FTK

FTK is by far probably one of the most tools used this year for me. Shucks, I even got the ACE certification for it [which means nothing, but I don't care]. The following is a little walkthrough of FTK.

What is it?
FTK is one of the top forensic toolkits available. I've heard it goes Encase, FTK, then X-Ways, but I have no data to back that up, just here say. The product site is located here, and that can give you more information. But basically this program lets you load in a disk image in various formats, and analysis the contents of that disk. The accepted formats include: AD1, SMART, dd, AFF, and e01.

QuickStart Guide:
Let's say we have two Android images in the .001 format. We can create a new case, filling the info out however we want. On the main screen we select from the Evidence menu "Add/Remove". Clicking on "Add" will show the following:

We want to select acquired images, since we already have the images of the android device. Clicking OK from the Manage Evidence window will pop up a processing window that will show the images being processed into the case. So say we select two images called android1.001, and android2.001. They will appear in the Evidence window as shown:

Now is where the analysis begins.

To view what's on the devices  or the folder structures, we can select the arrows that are next to the image names in the Evidence Items pane. The File List pane on the bottom will appear with a list of all the files that are found on that image.

A lot of the time we're not really going to be digging through the file structure much, so we can switch over to the Overview tab and see a listing of all the different file types that were found on the images. File Category will list the pre defined category that FTK uses and show how many files are in each category. The File Extension will list all the different file extensions found with the files as an expansion from that extension.

Often a user will delete a file and think that it's gone. If those files haven't been over written in the slack space, we can carve them back out. FTK makes this process fairly easy. To cave an image, select Evidence -> Additional Analysis. We can then select the option for Data Carve.

After letting that run, any carved files that were found will appear under the File Status -> Data Carved Files in the Overview tab. On these images we see that there were 903 files carved. Quite a few for a phone. A large number of them appear to be deleted photos.

Because this is a phone, there aren't any emails that we will be able to find, but if there were, we would use the Email tab. The Graphics tab is just what it says it is. It will list all of the graphics found on an image. Generally there are quite a few, since it will show every single icon on the device. Probably the next most used tab is either the Live Search or the Index Search. The index search is significantly faster, since to use it requires the images added to be indexed. That can be done under Evidence -> Additional Analysis then index search.

In the index search, regex is an option and can be extremely powerful.

A lot of your time is now spent on running searches for terms or looking through file extensions for incriminating evidence. Now that you have the basics down, you can do that. Of course, there is a lot more of FTK that is out there, so don't stop poking around and looking into new options.

Personal Remarks:
Just FYI, a license for FTK costs a couple thousand dollars. She's not cheap. With that said, she is great for doing forensics analysis. I've touched Encase a little, but still fall back to FTK just because of it's ease of use.  If you're looking for a free option check out SleuthKit.

Redline

I wrote what I felt was a fairly extensive walkthrough of Redline. Check out the following link for that write up: http://cyberforensics.et.byu.edu/wiki/Analysis_with_Redline

TCPDump

        This is a program to capture packets that are transferred across a network. Unlike wireshark, TCPDump is all command line. I personally don't feel that it allows for analytics the way that Wireshark does just because it is all in the terminal. To use it, we need to set a specified interface to use that we wish to capture the packets from. The follow command is a good example: "tcpdump -n -i eth0 -s 1515 -w [filename].lpc".
The -n flag disables the translation of IP addresses to host names and port numbers to services. This is good if we are looking for a specific ip address. The -i flag is of course the interface to use. The -s designates the size of the packets it should capture. In this example we are capturing 1515 bytes. Finally, the -w flag is where to write the output file.

Personal Remarks: When faced with an option, I will chose Wireshark over TCPDump every time. Sadly, not every situation allows for wireshark to be used. Wireshark is a full blown program that can leave a large footprint on a victim machine. TCPDump on the other hand is ran right from the command line. It is a bit difficult to parse all the data easily though, which can be a pain. I'm sure it'd be a lot easier if I used the program daily, but I don't.

FTK Imager

FTK is apart of the AccessData suite of tools for forensics analysis. FTK is generally one of the top go to tools for forensic experts. The nice thing about FTK Imager is the ease in it's ability to capture a full memory dump. A download can be found here: http://www.accessdata.com/support/product-downloads. The tool can be placed either on a forensics tool cd, or a USB stick. If needed, you can install the program directly onto the machine, but that leaves a LARGE imprint on the machine. To capture the memory, either clicking on the picture of a ram stick on the tool bar, or going through File > Capture Memory, will begin to grab all the memory on a victim machine. This image file can then be analyzed with FTK itself, or through Strings, or another program of choice.

Personal Remarks: The only problem with FTK imager is the footprint it can leave on a victim machine. It will appear as you're capturing data, and could possibly interfere with other processes running. Though, it is an easy way to do things. Compared to DD, all you need to do is point and click and BAM you got a full memory dump. It's also fairly stable so it's highly unlikely it will fail on you while captureing data.

DD

         To gain a full memory dump, we can use dd (standing for "data description"). DD is often hard to use. It took quite a bit of playing with to get it work for us during an analysis we had done recently. Download the dd program here: http://www.gmgsystemsinc.com/fau/. The command to use is "dd.exe if=\\.\physicalmemory of=[full path of where to write file].dd bs=4096". The if statement tells dd to dump the physical memory. of is the path of where that dump should go. For example z:\[filename].dd. And bs=4096 lets us copy large amounts of data faster and more stable.

Persomal Remarks: DD is by far a great tool to use to get a full image of a disk. I am personally not impressed with it's memory acquistion. It's a farily finicky program and can take a couple of runs to get it to go write. The positive of it is that it doesn't leave a large fingerprint when it's on a machine and capturing the memory, as opposed to FTK Imager.

UserDump

       UserDump is a microsoft tool that is able to generate a user dump of a process. The tool can be downloaded from http://support.microsoft.com/kb/241215. Support is also found on the same page.
To use userdump, we can run the following command "userdump [process id] Z:\[filename].dmp". The pre-requist for using this program is setting up a network drive from the victim machine to the forensics workstation we are using. To set up a shared drive, we can use "net use Z: \\[ip of forensics machine]\[folder name]".

To validate the dump files that we have created we will use a program named dumpchk.exe. A download link is found at: http://technet.microsoft.com/en-us/library/ee424340(v=ws.10).aspx. To use dumpchk, we run "dumpchk [name of file].dmp". This will display validation information about the dump file such as what product was used for the process (windows xp, nt, etc), and the modules that were ran.

Because these dump files can be fairly large, we can use a program from the PSTool Suite that will allow us to easily find strings. The program is coincidentally named Strings. To use we just run "strings [dump file].dmp".

Personal Remarks: Memory is always volitaile and a bit of a pandora's box when you are trying to capture it. Some of the time, capturing the memory of a process caused that process to crash. UserDump is a farily safe way to not mess with the entire memory and instead only grab a single process, which is far less space than the entire memory of a machine. These .dmp files, I've found, contain a LOT of spaghetti. That's where Strings comes in, since it can search that whole .dmp file and find a certain phrase or key input. These could be commands ran, or how the program was exectuted.

PSTools Suite

69 Tools are rolled together into the Sysinternals Suite. The PSTools Suite is also included in the suite and can be downloaded here: http://technet.microsoft.com/en-us/sysinternals/bb842062.
I will highlight only a few of the tools that I have used.

PSLoggedOn - running just "PSLoggedOn" will display the users that are currently logged onto a system. It will also display their access rights, ie whether they are administrator or not.

PSList - running "pslist" will display the currently running processes. This can display any odd programs that could be used as a backdoor by a hacker.

PSService - this will display a list of services that are currently being ran. "psservice" with no flags will give a list of those services. This list can sometimes be fairly lengthy.

PSFile - this will display a list of all the open files. This is useful to examine any odd files that could be running.

PSInfo - This displays information about the machine we are currently on. Various flags can display different information. For example -h will show installed hotfixes, -s will show installed applications, and -d will show disk volume information. For a complete list of all the flags see http://technet.microsoft.com/en-us/sysinternals/bb897550.aspx.

Personal Remarks: There are a lot more tools listed with PSTools Suite, but I haven't ever touched them. The most common of these tools is just to run pslist. This shows all the running processes that you can then review and flag any as suspicious. All of these programs are ran with no flags attached to them. NetCat-ing them to a forensics machine is the best practice for these tools.

NbtStat

Nbtstat (standing for NetBios Over TCP/IP Statistics) is a CLT that displays the cached NetBios name table. We can use it to display NetBios adapter status, the name-to-IP address mappings, names that have been registered locally on a system by NetBios applications, and even displays names resolved by broadcasts and by querying WINS servers. For more information see: http://technet.microsoft.com/en-us/library/cc940106.aspx.
How it works: To display the NetBios name cache, we can use the command "nbtstat -c".

Personal Remarks: For all of the labs that we completed, there were no NetBios names in the cache. I can see where this could be benefical if an attacker had accessed a computer and that registered in the NetBios and they no longer had an active connection. Of course, I never ran across this, so I can't really speak to the validity of this.
In addition to the -c swtich, there is the -A switch that lets you pass in a single ip address to check. It looks like the could be benefical. The -a swtich shows the status of the NetBios adapter.

FPort

FPort (made by McAffe) is another CLT that can display open ports with executables linked to them. It can easily display programs that opened ports and the protocol that it is using. The lastest version is v2.0 and can be downloaded here: http://www.mcafee.com/us/downloads/free-tools/fport.aspx.
How it works: using the command line, just typing "FPort" will run the program to display all the ports with excutables linked to them.

Personal remarks: This tool can be difficult to find, but easy to use. The link above is the correct link to use. I made the mistake of downloading from some where third party site. Pretty sure it was virus infected. Oh well, everyone can use a bit more spyware.
The output of FPort displays all the open ports and what applications are linked to them. This is handy to see if there is a certain program that is leaking data. Using this tool with wireshark is helpful if there is a open port found with an application linked to it.

NetStat

NetStat is a CLT (command line tool) that displays a network connections, routing tables, and network interfaces. It is built into both Unix/Unix-Like, and Windows machines.
How it works: using "netstat -an" will display all the active connections on a machine.
"Netstat -rn" can be used to display the routing table.

Personal remarks: The information given from this tool can be extremely helpful, especially in network analysis for active connections. On almost every lab used, "netstat -an" was used. Once a connection is seen that is foreign, Wireshark can be used to capture traffic being sent to that address or from that address.

NetStat example output
http://indonetworksecurity.com

NetCat

       Netcat is a TelNet client that can be used to send information from one machine to another. It's commonly called the 'swiss army knife' due to it's functionality and common use with forensic investigators.

How it works: a listener needs to be established on the machine that you wish to pass data to. This is accomplished with the command "netcat -v -l -p 2222 > [filename].txt". The -v puts netcat into verbose mode, which will display status messages. The -l is the listening switch. Finally, -p is to secifiy the port to listen on. The ending portion after the greater-than sign is the output file.
To then send a command from a machine to the listener, you'll run: "[some command] | netcat [ip of listener] [port number]". The [ip of listener] is the ip address of where the netcat listener is.
Overall, netcat is a easy and quick way to send information from one machine to another.

Where to download: The version of netcat that I enjoy and have found to work the best is the beta version from nmap. Download can be found here: http://nmap.org/ncat/.

Personal remarks: Netcat is a fairly easy to use tool that can transfer files and information between computers quickly. That is, if you get it set up right. Initally using netcat, it took a number of failed attempts to finally realize the format of commands. Then even more failed attempts to realize that the firewall was blocking the port we were sending info through. After those user 'blunders' the tool is extremely easy to use and pretty efficent.