical way that has almost no impact on current email systems. i Table of Contents Chapter 1 : Introduction ................................................................................................... 2 1.1 Introduction ............................................................................................................ 2 1.2 Terms...................................................................................................................... 3 1.3 Problem statement ................................................................................................... 5 1.4 Goals ...................................................................................................................... 7 1.5 Scope ...................................................................................................................... 7 1.6 Dissertation Structure .............................................................................................. 8 Chapter 2 : Email systems .............................................................................................. 12 2.1 Introduction .......................................................................................................... 12 2.2 Simple Message Transfer Protocol ........................................................................ 13 2.3 Internet Protocol ................................................................................................... 15 2.4 Security Architecture for Internet Protocol ............................................................ 16 2.5 An overview of email system components ............................................................ 17 2.5.1 Basic email systems ....................................................................................... 17 2.5.2 Anti-Spam servers .......................................................................................... 20 2.5.3 Archiving server ............................................................................................ 21 2.5.4 DNS Server .................................................................................................... 21 2.6 Information security and email systems ................................................................. 23 2.7 Legislation and governance with regard to electronic communication ................... 23 2.8 Conclusion ............................................................................................................ 24 Chapter 3 : State of the art of Spam and Anti-Spam ....................................................... 26 3.1 Introduction .......................................................................................................... 26 3.2 Intelligent Filters ................................................................................................... 28 3.3 Content Scanning .................................................................................................. 28 3.4 Block list, black list, white list and mailbox authentication .................................... 29 3.5 Anti-spoofing SMTP service extensions ................................................................ 30 3.6 Honey-pots ........................................................................................................... 31 3.7 Botnets .................................................................................................................. 31 3.8 Conclusion ............................................................................................................ 33 ii Chapter 4 : Digital Forensics, Email forensics and Digital Forensic Readiness ............... 34 4.1 Introduction .......................................................................................................... 34 4.2 Digital Forensics ................................................................................................... 34 4.3 Email forensics ..................................................................................................... 35 4.4 Digital Forensic Readiness .................................................................................... 36 4.4.1 Designing a DFR process ............................................................................... 36 4.4.2 Performance monitoring tools ........................................................................ 39 4.4.3 Network monitoring tools .............................................................................. 41 4.5 DFR processes, Big-Data and Hadoop .................................................................. 41 4.6 Conclusion ............................................................................................................ 44 Chapter 5 : Planning the eDRF architecture .................................................................... 46 5.1 Introduction .......................................................................................................... 46 5.2 Creating the Scenario definition ............................................................................ 48 5.3 Identification of potential digital evidence sources ................................................ 50 5.4 Planning the collection, storage and handling of data ............................................ 50 5.5 Planning the analysis of the data ........................................................................... 51 5.6 Planning incident detection ................................................................................... 51 5.7 Defining system architecture ................................................................................. 51 5.8 Summary .............................................................................................................. 53 Chapter 6 : Identifying sources of potential digital evidence for the eDRF architecture .. 56 6.1 Introduction .......................................................................................................... 56 6.2 Automating the collection and storage of SMTP header data ................................. 57 6.3 Adding validation to SMTP header ....................................................................... 60 6.3.1 Adding digital forensic data to SMTP ............................................................ 60 6.3.2 Adding digital forensic data to IP ................................................................... 62 6.3.3 Gap-detection Algorithm................................................................................ 65 6.4 Implementing log file sniffing using a performance monitoring tool...................... 69 6.4.1 Setup of the Performance monitoring tool to collect digital forensic data ....... 69 6.4.2 Collecting data from the log files using custom probes ................................... 71 6.4.3 Using the data for a digital forensic investigation ........................................... 73 6.4.4 Collecting digital evidence from email system log files .................................. 76 6.5 Collecting IP header data ...................................................................................... 76 iii 6.5.1 Creating the IP packet data collection process ................................................ 77 6.5.2 Scenario for collecting IP header data ............................................................ 80 6.5.3 Implementing the collection points ................................................................. 81 6.5.4 Reviewing the data collected

Load more