Methods for Enhancement of Timestamp Evidence in Digital Investigations
Total Page:16
File Type:pdf, Size:1020Kb
View metadata, citation and similar papers at core.ac.uk brought to you by CORE provided by NORA - Norwegian Open Research Archives Svein Yngvar Willassen Methods for Enhancement of Timestamp Evidence in Digital Investigations Doctoral thesis for the degree philosophiae doctor Trondheim, January 2008 Norwegian University of Science and Technology Faculty of Information Technology, Mathematics and Electrical Engineering Department of Telematics NTNU Norwegian University of Science and Technology Doctoral thesis for the degree philosophiae doctor Faculty of Information Technology, Mathematics and Electrical Engineering Department of Telematics © Svein Yngvar Willassen ISBN 978-82-471-6227-9 (printed version) ISBN 978-82-471-6230-9 (electronic version) ISSN 1503-8181 Doctoral theses at NTNU, 2008:19 Printed by NTNU-trykk iii ACKNOWLEDGMENTS I would first like to thank my advisor, Stig Frode Mjølsnes. His guidance and helpful feedback has helped shape and direct this work. I would also like to thank the others at Department of Telematics for many discussions providing valuable inspiration. Special thanks to Kristian Gjøsteen for mathematical insights and fruitful discussions about digital forensics and digital security. Thanks to Tore Amble at the Department of Computer and Information Science for introducing me to Shanahan ’s Event Calculus. Also thanks to Eugene Spafford at Purdue University and Pavel Gladyshev at University College Dublin. The discussions we had during our meetings in Norway as well as during my visits to West Lafayette and Dublin were most inspiring. Thanks to the many people in the Digital Forensics community in Norway. Special thanks to my previous colleagues in Økokrim, Inger Marie Sunde, Steffen Thorkildsen and Lars Wilberg and to my previous colleagues in Ibas AS. Their work and support has been most inspiring for me. Also great thanks to the anonymous participants in the antedating experiment for supporting this work with their valuable time. I would also like to thank my family; my wife Ingebjørg and my three children Kristian, Johannes and Sigrid. Their support enabled me to go back to research after working in the public and private sector, and provided me with the necessary time and energy to complete this work. This work was performed under the project Timestamps in Digital Forensics , funded by the Norwegian Research Council under project number 164378/V30. I am deeply grateful for the financial support of the Norwegian government that enabled this work. iv TABLE OF CONTENTS 1 INTRODUCTION ......................................................................................................1 1.1 Timestamps and their origin ..............................................................................1 1.2 The digital investigation process ........................................................................3 1.3 The role of timestamps in digital investigations.................................................5 1.4 Sources of error and uncertainty in timestamps.................................................6 1.5 Implications of timestamp error and uncertainty in investigations ....................8 1.6 Timestamps and causality, thesis statement ....................................................10 1.7 Related work ....................................................................................................12 1.8 Outline .............................................................................................................13 2 CASE STUDIES .......................................................................................................15 2.1 Antedated documents.......................................................................................15 2.2 Timestamps as bogus alibi ...............................................................................17 2.3 Clock manipulation in a contract investigation................................................18 2.4 Timestamps in procedure .................................................................................21 3 REASONING ON SETS OF CAUSAL EVENTS WITH TIMESTAMPS ...............24 3.1 Causality ..........................................................................................................24 3.2 Time and time values.......................................................................................27 3.3 Clocks...............................................................................................................29 3.4 Timestamped events.........................................................................................30 3.5 Ideal and non-ideal clocks and their properties ................................................30 3.6 Clock hypotheses, adjustment and drift ...........................................................32 3.7 Observed event sets and correctness ................................................................36 3.8 Clock hypothesis consistency............................................................................41 3.9 Subsets, supersets, intersections and unions.....................................................42 3.10 The clock hypothesis as a scientific hypothesis ................................................48 4 CAUSALITY IN STORAGE SYSTEMS..................................................................51 4.1 Append only allocation.....................................................................................51 4.2 First-fit allocation.............................................................................................53 4.3 Other allocation strategies................................................................................57 4.4 Sequence numbers ............................................................................................60 4.5 Allocation causality in file systems...................................................................61 4.5.1 File system category.....................................................................................62 v 4.5.2 Content category..........................................................................................62 4.5.3 Metadata category........................................................................................63 4.5.4 File name category .......................................................................................65 4.5.5 Application category ....................................................................................65 4.5.6 File system causality ....................................................................................67 5 TIMESTAMP REASONING WITH EVENT CALCULUS......................................68 5.1 Introduction to Simplified Event Calculus .......................................................68 5.2 Representation of timestamps in Simplified Event Calculus ............................71 5.3 Observation sets and action hypotheses ...........................................................76 5.4 Formulating action hypotheses.........................................................................79 5.5 Using event calculus to test a clock hypothesis................................................82 5.6 Invariants in the simple file system..................................................................84 5.7 Using invariants to test a clock hypothesis ......................................................88 5.8 Using Simplified Event Calculus to develop tests for a system ........................91 5.9 Extending the simple file system with creation and deletion ...........................92 5.10 Invariants in the simple file system with creation............................................95 5.11 Complexity..................................................................................................... 102 6 TIMESTAMP REASONING WITH AFFECTS TABLES..................................... 106 6.1 Actions affects timestamps............................................................................. 106 6.2 Timestamping orders...................................................................................... 108 6.3 Action sequences and possible timestamping orders....................................... 110 6.4 Modelling a real file system............................................................................ 113 6.5 Complexity..................................................................................................... 115 6.6 Comparison with Simplified Event Calculus .................................................. 122 7 IMPLEMENTATION AND EXPERIMENT.......................................................... 125 7.1 Purpose........................................................................................................... 125 7.2 TimeStampLogic implementation................................................................... 126 7.3 Results from initial TimeStampLogic test runs.............................................. 129 7.3.1 RuleSet....................................................................................................... 130 7.3.2 SequenceChecker ........................................................................................ 131 7.3.3 LogSequenceChecker .................................................................................. 131 7.4 Document antedating experiment .................................................................. 132 7.5 Analysis of the reference image ...................................................................... 134 7.6 Results...........................................................................................................