1. Digital Forensics
NIST Information Technology Laboratory
William C Barker
October 23, 2012
Forensic science is generally defined as the application of science
to the law.
2. Examples of digital forensic
Some examples of data types: evidence:
• Standard computer systems • Electronic mail messages
• Networking equipment • Video/photo/audio
attachments
• Computing peripherals • Unstructured data
• Mobile devices • Protocol information such as
• Consumer electronic devices IP addresses
• GPS data
• Various types of media
• Cell phone data
• Metadata
• Internet history
• Deleted data residues in
various types of IT devices.
2
3. Some Uses of Digital Forensics Techniques
• Investigating crimes and internal policy
violations,
• Pre-trial e-discovery in civil litigations,
• Reconstructing computer security incidents,
• Troubleshooting operational problems, and
• Recovering from accidental system damage.
3
4. Performing Digital Forensics
Phases specified in NIST’s Guide To Integrating Forensic Techniques Into Incident Response
• Collection: identifying, labeling, recording, and acquiring data from the possible sources
of relevant data, while following procedures that preserve the integrity of the data.
• Examination: forensically processing collected data using a combination of automated
and manual methods, and assessing and extracting data of particular interest, while
preserving the integrity of the data.
• Analysis: analyzing the results of the examination, using legally justifiable methods and
techniques, to derive useful information that addresses the questions that were the
impetus for performing the collection and examination.
• Reporting: reporting the results of the analysis, which may include describing the
actions used, explaining how tools and procedures were selected, determining what
other actions need to be performed (e.g., forensic examination of additional data
sources, securing identified vulnerabilities, improving existing security controls), and
providing recommendations for improvement to policies, procedures, tools, and other
aspects of the forensic process.
4
5. Policies and Procedures for Digital Forensics
• Organizations should ensure that their policies contain clear statements addressing all
major forensic considerations, such as contacting law enforcement, performing
monitoring, and conducting regular reviews of forensic policies and procedures.
• Organizations should create and maintain procedures and guidelines for performing
forensic tasks, based on the organization’s policies and all applicable laws and regulations.
• Organizations should ensure that their policies and procedures support the reasonable
and appropriate use of forensic tools. Policies and procedures should clearly explain what
forensic actions should and should not be performed under various circumstances, as
well as describing the necessary safeguards for sensitive information that might be
recorded by forensic tools, such as passwords, personal data, and the contents of e-mails.
• Legal advisors should carefully review all forensic policy and high-level procedures.
• Organizations should ensure that their IT professionals are prepared to participate in
forensic activities.IT professionals throughout an organization, especially incident
handlers and other first responders to incidents, should understand their roles and
responsibilities for forensics, receive training and education on forensics-related policies
and procedures.
5
6. Chain of Evidence
Maintaining source and content integrity of forensics information
Electronic authentication, access control mechanisms, and audit
trails are needed for:
• Control of forensic data
• To record generation of forensic data
• Access to forensic data
• Change management for forensic data.
Cryptographic technologies such as time stamped digital signature or
signed hashes, can be employed to identify the source of forensic
data, establish the time(s) at which each access to the data occurred
and by whom, and whether or not modifications to the information
has occurred (and, if so, at which point in the chain). 6
7. Overview of Existing NIST Computer Forensics Work
Overall NIST ITL Forensics Program Lead: Martin Herman,
martin.herman@nist.gov
http://www.nist.gov/itl/ssd/computerforensics.cfm.
Current Projects:
– Computer Forensics Tool Testing (including mobile device tool
testing)
– National Software Reference Library, and
– Computer Forensic Reference Data Sets.
Initiating projects on:
– Performing forensics as part of incident response
– Cloud forensics (e.g., when a cloud computing environment is used
by criminals for their illegal activities such as child pornography, or
when there is an attack on a cloud computing). Privacy is a huge 7
issue here because clouds are typically multi-tenants.
8. Computer Forensics Tool Testing (CFTT)
• Goal: Establish a methodology for testing computer forensic software
tools by development of general tool specifications, test procedures,
test criteria, test sets, and test hardware.
• The Computer Forensics Tool Testing Project Handbook is now available
in PDF format for downloading (http://www.cftt.nist.gov/CFTT-Booklet-
Revised-02012012.pdf).
• A description of NIST mobile device forensics tool testing activity is now
available at (http://www.cftt.nist.gov/documents/MobileDeviceForensics-
MFW08.pdf). Rick Ayers (richard.ayers@nist.gov) is a good resource for
additional information on this topic.
8
9. Sample Case: Problems Facing Deleted Files Recovery Tools
(http://www.cftt.nist.gov/DFR-req-1.1-pd-01.pdf)
• The files that have been deleted have to be identified and located.
Although this could be as simple as scanning directory entries for a
particular key (e.g. ‘0xE5’ in Fat 32), it may be a more complex
process.
• From a file system perspective, the data to be recovered is latent, and
needs the assistance of a tool to recover the data. As with most other
latent data recovery, since the results depend on the output of a
particular tool, the tool must be shown to operate correctly (i.e.,
undelete files correctly).
• The potential uncertainty present in any recovery effort leads to a
reduced level of confidence in the information recovered. Specifically
with deleted file recovery, the data recovered may be commingled
with data from other deleted files, allocated files, or even from non- 9
allocated space.
10. National Software Reference Library (NSRL)
Goal: Promote efficient and effective use of computer technology in
the investigation of crimes involving computers.
• The Reference Data Set (RDS) is a collection of digital signatures
of known, traceable software applications .
• The NSRL is designed to collect software from various sources
and incorporate file profiles computed from this software into
Reference Data Sets of information.
• The NSRL RDS is released four times each year - in March, June,
September and December. The current release, June 2012 RDS
2.37, contains 26,911,012 unique entries. 10
11. Computer Forensic Reference Data Sets(CFReDS)
• Computer Forensic Reference Data Sets provide to an investigator documented sets
of simulated digital evidence for examination.
• Applications for Computer Forensic Reference Data Sets:
- Data sets for tool testing need to be completely documented. The user of the data
set needs to know exactly what is in the data set and where it is located. These data
sets should also provide specification for a set of explicit tests.
Examples of focused function areas are string searching, deleted file recovery and
email extraction.
- Data sets for equipment check out need to focus on issues in acquisition, access
and restoration of data. These data sets might need to have a strong procedural
component.
- Data sets for staff training are primarily investigation scenario based tests intended
to give a real flavor to the data set (similar to the data sets for proficiency testing).
- Proficiency Testing and Skill Testing data sets are primarily investigation scenario
based tests designed to give a real flavor to the data set (for example, a data set
that would require the examiner to demonstrate some system skill such as loading a
new font onto an analysis computer). 11
12. Some Other NIST Computer Forensics Publications
Guide to SIMfill Use and Development, NIST IR-7658, February 2010, Wayne Jansen, AurelienDelaitre.
Mobile Forensic Reference Materials: A Methodology and Reification, NIST IR-7617, October 2009, Wayne Jansen,
AurélienDelaitre.
Forensic Protocol Filtering of Phone Managers, International Conference on Security and Management (SAM'08),
July 2008. Wayne Jansen, AurelienDelaitre
Overcoming Impediments to Cell Phone Forensics, Hawaii International Conference on System Sciences (HICSS),
January 2008. Wayne Jansen, AurelienDelaitre, LudovicMoenner.
Reference Material for Assessing Forensic SIM Tools, International Carnahan Conference on Security Technology,
October 2007. Wayne Jansen, AurelienDelaitre.
Guidelines on Cell Phone Forensics, SP 800-101, May 2007, Wayne Jansen, Rick Ayers.
Cell Phone Forensic Tools: An Overview and Analysis Update, NISTIR 7387, March 2007. Rick Ayers, Wayne Jansen,
LudovicMoenner, AurelienDelaitre.
Guide to Integrating Forensic Techniques into Incident Response, SP 800-86, August 2006, Karen Kent, Suzanne
Chevalier, Tim Grance, Hung Dang.
Forensic Software Tools for Cell Phone Subscriber Identity Modules, Conference on Digital Forensics, Association of
Digital Forensics, Security, and Law (ADFSL), April 2006. Wayne Jansen, Rick Ayers.
Cell Phone Forensic Tools: An Overview and Analysis, NISTIR 7250, October 2005. Rick Ayers, Wayne Jansen, Nicolas
Cilleros, Ronan Daniellou.
An Overview and Analysis of PDA Forensic Tools, Digital Investigation, The International Journal of Digital Forensics
and Incident Response, Volume 2, Issue 2, April 2005. Wayne Jansen, Rick Ayers.
Guidelines on PDA Forensics, SP 800-72, November 2004. Wayne Jansen, Rick Ayers.
PDA Forensic Tools: An Overview and Analysis, NISTIR 7100, August 2004. Rick Ayers, Wayne Jansen. 12
Editor's Notes
Regardless of the data sources, effective use of forensic information requires maintaining the source and content integrity of the information - that is, maintaining the integrity of the chain of evidence. Electronic authentication, access control mechanisms, and audit trails are needed to control and record generation of, access to, and change management for forensic data. Cryptographic technologies such as time stamped digital signature or signed hashes, can be employed to identify the source of forensic data, establish the time(s) at which each access to the data occurred and by whom, and whether or not modifications to the information has occurred (and, if so, at which point in the chain).
Existing computer forensics work in NIST’s Information Technology Laboratory includes Computer Forensics Tool Testing (including mobile device tool testing), the National Software Reference Library, and Computer Forensic Reference Data Sets. The forensics program manager at the Information Technology Laboratory is also interested in initiating more work in cybersecurity forensics, which involves performing forensics as part of incident response. The Laboratory is also starting a project in cloud forensics, which involves forensics activities when a cloud computing environment is used by criminals for their illegal activities (e.g., child pornography), or when there is an attack on a cloud computing system and we want to use forensics as part of incident response. Certainly privacy is a huge issue here because clouds are typically multi-tenants. The overall NIST Information Technology Laboratory forensics program is coordinated by Dr. Martin Herman.
There is a critical need in the law enforcement community to ensure the reliability of computer forensic tools. The results provide the information necessary for toolmakers to improve tools, for users to make informed choices about acquiring and using computer forensics tools, and for interested parties to understand the tools capabilities. A capability is required to ensure that forensic software tools consistently produce accurate and objective test results. Our approach for testing computer forensic tools is based on well-recognized international methodologies for conformance testing and quality testing. Frequently during a forensic examination, data is discovered on the target media that is not part of any active or visible file. Although this data can still be examined such as by string searching, if the data associated with a particular file could be identified and recovered in its original form, this could provide additional useful information. An example of this would be where a graphics file, if undeleted and recovered, could be viewed—potentially providing more information than a simple string search.
Many of the forensic tools used by investigators identify files that have been deleted, and allow the operator to undelete them. This may allow the investigator to examine the file in the original format such as a graphics file viewer, or identify when a particular file was deleted and its original location. To reconstruct deleted files within a forensic setting, three fundamental problems have to be addressed by a deleted file recovery (DFR) tool. A NIST document Active File Identification & Deleted File Recovery Tool Specification, currently out for public comment, defines functional requirements for tools used within forensic investigations to address these issues associated with identifying active files, deleted files and to reconstruct deleted files.
The National Software Reference Library project is supported by the U.S. National Institute of Justice and by Federal, state, and local law enforcement organizations.The Reference Data Sets can be used by law enforcement, government, and industry organizations to review files on a computer by matching file profiles, or “hashes” in the sets. This will help alleviate much of the effort involved in determining which files are important as evidence on computers or file systems that have been seized as part of criminal investigations. There are application hash values which may be considered malicious in the profiles, such as for steganography tools and hacking scripts, but there are no hash values of illicit data, such as child abuse images.
NIST is also developing Computer Forensic Reference Data Sets for digital evidence.. Since the sets would have documented contents, such as target search strings seeded in known locations of reference data sets, investigators could compare the results of searches for the target strings with the known placement of the strings.Investigators could use these sets in several ways including validating the software tools used in their investigations, equipment check out, training investigators, and proficiency testing of investigators as part of laboratory accreditation.The site contains test images and resources to aid in creating tailored test images. These aids will be in the form of interesting data files, software tools and procedures for specific tasks.The four most obvious applications for these data sets are testing forensic tools, establishing that lab equipment is functioning properly, testing proficiency in specific skills, and training laboratory staff. Each type of data set has slightly different requirements, and most data sets can be used for more than one function.Prototype data sets are available for public comment. For more information contact Jim Lyle at jlyle@nist.gov.