Daily Blog #142: Finding new artifacts - Re-creation testing part 2 Isolation and Uniqueness

Hello Reader,
          As I write this I'm on a flight to PFIC where I will be speaking on our further research into file system forensics. PFIC is a fun conference as its big enough to get a critical mass of people but small enough to allow for easy conversation. I'm looking forward to doing some demos and talking tech in the upcoming week. If you are at PFIC please don't hesitate to come up and say hi, it's always nice to know that the view count that I watch to determine if anyone is reading is more than just web crawlers :)

Today I wanted to continue the finding new artifacts post and get more into what we do. This is not the only way to do things, but its a set method that has been successful in my lab and lead to most of the research you've read on this blog and in the books. I'm currently typing on my surface so this won't be the longest of posts, but I wanted to cover the concepts of Isolation and Uniqueness today.

Isolation 

When I say isolation here I don't mean process isolation, air gaping or any other standard method. I mean trying to isolate as much as possible what your testing versus what the operating system is generating in the background, When we first started our file system journaling research we did so on the main system disk within our virtual machine. Doing this lead to mass confusion because we couldn't determine where in the unknown data structure we were trying to decode our changes were located versus what the underlying system was changing in its background actions.

We solved this issue by creating a separate disk and partition where the only actions taking against it was ourselves and the file system drivers. Once we knew that all the changes in the data structure were reflected my our changes it was much easier to find patterns and timestams.

I've since taken this method of isolation and applied it whenever possible, always trying to move whatever programs/files/methods I'm testing to a non system disk not shared with any other test that i'm doing. When I do this I find my results are more reliable and they come quicker as well. I know reading this it may seem obvious, but you really never understand just how much activity is going on in the background by the operating system until you try to go through every change looking for your test results.

Uniqueness

The concept of uniqueness applies to what you name the things you test with. The idea is that every directory, file, program, dll you create/call/reference should have a name unique enough that if you search for it that you won't find any false positives. If you are going to run multiple tests in sequence its equally important for those test runs to identifiable to what test its part of. For instance lets say you are testing a system cleaner (ccleaner for instance) to determine what it does when it wipes a file. You would want to create a test plan where you document:

• Each of the combination of options you are going to try
• The operating system version and service pack you are testing
• Which file system you are testing
• What version of the program you are testing
• The name of the file and directory you wiped
• An example being UniqueFileToBeWipedTest1
• The time to the second when you executed the test
• The time to the second when the processes ended

With these facts at hand you can easily isolate the changes you are making in those times from other tests and know which files are being effected by your testing. The worst thing that you can do is not document your testing well, causing your results to be either unverifiable to another examiner and making you spend all the time to recreate all your work.

That's all for today, I want to continue this topic this week going into what we do to test, how we pick our tests and the tools we use to isolate results.

Daily Blog #2: What I wish I knew when I was starting out

Howdy Reader,
                    BTW I'm from Texas, so we say howdy sometimes. Not a lot mind you, but its just something fun to say. I'm taking topics to blog about from readers and Karen Palmer among others submitted some great ideas! One of Karen's questions was ' what do you wish you knew when you first started?'. It's a great question and something I hope will help a lot of people get over some basic fears. This will likely be a multipart series as I think about things, but here is the first.

There is no such thing as a 'court approved' tool. No really, seriously, there is absolutely no such thing. Now, courts have accepted the results of several tools and those tools can now cite case law (meaning past cases) which shows their tools being accepted. What was important though in those cases was not the tool, but the expert who presented the tool and its results to the court. A tool on its own is not admissible, it requires an expert who is knowledgeable in its operation and can explain its results while answering questions about its meaning.

It is the expert, not the tool that defines what will be admissible. Now, the federal rules of evidence do specify the guidelines for a judge to consider what is admissible. For instance here is a rule that was not written with digital evidence in mind but has been adapted to suit it:

Rule 1003 (http://www.law.cornell.edu/rules/fre/rule_1003)

"A duplicate is admissible to the same extent as the original unless a genuine question is raised about the original’s authenticity or the circumstances make it unfair to admit the duplicate."

If that is not clear to you, any duplicate (and a forensic image is by definition a duplicate of the original evidence bit for bit) you create is admissible by rule 1003, unless there is a genuine question raised by either the opposing counsel or the judge.

So why do we have chain of custody? Well that goes to authenticating the evidence you are looking to get admitted. For a judge looking determine the admissibility of a challenged forensic image, his decision will be based on your testimony regarding the facts of how it came to be in your possession, what you did with it and how you know it is what you claim it to be:

Rule 901 (http://www.law.cornell.edu/rules/fre/rule_901)

(a) In General. To satisfy the requirement of authenticating or identifying an item of evidence, the proponent must produce evidence sufficient to support a finding that the item is what the proponent claims it is.

(b) Examples. The following are examples only — not a complete list — of evidence that satisfies the requirement:

 (1) Testimony of a Witness with Knowledge. Testimony that an item is what it is claimed to be.

combined with the following which is detailed in the chain of custody and shows the identifying information of the original evidence you made the forensic image of:

(4) Distinctive Characteristics and the Like. The appearance, contents, substance, internal patterns, or other distinctive characteristics of the item, taken together with all the circumstances." 

For the admission of the results of forensic tools the following applies:

(9) Evidence About a Process or System. Evidence describing a process or system and showing that it produces an accurate result.

A report generated by a tool is admissible with the following:

Rule 1006 (http://www.law.cornell.edu/rules/fre/rule_1006)

"The proponent may use a summary, chart, or calculation to prove the content of voluminous writings, recordings, or photographs that cannot be conveniently examined in court. The proponent must make the originals or duplicates available for examination or copying, or both, by other parties at a reasonable time and place. And the court may order the proponent to produce them in court."

So the report summarizes the findings, for example of the registry or file system in an understandable form, but other parties are allowed to validate your summary by reviewing the data that was used to produced it.

So there you go, criminal or civil the rules are the same.

What is important in your evidence's successful admission is not the tool you use, although lets be honest; a well known tool may be challenged less than an unknown tool. It is your ability to explain how the tool works, what you did to create the forensic image from the original evidence, and why it is admissible that is important. So don't restrict your choice of tools to those that others tell you is 'court approved' or have great marketing, use the tool that you have the greatest understanding of and can provide the best description of so you can feel confident of its admissibility in the face of a challenge.

I will say that those tools that provide certifications can be very helpful in showing your training and knowledge of the usage of the tool, so if your tool maker provides one it can't hurt to have it.

Talk to you tomorrow!