Blog Post #32: Go Bag part 7 end of series

Guten tag Reader,
          It's time to wrap up this series and move onto to other topics. I hope you've found these scenarios and how I deal with them from my light go bag helpful. Hopefully I can help you lighten your load when you are out in the field, it really is a more pleasant experience. In this post we will cover handling all the assorted storage locations you might receive and how I deal with them.
       
CDs/DVDs - Imaging these is fairly straight forward as I'm not aware of any operating system that tries to write to a CD/DVD rewritable on insert. Remember not all CDs/DVDs are simple write once media, if the burns are layered in sessions you can recover the prior sessions burned once imaged.

MMC/SD Cards - Many of these actually have switches to make them read only, but otherwise I will either boot into Linux to acquire these read only or enable the usb write block hack and plug in a usb card reader.

External drives - I don't carry a USB write blocker because I haven't found a usb 3.0 one yet and they don't always work with the random drives I encounter. So instead I use the usb write block hack to acquire the drive if I can't easily access the underlying drive and attach it via SATA. This is also why I make sure my acquisition system has eSATA so I can always have a writeable external storage interface available to me and I can leave my USB ports read only when acquiring.

Email accounts on mail servers - Many times i'll be asked to preserve the contents of a mailbox I use a piece of software from transend called transend forensic migrator for this. Transend supports a large variety of mail servers (Exchange, Lotus, Groupwise Imap, etc..) so it makes my life easier to just plug in one or one hundred credentials (via batch mode) and have all the mail stored in your choice of output format (pst, mbox, etc..) with a log of its actions when its done. You can even enable filter options to limit the data your acquiring.

Webmail servers - One of the other types of email we are asked to grab is webmail, I've found the easiest way to deal with grabbing someones webmail is to search for the webmail providers instructions for email access from a smart phone. Through those instructions they will typically identify an Imap or Pop3 server that a phone and your software can connect to and grab the data.

Sharepoint - There are two good ways to deal with sharepoint, neither of which involve grabbing the underlying database. You can access a sharepoint website through webdav and copy down the contents or use a commercial tool like ontrack powercontrols to grab the data if you have the budget.

That's all I can think of right now but I think this capture 99% of what I deal with when out in the field and how I deal with it. Tomorrow we will switch topics to 'web 2.0' forensics and then make time Sunday for the weekly contest where this weeks prize is a free ticket to PFIC!

Daily Blog #31: Go Bag Part 6

Hello Reader,
                     Have I mentioned how good Civ 5 brave new world is? It's really good, and the reason I'm writing this blog post this morning instead of last night again. Tip, playing Venice is hard on king. I realized I missed a couple scenarios we should go over so I'm continuing the go bag series a little longer before we begin our discussion on 'Web 2.0' forensics. We focused on the NAS's in the last post and now we are going to talk about how to deal with embedded devices and a quick look a memory storage devices.

The system is an embedded storage device - You won't see this very often, but every so often you'll be told that there is an embedded device that contains logs you need.

When dealing with embedded devices you have a couple types you'll come across

1. SoC (System on a chip) with sdcard storage

If you have this you are lucky, power down the embedded device and remove the sdcard for standard imaging. When you image it you have two options, you can actually get a memory card write blocker or you can use software write blocking. In Windows you can use the registry write block hack and then attach a memory card reader via USB or you can boot off a forensically sound Linux distribution and image the device. In either case this is the best possible scenario.

2. SoC (System on a chip) with a maintenance port

You may come across an embedded device where the memory is soldered to the board and no removable storage options exist, but they may have a maintenance port. Either through ethernet, usb or com port getting access to the underlying maintenance port can also lead to shell access as many of these devices are running embedded unix variants and others are running DOS. Once in this shell, and getting there will very by device, the nice part about embedded systems it that they are rarely multi user systems, meaning every process runs as root or administrator. Once you have the console you can then capture raw logs back to your system through it, sometimes if your lucky there may be older kermit/zmodem transmission programs left on the image or tftp for network connected systems (originally intended for network booting). 

You can in embedded unix systems get full disk images this way by dumping the contents of the physical memory devices, just remember that you need to use a protocol capable to transmit the data without treating it as ascii strings or pipe it through a function to encode it first (base64 works here well). 

3. SoC (System on a chip) with no access

This happens, and it sucks. At this point you can hope that there is some kind of Jtag access or firmware flashing access. If there is no firmware flashing access (which you can use to download the current memory image) then you are stuck with Jtag. Jtag means you are going to have to find the Jtag pads (documented if your lucky) solder a Jtag connection to the board and find a compatible app for the processor to dump the nvram to your system. 

This isn't fun and if you are not experienced with Jtag easy to mess up. At this point you should probably let your client know that you need to send this system off to a specialist shop for extraction. 

4. SoC (System on a chip) locked down for security

This typically is only found in high security embedded devices (ATMs, Lottery terminals, etc...) where they have attempted to remove all internal access to the system and its underlying data. You have one option here and you can't really go back from it. You have to de-solder the memory chips from the board and plug them into a raw reader. From that point its up to you to reconstruct the file system and access the underlying files. If you are on this step you are likely dealing with a pretty serious case and if you are not comfortable with what mobile forensic experts have termed 'Chip Off' forensics I would send this to a lab that is. Once you remove the chip its not likely you'll get it on the board and get the device functioning again so remember this is on way street, no going back. 

That was longer than I thought it would be, as you can see I've dealt with a lot of weird systems over the last 14 years. We should talk about memory cards tomorrow and then on to 'Web 2.0' forensics. Don't forget this sunday you can win tickets to PFIC!

Daily Blog #30: Go Bag Part 5

Hello Reader,
             Another day another blog, I should have started this one last night but Civilization 5's Brave New World expansion is out, and it's really good. I am going to try to finish the Go Bag series before moving on to 'web 2.0 forensics' and dealing with JSON fragments. In other news I'm reaching out to more companies I like that provide forensic products I use that want to provide prizes for the Sunday Funday contests. I'm happy to announce that Paraben is offering free tickets to the PFIC conference. The first of them, a $399 ticket,  will be given away this Sunday to the best answer to make sure to pencil in some time on Sunday if you are interested. I'll be speaking there as well some other very talented DFIR pros and the conference is a great deal of fun, and its held in a ski resort!

The system is a NAS - You've imaged the systems the custodian used but are then informed that his network data is on a NAS

Note: Remember that most NAS's are not windows embedded systems and thus will likely not have the same file system internally that the custodian was using. This means the custodians computer will treat the underlying file share as it would any windows network file share but what file system metadata actually gets recorded (change versus recorded time stamps for instance) depends on what file system the NAS has formatted the volume to do be.

There are three different types of NAS systems you'll commonly encounter:

1. The consumer grade NAS
These devices typically have a couple of drives internally and run embedded linux. Some of these will just have one drive. You can either remove the drive and image it or in some models attach it to your imaging laptop via USB. The important part here is that you realize there is a difference between what the NAS exposes and what you can acquire. 

Logically imaging the network drive - This will allow you to capture in a forensic container all of the data as its currently seen within the NAS. However, what it will not allow you to do is acquire any of the deleted data or free space of the disk as the NAS will only be providing you with a logical view of the file system. If your case does not mandate deleted data 

Physically imaging the drives - typically consumer grade NAS systems don't have iSCSI so i'll leave that option out of this section. You will have two options at this point, you can remove the drives from the NAS and image them (for many models this is easy as they are meant to be swapped out) or if you are luck and there is a USB port you can attach the NAS to your system for imaging. Remember to use a USB write blocker (software or hardware) to prevent writing to the drives.

2. The small business NAS
Small business NAS's typically have more features but lack the USB option for direct connection. What feature they will typically add though is iSCSI. iSCSI allows you to present the local physical disk to another system over the network, this is how f-response provides access to remote disks (but they do so in a read only fashion). If you can create an iSCSI connection then you can get the physical image you want using any tool that you have on your forensic workstation, if your going to do this i would recommend doing it in Linux or WinFE to prevent the system from touching the disk as I'm not aware of a iSCSI write blocking solution outside of f-response.

If iSCSI is not available then look at the other two options listed to determine what you have available to you.

3. The enterprise NAS
Enterprise NAS systems like those from NetApp may or may not have an iSCSI function but what they typically do have is some type of maintenance connection giving you a command shell on the local system. With these systems I typically will acquire the data logically and then log into the command shell and run dd locally and output the data to my collection system via a netcat listner. This isn't fast but when you get to proprietary systems it may become the only way to get the data out. 

If i can actually load a utility onto the box for execution f-response is a great option here.

If you want system logs or data you can also logically take the contents of the running NAS out over a netcat listener this way as well. 

Time to put together my notes and see whats left for this series before moving on. Have questions about handling onsite imaging situations? Ask them in the comments!

Daily Blog #25: Go Bag Part 4 - Advanced Persistent Problem Child

Hello Reader!,
       It's Thursday, the week goes fast when your busy. I hope these daily blogs are interesting to you and helping your week go faster as well. I'm continuing the imaging scenarios today as enter the realm of the 'oh not this' level of imaging. We are doing lots of research here at G-C as our cases continue to get more complex and we see more Windows 7 systems and their artifacts get produced in cases. I'm hoping that as these results are validated we can put out some more Saturday reading papers on USN journal analysis, it's not as simple as it appears!

The system is in sleep mode - The system has been brought to me and it was thought to be powered off, but really the user just closed the lid on the laptop and it went to sleep. 

This is a pretty common scenario and you have four options at this point in order of time required (least to most):

1. You have to have this device imaged and returned ASAP and you have no reason to believe that the contents of memory will be relevant as the event you are investigating occurred in the past. In this case your best course of action may be to pull the battery and image the drive offline. 
2. You have to have the device image and returned ASAP, but the user is willing to provide their password. In this scenario you would do a live image of the system's memory to your external drive and then since you've already created the artifacts relating to the memory capture and storage connection (whether network or external storage) so you might as well do a live forensic image as well. 
3. You have to have the device image but you can return it later that day or the next. This is a good middle scenario and I'll explain why. If you have enough time to let the battery power run out the system will on its own going into hibernation causing it to write the contents of memory to disk and allowing you to get a copy of both the disk and the contents of RAM without having to introduce any artifacts from your software/hardware. If you are worried about overwriting the old hiberfil.sys know that for Windows Vista and 7 systems it should be in the volume shadows as well.
4. You have to have the device image, its Windows XP or before and you don't have time to wait for it to suspend. At this point if your lucky they have a firewire port on their computer which will let you directly access the contents of RAM without authenticating to the system, your device will show up in sbp2 store though in the system registry and its plugin will be recorded in the setup logs. 

The system is connected to a SAN - You've been taken to the system and see a fiber cable coming out of the back of it, you realize its likely connected to a SAN


Termonology to kow here:

HBA - Host bus adapter - This is your fiber card interface to the SAN like a network card
SAN - Storage Array Network - This is a large embedded system that can contain 100s of hard drives and present slices of them to systems as local storage
LUN - Logical Unit Number - How the disk is identified between the SAN and the system that mounts it
Fiber port - The physical port on the fiber hub your SAN and systems are connected to

Things to know before even starting:

• Pulling a drive from a SAN will result in the SAN discarding those drives 
• You do not know which drives in a SAN your data is written on typically
• I am not aware of a forensic tool that has support for any SANS proprietary algorithm for storing data across drives and even if you where to image the disks with the SAN offline you would not likely be able to reassemble the file system
• You need to know the following 
• The type of HBA in the system (single mode or multimode)
• The LUN the HBA is connecting to
• The port you are plugged into
• If there are any ports open

Ok now that we have that covered this is how you deal with it. You have two options depending on if you can take the system offline.

1. You can take the system offline

If you can take the system offline then you can reboot it off of your forensically sound boot CD, I keep saying Linux but it could WinFE as well. I have more experience with Linux boot CD/DVDs though. If your bootable distribution has support for the fiber card HBA then you should have the disk presented to you at boot time as another physical drive you can image. This works because SAN security is typically set for the port the device is plugged into rather than any type of credential, so if you can access it from the same port you should be presented with the disk. 

    2.  You can't take the system offline

You have two options here. 

    A. Make a live image, this is the simplest method. The OS will already have the fiber card drivers loaded and the physical disk will be available to you for imaging.

    B. If you can't make a live image and you can't shut it down this is what you have to do to get at the SAN disk.

1. Get the SAN administrator to allocate a port you can plug another computer with a compatible HBA 
2. Get the SAN administrator to provide access to the LUN your target system is accessing to your new port
3. Boot your system off a Linux winfe forensically sound system with the HBA connected  you should see the physical disk presented to you
4. Realize that you need to still treat this as volatile evidence, the original system is still accessing/changing this disk and the only write protection you have is your operating system correctly treating the SAN disk as read only.
5. Image the disk and shutdown, making sure never to mount the disk read/write and if its a journaled file system (ext3/4) make sure that you mount it read only as a non-journaled variant (ext2) if you simply have to mount it and extract data from the live system. 

    I know point 5 may seem confusing especially on the read only exception there. The read only flag in your Linux mount applies to the data but the underlying journal file system may still be updated in ext3/4 on mounting it even if you tell it to mount read only. Be aware of this as you may cause two competing journal operations to collide and that wouldn't be good!

    So there you go, all my SAN nightmares boiled down to a how to guide. I hope this helps you because they are not going away. Tomorrow we will talk about NAS and embedded systems. 

Daily Blog #24: Go Bag Part 3 - When things go sideways

Hello Reader,

        We are in the middle of a series on how I use my go bag to deal with a series of escalating difficult situations. In the prior post I detailed my first two most common scenarios when arriving onsite to image. This post will continue with the next two common scenarios where things just aren't going to be easy on me. Before I begin I wanted to announce that this weeks Sunday Funday will have its prize provided by Magnet Forensics, so make sure you give it a try!

The pain begins - The system has been brought to me and its powered off and not in sleep mode but I cannot remove the hard drive without the possibility of either breaking it or not being able to easily put it back together (thanks OEM)

    This happens many times when we receive Macbook Airs and the odd ultra portable (I'm looking at you Sony). If you are brave enough, I'm usually not, to take apart 20+ screws and extract the drive from the nether regions of the laptop you my be greeted by a proprietary ZIF interface or worse which just wastes your time. This again is when I turn to my bootable forensically sound Linux CDs/DVDs. Before attempting to boot them though I always Google the proper key sequence to either select boot device or enter BIOS. While an unintentional boot isn't the end of the world its always nicer to not have to explain one.

 

A system with a RAID is powered off and waiting for you- The system in question turns out not to be a simple desktop as previously stated but is actually a high end workstation with an internal RAID or a server with direct attached storage.

 

    I know many people who advocate imaging RAID drives separately  This is something I  do not advocate as many people who do this don't take the time to fully document the RAID configuration, RAID card and BIOS version before doing so. This leaves us with a mess of drives we have to figure out how to put back together. Instead its much cleaner to again boot the system if it's off into a forensically safe Linux CD/DVD that supports the RAID card and imaging the volume the RAID card presents. If you have a suspect you believe is sophisticated enough to have written outside of what the RAID card presents or you think there was a previous set of data you can recover, then image it both ways. Image the set as the RAID card presents it and then image the physical disks separately so you get the data both ways. 

 

A business critical server - You walk in to find out the data you need is on a server that can't be taken offline and has a RAID

    Many times the burden on a company to shut down a large business critical server overrides the need for an offline forensic image. In these situations you are much better off making a 'Live Image'. What I mean by a 'Live Image' is creating a forensic image of the system while its running. I like to put FTK Imager lite on a thumb drive and executing it from there and writing the image out either over the network to my system or to an attached storage drive depending on the amount of space needed. Other than having a pre-installed agent, this is one of the lowest impact forensic imaging methods available for a Live system. 

 

    Tomorrow we will continue into more hard scenarios like dealing with systems in sleep mode, SANs and more! I may interrupt this series this week with an interview of a fellow Milestone 14er so keep checking in with me for more.

Daily Blog #23: Go Bag Part 2 - Flexibility over possibility

Hi Reader,
      Last week I posted what was in my go bag, this week I'd like to explain more about why it's there. I used to carry around a lot of equipment with me, even lugging a pelican case around with me at one point. What I found is that I rarely needed to bring the kitchen sink with me of every possible adapter, what was more important is that I had a portable/flexible toolkit that I could fall back on in a series of steps. With what I posted I can handle 99% of situations, I've found the other 1% is so special that most people either let me know to bring special equipment or understand I'll need some time to get additional equipment.

Best Case Scenario - The system has been brought to me and its powered off and not in sleep mode and I can remove the hard drive and I have the cables to connect it to my write blocker.

    I know those of you who do a lot of memory analysis are saying, Why is the best case scenario?! The answer? It's the simplest to deal with. I can take the system, remove the hard drive, document it to my chain of custody. Then I can check the bios time and attach it to a write blocker and image it all without having any worry about my process making any changes to the evidence. The lowest risk and easiest procedure, when this is all that's involved, it's a good day.

    This sadly is not most days, many times something will gum up the works or there will be more systems to forensically image than I was told. This is where the flexibility of my go bag shines.

Common Scenario - The system has been brought to me and its powered off and not in sleep mode and I can remove the hard drive but I don't have the adapter I need

    At this point I have two options, if I have other systems I can image and there is a real computer store in town (frys, micro center, etc...) then I may go grab the adapter while I'm out for lunch. Otherwise, this is where the bootable CDROMs come into play. Booting up the suspect system I don't have an adapter for with a forensically safe OS will let me acquire his system with minimal risk and without having to wait for fedex to arrive.

    I used to use Helix Pro as my preferred Linux Boot CD but they stopped updating it, though they will still take your money for it. I now carry Raptor and Paladin with me as I've found they will boot different kinds of systems. If I can remove the drive then I can safely verify the boot order before inserting the drive again and booting it to acquire. This is where the power of the Seagate Backup Plus drive (aka GoFlex) really shows itself in my toolkit. Without the drive dock the interface on the bottom of the drive is plain SATA. So I have the option when attaching it to a system for acquisition of going USB, eSATA, SATA or firewire/thunderbolt/NAS via other adapters. It's this kind of flexibility that lets me reduce bulk in my bag and remain flexible in being able to always get the highest data transfer speed from the system I'm acquiring.

    I'll continue this series tomorrow, hopefully my lessons learned will make your load lighter on the road and lead to a higher rate of success. 

Daily Blog #19: What's in your go bag

Hello Reader,
               Karen Palmer asked 'What's in your go bag?'. A good question as I am routinely surprised by a sudden need to forensically image a system when I'm traveling and the timing just happens to work out that a case starts in the same city. I keep a minimal kit with me during most times that gives me the most flexibility. My kit fits in the following bag samsonite carryon  that can also fit a change of clothes and some other gear while still fitting in the overhead.

Contents of my travel kit/go bag:

• Tableau SATA/IDE write blocker with esata cables - I like eSata to save the USB bus for writes
• Paladin Boot CD - Works with new macbook airs
• Raptor Boot CD - http://forwarddiscovery.com/Raptor
• Screw driver kit - I like these Good grip and easy to use
• Seagate Backup Plus 4TB Desktop drive The ability to switch the connection is the best
• eSata to USB 3 bridge - In case I need to attach the eSATA write blocker to laptop 2
• USB 3 64gb thumbdrive - Microcenter makes great ones
• USB 3 32gb thumbdrive  - They are affordable too
• Dual sata drive dock with cooling fan - The cooling fan is key
• Laptop 1 HP Elitebook - Main laptop that is my mobile workstation
• Laptop 2 ASUS- Backup imaging computer and games
• USB Micro cable
• USB Mini cable
• Apple iPhone cable
• Apple Lightning cable
• F-Response dongle
• Network cable
• Crossover cable
• Power strip
• External CDROM/DVDROM

The idea of my kit is maximum flexibility with minimum bulk. When I first started doing computer forensics I had a big portable computer like this one we called it 'the heavy' for obvious reasons. At the time it was the only system I could get that could do what I needed. That thing was hard to travel with and was easy to get damaged in airline cargo. With this kit in an easy to travel with overhead bag I can handle 90% of situations with the last 10% requiring a trip to microcenter or frys if they have one where I am. When that fails me its on to the internet to see what I can find locally or if its an option have shipped overnight. 

I'll go the scenarios my response kit handles next week, until then get ready for this week's Sunday Funday!