DEGREE PROJECT FOR MASTER OF SCIENCE IN ENGINEERING COMPUTER SECURITY Automated file extraction in a cloud environment for forensic analysis Kevin Gustafsson | Emil Sundstedt Blekinge Institute of Technology, Karlskrona, Sweden, 2017 Supervisor: Kurt Tutschku, Department of Communication Systems, BTH Abstract The possibility to use the snapshot functionality of OpenStack as a method of securing evidence has been examined in this paper. In addition, the possibility of extracting evidence automatically using an existing operation tool has been investigated. The usability of snapshots in a forensic investigation was examined by conducting a series of tests on both snapshots and physical disk images. The results of the tests were then compared to evaluate the usefulness of the snapshot. Automatic extraction of evidence was investigated by implementing a solution using Ansible and evaluating the algorithm based on the existing standard ISO 27037. It was concluded that the snapshots created by OpenStack behaves similar enough to disks to be useful in a forensic investigation. The algorithm proposed to extract evidence automatically seems to not breach the standard. Keywords: Forensic, Qcow, OpenStack, Snapshot i Sammanfattning Möjligheten att använda OpenStacks ögonblicks funktion som metod för att säkra bevis har granskats i detta papper. Dessutom har möjligheten att extrahera bevis automatiskt med ett befintligt automatiseringsverktyg undersökts. Användbarheten av ögonblicksbilder i en rättslig utredning undersöktes genom att genomföra en serie tester påbåde ögonblicksbilder och fysiska disk avbilder. Resultaten av testerna jämfördes sedan för att utvärdera användbarheten av ögonblicksbilden. Automatisk utvinning av bevis undersöktes genom att implementera en lösning med Ansible och utvärdera algoritmen baserat påden befintliga standarden ISO 27037. Det drogs slutsatsen att de ögonblicksbilder som skapats av OpenStack beter sig tillräckligt lika en fysisk disk för att avbilderna ska vara användbara vid en råttslig utredning. Den algoritm som föreslås att extrahera bevis automatiskt tycks inte bryta mot standarden. Nyckelord: Forensik, Qcow, OpenStack, Ögonblicksbild iii Preface This thesis is the last part of five year education on Blekinge Institute of Technology. The education will provide a degree of master of science in engineering computer security. We would like to thank City Network AB for the time they spent on helping us and also for the workspace in their office. A special thanks to our advisor Anders Carlsson who have helped us with contact information and provided us with ideas on how to solve the task. Thanks to Vida Ahmadi for helping us get in contact with City Network. Thanks to Kurt Tutschku who have been our supervisor throughout the thesis. Thanks Jonas Virdegård and Jim Keyzer who have helped us as external resources. "I am the wisest man alive, for I know one thing, and that is that I know nothing." - Socrates v Nomenclature Notations Acronyms API Application Programming Interface CSP Cloud Service Provider DEFR Digital Evidence First Responder GDPR General Data Protection Regulation IaaS Infrastructure-as-a-Service IDS Intrusion Detection System IoT Internet of Things IP Internet Protocol ISO International Organization for Standardization kB Kilobyte LVM Logical Volume Management NTP Network Time Protocol PaaS Platform-as-a-Service PID Process identifier Qcow QEMU copy on write RAM Random Access Memory RB Rättegångsbalken SaaS Software-as-a-Service SSH Secure Shell UUID Universally Unique Identifier VM Virtual Machine YAML YAML Ain’t Markup Language vii Table of Contents Abstract i Sammanfattning (Swedish) iii Preface v Nomenclature vii Notations ........................................ vii Acronyms ........................................ vii Table of Contents ix 1 Introduction 1 1.1 Introduction .................................... 1 1.2 Background .................................... 1 1.3 Objectives ..................................... 1 1.4 Delimitations .................................... 2 1.5 Thesis question .................................. 3 2 Theoretical Framework 5 2.1 What is cloud computing ............................. 5 2.2 Forensic science .................................. 9 2.3 Automated tools .................................. 15 2.4 Technical standards ................................ 16 2.5 Laws and preliminary investigation ........................ 18 2.6 Similar work .................................... 19 3 Method 21 3.1 Tests of Qcow disk image ............................. 21 3.2 Algorithm for automated extraction ........................ 24 3.3 Analysis of Qcow using forensic tools ....................... 26 3.4 Prove non-repudiation of snapshots ........................ 27 4 Results 29 4.1 Test results .................................... 29 4.2 Proposed algorithm for automated extraction ................... 30 4.3 Findings in Qcow snapshot ............................ 31 4.4 Proving non-repudiation of snapshots ....................... 31 5 Discussion 35 5.1 Proposed method ................................. 35 5.2 ISO 27037 ..................................... 36 5.3 Why we chose Ansible ............................... 36 5.4 OpenSSH or Paramiko .............................. 37 5.5 Test results .................................... 37 5.6 Identifying a virtual machine ............................ 37 5.7 Using backing and overlay files .......................... 38 5.8 CLI history file ................................... 39 5.9 Virtual Introspection ................................ 39 5.10 Ethics ....................................... 39 5.11 Sustainable Development ............................. 40 6 Conclusions 41 ix 6.1 Is it possible to use a snapshot as evidence? ................... 41 6.2 Prove non-repudiation of a snapshot ....................... 41 7 Recommendations and Future Work 43 7.1 Implementation in OpenStack ........................... 43 7.2 Implementation on a hypervisor level ....................... 43 7.3 Check additional hypervisors ........................... 43 7.4 Additional file systems ............................... 44 7.5 Automatic learning and extraction ......................... 44 7.6 Test in court .................................... 44 7.7 Checkpoint snapshot ............................... 44 7.8 Snapshotting in containers ............................ 44 References 45 x 1 INTRODUCTION 1.1 Introduction Crimes has been an inconvenient truth since the beginning of humanity and have unfortunately become a fact of the society of today. As the capabilities of technology have evolved throughout the past decade, so has the methods of committing crimes. Currently all types of crimes involve electronic equipment in some way, if not to commit the action itself but to communicate or ease the task. This is unlikely to change as computer systems play a more important role in our everyday lives, cell phones are more likely than not to be present and additional equipment is being introduced daily, Internet of Things (IoT) for example. As illegal actions, such as selling and buying drugs, obtaining and distributing child pornog- raphy, money laundering, piracy, etc. moved into the Internet, so did the investigators of crimes. The standard procedure when conducting a forensic investigation includes a collection of electronics that may contain evidence for the case. This means that the physical hardware found is collected and brought to a forensically sound lab for analysis. Cloud technology allows users to move their activity away from in-house hardware and into the cloud instead. This means that any illegal activity such as distributing illegal material which was previously conducted via in-house solutions or otherwise outsourced to rental servers, can now be moved into the cloud. Due to the nature of the cloud, data can now be moved seamlessly between servers, data centres and even countries. This seamless structure adds an extra layer of obstacles during a forensic investigation as data can be spread across multiple servers and countries, rendering a physical collection impossible. Also there exist laws which prevent authorities from shutting down an entire cloud just to investigate a single user’s actions. 1.2 Background City Network Hosting AB is a Swedish company currently located in Karlskrona but with infrastructure around the world. Their initial business was to offer a web hosting service to individual users as well as companies. Their focus has lately shifted from web hosting to cloud computing. Because they are offering infrastructure to their customer, they might be hosting systems included in potential crimes. A solution which could be used to secure digital evidence located in a cloud would enhance the perception of the business as well as their credibility. Also in May 2018 a new General Data Protection Regulation (GDPR) will be applied. This new EU regulation will replace the current regulations in Sweden. The regulation shifts all the power of information related to individuals back to the individual. In case the regulation is not followed as expected companies can face severe penalties of up to 4% of their turnover. Due to this, there is an interest for City Network Hosting AB to be able to secure evidence of systems running in their cloud to be able to dismiss any accusations as well as aid a pending investigation. 1.3 Objectives Our objectives with this project are to investigate available snapshot functionality found in the cloud environment OpenStack,