Computer

Forensics

1
 Computer
Forensics
Computer forensics is a field of technology that uses investigative
techniques to identify and store evidence from a computer
device. Often, computer forensics is used to uncover evidence
that could be used in a court of law.

2
File System
Management

3
 File
File is a collection of data created by users. It is the
collection of related information stored in the sequence of
bits, bytes, lines or records. Files are treated as single
entity. Every file stored in computer has some common
property.

4
 Properties of File
• Long Term Existence: Files are stored in secondary devices. They
do not get erased when a user logs off.

• Shareable between processes: Files have names. They can

have associated access permissions that permit controlled sharing.

• Structure: Files can be organized into complex structures.

5
 Basic File
1
Operations
SR No File Operations

Read
2 Write
3 Rename
4 Copy
5 Sort
6 Cut
7 Delete

6
 File Extension
• Every file has a name and an extension.
• The extension is used to retrieve its content in the application
software.
• This means that there are different types of files which are linked to
different applications

7
 File Types
• Regular files: are the most common files and are
used to contain data. These files store information
about user programs

• Directory files: Directory files contain information that

the system needs to access all types of files, but
directory files do not contain the actual file data. Each
entry contains the name of the file and the file's index
node reference number (i-node number).. The i-node
number describes the location of the data associated
with the file.

8
 File Types
• Special files: Special files define devices for the
system or are temporary files created by processes.
• The basic types of special files are FIFO (first-in, first-
out), block, and character. FIFO files are also
called pipes. Pipes are created by one process to
temporarily allow communication with another process.
• These files cease(stop) to exist when the first process
finishes. Block and character files define devices.
• Every file has a set of permissions (called access
modes) that determine who can read, modify, or
execute the file.
9
 What is File
System?

• A file system defines how files are named, stored, and retrieved from
a storage device.
• Why do we need a file system in the first place, you may ask?
-> Well, without a file system, the storage device would contain a big chunk of
data stored back to back, and the operating system wouldn't be able to tell
them apart.
Imagine a room with piles
of papers scattered all
over the place.

A storage device without a file

system would be in the same
situation - and it would be a
useless electronic device.
• A file system isn't just a
bookkeeping feature,
though

• Space management,
metadata, data
encryption, file access
control, and data
integrity are the
responsibilities of the
file system too.
 “
• Storage devices must be partitioned and formatted before use.
• Partitioning is splitting a storage device into several logical regions, so
they can be managed separately as if they are separate storage
devices.
• Before a file system can be created, a partition must be created to
specify how much of the hard drive it will occupy. The first sector of a
hard disk contains the Master Boot Record (MBR) containing a partition
table to tell the operating system how the disk is divided
 File system in
• FAT16 Windows
• FAT32,
• exFAT
• NTFS
• These are four types of file systems most
widely adopted by users.

14
 FAT32
• File systems such as FAT16, FAT32, NTFS, HFS (Macintosh Hierarchical
Filesystem), HFS+, Ext2 (Linux), and UFS (Solaris) keep track of where data are
located on a disk, providing the familiar file and folder structure.
• Before a file system can be created, a partition must be created to specify how
much of the hard drive it will occupy.
• The first sector of a hard disk contains the Master Boot Record (MBR) containing a
partition table to tell the operating system how the disk is divided.

15
FAT32

16
 FAT32
• The partition table specifies the first and last sectors in each partition, as well
as additional information about the partition.
• Once a partition has been created it can be formatted with any file system. For
instance, a FAT file system can be created using the format command on
Windows. The area occupied by the file system is called a volume, which is
assigned a letter such as C: by the operating system.
• Contrary to popular belief, the format command does not erase data from the
volume - it is possible to recover data from a hard drive after it has been
formatted.
• Comparing volumes to bookcases in a library, file systems are analogous to
library catalogs, providing an efficient way to locate a particular item.
• Formatting a volume is like destroying the card catalog in a library but leaving
the books on the shelves. It is still possible to find a particular book but it
takes more time.

17
 FAT32
• The data width for FAT32 amounts to 32 bits – hence the 32 in its name instead
of the 16 bit of the predecessor system.
• The data width for the current standard file system, NTFS, is 64 bits
• The number of addressable clusters in the FAT32 file system is 268,435,456.
The maximum size of a cluster in the FAT32 file system is exactly 32 KB.
• The first sector on each volume, called the boot sector (a.k.a. boot record or
boot block), contains important file system information
• Be aware that a file system may not use an entire partition, leaving space
between the end of the volume and the end of the partition, an area called
volume slack that can be used to hide data.
• Also be aware that partitions typically start at the beginning of a cylinder
resulting in unused space between the end of one partition and the beginning
of the next.

18
 FAT32
• There are several features of file systems that are useful from a data recovery
standpoint.
• When a file takes up less than one cluster, other files will not use the additional
space in that cluster. In short, once a cluster contains data, the entire cluster is
reserved. This is similar to the situation in most restaurants.
• Similarly, if a computer tried to squeeze extra data into the unused part of a
cluster, the new data might interfere with the old. The extra sectors in a cluster
are called file slack space.
• When a file is deleted, its entry in the file system is updated to indicate its
deleted status and the clusters that were previously allocated to storing are
unallocated and can be reused to store a new file.
• However, the data are left on the disk and it is often possible to retrieve a file
immediately after it has been deleted. The data will remain on the disk until a
new file overwrites them
19
FAT32

20
NTFS -New Technology File
System
 How does NTFS
work?
The Master File Table (MFT), which holds data about all of the files and folders
on the NTFS disk, is created when a volume is formatted with the NTFS file
system, along with numerous other system files.

23
 How does NTFS
work?
• The Master File Table (MFT), which holds data about all of the files and
folders on the NTFS disk, is created when a volume is formatted with the
NTFS file system, along with numerous other system files.
• When an HDD is formatted or initialized, it is divided into partitions.
Partitions are the major divisions of the hard drive's physical space. Within
each partition, the OS keeps track of all the files it stores.
• Using NTFS, the sizes of the clusters range from 512 bytes to 64 KB. Windows
NT provides a recommended default cluster size for each drive size.
• For example, a 4 gigabyte (GB) drive has a default cluster size of 4 KB. The
clusters are indivisible, so even the smallest file takes up one cluster, and a
4.1 KB file takes up two clusters, or 8 KB, on a 4 KB cluster system.

24
 How does NTFS
work?
• Cluster sizes are determined based on balancing a tradeoff between
maximizing use of disk space and minimizing the number of disk accesses
required to get a file.
• With NTFS, generally, the larger the drive, the larger the default cluster size,
because it's assumed that a system user will prefer to have fewer disk
accesses and better performance at the expense of less efficient use of space

25
 Advantages
There are several advantages and disadvantages to using NTFS, which are
included
Advantages
•Control. One of the primary features of NTFS is the use of disk quotas,
which gives organizations more control over storage space. Administrators
can use disk quotas to limit the amount of storage space a given user can
access.
•Performance. NTFS uses file compression, which shrinks file sizes,
increasing file transfer speeds and giving businesses more storage space to
work with. It also supports very large files.

26
 Advantages
•Security. The access control features of NTFS let administrators place permissions on
sensitive data, restricting access to certain users. It also supports encryption.
•Easy logging. The MFT logs and audits files on the drive, so administrators can track
files that have been deleted, added or changed in any way. NTFS is a journaling file
system, meaning it logs transactions in a file system journal.
•Reliability. Data and files can be quickly restored in the event of a system failure or
error, because NTFS maintains the consistency of the file system. It is a fault tolerant
system and has an MFT mirror file that the system can reference if the first MFT gets
corrupted.

27
 Disavantages
Limited OS compatibility. The main disadvantage of NTFS is
limited OS compatibility; it is read-only with non-Windows OSes.
Limited device support. Many removable devices don't
support NTFS, including Android smartphones, DVD players and
digital cameras. Some other devices don't support it either, such
as media players, smart TVs and printers.
Mac OS X support. OS X devices have
limited compatibility with NTFS drives; they can read them but
not write to them.

28
UNIX File System-UFS
 UFS
• Although directories play a role in UNIX file systems, they are much
simpler than their Windows counterparts, only containing a list of
filenames and their associated inode (index node) numbers.
• Every file has an associated entry in the inode table, identified by the
inode number, which contains all information about the file, apart from
its name.
• The contents of an inode include date-time stamps, the number of
bytes in the file, and which clusters (a.k.a. blocks) on the disk contain
the data.

30
UFS

31
UFS

32
 UFS
• UNIX file systems break each partition into block groups, each
with its own inodes and data blocks. Compartmentalizing data in
this way prevents catastrophic file system damage because
there is no single point of failure. If the disk area containing one
block group is damaged, only the data in that group are
impacted, leaving data in the other groups intact
• In addition to containing data, each block group contains
duplicates of critical file system components; that is, the
superblock and group descriptors, to facilitate recovery if the
primary copy is damaged. The superblock contains information
about the file system such as block size, number of blocks per
block group, the last time the file system was mounted, last time
it was written to, and the sector of the root directory's inode
33
 UFS
• UNIX file systems, imagine a library with several divisions,
each with its own books and associated card catalog. If an
absent minded librarian loses his list of the locations of each
division's card catalog, he can obtain an identical list from any
other division. However, if the card catalog in one division is
damaged or destroyed, this information is not duplicated
anywhere, making it more difficult to find books in that division.
• Fortunately, because of the compartmentalization, damage to
one division's card catalog does not adversely effect other
divisions.
34
 UFS
• When a file is deleted on a UNIX system, the file's
directory entry is hidden from view and the system
notes that the associated inode is available for reuse.
The file's directory entry, inode, and data remain on the
disk until they are overwritten.
• Some systems such Solaris, ext3, and newer versions of
ext2 remove the inode number in the directory, thus
breaking the link between directory entries and inodes,
making it more difficult to recover deleted files. Also,
some systems like HP-UX delete directory entries
completely, making file recovery even more difficult.
Furthermore, newer file systems also break the link
between the inode and the sectors that contained the
data, thus removing allfile system references to the 35
 UFS
• The root directory (denoted by /, pronounced slash) is the
highest-level directory in the hierarchical (or tree-like) Unix
File System.
• There are several subdirectories immediately below the root
level directory, most of which house system files. System
files, application files, and/or user data files may be found
below this

36
 UFS
• The root directory (denoted by /, pronounced slash) is the
highest-level directory in the hierarchical (or tree-like) Unix
File System.
• There are several subdirectories immediately below the root
level directory, most of which house system files. System
files, application files, and/or user data files may be found
below this

37
38
MAC File System
 MAC File System
• As with other systems, Macintosh stores its partition table in the first sector on
disk.
• The first sector of each volume contains the boot sector and additional details
about the volume are stored in the third sector.
• Like FAT16 and FAT32, the Macintosh HFS and HFS Plus (HFS+) file systems use
16 and 32 bits, respectively, to address clusters on a disk.
• HFS supports a maximum of 216 (65536) clusters and HFS Plus has a maximum of
232 clusters.
• The main files comprising HFS are the Catalog and Extents Overflow files.
• The Catalog file is comparable to a master file table, containing records for each
file and folder on the system with attributes such as date-time stamps.

40
 MAC File System
• As with other systems, Macintosh stores its partition table in the first sector on
disk.
• The first sector of each volume contains the boot sector and additional details
about the volume are stored in the third sector.
• Like FAT16 and FAT32, the Macintosh HFS and HFS Plus (HFS+) file systems
use 16 and 32 bits, respectively, to address clusters on a disk.
• HFS supports a maximum of 216 (65536) clusters and HFS Plus has a
maximum of 232 clusters.
• The main files comprising HFS are the Catalog and Extents Overflow files.
• The Catalog file is comparable to a master file table, containing records for
each file and folder on the system with attributes such as date-time stamps. 41
 MAC File System
• Records in the Catalog file are stored in a balanced tree (B-tree), which is a
simple database that enables efficient searching.
• Each record in the Catalog file has a unique number called a catalog node
ID (CNID).
• The Catalog file has four types of records: folders, files, folder threads, and
file threads. Although the format of folder and file records varies between
HFS and HFS Plus, they contain similar information.
•

42
 MAC File System
• Folder records contain the following fields, in addition to some details used
by the system.
• Record type: 0 × 0100
• Name: folder name
• Valence: number of files and folders directly contained by this folder
• CNID: unique catalog node ID
• Creation date: when this folder was created
• Modification date: when a file or folder was created or deleted inside this
folder, or when a file or folder was moved in or out of this folder
• Access date: not maintained by HFS (always set to zero)
• Backup date: when this folder was last backed up 43
 MAC File System
• File records contain the following fields, in addition to some details used by
the system.
• Record type: 0 × 0200
• Name: file name
• CNID: unique catalog node ID
• Creation date: when this file was created
• Modification date: when a file modified by extending, truncating, or writing
either of the forks
• Access date: not maintained by HFS (always set to zero)
• Backup date: when this file was last backed up
• Data fork: information about the location and size of the data fork
• Resource fork: Information about the location and size of the resource fork
44
 MAC File System
• HFS uses folder and file thread records in the Catalog file to link names with the
associated file or folder records using the unique CNID.
• These file and folder thread records also contain references to parent folders
that are used to construct the file system hierarchy and directory listings that
most users are familiar with.
• Files on an HFS volume have two forks: a data fork that stores the contents of a
file, and a resource fork with a special data structure for information such as
icons and menu items. The first eight clusters of each fork (a.k.a. extents) are
listed in each file's Catalog record.
• Any additional extents are stored in the Extents overflow file, which is also
organized as a B-tree.
45
 MAC File System
• Notice that, rather than relying entirely on file extensions to determine the type
of data in a file, HFS stores this information in Catalog records. However, this
information can be altered and should not be relied on to classify files.
• When a file is moved to the Trash on a Macintosh, it is actually moved to a Trash
folder but is not marked as deleted. The file is only marked as deleted when the
Trash is emptied but the data remains on disk until it is overwritten.
• A file is marked as deleted by setting the key length value within the associated
Catalog database key to zero. Also, when a file is deleted, its Catalog entry may
be deleted, removing all references to the data on disk.
• Because of the complexity of the Catalog file, it is difficult to recover deleted files
manually. Fortunately, automated tools exist that scan the Catalog B-tree and
find deleted entries.
46
 HFS File System
• Logical Blocks 0 and 1:these are boot blocks, store system start-up
information. Eg: the name of the system.
• Logical Block 2:The Master Directory Block(MDB), which stores
information such as date and timestamps of the volume,
• Logical Block3:tracks which allocation blocks are in use and which are free
• Extent Overflow File: stores the file information that is not in MDB
• Catalog File:tracks all the files and directories stored in the volume.

47
 HFS+ File System
• Boot Block: included in sector 0 and sector1
• Volume Header: included in sector 2 and is same as MDB, stores the
information such as date and timestamps of the volume.
• Allocation File:find which allocation blocks are in use and which are free.
Allocation block is represented as 1 bit. If free-> 0 bit, use -> 1 bit
• Catalog File:used to track the files and directories stored in volume
• Extent Overflow File:record the allocation blocks that are allocated to
each file as extents
• Attributes File:stores 3 types of 4KB record, Inline Data Attribute, Fork
Attribute and Extensible Attribute

48
• Inline Data Attribute records store small
attributes that can fit within the record itself.
• Fork Data Attribute records contain references
to a maximum of eight extents that can hold
larger attributes.
• Extension Attributes are used to extend a Fork
Data Attribute record when its eight extent
records are already used.
 HFS+ File System
• Start-up File:designed for non MAC OS systems, that are with or without
HFS or HFS+ support. This is like HFS Volume Boot Block.
• Alternate Volume Header: second last sector of HFS+ volume. It is like
Alternate Master Directory Block
• Last Sector: reserved for use.

50
Windows OS Artifacts
 What are Artifacts
• something observed in a scientific investigation or experiment
that is not naturally present but occurs as a result of the
preparative or investigative procedure:

52
 What are Forensic Artifacts
• Forensic artifacts are the forensic objects that have some
forensic value. Any object that contains some data or evidence
of something that has occurred like logs, register, hives, and
many more

53
 Why to learn about
Windows Artifacts
• Learning about artifacts in Windows is crucial for digital
forensics examiners, as Windows accounts for most of the traffic
in the world (91.8 of traffic comes from computers using
Windows as their operating system as of 2013) and examiners
will most likely encounter Windows and will have to collect
evidence from it in almost all cyber-crime cases

54
 What is Windows Forensic
Windows Forensic Analysis Analysis
focuses on 2 things:
• In-depth analysis of Windows Operating System.
• Analysis of Windows System Artifacts.

55
 What is Windows Forensic
• Windows artifacts are theAnalysis
objects which hold information about
the activities that are performed by the Windows user.
• The type of information and the location of the artifact varies
from one operating system to another.
• Windows artifacts contain sensitive information that is collected
and analyzed at the time of forensic analysis

56
 What is Registry?

• The Registry or Windows Registry is the database that stores the

low-level settings of the operating system and its applications
that support registries.
• It contains all the information of the software and hardware
installed on the system. Users can access and configure the
settings of Registries by launching the Registry Editor tool of
Windows OS.
• The registries can be considered as the DNA of the Windows
devices. 57
 What is Registry?
• It contains commands for the installed applications. Whenever
you install a registry-supported Windows application on your
system, it automatically adds a new registry entry and stores all
the essential information required for running the new
application in it.
• For example, where the files are located, which other
applications can use the new program, and more.
• Registries are available to edit on Windows 10/8/7 and up to
devices with Windows 95 operating system.
58
 What is Registry?
• “The Registry contains information that Windows continually
references during operation, such as profiles for each user, the
applications installed on the computer and the types of
documents that each can create, property sheet settings for
folders and application icons, what hardware exists on the
system, and the ports that are being used.

59
 What is Registry?
• The main branches of the registry are called hives.
• A hive is a logical group of keys, subkeys, and values in the
registry that has a set of supporting files loaded into memory
when the operating system is started or a user logs in. Each time
a new user logs on to a computer, a new hive is created for that
user with a separate file for the user profile
• And most PCs have five of them. All the folders in the registry
are called keys except for these five hives. The hives in the
Windows registry have the following names:

60
 Registry root keys
Registry Root key Descriptions

It describes the file type, its extension, and

HKEY_CLASSES_ROOT (HKCR) Object Linking and Embedding (OLE)
information.

HKEY_CURRENT_USER (HKCU)
Contains the information and the settings of the
currently logged-in user.

This is where most registries are present and

HKEY_LOCAL_MACHINE (HKLM)
are being edited. It contains device-specific
information. Every user who can log in to the
computer can access HKLM.

HKEY_USERS (HKU)
It contains data of all the user’s accounts of the
system.

This root key contains the details of the

HKEY_CURRENT_CONFIG (HKCC) configuration of the hardware currently attached
to the device. 61
 Registry root keys

• Intruders use the Registry to ensure that programs they have

installed stay running, even after the system is rebooted. For
instance, Trojan horse programs often have associated entries in
the Registry

62
 From a forensic standpoint, you can find a plethora of
information in the registry. The following list summarizes a
few of the possibilities
• Auto-start programs: Identify applications that run
automatically when the system starts up or a user logs in
• Hardware: Enumerate the external media devices that were
connected to the system.
• User account information: Audit user passwords, accounts,
most recently used (MRU) items, and user preferences.
• Recently run programs: Determine what applications
executed recently (using data from the Userassist, Shimcache,
and MUICache keys).
63
 From a forensic standpoint, you can find a plethora of
information in the registry. The following list summarizes a
few of the possibilities

• System information: Determine system settings, installed

software, and security patches that have been applied.
• Malware configurations: Extract data related to malware
command and control sites, paths to infected files on disk, and
encryption keys (anything malicious code writes to the registry).

64
 Case Study 1
The Windows registry facilitated law enforcement in solving a credit card case in Houston, Texas.
The suspects were a man and his wife who bought goods from the Internet with pilfered credit
card numbers. They were detained as a result of a controlled drop of commodities ordered from
the Internet. When [Link], the registry, and the protected storage system provider were
scrutinized, a list of numerous names, addresses, and credit card numbers were found. It turned
out that the information in the list was applied online to purchase goods as well, and after an
additional investigation it was concluded that these credit card numbers were used illegally,
without any permission from their owners.
The data retrieved from the registry was sufficient to exact more search warrants which led to the
arrest of 22 persons and the retrieval of illegally bought goods worth more than $100,000.
The development of the events turned out to be the following:
All defendants pled guilty to organized crime accusations and served time in jail, which may have
not been possible without the help of the Windows registry.

65
 Case Study 2
Guests at a hotel located in a little town near Austin, Texas, called the
law enforcement authorities after seeing a person, who looked
intoxicated, walking around the hotel naked. When the law enforcement
officials arrived after the 911 call they located the individual and
concluded that he was, in fact, staying at that hotel so they escorted him
to his room and there they discovered that he was staying with another
person—but what surprised them was that a picture of child pornography
was being projected on the wall. The picture was projected through a
laptop that had a projector attached to it. In close proximity to the
laptop, there were two external hard drives.
The individual who was already in the room was surprised by the entry of
the police and he asserted that the laptop was his but that the external
drives belonged to his intoxicated fellow and had nothing to do with him.
The equipment was immediately confiscated and sent for analysis.
Forensic clones were created from the laptop and the two external hard
drives without delay. The initial analysis of the external hard drives
66
revealed the existence of pictures and movies of child pornography on
 Case Study 2
Consequently, the forensic analysts had to find out whether any of these
external drives were connected to the laptop of the individual asserting
that he had nothing to do with them. Thus, the laptop’s system registry
file was examined to match any entries in the USBStor key with the
external drives. This turned out to be a fruitful examination, as listings
for the external drives were found as well as their hardware serial
numbers.
Following these steps, the forensic analysts had to determine whether
their results were authentic, so they linked the suspect’s external drives
to their lab’s computer system, using a freshly installed version of
Windows. To avert any alteration to the clones of the EHDs a write
blocker was linked between the two drives and the system.
Lastly, they examined the clone’s system registry file and the USBStor
keys and came to the same conclusion, that the EHDs listings were
identical to the defendant’s, in addition to having the same hardware
serial numbers, and this proved that at some point in time the EHDs were
67
connected to the suspect’s laptop. Ultimately, the culprit was sentenced
Events Logs
 Windows Event Log
• The Windows event log is a detailed record of system, security and
application notifications stored by the Windows operating system that is
used by administrators to diagnose system problems and predict future
issues.
• The Windows operating system tracks specific events in its log files, such as
application installations, security management, system setup operations on
initial startup, and problems or errors.

69
 Windows Event Log
• Each event in a log entry contains the following information:
• Date: The date the event occurred.
• Time: The time the event occurred.
• User: The username of the user logged onto the machine when the event
occurred.
• Computer: The name of the computer.
• Event ID: A Windows identification number that specifies the event
type.
• Source: The program or component that caused the event.
• Type: The type of event, including information, warning, error, security
success audit or security failure audit.
70
 Windows Event Log
• For example, an information event might appear as:
• Information 5/16/2018 8:41:15 AM Service Control
Manager 7036 None
• A warning event might look like:
• Warning 5/11/2018 10:29:47 AM Kernel-Event Tracing
1 Logging
• By comparison, an error event might appear as:
• Error 5/16/2018 8:41:15 AM Service Control
Manager 7001 None
• A critical event might resemble:
• Critical 5/11/2018 8:55:02 AM Kernel-Power 41 (63)
71
 Windows Event Log
The Windows operating system records events in five areas:
• application, security, setup, system and forwarded events. Windows stores
event logs in the C:\WINDOWS\system32\config\ folder.
• Application events relate to incidents with the software installed on the local
computer. If an application such as Microsoft Word crashes, then the Windows
event log will create a log entry about the issue, the application name and why
it crashed.
• Security events store information based on the Windows system's audit
policies, and the typical events stored include login attempts and resource
access. For example, the security log stores a record when the computer
attempts to verify account credentials when a user tries to log on to a machine.

72
 Windows Event Log
• Setup events include enterprise-focused events relating to the control of
domains, such as the location of logs after a disk configuration. The setup
log contains events that occur during the installation of the Windows
operating system.
• System events relate to incidents on Windows-specific systems, such as the
status of device drivers
• Forwarded events arrive from other machines on the same network when an
administrator wants to use a computer that gathers multiple logs.

73
 Using Event Viewer
• Windows categorizes every event with a severity level. The levels in order
of severity are information, warning, error and critical.
• Most logs consist of information-based events. Logs with this entry usually
mean the event occurred without incident or issue.
• An example of a system-based information event is Event 42, Kernel-
Power which indicates the system is entering sleep mode.

74
 Using Event Viewer
• Warning level events are based on particular events, such as a lack of
storage space. Warning messages can bring attention to potential issues that
might not require immediate action. Event 51, Disk is an example of a
system-based warning related to a paging error on the machine's drive.
• An error level indicates a device may have failed to load or operate
expectedly. Event 5719, NETLOGON is an example of a system error
when a computer cannot configure a secure session with a domain
controller.
• Critical level events indicate the most severe problems. Event ID 41,
Kernel-Power is an example of a critical system event when a machine
reboots without a clean shutdown.
75
Memory Forensics: RAM
Forensic Analysis
 What is Memory
• Digital forensics is a very large and diverse field in cybersecurity. One of the
core and most important sectionForensics?
is digital forensics is memory forensics.
• Memory forensics deals with the acquisition and analysis of a system’s volatile
memory. Hence it is also called Volatile Memory forensics.
• Memory forensics (sometimes referred to as memory analysis) refers to the
analysis of volatile data in a computer’s memory dump. Information security
professionals conduct memory forensics to investigate and identify attacks or
malicious behaviors that do not leave easily detectable tracks on hard drive
data.
• There are 2 steps in Memory Forensics:
• A. Evidence Acquisition
• B. Evidence analysis
77
 Why Memory Forensics ?

This is useful because of the way in which processes, files and programs are
run in memory, and once a snapshot has been captured, many important facts
can be ascertained by the investigator, such as:
• Processes running
• Executable files that are running
• Open ports, IP addresses and other networking information
• Users that are logged into the system, and from where Files that are open
and by whom

78
 Volatile Data ?
• Volatile data is the data stored in temporary memory on a computer while it is
running. When a computer is powered off, volatile data is lost almost
immediately.
• Volatile data resides in a computer’s short term memory storage and can
include data like browsing history, chat messages, and clipboard contents.
• If, for example, you were working on a document in Word or Pages that you
had not yet saved to your hard drive or another non-volatile memory source,
then you would lose your work if your computer lost power before it was
saved.

79
 Memory Dump
• A memory dump (also known as a core dump or system dump) is a snapshot
capture of computer memory data from a specific instant.
• A memory dump can contain valuable forensics data about the state of the system
before an incident such as a crash or security compromise.
• Memory dumps contain RAM data that can be used to identify the cause of an
incident and other key details about what happened.
• The information stored in the memory dump is binary, octal or hexadecimal
format. In Windows 10, there are four types of memory dump

80
 Memory Dump
• Complete memory dump: largest mry dump. Contains data used by windows in
the physical memory. If the user is using 4Gb of his system’s RAM at the time of
crash, the memory dump will be 4GB in size.
• Kernel memory dump:size is 1/3rd of the physical memory. Does not contain any
unallocated memory or the mry allocated to user applications. Only stores the
memory allocated to the Windows kernel and kernel-mode programs.
• Small memory dump: contains very limited information that includes blue-screen
information, a list of loaded drivers, process information and kernel information.
• Automatic Memory dump: An Automatic Memory Dump contains the same
information as a Kernel Memory Dump .The difference between the two is not in
the dump file itself, but in the way that Windows sets the size of the system
paging file.
81
 Memory Dump
• Complete memory dump: largest mry dump. Contains data used by windows
in the physical memory. If the user is using 4Gb of his system’s RAM at the
time of crash, the memory dump will be 4GB in size.
• Kernel memory dump:size is 1/3rd of the physical memory. Does not contain
any unallocated memory or the mry allocated to user applications. Only stores
the memory allocated to the Windows kernel and kernel-mode programs.
• Small memory dump: contains very limited information that includes blue-
screen information, a list of loaded drivers, process information and kernel
information.
• Automatic Memory dump: An Automatic Memory Dump contains the same
information as a Kernel Memory Dump .The difference between the two is not
in the dump file itself, but in the way that Windows sets the size of the system
paging file. 82
 Creating a RAM memory
•
image
The software used for this purpose will be the “DumpIT”
• Recommendation:
The image should not be written directly to the machine that will have the analyzed RAM.
The software “DumpIT” must be copied and run from an external storage device (for
example a flash drive, external HD or even a secure network share).
• Execution:
Run the “DumpIT” software with administrator privileges:
• The Software “DumpIT” will display the memory size “Address space size”, which in the
example displays a 16GB of RAM, where the result of the image file generated will have
approximately the same size. The path where the file is saved is shown in “Destination”
and is the path where the program “DumpIT” is running.
• By default the file name is the hostname (hostname) followed by the date of execution of
the imaging process. The file is saved by default in “raw” format.
83
Creating a RAM memory
image

84
 Creating a RAM memory
• image
To start the process, simply press the “Y” key.
• The “Processing” message indicates that the forensic image memory is being
processed.
• The “Success” message indicates that the process was successfully completed:

Basics of Memory Forensics - Abhiram's Blog (stuxn

[Link])

85
Creating a RAM memory
image

86
Volatility Framework
 Volatility Framework

• Volatility Framework- The Volatility Framework is a completely open

collection of tools, implemented in Python under the GNU General Public
License 2. Analysts use Volatility for the extraction of digital artifacts from
volatile memory (RAM) samples.

• Because Volatility is open source and free to use, you can download the
framework and begin performing advanced analysis without paying a penny

88
 Volatility Framework
• It is written in Python. Python is an established forensic and reverse engineering
language with loads of libraries that can easily integrate into Volatility.
• Runs on Windows, Linux, or Mac analysis systems. Volatility runs anywhere
Python can be installed—a refreshing break from other memory analysis tools
that run only on Windows.
• Extensible and scriptable application programming interface (API). Volatility
gives you the power to go beyond and continue innovating. For example, you can
use Volatility to drive your malware sandbox, perform virtual machine (VM)
introspection, or just explore kernel memory in an automated fashion

89
 Features of Volatility
Framework?

• A single, cohesive framework. Volatility analyzes memory from 32- and

64-bit Windows, Linux, Mac systems (and 32-bit Android). Volatility’s
modular design allows it to easily support new operating systems and
architectures as they are released.
• It is Open Source GPLv2. This means you can read the source code, learn
from it, and extend it. By learning how Volatility works, you will become a
more effective analyst.
90
 Features of Volatility
Framework?
• Unparalleled feature sets. Capabilities have been built into the framework
based on reverse engineering and specialized research. Volatility provides
functionality that even Microsoft’s own kernel debugger doesn’t support.
• Comprehensive coverage of file formats. Volatility can analyze raw dumps,
crash dumps, hibernation files, and various other formats (see Chapter 4). You
can even convert back and forth between these formats
• Fast and efficient algorithms. This lets you analyze RAM dumps from large
systems in a fraction of the time it takes other tools, and without unnecessary
memory consumption
91
 Structure Volatility
Framework?
• The Volatility Framework consists of several subsystems that work
together to provide a robust set of features.
• A. Vtypes
• This is Volatility’s structure definition and parsing language.
• Because Volatility is written in Python, you need a way to represent C data
structures in Python source files.
• struct process
• { int pid;
• int parent_pid;
• char name[10];
• char * command_line;
• void * ptv; };
92
 Structure Volatility
• Framework?
The equivalent structure in the VType language is as follows:
• 'process' : [ 26, {
• 'pid' : [ 0, ['int']],
• 'parent_pid' : [ 4, ['int']],
• 'name' : [ 8, ['array', 10, ['char']]],
• 'command_line' : [ 18, ['pointer', ['char']]],
• 'ptv' : [ 22, ['pointer', ['void']]], }]

93
 Structure Volatility
• Framework?
The equivalent structure in the VType language is as follows:
• 'process' : [ 26, {
• 'pid' : [ 0, ['int']],
• 'parent_pid' : [ 4, ['int']],
• 'name' : [ 8, ['array', 10, ['char']]],
• 'command_line' : [ 18, ['pointer', ['char']]],
• 'ptv' : [ 22, ['pointer', ['void']]], }]

94
 Generating VTypes?
• Despite the fact that working with VType syntax can be a fairly simple task once
you practice, the sheer number of structures that an operating system or
application uses makes it highly impractical to generate them all by hand
Furthermore, the structures can change drastically with each new version of an
operating system, or even with just a new service pack or security update
• To deal with these complexities, Brendan Dolan-Gavit
([Link] .[Link]/grads/b/brendan/) designed a method of automatically
generating VTypes from Microsoft’s debugging symbols (PDB files). In
particular, he wrote a library named pdbparse
([Link] that can convert the proprietary, binary PDB
file format into the open VType language that Volatility can understand. 95
 Generating VTypes?
• Despite the fact that working with VType syntax can be a fairly simple task
once you practice, the sheer number of structures that an operating system or
application uses makes it highly impractical to generate them all by hand.
Furthermore, the structures can change drastically with each new version of an
operating system, or even with just a new service pack or security update
• To deal with these complexities, Brendan Dolan-Gavitt designed a method of
automatically generating VTypes from Microsoft’s debugging symbols (PDB
files). In particular, he wrote a library named pdbparse that can convert the
proprietary, binary PDB file format into the open VType language that Volatility
can understand.
• However, it is important to note that Microsoft does not divulge all the
structures that its operating system needs—only the ones that could reasonably
be seen to assist with debugging efforts. 96
 Overlays
• Overlays enable you to fix up, or patch, the automatically generated structure
definitions.
• Aside from providing the ability to make structure definitions more accurate,
overlays also come in handy for convenience and consistency purposes.
• For example, Windows stores many of its timestamps in a structure called
_LARGE_INTEGER. The structure contains two 32-bit integers (a low part
and high part), which are combined to form a 64-bit timestamp value. The
value of 1325230153, when translated, means 2011-12-30 07:29:13
UTC+0000. Many Volatility plugins need to report timestamps in this human-
readable format. Thus, it makes sense to globally change structures that use
_LARGE_INTEGER to store timestamp values into a special type that
translates the value automatically.
97
 Overlays
• Despite the fact that working with VType syntax can be a fairly simple task once
you practice, the sheer number of structures that an operating system or
application uses makes it highly impractical to generate them all by hand.
Furthermore, the structures can change drastically with each new version of an
operating system, or even with just a new service pack or security update
• To deal with these complexities, Brendan Dolan-Gavitt
([Link] .[Link]/grads/b/brendan/) designed a method of
automatically generating VTypes from Microsoft’s debugging symbols (PDB
files). In particular, he wrote a library named pdbparse
([Link] that can convert the proprietary, binary
PDB file format into the open VType language that Volatility can understand.
98
 Objects and Classes
• A Volatility object (or just object for short) is an instance of a structure that
exists at a specific address within an address space (AS).
• An object class enables you to extend the functionality of an object. In other
words, you can attach methods or properties to an object that then become
accessible to all instances of the object.

99
 Profiles
• A profile is a collection of the VTypes, overlays, and object classes for a
specific operating system version and hardware architecture (x86, x64, ARM).
• In addition to these components, a profile also includes the following: •
Metadata: Data such as the operating system’s name (i.e., “windows”, “mac”,
or “linux”), the kernel version, and build numbers
• System call information: Indexes and names of system calls
• Constant values: Global variables that can be found at hard-coded addresses
in some operating systems
• Native types: Low-level types for native languages (usually C), including the
sizes for integers, longs, and so on
• System map: Addresses of critical global variables and functions (Linux and
Mac only
10
 Address Spaces
• An address space (AS) is an interface that provides flexible and consistent
access to data in RAM, handles virtual-to-physical-address translation when
necessary, and transparently accounts for differences in memory dump file
formats.

10
 Virtual/Paged Address
• An address space (AS) is an Spaces
interface that provides flexible and consistent
access to data in RAM, handles virtual-to-physical-address translation when
necessary, and transparently accounts for differences in memory dump file
formats.

10