Upload File

Download - Computer Forensics: You can run but you can't hide

Transcript
Page 1: Computer Forensics: You can run but you can't hide

Digital Forensics & IR

You can run, but you can’t hide

Page 2: Computer Forensics: You can run but you can't hide

Antonio Sanz

IT Systems & Security Manager

Expert witness

@antoniosanzalc

http://www.equipoazul.es

Page 3: Computer Forensics: You can run but you can't hide

#SanPepeEINA

Page 4: Computer Forensics: You can run but you can't hide

WTF DFIR bro?

Boring legal stuff

Forensic magic

Stand-up guy

Wanna more ?

Page 5: Computer Forensics: You can run but you can't hide

There is a war out there

Page 6: Computer Forensics: You can run but you can't hide

Cybercrime

Page 7: Computer Forensics: You can run but you can't hide

Cyberespionage

Page 8: Computer Forensics: You can run but you can't hide

Child pornography

Page 9: Computer Forensics: You can run but you can't hide

Digital

Forensics

Incident

Response

Page 10: Computer Forensics: You can run but you can't hide

IR : Respond to an incident

Page 11: Computer Forensics: You can run but you can't hide

Digital forensics : Post-mortem

Page 12: Computer Forensics: You can run but you can't hide

Locard’s exchange principle

Page 13: Computer Forensics: You can run but you can't hide

This is not a pipe

Page 14: Computer Forensics: You can run but you can't hide

This is not a pipe

Page 15: Computer Forensics: You can run but you can't hide

It’s all about evidence, stupid !

Page 16: Computer Forensics: You can run but you can't hide

No fancy 3D tools like CSI

Page 17: Computer Forensics: You can run but you can't hide

Techniques, tools and procedures

Page 18: Computer Forensics: You can run but you can't hide

People could go to prison

Page 19: Computer Forensics: You can run but you can't hide

Identification

Adquisition

Preservation

Analysis

Dissemination

Digital forensics phases

Legal stuff here

and here

Tech yeah!

Page 20: Computer Forensics: You can run but you can't hide

WTF DFIR bro?

Boring legal stuff

Forensic magic

Stand-up guy

Wanna more ?

Page 21: Computer Forensics: You can run but you can't hide

Acquisition

Page 22: Computer Forensics: You can run but you can't hide

Mobile devices

Page 23: Computer Forensics: You can run but you can't hide

RAID, SAN, NAS, VM

Page 24: Computer Forensics: You can run but you can't hide

Cloud storage

Page 25: Computer Forensics: You can run but you can't hide

Game consoles,

ebooks, DVR …

Page 26: Computer Forensics: You can run but you can't hide

Gotta catch ‘em all

Page 27: Computer Forensics: You can run but you can't hide

Should I pull the plug ?

Page 28: Computer Forensics: You can run but you can't hide

Use a cond …

A write blocker

Page 29: Computer Forensics: You can run but you can't hide

Whole enchilada

Get the whole enchilada

Page 30: Computer Forensics: You can run but you can't hide

Preservation

is king

Page 31: Computer Forensics: You can run but you can't hide

31

Chain of custody

Page 32: Computer Forensics: You can run but you can't hide

OBEY THE CHAIN

Page 33: Computer Forensics: You can run but you can't hide

WTF DFIR bro?

Boring legal stuff

Forensic magic

Stand-up guy

Wanna more ?

Page 34: Computer Forensics: You can run but you can't hide

Bad guys want to hide … but they

need to run

Page 35: Computer Forensics: You can run but you can't hide

Remember Locard: Artifacts

Page 36: Computer Forensics: You can run but you can't hide

Live forensics

Page 37: Computer Forensics: You can run but you can't hide

Order

of

Volatility

Page 38: Computer Forensics: You can run but you can't hide

Cold boot attacks

Page 39: Computer Forensics: You can run but you can't hide
Page 40: Computer Forensics: You can run but you can't hide

Preservation

is king

Page 41: Computer Forensics: You can run but you can't hide

Standard forensics

Page 42: Computer Forensics: You can run but you can't hide

Recover deleted data

Recover deleted data

Page 43: Computer Forensics: You can run but you can't hide

How

filesystems

work

Page 44: Computer Forensics: You can run but you can't hide

Good times, MAC times

Page 45: Computer Forensics: You can run but you can't hide

Making history

Page 46: Computer Forensics: You can run but you can't hide

Space / Time Analysis

Page 47: Computer Forensics: You can run but you can't hide

47

Don’t delete your history. Or do it, it doesn’t matter

Page 48: Computer Forensics: You can run but you can't hide

Prefetch

Dogs can’t prefetch

Page 49: Computer Forensics: You can run but you can't hide

Your Instant

Messages

belong to us

Page 50: Computer Forensics: You can run but you can't hide
Page 51: Computer Forensics: You can run but you can't hide

Recycle bin are gold mines

Page 52: Computer Forensics: You can run but you can't hide

52

Registry knows where your porn is

Page 53: Computer Forensics: You can run but you can't hide

Every USB you plugged could be used against you

Page 54: Computer Forensics: You can run but you can't hide
Page 55: Computer Forensics: You can run but you can't hide

Where did you say you hide your crap?.

Page 56: Computer Forensics: You can run but you can't hide

Event logs

Finding things in logs is like…

Page 57: Computer Forensics: You can run but you can't hide

Too much … metadata

Page 58: Computer Forensics: You can run but you can't hide
Page 59: Computer Forensics: You can run but you can't hide

You’ve got an email

Page 60: Computer Forensics: You can run but you can't hide

Share your downloads with us !

Page 61: Computer Forensics: You can run but you can't hide

Smartphone / Tablets

Page 62: Computer Forensics: You can run but you can't hide

Acquisition is complicated

Page 63: Computer Forensics: You can run but you can't hide

Preservation

is king

Page 64: Computer Forensics: You can run but you can't hide

Yummy extra info …

Yummy data breakfast

Page 65: Computer Forensics: You can run but you can't hide

Virtual Machines

Page 66: Computer Forensics: You can run but you can't hide

Take snapshots like there’s no tomorrow

Page 67: Computer Forensics: You can run but you can't hide

Preservation

is king

Page 68: Computer Forensics: You can run but you can't hide

Network forensics

Page 69: Computer Forensics: You can run but you can't hide

How I Xplico to you dude ?

Page 70: Computer Forensics: You can run but you can't hide

Preservation

is king

Page 71: Computer Forensics: You can run but you can't hide

Cloud computing

Page 72: Computer Forensics: You can run but you can't hide

There’s still traces

There are always traces left

Page 73: Computer Forensics: You can run but you can't hide

WTF DFIR bro?

Boring legal stuff

Forensic magic

Stand-up guy

Wanna more ?

Page 74: Computer Forensics: You can run but you can't hide

Cut to the chase

Page 75: Computer Forensics: You can run but you can't hide

Know your trade

Page 76: Computer Forensics: You can run but you can't hide

Know your enemy

Know your enemy

Page 77: Computer Forensics: You can run but you can't hide

Use more than one tool

Page 78: Computer Forensics: You can run but you can't hide

Missing things tell us a lot

Page 79: Computer Forensics: You can run but you can't hide

Put two and two together

Page 80: Computer Forensics: You can run but you can't hide

Always learn new tricks

Page 81: Computer Forensics: You can run but you can't hide

50% Knowledge

30% Technique

15% Instincts

5% Luck

Page 82: Computer Forensics: You can run but you can't hide

Writing the report > Introducción

> Resumen Ejecutivo

> Entorno del Informe (personas, lugares, fechas)

> Hechos probados iniciales (lo que sabemos)

> Hechos técnicos demostrables (lo que encontramos)

> Conclusiones

> Anexo: Evidencias

Write your report

Page 83: Computer Forensics: You can run but you can't hide

Defending the report > Contrainforme pericial

> Exposición del informe en el juicio

> Validez del técnico

> Validez de las herramientas

> Preguntas de la otra parte

> Mantener la calma, responder lo justo y bien pensado

Defend your report

Page 84: Computer Forensics: You can run but you can't hide

Ethics

Ethics

Page 85: Computer Forensics: You can run but you can't hide

WTF DFIR bro?

Boring legal stuff

Forensic magic

Stand-up guy

Wanna more ?

Page 86: Computer Forensics: You can run but you can't hide

Books

Page 87: Computer Forensics: You can run but you can't hide

Blogs

Page 88: Computer Forensics: You can run but you can't hide

Tools / LiveCDs

Page 89: Computer Forensics: You can run but you can't hide
Page 90: Computer Forensics: You can run but you can't hide

Certifications

Page 91: Computer Forensics: You can run but you can't hide

Conclussions

Page 92: Computer Forensics: You can run but you can't hide

We need DFIR Lots of it

Page 93: Computer Forensics: You can run but you can't hide

Legal issues are critical

Page 94: Computer Forensics: You can run but you can't hide

Many places to look

Have to know where, how & why

Page 95: Computer Forensics: You can run but you can't hide

You can run

You can’t hide

Page 96: Computer Forensics: You can run but you can't hide

If you’re guilty …

we’ll catch you

@antoniosanzalc

http://www.equipoazul.es

http://bit.ly/1h47zfF


Top Related

Digital Evidence and Computer Forensics Oct 7-8 2013/Tab 02 Oct 7-8... · Digital Evidence and Computer Forensics COMPUTER FORENSICS FORENSICS FORENSICS
Digital Evidence and Computer Forensics Oct 7-8 2013/Tab 02 Oct 7-8... · Digital Evidence and Computer Forensics COMPUTER FORENSICS FORENSICS FORENSICS
 · 2020. 5. 13. · Black Velvet — Alanah Myles Brass In Pocket — The Pretenders Buses & Trains — Bachelor Girl Cant Get Enough Of Your Lcn.'e — Barry White Can't Hide Love
 · 2020. 5. 13. · Black Velvet — Alanah Myles Brass In Pocket — The Pretenders Buses & Trains — Bachelor Girl Cant Get Enough Of Your Lcn.'e — Barry White Can't Hide Love
"Those that don't got it, can't show it. Those that got it, can't hide it.“ -Zora Neale Hurston "When peoples care for you and cry for you, they can straighten
"Those that don't got it, can't show it. Those that got it, can't hide it.“ -Zora Neale Hurston "When peoples care for you and cry for you, they can straighten
SQL SERVER Anti-Forensics - Black Hat · • Anti-Forensics techniques help to make forensics investigations difficult • Anti-Forensics can be a never ending game • Forensics
SQL SERVER Anti-Forensics - Black Hat · • Anti-Forensics techniques help to make forensics investigations difficult • Anti-Forensics can be a never ending game • Forensics
iPhone Forensics Methodology and Tools · Forensics methodologies, iPhone forensics, forensics tools, digital forensics evidence handling, INTRODUCTION iPhone mobile phone is becoming
iPhone Forensics Methodology and Tools · Forensics methodologies, iPhone forensics, forensics tools, digital forensics evidence handling, INTRODUCTION iPhone mobile phone is becoming
Introduction to Computer Forensics In Class.pdf · CIS 4000 Introduction to Computer Forensics Steganography and Its Detection with JP Hide and Seek, StegDetect, and StegBreak Purpose:
Introduction to Computer Forensics In Class.pdf · CIS 4000 Introduction to Computer Forensics Steganography and Its Detection with JP Hide and Seek, StegDetect, and StegBreak Purpose:
You Can't Hide that Cardinal Pride!
You Can't Hide that Cardinal Pride!
Activity Server: You can run but you can't hide · Activity Server: You can run but you can't hide Sanjay Manandhar MIT Media Laboratory Cambridge, MA 02139 USA sanjay @media-lab
Activity Server: You can run but you can't hide · Activity Server: You can run but you can't hide Sanjay Manandhar MIT Media Laboratory Cambridge, MA 02139 USA sanjay @media-lab