Upload File

computer forensics: you can run but you can't hide

96
Digital Forensics & IR You can run, but you can’t hide

Upload: antonio-sanz-alcober

Post on 08-May-2015

341 views

Category:

Technology


1 download

Report

DESCRIPTION

A talk describing the field of computer forensics and its relation with incident response. Live forensics, timelines, registry, smartphones, cloud forensic, ethics, writing and defending reports are issues that will be covered.

TRANSCRIPT

Page 1: Computer Forensics: You can run but you can't hide

Digital Forensics & IR

You can run, but you can’t hide

Page 2: Computer Forensics: You can run but you can't hide

Antonio Sanz

IT Systems & Security Manager

Expert witness

@antoniosanzalc

http://www.equipoazul.es

Page 3: Computer Forensics: You can run but you can't hide

#SanPepeEINA

Page 4: Computer Forensics: You can run but you can't hide

WTF DFIR bro?

Boring legal stuff

Forensic magic

Stand-up guy

Wanna more ?

Page 5: Computer Forensics: You can run but you can't hide

There is a war out there

Page 6: Computer Forensics: You can run but you can't hide

Cybercrime

Page 7: Computer Forensics: You can run but you can't hide

Cyberespionage

Page 8: Computer Forensics: You can run but you can't hide

Child pornography

Page 9: Computer Forensics: You can run but you can't hide

Digital

Forensics

Incident

Response

Page 10: Computer Forensics: You can run but you can't hide

IR : Respond to an incident

Page 11: Computer Forensics: You can run but you can't hide

Digital forensics : Post-mortem

Page 12: Computer Forensics: You can run but you can't hide

Locard’s exchange principle

Page 13: Computer Forensics: You can run but you can't hide

This is not a pipe

Page 14: Computer Forensics: You can run but you can't hide

This is not a pipe

Page 15: Computer Forensics: You can run but you can't hide

It’s all about evidence, stupid !

Page 16: Computer Forensics: You can run but you can't hide

No fancy 3D tools like CSI

Page 17: Computer Forensics: You can run but you can't hide

Techniques, tools and procedures

Page 18: Computer Forensics: You can run but you can't hide

People could go to prison

Page 19: Computer Forensics: You can run but you can't hide

Identification

Adquisition

Preservation

Analysis

Dissemination

Digital forensics phases

Legal stuff here

and here

Tech yeah!

Page 20: Computer Forensics: You can run but you can't hide

WTF DFIR bro?

Boring legal stuff

Forensic magic

Stand-up guy

Wanna more ?

Page 21: Computer Forensics: You can run but you can't hide

Acquisition

Page 22: Computer Forensics: You can run but you can't hide

Mobile devices

Page 23: Computer Forensics: You can run but you can't hide

RAID, SAN, NAS, VM

Page 24: Computer Forensics: You can run but you can't hide

Cloud storage

Page 25: Computer Forensics: You can run but you can't hide

Game consoles,

ebooks, DVR …

Page 26: Computer Forensics: You can run but you can't hide

Gotta catch ‘em all

Page 27: Computer Forensics: You can run but you can't hide

Should I pull the plug ?

Page 28: Computer Forensics: You can run but you can't hide

Use a cond …

A write blocker

Page 29: Computer Forensics: You can run but you can't hide

Whole enchilada

Get the whole enchilada

Page 30: Computer Forensics: You can run but you can't hide

Preservation

is king

Page 31: Computer Forensics: You can run but you can't hide

31

Chain of custody

Page 32: Computer Forensics: You can run but you can't hide

OBEY THE CHAIN

Page 33: Computer Forensics: You can run but you can't hide

WTF DFIR bro?

Boring legal stuff

Forensic magic

Stand-up guy

Wanna more ?

Page 34: Computer Forensics: You can run but you can't hide

Bad guys want to hide … but they

need to run

Page 35: Computer Forensics: You can run but you can't hide

Remember Locard: Artifacts

Page 36: Computer Forensics: You can run but you can't hide

Live forensics

Page 37: Computer Forensics: You can run but you can't hide

Order

of

Volatility

Page 38: Computer Forensics: You can run but you can't hide

Cold boot attacks

Page 39: Computer Forensics: You can run but you can't hide
Page 40: Computer Forensics: You can run but you can't hide

Preservation

is king

Page 41: Computer Forensics: You can run but you can't hide

Standard forensics

Page 42: Computer Forensics: You can run but you can't hide

Recover deleted data

Recover deleted data

Page 43: Computer Forensics: You can run but you can't hide

How

filesystems

work

Page 44: Computer Forensics: You can run but you can't hide

Good times, MAC times

Page 45: Computer Forensics: You can run but you can't hide

Making history

Page 46: Computer Forensics: You can run but you can't hide

Space / Time Analysis

Page 47: Computer Forensics: You can run but you can't hide

47

Don’t delete your history. Or do it, it doesn’t matter

Page 48: Computer Forensics: You can run but you can't hide

Prefetch

Dogs can’t prefetch

Page 49: Computer Forensics: You can run but you can't hide

Your Instant

Messages

belong to us

Page 50: Computer Forensics: You can run but you can't hide
Page 51: Computer Forensics: You can run but you can't hide

Recycle bin are gold mines

Page 52: Computer Forensics: You can run but you can't hide

52

Registry knows where your porn is

Page 53: Computer Forensics: You can run but you can't hide

Every USB you plugged could be used against you

Page 54: Computer Forensics: You can run but you can't hide
Page 55: Computer Forensics: You can run but you can't hide

Where did you say you hide your crap?.

Page 56: Computer Forensics: You can run but you can't hide

Event logs

Finding things in logs is like…

Page 57: Computer Forensics: You can run but you can't hide

Too much … metadata

Page 58: Computer Forensics: You can run but you can't hide
Page 59: Computer Forensics: You can run but you can't hide

You’ve got an email

Page 60: Computer Forensics: You can run but you can't hide

Share your downloads with us !

Page 61: Computer Forensics: You can run but you can't hide

Smartphone / Tablets

Page 62: Computer Forensics: You can run but you can't hide

Acquisition is complicated

Page 63: Computer Forensics: You can run but you can't hide

Preservation

is king

Page 64: Computer Forensics: You can run but you can't hide

Yummy extra info …

Yummy data breakfast

Page 65: Computer Forensics: You can run but you can't hide

Virtual Machines

Page 66: Computer Forensics: You can run but you can't hide

Take snapshots like there’s no tomorrow

Page 67: Computer Forensics: You can run but you can't hide

Preservation

is king

Page 68: Computer Forensics: You can run but you can't hide

Network forensics

Page 69: Computer Forensics: You can run but you can't hide

How I Xplico to you dude ?

Page 70: Computer Forensics: You can run but you can't hide

Preservation

is king

Page 71: Computer Forensics: You can run but you can't hide

Cloud computing

Page 72: Computer Forensics: You can run but you can't hide

There’s still traces

There are always traces left

Page 73: Computer Forensics: You can run but you can't hide

WTF DFIR bro?

Boring legal stuff

Forensic magic

Stand-up guy

Wanna more ?

Page 74: Computer Forensics: You can run but you can't hide

Cut to the chase

Page 75: Computer Forensics: You can run but you can't hide

Know your trade

Page 76: Computer Forensics: You can run but you can't hide

Know your enemy

Know your enemy

Page 77: Computer Forensics: You can run but you can't hide

Use more than one tool

Page 78: Computer Forensics: You can run but you can't hide

Missing things tell us a lot

Page 79: Computer Forensics: You can run but you can't hide

Put two and two together

Page 80: Computer Forensics: You can run but you can't hide

Always learn new tricks

Page 81: Computer Forensics: You can run but you can't hide

50% Knowledge

30% Technique

15% Instincts

5% Luck

Page 82: Computer Forensics: You can run but you can't hide

Writing the report > Introducción

> Resumen Ejecutivo

> Entorno del Informe (personas, lugares, fechas)

> Hechos probados iniciales (lo que sabemos)

> Hechos técnicos demostrables (lo que encontramos)

> Conclusiones

> Anexo: Evidencias

Write your report

Page 83: Computer Forensics: You can run but you can't hide

Defending the report > Contrainforme pericial

> Exposición del informe en el juicio

> Validez del técnico

> Validez de las herramientas

> Preguntas de la otra parte

> Mantener la calma, responder lo justo y bien pensado

Defend your report

Page 84: Computer Forensics: You can run but you can't hide

Ethics

Ethics

Page 85: Computer Forensics: You can run but you can't hide

WTF DFIR bro?

Boring legal stuff

Forensic magic

Stand-up guy

Wanna more ?

Page 86: Computer Forensics: You can run but you can't hide

Books

Page 87: Computer Forensics: You can run but you can't hide

Blogs

Page 88: Computer Forensics: You can run but you can't hide

Tools / LiveCDs

Page 89: Computer Forensics: You can run but you can't hide
Page 90: Computer Forensics: You can run but you can't hide

Certifications

Page 91: Computer Forensics: You can run but you can't hide

Conclussions

Page 92: Computer Forensics: You can run but you can't hide

We need DFIR Lots of it

Page 93: Computer Forensics: You can run but you can't hide

Legal issues are critical

Page 94: Computer Forensics: You can run but you can't hide

Many places to look

Have to know where, how & why

Page 95: Computer Forensics: You can run but you can't hide

You can run

You can’t hide

Page 96: Computer Forensics: You can run but you can't hide

If you’re guilty …

we’ll catch you

@antoniosanzalc

http://www.equipoazul.es

http://bit.ly/1h47zfF


COMPUTER FORENSICS - Boise Chapter€¦ · 3 Mobile device forensics 4 Other 5 References Computer forensics Main article: computer forensics ... 1.19 Computer Forensics Solution

Forensics & Anti- Forensics - Power Of Communitypowerofcommunity.net/poc2007/casper.pdf · Anti-Forensics • Wipe can reply all Host Forensics Tools • Counterfeit Evidence •

You Can't Hide from the Things that You've Done Anymore

AFRICAN PAINTED DOG · ENDANGERED BEAUTY Even painted dogs can't hide from habitat loss, farmers who fear for their livestock and people who accidentally catch them in snares used

You Can't Miss What You Can't Measure

Forensics & Anti- Forensics

USB FORENSICS -PRODISCOVER USB FORENSICS –ENCASE V7csc.csudh.edu/cae/.../2013/11/All-is-not-Lost-Forensics-on-a-USB-Ale… · USB FORENSICS -PRODISCOVER USB FORENSICS -PRODISCOVER

USA... · XLS file · Web view2018-04-23 · Johnny Clegg,Savuka 1chhR21ArJxfxC7O0AWkdZ No More - Radio Edit 1cnoP59YnTeLqzq6ndR5ms Can't Hide Sinner 1cpRsOFka91rcx06D8kFOO Yoga

You can't hide, Vivian: A Rumination

Acquisizione Laboratorio Disk forensics Network forensics

Marketing 3.0: "you can run, but you can't hide"

Daniel Shows Jesus’ Return is Near. EU’s 50th party can’t hide divisions Headline Smiles but EU's party can't hide divisions Headline Sunday Telegraph

Memory Forensics - publish.illinois.edupublish.illinois.edu/.../files/2014/03/acc-forensics.pdfWhat is Computer Forensics? Mobile Device Forensics Network Forensics Memory & Data Forensics

Network Forensics and Next Generation Internet Attacksfabian/courses/CS600.624/slides/discussion.pdfBotnet Herders can hide behind VoIP. InfoWeek, 2/27/06 ... Slide by: Ed Knightly

Multivariate Solutions to Emerging ... - Digital Forensics · 100,000 customer domains, good, bad and ugly. •Example #2: Bad domains hide behind a shared reverse-proxy service (i.e

Markets Can't Hide From This Election · presidential elections in memory. Instead, they got a crushing defeat of the “inevitable” Republican nominee Jeb Bush and emergence of

SQL SERVER Anti-Forensics - Black Hat · • Anti-Forensics techniques help to make forensics investigations difficult • Anti-Forensics can be a never ending game • Forensics

You can't manage what you can't measure

IBM QRadar Incident Forensics: QRadar Incident Forensics ...€¦ · Figure 2. IBM QRadar Incident Forensics Standalone deployment example Restriction: You can't add managed hosts

"Those that don't got it, can't show it. Those that got it, can't hide it.“ -Zora Neale Hurston "When peoples care for you and cry for you, they can straighten

Adventurers’ Fen · Sedge Fen Guinea Hall Fen Baker’s Fen Verrall’s Fen Adventurers’ Fen Boardwalk Hide New Tower Hide West Mere Hide Charlie’s Hide Tower Hide East Mere

You Can't Hide that Cardinal Pride!

You can't hide transparency

Network Forensics PPrinciples of Network Forensics

Live Forensics Investigations Computer Forensics 2013

COE589: Digital Forensics - ccse.kfupm.edu.saahmadsm/coe589-122/00_Overview_Logisti… · Digital Forensics computer forensics mobile forensics network forensics ... COE589 - Ahmad

Digital Evidence and Computer Forensics Oct 7-8 2013/Tab 02 Oct 7-8... · Digital Evidence and Computer Forensics COMPUTER FORENSICS FORENSICS FORENSICS

Depression - To Hide or Not To Hide?

You can run, but you can't hide (Marketing 3.0)

iPhone Forensics Methodology and Tools · Forensics methodologies, iPhone forensics, forensics tools, digital forensics evidence handling, INTRODUCTION iPhone mobile phone is becoming

Comp ter Forensics It’s NotComputer Forensics: It’s … ter Forensics It’s NotComputer Forensics: ... Computer Forensics Can be Useful with ... Solid state drives & deleted file

Windows 8 Forensics & Anti Forensics

Forensics · Disk Forensics Mobile Forensics E-mail investigations Questioned document Cryptography, examination Steganography Live Forensics and Network Forensics Audio/video authentication

Introduction to Computer Forensics In Class.pdf · CIS 4000 Introduction to Computer Forensics Steganography and Its Detection with JP Hide and Seek, StegDetect, and StegBreak Purpose:

Can't eat Can't eat beef... Mad Cow Can't eat chicken... Bird flu