Presentation 01: Digital Forensics

1. Definitions & Goals

• Digital Forensic Science (DFS): The use of scientifically derived methods to

preserve, collect, validate, identify, analyze, interpret, document, and present digital
evidence for criminal reconstruction or anticipating unauthorized actions.

• Reasons for Investigation:

o Recover damages/monetary compensation.

o Bring culprits to justice.

o Prevention (make sure it doesn't happen again).

o Prevent leakage of confidential information.

• Reactive vs. Proactive: Forensics is inherently reactive (after the event), whereas
Intrusion Detection and Incident Response are proactive. However, vendors are
moving into the proactive space.

2. Standards & Guidelines

• ISO Standards: ISO 27037 (Collection/Acquisition), ISO 27041 (Investigative

Method), ISO 27042 (Analysis/Interpretation).

• ACPO Guidelines (Good Practice Guide):

o Principle 1: No action should change data on the computer which may be

relied upon in court.

o Principle 2: If accessing original data is necessary, the person must be

competent and able to explain the relevance/implications.

o Principle 3: An audit trail of all processes must be created so a third party

can replicate the results.

o Principle 4: The person in charge is responsible for ensuring adherence to

the law and principles.

3. Forensic Laboratory Requirements

• Physical: Secure, lockable room/safe, screens not viewable by others, compliant

with ISO/IEC 17025:2005.

• Equipment:
 o Acquisition System: Independent of analysis station, uses hardware write
blockers.

o Analysis System: High-spec PC (e.g., Mac Pro, RAID 0 for speed).

o Storage: Short-term and long-term storage for images.

Presentation 02: Acquisition

1. Criminal vs. Corporate Forensics

• Criminal: Triggered by police investigation, strict legal procedures, cost is usually

not an object.

+1

• Corporate: Triggered by Board of Directors, often handled by admins, cost/viability

is a factor, may not require a sealed lab.

2. Evidence & Chain of Custody

• Evidence Rules: Must be Admissible, Authentic, Complete, Reliable, and

Believable.

• Chain of Custody: A process documenting the complete journey of evidence (Who

collected it? Where was it stored? Who accessed it?) to protect integrity .

• Evidence Life Cycle: Identification -> Storage/Preservation -> Testing (sealed

environment) -> Presentation -> Return .

3. Acquisition Procedures

• Order of Volatility (Capture first to last):

1. Registers/Cache.

2. Main Memory (RAM).

3. Network State/Running Processes.

4. Disk (Hard drives).

5. Archival Media (CDs, backups).

• Logical vs. Physical:

 o Physical (Bit-stream): Bit-for-bit copy (image), includes Master Boot Record
(MBR), deleted files, and slack space. Gold standard.

o Logical: Captures the file system as seen by the OS (partition only).

• Write Blocking: Essential to ensure evidence integrity (Principle 1).

4. Storage Media Issues

• SSD (Solid State Drives): Use "Wear Leveling" (data isn't overwritten in place). The
TRIM command may permanently wipe data shortly after deletion, making recovery
difficult.

• Handling: Protect from magnetic sources, extreme temps, and shock. Use anti-
static bags.

5. Hashing

• Purpose: Creates a digital "fingerprint" to verify integrity.

• Birthday Attack: A brute force attack to find two random messages that hash to the
same value (collision).

Presentation 03: Data Carving

1. File Allocation & Fragmentation

• Allocation Strategies:

o First Available: Uses the first free cluster found.

o Next Available: Continues search from the last allocated cluster.

o Best Fit: Finds a space that fits the file size best to reduce fragmentation.

• Fragmentation: Modern OSs try to limit this, but it complicates data carving.

2. File Systems

• FAT (File Allocation Table): Older, simple, still used in USBs. Deletion involves
replacing the first letter of the filename with a Greek character.

• NTFS (New Technology File System): Windows standard. Uses MFT (Master File
Table) to store attributes/records. Supports encryption (EFS) and compression .

• Others: Ext4 (Linux), HFS+ (Mac), ZFS (Solaris).

3. Data Carving Techniques

• Definition: Reassembling files from fragments without file system metadata.

• Magic Numbers: File signatures used to identify file types (e.g., JPEG starts with
0xFFD8, ends with 0xFFD9; PDF starts with %PDF).

• Types of Carving:

o Header-Footer: Scans for start and end signatures. Copies everything in

between.

o Header-Maximum File Size: Used when no footer exists; carves a fixed

amount of data.

o Header-Embedded Length: Reads the file size defined inside the header
(e.g., WAV files).

o Bi-fragment Gap Carving: Validates object structure across two fragments.

Presentation 04: Unix and Linux Forensics

1. File System Structure

• Components:

o Boot Block: Contains bootstrap code (only one per disk).

o Superblock: Indicates geometry, available space, and location of the first

inode.

o Inode Blocks: Contains file metadata (permissions, ownership, timestamps,

pointers to data blocks). Deleted inodes have a link count of 0.

o Data Blocks: Stores actual file content.

• Inode Pointers: Direct (1-10), Indirect (11), Double-indirect (12), Triple-indirect (13).

2. Boot Process

1. Firmware loads to RAM -> Checks hardware.

2. Loads Boot Program (LILO or GRUB) from MBR.

3. Loads Kernel -> Kernel identifies devices.

4. System runs in single-user mode, then switches to multi-user mode.

3. Investigation & Data Collection

• Toolkit: Use a prepared toolkit (e.g., on removable media) to avoid altering the
compromised system.

• Precautions: Do not run programs that modify metadata. Calculate hashes of

collected data.

• Collection Steps:

o Mount toolkit.

o Collect current date (UTC).

o Collect caches (ARP, routing).

o Collect connection info (open ports).

o Acquire physical memory.

o Check loaded kernel modules (analyze ksyms for intruders).

• Key Commands: dd (imaging), lsof (list open files), grep (search strings), uname -a
(kernel version).

+1

Presentation 05: Password Hacking

1. Password Storage & Protection

• Storage Levels: Clear text -> Hashed -> Hashed + Salted -> Encrypted Database.

• Encryption:

o Full Disk: BitLocker (Windows), FileVault (OSX).

o File System: Windows EFS (encrypts file content $DATA only, not metadata).

o Application: MS Office (AES-128 in 2007+), PDF (AES-256) .

2. Hacking/Recovery Methods

• Sources: Sticky notes, RAM (keys might be in memory), [Link].

• Attack Types (In order of preference):

1. Dictionary: Uses a list of common words.

 2. Rule-Based: Modifies dictionary words (e.g., adding numbers).

3. Brute Force: Tries all combinations (slowest).

• Rainbow Tables: Precomputed hash tables to reverse hashes quickly. Salts are the
countermeasure to this.

• Tools: AccessData PRTK, Cain and Abel, Jack the Ripper, Ophcrack.

Presentation 06: Antiforensics

1. Definition & Taxonomy

• Definition: Tools/techniques to remove or modify evidence.

• Rogers’ Taxonomy:

1. Data Hiding: Steganography, hidden partitions.

2. Artifact Wiping: Disk cleaning, file wiping.

3. Trail Obfuscation: Log cleaners, spoofing, zombie accounts.

4. Attacks against tools: Crashing forensic software.

2. Steganography (Data Hiding)

• Techniques:

o Null Ciphers: Hiding messages in unread characters (e.g., first letter of every
word).

o LSB Substitution: Hiding data in the Least Significant Bit of image/audio files
(imperceptible to humans).

o EOF: Hiding data after the End of File marker.

• Detection (Steganalysis): Can be "Targeted" (looking for specific tools) or "Blind"

(statistical anomalies).

3. Wiping & Obfuscation

• Wiping: Overwriting data (shredding). Degaussing destroys magnetic media.

• Timestomp: A tool to modify file timestamps (creation, access, modification) to

confuse the timeline.
Presentation 07: Malware Threats

1. Virus Classifications

• Boot Sector Virus: Infects MBR (e.g., Elk Cloner, Brain).

• File Deleting: Deletes critical OS files (e.g., CIH/Chernobyl).

• Polymorphic: Changes code/appearance every time to evade signature detection

(e.g., Ursnif).

• Armored: Designed to be difficult to analyze/disassemble (e.g., Whale).

• Stealth: Hides changes to file sizes or directories.

• Retrovirus: Attacks the antivirus software itself.

2. Trojans & Fileless Malware

• Trojan Horse: Disguised as legitimate programs. Includes Backdoor, DDoS, and

Data Sending Trojans.

• Fileless Malware: Exists in memory or uses legitimate tools (PowerShell, Registry)

without leaving files on disk.

3. Notable Attacks

• SolarWinds (2020): Supply chain attack by injecting malware into Orion updates.

• Kaseya (2021): Ransomware distributed via fake software updates.

• Twitter (2020): Social engineering (vishing) used to hijack celebrity accounts for
Bitcoin scams.

4. Detection & Best Practice

• Signature-based: Matches known patterns (prone to false positives/negatives).

• Reputation-based: Checks file reputation via cloud/community data.

• Forensic Practice: Mount suspect drive as read-only and scan with minimum of
three different AV products.

Presentation 08: Malware Analysis

1. Concepts & Goals

 • Why Analyze? To determine exactly what happened, identify malicious intent, find
indicators of compromise (IOCs), assess damage, and create signatures for
Intrusion Detection Systems (IDS) .

• Types of Analysis:

o Static Analysis: Code analysis performed without executing the malware. It

involves examining the file structure and code.

o Dynamic Analysis: Behavioral analysis performed by executing the malware

and monitoring its interactions with the system.

• Guidelines: Focus on essential features rather than every detail. Use a variety of
tools, as no single approach works for everything.

2. Preparing the Testbed

• Isolation: Use an isolated test network (e.g., separate DNS) to prevent the malware
from spreading.

• Virtualization: Use virtual machines with snapshots. This allows you to quickly
"wipe and rebuild" the machine after infection.

• Tools: The testbed should include imaging tools, static analysis tools
(Registry/Config readers), and a Sandbox for dynamic execution .

3. Static Analysis Techniques

• File Fingerprinting: Computing the hash value (MD5/SHA) to identify changes and
track the specific malware version across a network .

• Scanning:

o Local: Scan with up-to-date antivirus software.

o Online: Upload to VirusTotal to scan against multiple AV engines and get

metadata (DLLs, sections).

• String Search: Searching for readable strings in the binary (e.g., URLs, messages,
commands) to understand basic functionality. Tool: BinText.

• Packing/Obfuscation Detection: Attackers compress or encrypt executables to

hide logic. If a program is "packed," it must be unpacked before analysis . Tool: PEiD.
 • PE (Portable Executable) Info: Analyzing the Windows executable format.

o .text (Code), .rdata (Import/Export), .data (Global data), .rsrc (Resources like
icons/strings) . Tool: PE Explorer.

• Dependency Analysis: Identifying which DLLs (Dynamic Link Libraries) the

malware imports helps predict its behavior .

o [Link]: Memory/Hardware access.

o [Link]: Registry/Service Manager access.

o [Link]: User interface control.

o Tool: Dependency Walker.

• Disassembly: Converting binary code back into assembly to view APIs and logic.
Tool: IDA (Interactive Disassembler).

4. Dynamic Analysis Techniques

• System Baselining: Taking a snapshot before execution to compare against the

infected state.

• Port Monitoring: Checking for new open ports or connections. Malware often opens
ports to "phone home." Tool: TCPView.

• Registry Monitoring: Malware modifies the Registry for persistence (restarting after
reboot).

o Key Locations: Run, RunServices, RunOnce .

o Tool: Regshot (Compares registry before and after infection).

• Service & Startup Monitoring: Checking for programs set to run automatically as a
service (often as SYSTEM/Privileged account) . Tool: Autoruns.

• Installation Monitoring: Tracking files created or modified during the malware's

"installation" phase. Tool: Mirekusoft Install Monitor.

• Network & DNS Monitoring: capturing traffic and DNS requests (e.g., trying to
connect to a command & control server). Tool: DNSQuerySniffer.

• API Monitoring: Intercepting calls between the malware and the OS. Tool:
APIMonitor.
5. Summary of Tools Mentioned

• Static: HashMyFiles, VirusTotal, BinText, PEiD, PE Explorer, Dependency Walker,

IDA.

• Dynamic: TCPView, Regshot, Autoruns, Mirekusoft Install Monitor,

DNSQuerySniffer, APIMonitor, PA File Sight.