On the Network Performance of Digital Evidence Acquisition of Small Scale Devices Over Public Networks

Journal of Digital Forensics, Security and Law Volume 10 Number 3 Article 3 2015 On the Network Performance of Digital Evidence Acquisition of Small Scale Devices over Public Networks Irvin Homem Stockholm University, [email protected] Spyridon Dosis Stockholm University Follow this and additional works at: https://commons.erau.edu/jdfsl Part of the Computer Engineering Commons, Computer Law Commons, Electrical and Computer Engineering Commons, Forensic Science and Technology Commons, and the Information Security Commons Recommended Citation Homem, Irvin and Dosis, Spyridon (2015) "On the Network Performance of Digital Evidence Acquisition of Small Scale Devices over Public Networks," Journal of Digital Forensics, Security and Law: Vol. 10 : No. 3 , Article 3. DOI: https://doi.org/10.15394/jdfsl.2015.1205 Available at: https://commons.erau.edu/jdfsl/vol10/iss3/3 This Article is brought to you for free and open access by the Journals at Scholarly Commons. It has been accepted for inclusion in Journal of Digital Forensics, Security and Law by an authorized administrator of (c)ADFSL Scholarly Commons. For more information, please contact [email protected]. On the Network Performance of Digital Evidence Acquisition … JDFSL V10N3 This work is licensed under a Creative Commons Attribution 4.0 International License. ON THE NETWORK PERFORMANCE OF DIGITAL EVIDENCE ACQUISITION OF SMALL SCALE DEVICES OVER PUBLIC NETWORKKS Irvin Homem [email protected] Spyridon Dosis [email protected] Department of Computer and Systems Sciences Stockholm University Postbox 7003, 164 07 Kista Sweden ABSTRACT While cybercrime proliferates – becoming more complex and surreptitious on the Internet – the tools and techniques used in performing digital investigations arre still largely lagging behind, effectively slowing down law enforcement agencies at large. Real-time remote acquisition of digital evidence over the Internet is still an elusive ideal in the combat against cybercrime. In this paper we briefly describe the architecture of a comprehensive proactive digital investigation system that is termed as the Live Evidence Information Aggregator (LEIA). This system aims at collecting digital evidence from potentially any device in real time over the Internet. Particular focus is made on the importance of the efficiency of the network communication in the evidence acquisition phase, in order to retrieve potentially evidentiary information remotely and with immediacy. Through a proof of concept implementation, we demonstrate the live, remote evidence capturing capabilities of such a system on small scale devices, highliighting the necessity for better throughput and availability envisioned through the use of Peer-to-Peer overlays. Keywords: Digital Forensics, Digital Evidence, Remote acquisition, Proactive forensics, Mobile devices, P2P, Network performance, Availability INTRODUCTION Analysis Team, 2012) stealing banking credentials and performing espionage activities Malevolent activities quickly adapt and evolve respectively. They are no longer rare to align themselves with the particularities of occurrences with mild consequences. They have their given environment. This is seen in that permanently set up camp in intricate and they are no longer only a confined to the surreptitious forrms, taking unjust advantage physical world. They have readily adapted to over unsuspecting users going about the digital realm, taking up their niche commonplace activities on the Internet. The markedly on the Internet. Examples of such Regin malware (Kaspersky Lab, 2014), are the Zeus banking Trojan (Stone-Gross, formally analyzed and docummented in 2014 as 2012) and the Flame malware (sKyWIper a cyberespionage tool, is an example of this, © 2015 ADFSL Page 59 JDFSL V10N3 On the Network Performance of Digital Evidence Acquisition … This work is licensed under a Creative Commons Attribution 4.0 International License. having said to have been possibly in the wild process needs to be performed meticulously, since 2003. Today, all activities in digital realm carefully and in many cases slowly in order to are at the risk of being compromised by ensure that there is no potentially crucial piece malicious actors aiming at perpetrating theft, of evidence left behind. This is the state of impersonation, sabotage or to paralyze others’ affairs in the real physical world. activities for personal benefit. However, today’s crime scene is rapidly The consequences of such malicious edging away from a physical reality into a activities for the unsuspecting user have also more virtual one. The forms of evidence found become more detrimental, persistent and in these “Digital Crime Scenes” have also having far reaching effects in that they are moved from the traditional fingerprints, largely untraceable and easily invisible to the footprints, hair samples, blood samples or untrained eye. Developing novel and other DNA related evidence, into more digital innovative methods that enable malicious artifacts.. Such digital forms of evidence activities to remain effectively undetected and commonly include hard-disk drives, live untraceable, is the hallmark of these evildoers. (RAM) memory, network traffic captures, They are almost always one step ahead of the mobile devices, RAID sets (M. Cohen, pursuers. Furthermore, it is relatively easy to Garfinkel, & Schatz, 2009), and virtually any hide among the deluge of data that is created other form of technology that records past among communication devices that support events of its actions; that can be captured and the basic network communication on the can be analyzed during or after the criminal internet. Malevolent activity in the “Digital event and whose integrity can be verified. Realm” can thus, easily become rampant and This opens the floor to almost any form of uncontrollable if there are no equally computer appliance (physical or virtual) that innovative methods to counter the offending can be thought of. Thus arises the actors and their activities. The rate of heterogeneity problem among devices – or innovation and uptake of novel techniques by simply put the seeming lack of standardization law enforcement agencies, digital forensics among vendors of devices that perform related practitioners and incident responders must at tasks. Different devices may have different the very least be equivalent to that of their physical connectors, operating systems, criminal counterparts, if they are to keep up software applications, storage formats, with the proliferation of crime on the Internet. encoding schemes and communication One of the foremost areas in digital crime protocols (CDESF Working Group, 2006). This investigations where innovative means of heterogeneity makes the job of a Digital combatting crime are highly necessary, but Investigator a lot more difficult because of the largely lacking, is the evidence capture process. wide variety in which evidence could manifest This is the initial stage of an investigation itself in the wild. This greatly hampers any where artifacts from the scene of the crime manual efforts of collecting evidence, even with need to be retrieved in their original form, or, the assistance of semi-automated tools of today in the case of digital investigations, in some such as disk imagers. form of a complete copy of the original artifact In addition to this, Electronic Crime cases that can be proven to be devoid of any today often involve more than just a single tampering (National Institute of Standards and device. Several computer-like appliances Technology, 2004) (Scientific Working Group including tablets, mobile phones, digital on Digital Evidence (SWGDE), 2006). This cameras, GPS devices, smart-TV’s and even Page 60 © 2015 ADFSL On the Network Performance of Digital Evidence Acquisition … JDFSL V10N3 This work is licensed under a Creative Commons Attribution 4.0 International License. embedded devices such as onboard vehicle Finally, at present, investigators grapple computer systems (from trucks, cars and even with the problem of the relatively immature ships) could be seized for a single case, in order forensic tools that they are presented with. to be subjected to further investigative Current industry standard forensic tools such analysis. If we also bring in the vast realm of as EnCase, FTK, XRY, Volatility and the Internet also into play, such evidence Wireshark, at the moment of writing, do not sources could include web application accounts, cater for the highly divergent nature of digital online email accounts, cloud storage facilities, evidence sources. Most tools focus on a single network traffic captures and logs (Raghavan, niche area such as Filesystem Data, Live Clark, & Mohay, 2009). It is not difficult to Memory, Network Traffic, Mobile Devices or imagine that all these evidence forms could Log data. Some have recently begun to expand easily be part of a single case in today’s world their capabilities. The latest version of Encase and even more so in the imminent realm of the Enterprise v7 (Guidance Software, 2014) Internet of Things. The sheer volume of data claims to acquire evidence from disk drives as that one would have to sift through in order to well as RAM and some mobile devices within investigate a single case could be in the order an organizational context. AccessData’s FTK of Terabytes and can be a more than daunting AD Enterprise (AccessData, 2014) also claims task to perform. (Case, Cristina, Marziale, largely similar functionality. Neither deals with Richard, & Roussev, 2008) network

Load more