Computer forensics published version cwru 02242011

Case Western Reserve University Computer Fraud

February 24, 2011

Timothy M. Opsitnick, Esq.Senior Partner and General CounselJurInnov Ltd.John Liptak, ACEComputer Forensics Analyst

Who Are We?

JurInnov works with organizations that want to more effectively manage matters involving “Electronically Stored Information” (ESI). – Electronic Discovery– Computer Forensics– Document and Case Management– Computer & Information Security

Presentation Overview

• Understanding Computing Environments

• Collecting Electronically Stored Information

• Forensic Analysis Demonstration• Types of Cases When Forensics Are

Useful

What is Computer Forensics?

Computer Forensics is a scientific, systematic inspection of the computer system and its contents utilizing specialized techniques and tools for recovery, authentication, and analysis of electronic data. It is customarily used when a case involves issues relating to reconstruction of computer usage, examination of residual data, authentication of data by technical analysis or explanation of technical features of data and computer usage. Computer Forensics requires specialized expertise that goes beyond normal data collection and preservation techniques available to end-users or system support personnel.

Types of “ESI”

• E-mail• Office Files• Database• Ephemeral• Legacy Systems• Metadata

Sources of “ESI”• Desktops• Laptops• CDs/DVDs• Network Attached

Storage Devices (NAS)

• Storage Area Networks (SAN)

• Servers• Databases• Backup Tapes

• E-Mail• Archives• Cell Phones/PDAs• Thumb Drives• Memory Cards• External Storage

Devices• Cameras• Printers• GPS Devices

Why Computer Forensics?

• Reasons to use Computer Forensics– Internal Company Investigations

• Alleged criminal activity• Civil or Regulatory Preservation

– Receivership, Bankruptcy– EEO issues– Improper use of company assets

– Recovery of Accidentally or Intentionally Deleted Data• Deleted is not necessarily deleted• Recovery from Improper shutdowns

Types of Computer Fraud

• Fraud by computer manipulation– Program or data manipulation

• Common internal computer fraud schemes– Billing schemes– Inventory fraud– Payroll fraud– Skimming– Check tampering– Register schemes

Types of Computer Fraud

• Fraud by damage to or modification of computer data or programs– Economic advantage over a competitor– Theft of data or programs– Holding data for ransom– Sabotage

• Common external computer fraud schemes– Telecommunications fraud– Hacking– Internet fraud– Software piracy

How Does a Computer Operate?

• Hardware– Processor– Memory (RAM)– Hard Drive– CD/DVD Drive– Motherboard– Mouse/Keyboard

• Software– Operating System– Applications

How Does a Computer Operate?

• How is data stored on a hard drive?

• How is data “deleted” by the operating system?

Collecting “ESI”

• “Let’s let the IT staff do it.”

• Forensic Harvesting – What is a forensic copy?

• Forensic Harvesting - Logical v Physical– Logical / “Ghost” copy (Active Files)

• Data that is visible via the O.S.– Physical

• Logical + File Slack + Unallocated Space + system areas (MBR, Partition table, FAT/MFT)

• Network Harvest• E-Mail Harvest• Cell Phone / Device Seizure

Computer Forensics Process

• Interview Process/Needs Analysis• Maintaining Chain of Custody• Photograph Evidence• Record Evidence Information (users, S/Ns,

etc.)• BIOS/CMOS Time• Utilize Sanitized (“Wiped”) Drives• Write Blocker• On-Site Acquisition• Forensic Lab Acquisition

Acquisition (Data Harvest)• Software Tools

– EnCase (Guidance Software)– Forensic Tool Kit (AccessData)– Device Seizure (Paraben)– Network Email Examiner (Paraben)

• Hardware Tools– Write Blockers (Tableau)– Talon (Logicube)– Cell-Dek (Logicube)

Types of Data Acquisitions• Image Types

– EnCase Image (.E01)– DD Image (Linux)– Custom Content Image (.AD1)

• ESI Locations– Hard Drives– Network Shares/Department Shares/Public

Shares– Server E-Mail– Server Acquisition (On/Off)– Cell Phone/PDA– Thumb Drive/External Media

Forensic Considerations• Transfer Speeds

– USB– FireWire– IDE– SATA/eSATA

• Image Verification - MD5 Hash Values• Work Copies• Inventory Management

Forensic Considerations• Presentation Suspect Images• Description: Physical Disk, 39102336 Sectors, 18.6GB • Physical Size: 512• Starting Extent: 1S0• Name: Presentation Suspect Images• Actual Date: 03/24/09 03:17:21PM• Target Date: 03/24/09 03:17:21PM• File Path: E:\Presentation image.E01• Case Number: Presentation Drive• Evidence Number: Presentation Suspect Images• Examiner Name: Stephen W. St.Pierre• Drive Type: Fixed• File Integrity: Completely Verified, 0 Errors

• Acquisition Hash: 5cfa3830c3af83741da4f9adcfb896e1 • Verify Hash: 5cfa3830c3af83741da4f9adcfb896e1• GUID: 04d345276275524c8a111824be6eb170 • EnCase Version: 5.05j• System Version: Windows 2003 Server• Total Size: 20,020,396,032 bytes (18.6GB)• Total Sectors: 39,102,336

Forensic Considerations• Creating Work copy of original Backup

Image– Evidence Mover Log:

03/25/09 16:20:14 - Source file: F:\Evidence\Presentation image.E01 Destination file: G:\Evidence\Presentation image.E01.

Attempt# 1 Hash :9348B9FECFE8023FA3095FB710AFD678

Attempt# 1 Hash :363293E77BB1C974FD82DE7EC3CE1842

Attempt# 1 Hash :3AA6885A045E8F5D20899113A4848917

Forensic Considerations

• Windows Encryption– Encrypted File System (XP)– BitLocker (Vista & Windows 7)

• Other Hardware or Software Encryption– Laptop hard drives– e.g., Truecrypt

Forensic Analysis

• Indexing• Key Word Searching• Filters

– AND/OR/NOT– Date Range– Specific File Types

Forensic Analysis

• Deletion– Deleted Documents– Recycle Bin (Deleted Dates/Info 2)– Data Carving– Unallocated Space– Hard Drive Wiping

• Signature Analysis: File Extension vs. File Signature

Forensic Analysis

• File Hash Analysis: Comparing Files• Image Review/Analysis• Internet History Analysis

• Analysis Examples …

Registry Overview

• Windows Registry – central database of the configuration data for the OS and applications.

• Gold Mine of forensic evidence• Registry Hive Keys

– Software– System– SAM (Security Account Manager)– NTUSER.dat

Registry – Software

• What Operating System Installed?• Date/Time OS Installed• Product ID For Installed OS• Programs That Run Automatically at

Startup (Place to Hide Virus)• Profiles

Registry – System

• Mounted Devices• Computer Name• USB Plugged-In Devices (USBSTOR)• Last System SHUT DOWN Time• Time Zone

Registry – SAM & NTUSER.DAT• SAM

– Local Accounts• NTUSER.DAT

– Network Assigned Drive Letters– Typed URLs (websites)– Last Clean Shutdown Date/Time– Username and Passwords – Recent Documents

• Registry examples …

Unallocated Space Analysis

• Unallocated Space/Drive Free Space

• File Slack

Data Transfer Analysis

• FTP• E-Mail• External Drives• Link Files (external/server)• Internet History• Webmail• Created/Accessed/Modified Dates

Evidence/Analysis Reporting

• FTK Report (html based report)• Evidence Presentation• Final Expert Report• Interpretation of Report• Expert Testimony

Forensic Analyst

• Tips For Dealing With Your Forensics Analyst

• What to Expect From A Forensics Analyst– Certifications– Training – Experience– Testimony

Types of Cases When Forensics Are Useful…

• Financial– Receivership– Bankruptcy

• General Litigation– Commercial Litigation– Product Liability

• Corporate– Regulatory (SEC, Second Requests, FTC)– Mergers/Acquisitions

Types of Cases When Forensics Are Useful, cont.

• Intellectual Property– Theft of Intellectual Property– Temporary Restraining Order (TRO)– Permanent Injunction

• Labor/Employment– Violation of Non-Compete Agreements– Sexual Harassment – Age Discrimination– Fraud/Embezzlement– Other Violations of Company Policy

• Domestic Relations– Divorce– Custody

• Corporate Criminal– Other Criminal

For assistance or additional information

• Phone: 216-664-1100• Web: www.jurinnov.com• Email: tim.opsitnick@jurinnov.com

john.liptak@jurinnov.com

JurInnov Ltd.The Idea Center

1375 Euclid Avenue, Suite 400Cleveland, Ohio 44115

Computer forensics published version cwru 02242011

Technology

ARM Instruction Set - LDR, STR - bear CWRU

Trasncript RCR 02242011 Mae Beavers

2021-2022: CWRU SCHOOL OF MEDICINE PROMOTION ... - case.edu

CWRU Torture Feb28

Newsletter - Association for Continuing Education at CWRU

Dark Worlds - CWRU

CWRU WRITTEN PROGRAM FOR FORMALDEHYDE

CWRU PubMed go to Clinical Queries

CWRU UGS Upperclass Newsletter May 2014

CWRU UGS Upperclass Newsletter Jan 2014

Today's Libre 02242011

Putting good ideas to work for a carbon-neutral, flourishing campus Sustainable CWRU · 2018-10-18 · carbon-neutral, flourishing campus. Sustainable CWRU Elements ... Plan • The

Comp ter Forensics It’s NotComputer Forensics: It’s … ter Forensics It’s NotComputer Forensics: ... Computer Forensics Can be Useful with ... Solid state drives & deleted file

Astronomy News - CWRU

1 Efficient Application Placement in a Dynamic Hosting Platform Zakaria Al-Qudah – CWRU Hussein Alzoubi – CWRU Mark Allman – ICSI Michael Rabinovich –

NURSING BULLETIN 2020-2021 CWRU SCHOOL OF - Case

Forensics & Anti- Forensics

Forensics · Disk Forensics Mobile Forensics E-mail investigations Questioned document Cryptography, examination Steganography Live Forensics and Network Forensics Audio/video authentication

CWRU, February 2009 Can the WMAP haze really be a signature of annihilating neutralino dark matter? Daniel Cumberbatch (CWRU), Joe Zuntz (Oxford), Joe

CWRU – NORTH RESIDENTIAL VILLAGE