CHFI Final

Anti-Digital Forensic techniques: - Overwriting data (Wiping). Exploitation of bugs in forensic tools. Obfuscation. Hiding Data (Steganography, Cryptography, low-tech...) Volatile Data - Can be modified, rapidly. Non-Volatile data - Secondary storage of data. Long term, persistent data. Transient Data - Programs that reside in memory and cache data. (i.e. network connection, user logout, ...) Fragile Data - Data temporarily saved to the hard disk and can be changed. (i.e. time stamps, access times...) Temporarily-Accessible Data - Stored on hard disk and are accessible for a certain amount of time. Active Data - Data used for daily operations. Archival Data - long term storage of data. Backup Data - Copy of system data, used for the recovery process. Residual Data - Data stored on a computer. in unassigned storage space, after it is deleted. Metadata - data about a particular document. Rules for allowing duplicate evidence. - Original evidence is not available, due to: -Evidence destroyed due to an uncontrollable event (Fire/ Flood). -Evidence destroyed in normal course of business. -Original evidence in possession of a third party. Sources of data for digital evidence. - Server. Storage devices. Logs. Internal hardware. Swap file - space on a hard disk, used as the virtual memory extension of a computer's real memory (RAM). Digital evidence tends to be what kind of evidence? - Circumstantial Evidence Role of the First Responder - Identify Crime scene Protect the Crime Scene Preserve evidence Collect complete information about incident. Document findings Package and Transport evidence. Order of Volitility - 1. Registers, Cache. 2. Routing and Process tables, Kernel Statistics and memory. 3. Temporary File Systems. 4. Disk or other storage media. 5. Remote logging and monitoring data. 6. Physical configuration and topology. 7. Archival Media and Backups. When searching for evidence, what is the manner in which the search should be conducted? - Start from the computer and move outward in a circular manner. When logged on as an administrative user in Linux shell, the command line prior to the prompt will be__. - # Once the scene has been secured, the next step should be: - Photograph the machine. How should evince be labeled? - I.Item#.sub-item# i.e. JSP.031712.001.2 US accreditation association for forensic Laboratories. - ASCLD -American Association of Crime Lab Directors How many entrances should there be to a computer forensics laboratory? - 1 In a computer forensics laboratory, how many computers should be budgeted per examiner? - 2 UFED - Device for extracting data from mobile phones. TACC 1441 - Device for cracking passwords using multiple GPU's. What should be in place to ensure compliance with procedures and policies? - Routine audits NAND -based flash memory - Solid state memory (flash chips) that retains memory without power SCSI - Small Computer System Interface. circuit board that handles up to 15 peripheral devices How are tracks numbered? - Cylinder, HeadNumber, Sector Sector - Smallest Physical storage unit. 512 bytes. Cluster - Smallest allocation unit. Set of tracks and sectors from 2 to 32. inimizes fragmentation Slack Space - Free space on a cluster. How many bytes per kilobyte? - 1024 bytes/kb LBA number: - total number of sectors on a disk. How do you calculate disk capacity? - C x H x S x (Bytes/sector) Master Boot Record (MBR - First sector of a data storage device. (Location, size, other important data) What is the master boot record (MBR) used for? - Holding a Partition table. Bootstrapping an operating system. 32-bit disk signature (optional). Bootstrapping - Also called booting up. Describes a computer when it is just turned on and initializes the operating system. Which technology identifies attached devices as either Master of Slave devices? - PATA (3 position cable: One side attaches to the logic board the other 2 attach to either the slave device (Center of cable) or the Master Device (End of cable) The area that is circumscribed 360 degrees on a platter of a disk, when the read/ write head is in a single fixed position. - Track Areal Density - Number of bits per square inch on a hard disk platter. Calculate disk capacity, in gigabytes, from LBA. - LBA * Density / 1024/ 1024 / 1024 PATA - Technology that identifies attached devices as Slave or Master. Slack Space - The space that exists between the end of a file and the end of the cluster. Unused storage capacity. psfile command - lists and closes remotely opened files. Openfiles command - displays open files. Queries, Displays, and Disconnects files, Netstat -ano option - Displays TCP and UDP connections. Netstat -r option - displays routing table and persistent routes. pslist -x option - displays threads and memory used. listdlls command - Shows modules and dlls in use. A tool & its parameters for seeing what DLLs are referenced by an EXE handle command - Shows open files, ports, registry keys and threads. Netstat -o - shows processID of the network connection process. fport - shows open TCP and UDP ports PromiscDetect - checks to see if NIC is in promiscuous mode. Promqry - determines active network interface status on remote systems. doskey /history - Shows previously typed commands. R - CMD tools for accessing and managing the registry FTK imager - tools to grab registry files. DriveSpy - tool used to collect slack space in a partition, into a file. X-Ways tool - Tool used to scan virtual memory. Swap File - the disk space that is set aside for virtual memory.