Bfor 201 Intro To Digital Forensics Final

Front 1

Raw format

Back 1

Makes it possible to write but stream data to files.

Advantages: fast data transfers

Most comp forensics tools can read raw format

Disadvantages: requires as much storage as original disk or data

Front 2

Advanced forensics format

Back 2

Design goAls: provide compressed or uncompressed image files.

No size limit for disk to image files.

Open source

Front 3

Types of acquisitions

Back 3

Static- device off

Live- powered on device

Front 4

4 methods of data collection

Back 4

Disk to image

Disk to disk

Logical disk to disk or disk to data

Sparse data copy or a file or folder

Front 5

Disk to image file

Back 5

Most common method and offers most flexibility

Can make more than 1 copy

Copies are but to but

Most forensic tools have this capability

Front 6

Disk to disk

Back 6

When disk to image is not possible

Tools can adjust disks geometry configuration

Some forensic tools have this capability

Front 7

Logical or sparse acquisitions

Back 7

logical acquisition captures only specific files of interest to the case

sparse acquisitions collects fragments of unallocated (deleted) data

Front 8

digital hash

Back 8

3 rules for forensic hashes:

you can't predict the hash value of a file or deivce

no 2 hash values can be the same

if anything changes in the file or device, the hash value must change

Front 9

scope creep

Back 9

when an investigation expands beyond the original description

Front 10

investigation plan

Back 10

goal and scope of investigation

materials and resources needed

tasks to perfom

reporting

the approach depends on the case

Front 11

Data hiding

Back 11

changing or manipulating a file to conceal information

Front 12

data hiding techniques

Back 12

hiding entire partitions, changing file extensions, setting file attributes to hidden, bit shifting, using encryption, setting up password protection

Front 13

EnCase acquisitions

Back 13

outputs evidence in image files into two different formats:

Ex01

E01 (legacy)

Front 14

three sub-folders

Back 14

export

temp

report

Front 15

ftk imager acquisitions

Back 15

outputs image files into 4 different formats

encase files (E01)

Raw files (DD)

smart files (S01)

sleuth kit (AFF)

Front 16

prodiscover acquisition

Back 16

format of image:

unix dd (most common, no meta data)

prodiscover (.eve) recommended and has meta data

Front 17

recognizing graphics file

Back 17

graphic files contain digital photos, line art, 3-d images

Front 18

bit map images

Back 18

collection of dots
grids of individual pixels
bitmap formats: (.png) (.gif)(.jpeg)(.bmp)(.tiff)

Front 19

vector graphics

Back 19

based on math (lines) instead of dots

smaller than bitmap files

preserve quality when image in enlarged

CorelDraw, Adobe Illustrator

Formats: (.hpgl)(.dexf)

Front 20

metafile graphics

Back 20

combination of the bitmap and vector

ex. scanned photo (bitmap) with text (vector)

Front 21

raster images

Back 21

similar to bitmap in that it is also a collection of pixels (pixels stored in rows, better for printing)

Front 22

digital camera file formats

Back 22

raw file format- digital negative

demosaicing-process of converting raw picture data into another format

Exchangable image file(Exif)-commonly used to store digital pictures-collects meta data

to view exif: exif reader, prodiscover

Front 23

data compression

Back 23

coding data from a larger to a smaller form

(lossless or lossy)

Front 24

lossless compression

Back 24

reduces file size without removing data

(winZip, PKZip, FreeZip)

Front 25

Lossy compression

Back 25

permanently discards bits of info

vector quantization (VQ) determines what data to discard based on vectors in the graphics file

(LZip)

Front 26

Identifying graphics file fragments

Back 26

carving or salvaging- recovering any type of file fragments

DF tools can carve from file slack and free space

help identify image file fragments and put them together

Front 27

steganography

Back 27

hides information inside image files

two major forms (insertion and substitution)

Front 28

Insertion steganography

Back 28

hidden data is not displayed when viewing host file in its associated program

you need to analyze the data structure carefully

Front 29

substitution steganography

Back 29

replace bits of the host file with other bits of data

-usually change the last two LSBs(least significant bits)

-detected with steganography tools

clues: duplicate files with different hash values

Front 30

Acquistion

Back 30

making a copy of the original drive

-two types of methods:

1. physical copying of the entire drive

2. logical copying of a disk partiton

Front 31

Acquistion subfunctions

Back 31

physical data copy

logical data copy

data acquistion format

command line acquisition

gui acquistion

remote, live and memory acquistions

Front 32

hardware forensic tools

Back 32

range from single purpose components to complete computer systems and servers

Front 33

software forensic tools

Back 33

command line applications

gui applications

commonly used to copy data from a suspects disk drive to an image file

Front 34

tasks performed by df tools

Back 34

1. acquistions

2. validation and verification

3. extraction

4. reconstruction

5. reporting

Front 35

validation

Back 35

a way to confirm that a tool is functioning as intended

Front 36

verification

Back 36

proves that two sets of data are identical by calculating hash values or using another similar method

Front 37

Subfunctions of verification and validation

Back 37

hashing (MD5 and SHA1)

filtering based on hash value sets

analyzing file headers-file types

(see whether a file extension in incorrect for a file type)

Front 38

Extraction

Back 38

-recovery task in digital investigation

-most challenging of all tasks to master

-recovering data is the first step to analyzing data

Front 39

subfunctions of extraction

Back 39

data viewing, keyword searching, decompressing, uncompressing, carving, decrypting, tagging,

Front 40

reconstruction

Back 40

to re-create a suspect drive to show what happended during a crime or an incident

or

to recreate a victim drive to reutrn property and minimize inconvenience or re-victimization

Front 41

Methods of reconstruction

Back 41

disk to disk copy

partition to partition

image to disk

image to partition

simplest method is to use tool that makes a direct disk to image copy (EnCase, FTK, Prodiscover)

Front 42

Reporting

Back 42

to perform a forensics disk analysis and examination you need to create a report

Front 43

Write blocker

Back 43

prevents data writes to a hard disk

-Software enabled: typically run in shell mode

-Hardware enabled: act as a bridge b/t the suspect drive and the forensic workstation

Front 44

using validation protocols

Back 44

always verify your results by performing the same tasks with other similar forensics tools

- use at least two tools

Front 45

storage formats for digital evidence

Back 45

-data in a forensics acquisition tool is stored as an image file

1. raw format

2. porprietary formats

3. advanced forensics format

Front 46

proprietary format

Back 46

most forensic tools have their own formats

advantages: option to compress or not compress image files, can integrate meta data, can split an image into smaller images

disadvantages: inability to share an image b/t diff tools, file size limitation for each segmented volume