Live forensic on Windows

In the last posts, I talked about the processes of IT Forensic. Those are just theories as one might say. Hence, today, let's get more real and technical. How about what can we do to perform live forensic on Windows systems sounds to you?

Before we touch that, why do we need to do live forensic at the first place? For a few reasons:
a) It is a production server and the Business Owner or System Admin would not let you shut down the system/server for offline forensic
b) The server/system is at a location that you could not go there physically
c) We afraid that we may lost crucial information e.g. malware that runs in memory only if we were to shut down the system immediately

Next, what info or data should we gather? What tools to use? In IT Forensic, we normally talk about using trusted binaries. Why is it important? Because on a hacked or malware infected machines, it is not uncommon for the attacker/malware to install rootkits or replace some common commands/binaries of the system/server in order to hide or cover their tracks. Running these binaries might not give you the real output or info as they should be. Therefore, the first steps is to prepare a forensic kit (e.g. write protected USB stick, CD) with your trusted binaries/tools.

Back to what info or data to gather.... Below are the lists of what we should gather and how or using what tool can we gather it (yes, I know some of them are not of trusted binaries but there are also advantages in running them. Can you see those advantages? Answers below :) ) . Basically, we will need these free and great software suites:
a) Sysinternals Suite - http://technet.microsoft.com/en-us/sysinternals/
b) Nirsoft - http://www.nirsoft.net/
c) Redline (for memory dump and analysis) - http://www.mandiant.com/resources/download/redline

No.	What to Acquire	Tools/Commands to Use (Output is saved to a file)
1.	Hostname, OS version, system info, list of software installed	·         Psinfo –h –s –d > targethost\psinfo-hsd.txt
2.	System info	·         Systeminfo > targethost\systeminfo.txt
3.	Current system date	·         Date /t > targethost\date.txt
4.	Current system time	·         Time /t > targethost\time.txt
5.	Registry dump	·         Regedit /E targethost\registry.txt
6.	Current IP address	·         Ipconfig /all > targethost\ipconfig.txt ·         Awatch /stab targethost\awatch.txt ·         Networkinterfacesview targethost\networkinterfacesview.csv
7.	Running current process list	·         Pslist –t > targethost\pslist-d.txt ·         Pslist –x > targethost\pslist-x.txt
8.	Current network connection list	·         Netstat –anb > targethost\netstat-anb.txt ·         Netstat –anr > targethost\netstat-anr.txt ·         Tcpvcon –an > targethost/tcpvcon-an.txt ·         Cports.exe /scomma targethost\cports.csv
9.	Current list of current logon sessions	·         Psloggedon > targethost\psloggedon.txt
10.	List of auto start applications	·         Autorunsc –a –c > targethost\autorunsc.csv
11.	Environment variables	·         Set > targethost\set.txt
12.	List of services	·         Psservice > targethost\psservice.txt
13.	System event log records	·         Psloglist –x > targethost\psloglist-x.txt
14.	Last user activity records	·         Lastactivityview /scomma  targethost\lastactivityview.csv
15.	Windows turn on/off time records	·         Turnontimesview /scomma  targethost\turnontimesview.csv
16.	Windows user login/logoff records	·         Winlogonview /scomma  targethost\winlogonview.csv
17.	List of installed software	·         Myuninst /stab targethost\myuninst.csv
18.	List of loaded dlls	·         Listdlls > targethost\listdlls.txt
19.	List of user accounts	·         Net user > targethost\net-user.txt ·         Userprofilesview /scomma  targethost\userprofilesview.csv
20.	Browser history ·         IE ·         Mozilla ·         Chrome ·         Opera ·         Safari	·         Iecacheview /stab  targethost\iecacheview.csv ·         Iehv /stab targethost\iehv.csv ·         Mozillacacheview /scomma targethost\mozillacacheview.csv ·         Mozillahistoryview /scomma targethost\mozillahistoryview.csv ·         Mzcv /stab targethost\mzcv.csv ·         Chromecacheview /scomma targethost\chromecacheview.csv ·         Chromehistory /scomma targethost\chromehistoryview.csv ·         Chromecookiesview /scomma targethost\chromecookiesview.csv ·         Operacacheview /scomma targethost\operacacheview.csv ·         Safarihistoryview /scomma targethost\safarihistoryview.csv ·         Safaricacheview /scomma targethost\safaricacheview.csv
21.	Using Redline Comprehensive Collector tool to acquire full memory dump, page file data, running processes, registry data etc.	·         Runredlineaudit.bat

Have fun!

Oh wait... what are the advantages of running (carefully) "untrusted" binaries as well?
By comparing the output of trusted binaries vs untrusted binaries, it may give us some clues that the "untrusted binaries" had been modified or "rookitted". We then can analyse this binary in order to track down other malicious binaries  that might get installed on the system as well.

Enterprise IT Forensic Process - Disposal

In my previous posts, I have covered the first 4 processes of Enterprise IT Forensic Process:

1) Approval - Ensuring that we are allowed to do what we want to do
2) Acquisition - Ensuring that we collect and acquire the evidence in a forensically sound manner
3) Analysis - Performing the analysis and investigation, also in a forensically sound manner
4) Reporting - What a report should contain?

Disposal process is the final piece of the puzzle.

Once we have done the analysis, completed the report, the next question is what to do with the evidence (both original and acquired) that we have gathered? We cannot keep the evidence forever due to various reasons, e.g. storage limitation, legal requirements, security etc.

Basically, the options are:
1) Store - If there is a need to preserve the evidence e.g. legal case
2) Return - Return the evidence to the owner or data custodian
3) Forward - Forward the evidence to another party as agreed with the Requestor
4) Dispose - Securely delete or dispose the evidence

However, it is important to take note that the above decision does not lies entirely with the forensic examiner or investigator. The decision shall be made together with the Requestor.

There is also possibilities that the Requestor might want the original evidence to be returned and the acquired evidence to be deleted or vise versa. Anyway, regardless of the option, the chain of custody must be maintained and updated to reflect the status.

To delete/wipe an evidence, for example a hard drive, simply formatting the hard drive is not secure enough as data can still be recovered. There are a few methods out there that you could use to securely wipe a drive:

1) Hardware based - It is the fastest way. The hardware is known as degausser. It will render the drive useless digitally and physically - not a good idea if you still want to use the drive for other purposes.
2) Software based  - This method which is slower is to rewrite the drive with zeros or random data multiple times. There are various free tools out there that can do the job. For example diskwipe and dban.

Enterprise IT Forensic Process - Reporting

So far, I have covered 3 of the 5 key processes of Enterprise IT Forensic Process:

1) Approval - Ensuring that we are allowed to do what we want to do
2) Acquisition - Ensuring that we collect and acquire the evidence in a forensically sound manner
3) Analysis - Performing the analysis and investigation, also in a forensically sound manner

The next one is Reporting. Well, I agree, there is no rocket science about this one.

First of all, a forensic report should be written purely based on evidence and reference to the mentioned evidence must be made clear. An examiner or investigator should not write something based on assumptions.

In general, a forensic report should contain the following:
1) Introduction - Describe the background of the forensic investigation.
2) Objective - Describe the objective of the investigation. What is the purpose, what you were asked to look  for.
3) Executive Summary -  This section is to provide quick management summary. State the main highlights or findings and summary or conclusion.
4) Detailed Observations - List all observations, in detail , with reference to evidence. For example:

Based on the email (REF: Appendix 1, Item No.8) sent out by the suspect (Joe Black) to Mary Margaret on 18 Jul 2012 04:21:02 AM, it is possible that the suspect was aware that the invoice (REF: Appendix 1, Item No.10) that were given to her (Jane Doe) was a forged one.

5) Evidence Information - Detailed information of all evidence obtained and analysed.
6) Appendix - List all referred evidence and their contents here.

Enterprise IT Forensic Process - Analysis

In the last two months, I have talked about the first two processes - Approval and Acquisition. Now, let's us move to the next process - Analysis. 

You may have heard of PPT - People, Process and Technology.  While the Approval and Acquisition are more about Process and Technology, Analysis is really about People. No matters how good your processes or technologies are, without the "People" factor, those processes or technologies would not yield much tangible outcome. One needs to have a very good analytical skills and adequate experience to be a good forensic examiner. One gains experience by doing more forensics in different scenarios and solving more technical issues etc. Bottom line, it's all about experience. 

Nevertheless, there is one vehemently crucial element for the Analysis process. Even the most experience forensic examiner will need to have this prior to any investigation:

Knowing what to look for - You can't find anything if you don't know what to look for.  For example, one cannot just tell the police to look for a "murderer" in a big shopping complex. The police would need more detail descriptions of the murderer - male or female? Hair colour? What type of clothes etc.  It is the same in IT forensic, one cannot just throw a laptop to a forensic examiner and tell him/her to look for something criminal on this laptop. It needs to be more specific than that. For example - "look for any trace of child pornography in this laptop" is specific. 

This info about "What to look for" shall be obtained prior to Approval process, ideally it should be part of the Request for Investigation. 

Once you know what to look for, the next steps will be:

How to look for - There is no fix procedure or formula for this. It's really depends on situation and it is case by case. This is when one's experience really make a hell lots of difference. However, as a start, in most cases a forensic investigator or an examiner can use a certain forensic tool such as Encase or FTK to do a search based on relevant keywords. The search results would give more hints or clues on what or where to look deeper. In a nutshell, here are the basic steps:

1. Develop basic keywords
2. Perform search based on those keywords
3. Review search results
4. Refine keywords or develop new keywords
5. Repeat 2 - 4 until tangible results are obtained. 
6. Mark, note or extract those relevant evidence for reporting later. 

Of course, the above approach may not be always valid or applicable. For example, if you are investigating a DoS attack, you'll need to use a completely different approach. Using Encase or FTK to review firewall, routers, webservers logs are not effective and I will say it doesn't even make sense to do so. For this one, manual reviews of the logs with some customised filtering scripts is the best way forward. Needless to say, every investigator has his/her own favourite tools and methods.

Enterprise IT Forensic Process - Acquisition

Last month, I talked about the first  process in Enterprise IT Forensic Process, which is the Approval process. Today, I shall proceed to talk about the next process - Acquisition.

What is acquisition? In a nutshell, it means collecting the evidence. Sounds easy right? Not really. There are many things need to be considered, especially if there is a high chance that the investigation will lead into a legal case.

You may have heard that the evidence collection must be done in a forensically sound manner. I bet you would recall from many scenes in CSI or other movies alike that some criminals got away scott-free on technical grounds, for example police's mistake when taking evidence etc. This sort of things could happen in IT Forensic as well. Thus, it is very imperative that the acquisition is done properly and (again), in a forensically sound manner.

Now, what is meant by "in a forensically sound manner"? Basically:
1. Ensure that evidence intake is done legally (refer my last piece on "Approval" process).
2. Evidence's chain of custody is well documented and preserved.
3. Ensuring that tampering of evidence is not possible during collecting, transferring, analysis and storing of the evidence.
4. All forensic activities are well documented and traceable.

I will say a) Evidence Intake and b) Evidence Chain of Custody are two key sub-processes within the Acquisition Process. Furthermore, there are two principals that I always apply:
1) Four Eyes Principal - ensuring that there is always a witness around
2) Bag and Tag - ensuring that evidence is properly labelled, sealed and its movements are recorded.

a) Evidence Intake:
Basically referring to how the evidence is collected or taken into custody.

Let's image a simple and basic scenario - A forensic investigator is tasked to collect a laptop from IT department (data custodian) for forensic.

What the forensic investigator needs to prepare beforehand?

Tools:
1. A camera or phone with decent camera - It is always a good idea to photograph everything before you touch the evidence.
2. Evidence Intake and Custody form:
a) To record the information of the to-be-taken evidence
b) This form also serves as an acknowledgement of transfer/receipt of evidence. Both the investigator and the custodian shall sign on it (Four Eyes Principal).
3. Waterproof envelope to "bag" the evidence
4. Sticker to "tag" (labelling) the evidence

General Steps:
1. First, take photos of the evidence. Important info such as serial number, model, brand etc shall be clearly photographed.
2. Fill in the form and record all details as possible e.g. the model of the laptop, serial no, HDD size, its condition etc.
3. Label the evidence (Tag) with a unique ID (you shall already has this info beforehand!).
4. Put the evidence into the envelop and seal it (Bag).
5. Label the sealed envelope (Tag).
6. Sign the form and ensure that the data custodian counter signs as well (Four Eyes Principal). Once both parties have signed, the custody of the evidence is now with the investigator.
7. The investigator can now proceed to his lab and start the forensic analysis (shall be done in a forensically sound manner as well).

That's it for a simple scenario. How about a more complex scenario? Such as - evidence intake is to-be-done by a representative in a remote location, then the evidence will be shipped to the head office and handed over personally to investigator. As you can imagine, the evidence intake and chain of custody process will be much more complex.  So, stay tuned for the next piece!

Enterprise IT Forensic Process - Approval

In last March 2012, I wrote a piece about what are the key processes for IT Forensic in Enterprise's environment. Let's do a bit of a recap. There are 5 key processes - Approval, Acquisition, Analysis, Reporting and Disposal.

Today, I'm going to dive into more details on the first process - Approval.

Approval is the most important process. We don't want to do something that is illegal right? Therefore, this process will ensure that the investigation and forensic activities are legal in every aspect e.g. company's policy as well as law's.

Normally, the process starts when there is a Request for Investigation (RFI) raised by someone within the company (referred as Requestor hereafter). Naturally, the obvious next step is for the the Investigator to discuss with the Requestor in details about the RFI. Following questions shall be discussed and agreed:

Who shall approve this investigation?
As each request is normally a unique one, it cannot be predetermined who shall be the approver. However, typically following persons/roles should be part of the approval list:
a) A person that can confirm that investigation is allowed from employment contract's perspective e.g. Head of Human Resource Department
b) A person who can confirm that investigation is allowed from country law's and legal's perspective e.g. Head of Legal Department
c) A person who can confirm that data belonged to the subject (or suspect) is allowed to be transferred and examined by the Investigator e.g. Head of Data Protection.
d) a person who is direct disciplinary authority to the subject e.g. Direct manager of the subject
e) In some countries e.g. Germany where the Workers Council is strong, their approval maybe needed as well.
f) Your boss. He has to approve from resource allocation's perspective :)

Who shall be the driver to gather all these approvals?
It is in the best interest of the Requestor for the investigation to be approved. Therefore, the Requestor shall be primarily responsible to gather all the needed approval. The Investigator, to a certain extend (due to resource limitation etc) could provide support as well.

Another reason to have the Requestor taking the lead role is to avoid "misuse" of RFI. As an investigator, I'm sure you don't want to be running around chasing for approvals whenever there is a RFI raised to you :) .

We know we will get the approval, to expedite the time, could we start collecting evidence in parallel? 
NO. You shall not do that. Never collect or acquire evidence before you have all the green lights, no matter how strong is the pressure. Just like a police shall never search a place without a warrant.

Is email approval accepted?
I will say yes, provided that the email is digitally signed with a valid user certificate of your organisation's PKI infrastructure. A digitally signed email will ensure non-repudiation.      

Hack in the Box Amsterdam 2013

Today marks the end of the first part - Tech Training. Yesterday was a pretty smooth but today was a different story.

The "TECH TRAINING 6 – RECENT ADVANCES IN IPV6 INSECURITIES" guys were trying to prove their points and they did succeed, few times in fact. Therefore, the network was unstable almost the whole day and at some points, not working at all. The Wifi APs suffered as well. Nevertheless, the network team did try their best to manage it.

Yes. That's the routers.

However, I was informed that the exploited vulnerability (buffer overflow) is not something that they can just fix it on the fly (they would if they could) as it is on a third party's software, something that they don't have control. I was also tipped that Marc (the trainer) will tell more soon.. so, stay tuned to his site - thc.org
 
Tomorrow is the most important day. It is the official opening of HITB AMS 2013 Security Conference, and the keynote speaker is the CISO of RSA, Edward Schwartz.Keynote speaker for the second day is Bob Lord, CISO of Twitter.

BTW, we are still setting it up.....

Gateway to ComSec Village

5 Key Processes in Enterprise IT Forensic

As an Information Security Professional, I'm sure that many of us had been approached by the management to perform IT/digital forensic.

Cases such as: a manager suspects his employee is feeding secret company info to a competitor, a dude claims that a colleague has some of child pornography materials on his laptop, or HR  wants to pursue a case against an employee for breaching of company policy etc are not uncommon to us. Most of the time, the laptop of the suspect will just be thrown on our lap and we are expected to perform forensic and search for evidence asap.

I mentioned in my previous piece that IT forensic not only must be carried-out in a forensically sound manner, it must also be done legally. What's at stake is not only about winning the legal case but also our ass. In some countries such as Germany and other EU countries in general, one cannot simply access other's data without the owner's consent or proper approval. By performing forensic without a proper clearance, it is a criminal offense which could invite a hefty jail time.

Enough talking. So, what are the key processes for IT or digital forensic in enterprise? If you googled, you will find many useful information here and there but the principals are roughly the same. For me, I'll just stick to these 5 key processes: