More on Digital Forensics

So the SIFT workstation is up and running - almost. My slow internet connection is making the updating take a long time. Yesterday it ran almost all day to get SIFT on the machine. Lots of changes from stock Ubuntu - app installs, timezone changes, and the theme has been tarted up.

I looked at the digital images yesterday and thought about how to go about all of this. It's a little bit more complex than I thought. I know what I want, and I know what the output should be, its the pesky bits in the middle that are causing me some annoyance. Specifically the steganography output and how to carve the text files to get into what is clearly inside them. They are far too large for the text that they have.

I understand the methodology - it's quite clearly outlined in the text book, but there's a big difference between having your head around that and applying it. In order to write the report I have step through things fairly systematically - it's the way the old brain works and getting that system into some sort of operational semblance is the trick. There are some great cheatsheets on the desktop of a new SIFT install, for which I'm profoundly grateful. I'll read through these and have a good think.

There is a lot of info about forensic work out there. The glut of it makes it time consuming to go through, yet enjoyable at the same time. Once I've had a bit more time, I'll make known some of the posts that I've found interesting and relate my own experiences here!

The Foray into Digital Forensics

As part of  my tertiary studies I'm now working on Digital Forensics. Our latest assignment includes some steganography, some bit shifting and writing a forensic report on a made-up or actual scenario that we find or invent.

I thought it might of use to write a bit about the experience I'm having getting into this. From the course we are supplied a variety of different tools with a variety of different capabilities. Being a Linux chap, I thought it would be cool to go into the open source tools. Running ElementaryOS on laptop has made this difficult and more than a little frustrating. Perhaps because I'm not big on what the best tools are, or the install methods - but I'm experiencing annoyance. I'm currently downloading Ubuntu 14.04 Desktop to put the SANS Investigative Forensic Toolkit (SIFT) version 3 on it. Details on SIFT can be found at http://digital-forensics.sans.org/community/downloads. I'll work this later - I'm still waiting on Ubuntu to download. It doesn't help living out in the bush.

The Windows tools I have played with thus far include:

• ProDiscover Basic
• Hex Workshop
• OSForensics
• WinHEX

I've also found Notepad++ to be quite useful. It's a very powerful notepad replacement I find useful for many applications of work - find it here: https://notepad-plus-plus.org. 

The textbook also seems pretty good - "Guide to Computer Forensics and Investigations" Nelson, Phillips and Steuart are the authors. Lots of good examples and methods for working through things. Annoyingly, but this is to be expected, it all has a US slant on it, including laws and rights. Translating them into Australian can be tricky at times. There are a lot of good resources on the Net - SANS as I've already mentioned, CERT and AusCERT aren't bad. Google is, as always, your friend.

I've spoken with some friends about this and they immediately assume its like CSI-Cyber and we use cyber to describe everything - it's a cybercrime, it's a cyberstalking, its a cyberpen I'm writing on this cyberpaper with etc. Of course it's not like that at all. Lots of painstaking attention to detail and writing a *lot* of notes. You can't blow through this stuff on a hunch - stupid TV shows seem to make it a lot easier than it is and people jump around with ideas and stuff all the time. What a bag of pish! At any rate it's fascinating stuff if you have the patience and technical background for it.

I'll update and add a post as I play with SIFT and with the particular case I'm investigating.

I have spent some time on the digital forensic reddit https://www.reddit.com/r/computerforensics/ which has some great info and great help for people. I thank the contributors for their time and effort. Was looking through a bit list of blogs and stuff about forensics. Sad that so many of them have fallen away. There's some gold in amongst it though. On to the SIFT install!