Introduction to Computer / Digital Forensic : practical_floppy.dd

To cunduct Computer Forensic any 5 fase / procedure.
1. Identification
2. Preservation to preserve evidence, chain of chustady fisic and labelling exhibit
3. Examination /Colleccting
4. Analysis (chain of chustady, analisis, Colecting, Recontruction)
5. Presentation report and conclusion.

There are two types of data :
1. Volatile : data is loss when computer is off. ex : data on RAM
2. Non Volatile :  data is not loss when computer is off. ex :data on HDD,FDD, etc

Tools to Digital Forensic
on Linux :

• TSK (sleuthkit), 
• EwfLib, 
• Aff, 
• dd, to clone Divice
• Volatility, to Analisis memory RAM
• Ptk, cal
• Explico, to Network Forensic
• etc

on Windows: Encase, FTK

Practice for example..
resouces : The Law Enforcement and Forensic Examiner's Introduction to Linux
 

1. Analysis organization
analisis forensic practical_floppy.dd

The practice floppy (in raw image format from a simple dd) for the following exercise is available at:

http://www.LinuxLEO.com/Files/practical.floppy.dd

Once you download the floppy image, lets to analyze
- Create /dev/fd0 using touch couse on Backtrack not yet
-

- 
- create a directory in your “home” directory for evidence and then a subdirectory for different cases

The tilde (~) in front of the directory name is shorthand for “home directory”, Note that if you are already in your home directory, then you don't need to type ~/. Simply using mkdir evid will work just fine. o the output files that we create and the images we make will be found under /root/evid/.

- create a special mount point for all subject file system analysis

root@bt:~# mkdir /mnt/analysis

Determining the structure of disk

The first, fdisk, we discussed earlier using the -l option. Replace the “x” with the letter of the drive that corresponds to the subject drive. For example, if our subject disk is attached on the secondary IDE channel as the master disk, it will be seen as /dev/hdc. A Serial ATA (SATA) disk will be /dev/sda (or sdb, etc.) We can get the partition information on that disk with:

chek fdisk -l

get information a serial SATA..~#fdisk -l /dev/sda

We can redirect the output of this command to a file for later use by
issuing the command as:

root@bt:~# fdisk -l /dev/sb1 > ~/evid/fdisk.disk1




Creating a forensic image of the suspect disk

- Make an image of the practice disk using basic dd, and change directory to evid

root@bt:~/evid# dd if=/dev/fd0 of=image.disk1 bs=512

/dev/fd0 : take flopy device
if : input file

of=image.disk1 : out file called image.disk1 in directory /dev/fd0

bs=512 : specific block size 512

- For the sake of safety and practice, change the read-write permissions of
your image to read-only

can give 400 to real picky

Mounting a restored image

root@bt:~/evid# mount -t vfat -o ro,noexec /dev/fd0 /mnt/analysis/ -o loop

specifies the options
ro :read-only
noexec : prevents the execution of binaries from the mount point

be sure unmount if finish

root@bt:~/evid# umount /mnt/analysis/



File Hash

can use SHA or MD5 Hash

root@bt:~/evid# md5sum /dev/fd0

hasing /dev/fdo and return to file md5.disk1 by type this: 
root@bt:~/evid# md5sum /dev/fd0 > md5.disk1

- We can get a hash of each file on the disk using the find command and an option that allows us to execute a command on each file found

- mounting image
root@bt:~/evid# mount -t vfat -o ro,noexec,noatime,loop image.disk1/mnt/analysis
root@bt:~/evid# cd /mnt/analysis


-t :
ro : read only
noexec : prevents the execution of binaries from the mountpoint
noatime : time
loop :

- Once we are in the /mnt/analysis directory we can now run a command that will find all the regular files on the file system at that mount point and run a hash on all those files:

root@bt:/mnt/analysis# find . -type f -exec md5sum {} \; > ~/evid/md5.filelist
find : comand
"." : signifed
-type f : any reguler type file
-exec : execute
md5sum {} : to hasing md5 all files found
> : redirect to
md5.filelist : name file to output
~/evd/ : directory where we all storing all our evidence files

- Have a look at the hashes by using the cat command to stream the file to
standard output
 root@bt:/mnt/analysis# cat /root/evid/md5.filelist

- To verify that nothing has been changed on the original floppy, you can use the -c option

root@bt:/mnt/analysis# md5sum -c /root/evid/md5.disk1



root@bt:/mnt/analysis# md5sum -c /root/evid/md5.filelist

The Analysis

- mount /mnt/analysis
- use ls -all
root@bt:/mnt/analysis# ls -al

This will show all the hidden files (-a), give the list in long format to
identify permission, date, etc. (-l). You can also use the –R option to list
recursively through directories. You might want to pipe that through less.

root@bt:/mnt/analysis# ls -alR | less

Making a List of All Files

- For example,you could use the –i option to include the inode (file “serial number”) in the list, the –u option can be used so that the output will include and sort by access time (when used with the –t option).


root@bt:/mnt/analysis# ls -aliRtu > ~/evid/access_file.list

- using the find command and redirecting the output to another list file:

root@bt:/mnt/analysis# find . -type f > ~/evid/file.list.2

- There is also the tree command,

Now use the grep command on either of lists created by the first two
commands above for whatever strings or extensions you want to look for.

i : case insensitive

jpg : grep file JPG


Making a List of File Types

file filename

root@bt:/mnt/analysis# find . -type f -exec file {} \; > ~/evid/filetype.list

root@bt:/mnt/analysis# cat ~/evid/filetype.list

root@bt:/mnt/analysis# grep image ~/evid/filetype.list

Viewing Files

For text files and data files, you might want to use cat, more or less to
view the contents.

cat filename
more filename
less filename

Perhaps a better alternative for viewing unknown files would be to use
the strings command.

strings filename | less


root@bt:/mnt/analysis# ls
ARP.EXE  Docs  FTP.EXE  loveletter.virus  ouchy.dat  Pics  snoof.gz

root@bt:/mnt/analysis# strings arp.exe | less

this screenshot not full..
Once you are finished exploring, be sure to unmount the floppy

Searching Unallocated and Slack Space for Text

Now let’s go back to the original image.
First, change back to the directory in which you created the image, whether it was the root’s home directory, or a special one you created.

root@bt:~# cd evid/
root@bt:~/evid#

use the grep command to search the image for any instance of an expression or pattern.

grep –options <pattern> <file-to-search>

root@bt:~/evid# nano searchlist.txt

root@bt:~/evid# grep -abif searchlist.txt image.disk1 > hits.txt
root@bt:~/evid# cat hits.txt

root@bt:~/evid# xxd -s 75441 image.disk1 | lees