Hello Reader,
Let's start looking at our last forensic image challenge, from Sunday Funday 10/6/13, by looking for communication between our suspect and other co-workers through non work provided communications. That means we are not looking at work email, sametime, communicator or other instant messaging service provided by the company. Most companies have locked down the popular instant messaging protocols at the firewall so people have turned to social media services chat functionality.
In our case our suspect is using Facebook chat. Facebook likes to change their message format for chat messages so often times if you make an image of a drive that is in active use the tools you use for Facebook chat recovery may miss these messages. For instance when we wrote the new book last year, Infosec Pro Guide to Computer Forensics, the keyword 'msgID' was present within Facebook chat artifacts. Now 'msgID' is gone and in its place is 'source:chat' and 'message_id'. A good example of this is using IEF, running the latest and greatest (6.2) did pull back the IE10 history that befuddles many tools but in this case it only found one false positive Facebook chat.
Remember that Facebook chat is all exchanged via AJAX/JSON so you shouldn't expect to find cached pages with chat messages in them in free space. Instead Facebook chat will usually be found in the Pagefile.sys, Hiberfil.sys and the volume shadow copies of these files. In our suspect image thee are several messages being exchanged between two parties, we found these by searching the pagefile.sys for 'source:chat' and then highlighting the relevant portions. We could write a parser to clean this up but I know that IEF will soon support the new format so it would be a duplication of effort on my part.
In this picture you can see a conversation taking place between two Facebook contacts. The field 'fbid' identifies which Facebook account we are getting this data from the Facebook ID '100006425125674' which we can pass back to Facebook and find their profile by going to the url:
http://www.facebook.com/100006425125674 which will resolve to the page of Knot Quilty:
https://www.facebook.com/knot.quilty
In addition there are timestamps in each message under the field 'timestamp'. The timestamps are standard Unix timestamps records meaning seconds since epoc. I like to use DCode for this type of timestamp identification as its free and has a variety of time-stamp options to try. Putting one of these timestamp fields into Dcode and selecting Unix: Numeric Value will correctly translate the timestamp a shown below:
There are some other Facebook chat fields that can be relevant depending on what you are investigating:
'100006425125674' which is a pretty unique keyword and will pull back all their Facebook related traffic as it will be embedded in all their pages.
Tomorrow lets talk about IE10 history.
Let's start looking at our last forensic image challenge, from Sunday Funday 10/6/13, by looking for communication between our suspect and other co-workers through non work provided communications. That means we are not looking at work email, sametime, communicator or other instant messaging service provided by the company. Most companies have locked down the popular instant messaging protocols at the firewall so people have turned to social media services chat functionality.
In our case our suspect is using Facebook chat. Facebook likes to change their message format for chat messages so often times if you make an image of a drive that is in active use the tools you use for Facebook chat recovery may miss these messages. For instance when we wrote the new book last year, Infosec Pro Guide to Computer Forensics, the keyword 'msgID' was present within Facebook chat artifacts. Now 'msgID' is gone and in its place is 'source:chat' and 'message_id'. A good example of this is using IEF, running the latest and greatest (6.2) did pull back the IE10 history that befuddles many tools but in this case it only found one false positive Facebook chat.
Remember that Facebook chat is all exchanged via AJAX/JSON so you shouldn't expect to find cached pages with chat messages in them in free space. Instead Facebook chat will usually be found in the Pagefile.sys, Hiberfil.sys and the volume shadow copies of these files. In our suspect image thee are several messages being exchanged between two parties, we found these by searching the pagefile.sys for 'source:chat' and then highlighting the relevant portions. We could write a parser to clean this up but I know that IEF will soon support the new format so it would be a duplication of effort on my part.
In this picture you can see a conversation taking place between two Facebook contacts. The field 'fbid' identifies which Facebook account we are getting this data from the Facebook ID '100006425125674' which we can pass back to Facebook and find their profile by going to the url:
http://www.facebook.com/100006425125674 which will resolve to the page of Knot Quilty:
https://www.facebook.com/knot.quilty
In addition there are timestamps in each message under the field 'timestamp'. The timestamps are standard Unix timestamps records meaning seconds since epoc. I like to use DCode for this type of timestamp identification as its free and has a variety of time-stamp options to try. Putting one of these timestamp fields into Dcode and selecting Unix: Numeric Value will correctly translate the timestamp a shown below:
There are some other Facebook chat fields that can be relevant depending on what you are investigating:
- “has_attachments” indicates if the chat message contained an attachment, usually a picture
- “action_type” “user-generated” tells us that this information came from a user and not an automated function.
'100006425125674' which is a pretty unique keyword and will pull back all their Facebook related traffic as it will be embedded in all their pages.
Tomorrow lets talk about IE10 history.
