Alternate Data Storage Forensics

VISIT US AT Syngress is committed to publishing high-quality books for IT Professionals and delivering those books in m...

Author: Amber Schroader | Tyler Cohen

255 downloads 3357 Views 21MB Size Report

This content was uploaded by our users and we assume good faith they have the permission to share this book. If you own the copyright to this book and it is wrongfully on our website, we offer a simple DMCA procedure to remove your content from our site. Start by pressing the button below!
Report copyright / DMCA form

DOWNLOAD PDF

VISIT US AT Syngress is committed to publishing high-quality books for IT Professionals and delivering those books in media and formats that fit the demands of our customers. We are also committed to extending the utility of the book you purchase via additional materials available from our Web site.

SOLUTIONS WEB SITE

To register your book, visit www.syngress.com/solutions. Once registered, you can access our [email protected] Web pages. There you may find an assortment of valueadded features such as free e-books related to the topic of this book, URLs of related Web sites, FAQs from the book, corrections, and any updates from the author(s).

ULTIMATE CDs

Our Ultimate CD product line offers our readers budget-conscious compilations of some of our best-selling backlist titles in Adobe PDF form. These CDs are the perfect way to extend your reference library on key topics pertaining to your area of expertise, including Cisco Engineering, Microsoft Windows System Administration, CyberCrime Investigation, Open Source Security, and Firewall Configuration, to name a few.

DOWNLOADABLE E-BOOKS

For readers who can't wait for hard copy, we offer most of our titles in downloadable Adobe PDF form. These e-books are often available weeks before hard copies, and are priced affordably.

SYNGRESS OUTLET

Our outlet store at syngress.com features overstocked, out-of-print, or slightly hurt books at significant savings.

SITE LICENSING

Syngress has a well-established program for site licensing our e-books onto servers in corporations, educational institutions, and large organizations. Contact us at [email protected] for more information.

CUSTOM PUBLISHING

Many organizations welcome the ability to combine parts of multiple Syngress books, as well as their own content, into a single volume for their own internal use. Contact us at [email protected] for more information.

....~ii li

SYN~RESS

®

This Page Intentionally Left Blank

~!

~I~

~

10114~~'T|m~~~

~ ~i ~

~

~ ii~i~

~ i:

:i ~ ! ..... ~ i

~~~ ....

i~!~:~!~!:~¸~!i~',¸~

~

~

~

~.....

i

Tyler Cohen Amber

Schroader

ii ¸

i~

....

i~~

i ! .........

/

,i

ii

........

i~~ii!i...... ~iii!:,~

.....

!~ i~:~ i : ~ ,~:::~: ~

~:~: :~:~

Elsevier, Inc., the author(s), and any person or firm involved in the writing, editing, or production (collectively "Makers") of this book ("the Work") do not guarantee or warrant the results to be obtained from the Work. There is no guarantee of any kind, expressed or implied, regarding the Work or its contents. The Work is sold AS IS and W I T H O U T WARRANTY.You may have other legal rights, which vary from state to state. In no event will Makers be liable to you for damages, including any loss of profits, lost savings, or other incidental or consequential damages arising out from the Work or its contents. Because some states do not allow the exclusion or limitation of liability for consequential or incidental damages, the above limitation may not apply to you. You should always use reasonable care, including backup and other appropriate precautions, when working with computers, networks, data, and files. Syngress Media®, Syngress®, "Career Advancement Through Skill Enhancement®," "Ask the Author UPDATE®," and "Hack Proofing®," are registered trademarks of Elsevier, Inc. "Syngress: The Definition of a Serious Security Library"TM,"Mission CriticalTM, '' and "The Only Way to Stop a Hacker is to Think Like One TM'' are trademarks of Elsevier, Inc. Brands and product names mentioned in this book are trademarks or service marks of their respective companies. KEY

001 002 003 004 005 006 007 008 009 010

SERIAL NUMBER

HJIRTCV764 PO9873D5FG 829KM8NJH2 CDF476857U CVPLQ6WQ23 VBP965T5T5 HJJJ863WD3E 2987GVTWMK 629MP5SDJT IMWQ295T6T

PUBLISHED BY Syngress Publishing, Inc. Elsevier, Inc. 30 Corporate Drive Burlington, MA 01803 Alternate Data Storage Forensics Copyright © 2007 by Elsevier, Inc. All rights reserved. Printed in the United States of America. Except as permitted under the Copyright Act of 1976, no part of this publication may be reproduced or distributed in any form or by any means, or stored in a database or retrieval system, without the prior written permission of the publisher, with the exception that the program listings may be entered, stored, and executed in a computer system, but they may not be reproduced for publication. Printed in the United States of America 1234567890 ISBN 13:978-1-59749-163-1

Publisher: Amorette Pedersen Acquisitions Editor: Andrew Williams Cover Designer: Michael Kavish

Copy Editor: Audrey Doyle Page Layout and Art: Patricia Lupien Indexer: Nara Wood

For information on rights, translations, and bulk sales, contact Matt Pedersen, Commercial Sales Director and Rights, at Syngress Publishing; email [email protected].

ntri buti ng Authors

Tyler C o h e n (CISSP) is employed by Computer Science Corporation contracted as a researcher and developer for the Department of Defense Cyber Crime Center. Her specialty is digital forensics and intrusions. She is considered an expert in hacking and conducting forensic exams with the iPod and other alternative media devices. She presents her expertise at various conferences all over the country some of which include the Department of 1)et:ense Cyber Crime Conference, International High Technology Crime Investigation Association and The California District Attorney's Cyber Crime Conference.

Kevin Cardwell (CEH, ECSA, LPT) works as a flee-lance consultant and provides consulting services for companies throughout the US, UK and Europe. He is an Adjunct Associate Professor for the University of Maryland where he participated in the team that developed the Information Assurance program for Graduate Students which is recognized as a Center of Excellence program by the National Security Agency (NSA). He is an Instructor and Technical Editor for Computer Forensics, and Hacking courses. He has presented at the Blackhat USA Conference. Kevin spent 22 years in the U.S. Navy, during this time he tested and evaluated Surveillance and Weapon system software, some of this work was on projects like the Multi-Sensor Torpedo Alertment Processor (MSTRAP), Tactical Decision Support System (TDSS), Computer Aided Dead Reckoning Tracer (CADP, T), Advanced Radar Periscope Discrimination and Detection (ARPI)D), and the Remote Mine Hunting System (RMHS). He has worked as both software and systems engineer on a variety, of Department of Defense projects and was selected to head the team that built a Network Operations Center (NOC) that provided services to the command ashore and ships at sea in the Norwegian Sea and Atlantic Ocean. He served as the Leading Chief of Information Security at the N O C for six years prior to retiring from the U.S. Navy. During this time he was the leader of a 5 person Red Team.

Kevin holds a Master's degree from Southern Methodist University, and is a member of the IEEE and ACM. Kevin currently resides in Cornwall, England. Paul Crowley is the founder and lead developer at InfinaDyne. InfinaDyne is one of a small number of companies publishing software specifically targeted at the forensic examiner. Paul has been working in the software development field since 1975. His career includes experience that spans computer hardware from the very smallest home video game console to the largest IBM mainframes. Paul began working with CD recording technology in 1994 and is one of a small number of respected authorities on this technology. The first CD data recovery software product was written by Paul and has led the market for such tools since 1997. InfinaDyne has been offering CD and DVD Forensics training classes since 2005 and has held classes in the U.S. and Australia. Attendees at these classes have included members of the FBI, US Department of Defense, and the Australian Federal Police.

Michael Gregg (CISSP, CISA, MCSE, MCT, C T T + , A + , N+, Security+, CNA, CCNA, CIW Security Analyst, CCE, CEH, CHFI, DCNR ES Dragon IDS, TICSA) is the founder and Chief Operating Officer of Superior Solutions, Inc., a Houston-based IT security consulting firm. Superior Solutions performs security assessments and penetration testing for Fortune 1000 firms. Michael is responsible for working with organizations to develop cost effective and innovative technology solutions to security issues and for evaluating emerging technologies. Michael supervises client engagements to ensure high quality solutions are developed for software design issues, systems administration concerns, policy development, and security systems testing. Michael has more than 20 years experience in the IT field and holds two associate's degrees, a bachelor's degree, and a master's degree. He has written or co-written a number of other books including Que's Certified Ethical Hacker Exam Prep 2 and Inside Network Security Assessment by Sam's publishing. He is the author of Hack the Stack: Using Snort and Ethereal to Master the 8 Layers of an Insecure Network (Syngress, ISBN: 1597491098). He is a member of the American College of Forensic Examiners, the vi

Independent Computer Consulting Association, and the Texas Association for Educational Technology.

Kevin O'Shea is currently employed as a Homeland Security and Intelligence Specialist in the Justiceworks program at the University of New Hampshire. In this capacity, Mr. O'Shea supports the implementation of tools, technology, and training to assist law enforcement in the investigation of crimes with a cyber component. In one of Kevin's recent projects, he was a technical consultant and developer of a training program for a remote computer-forensics-viewing technology, which is now in use by the state of New Hampshire. He also has developed a computer-crime-investigative curriculum for the New Hampshire Police Standards and Training. /

Thomas Ralph graduated cure laude from Case Western Reserve University School of Law, where he served as editor on the school's Law Review. In 1998, after serving as legal counsel at MassHighway, Mr. Ralph joined the Middlesex District Attorney's Office, where he performed trial work in the District and Superior Courts. Mr. Ralph became Deputy Chief of the Appeals Bureau, Captain of the Search Warrant Team, and Captain of the Public Records Team. Mr. Ralph has appeared dozens of times in the Massachusetts Appeals Court and Supreme Judicial Court. In 2005, Mr. Ralph became an Assistant Attorney General in the New Hampshire Attorney General's office. His responsibilities there included spearheading the New Hampshire Attorney General's Cybercrime Initiative, an innovative program for processing and handling electronic evidence that has received national recognition, and overseeing complex investigations into the electronic distribution of child pornography. Amber. Schroader has been involved in the field of computer forensics for the past sixteen years. During this time, she has developed and taught numerous courses for the computer forensic arena, specializing in the field of wireless forensics as well as mobile technologies. Ms Schroader is the CEO of Paraben Corporation and continues to act as the driving force behind some of the most innovative forensic technologies. As a pioneer in the field, Ms Schroader has been key in developing new technology to help Vii

investigators with the extraction of digital evidence from hard drives, e-mail and, hand held and mobile devices. Ms Schroader has extensive experience in dealing with a wide array of forensic investigators ranging from federal, state, local, and corporate. With an aggressive development schedule, Ms Schroader continues to bring new and exciting technology to the computer forensic community world wide and is dedicated to supporting the investigator through new technologies and training services that are being provided through Paraben Corporation. Ms Schroader is involved in many different computer investigation organizations including The Institute of Computer Forensic Professionals (ICFP), HTCIA, CFTT, and FLETC.

James "Jim" Steele (CISSR MCSE: Security, Security+) has a career rich with experience in the security, computer forensics, network development, and management fields. For over 15 years he has played integral roles regarding project management, systems administration, network administration, and enterprise security management in public safety and mission-critical systems. As a Senior Technical Consultant assigned to the NYPD E-911 Center, he designed and managed implementation of multiple systems for enterprise security; he also performed supporting operations on-site during September 11, 2001, and the blackout of 2003. Jim has also participated in foreign projects such as the development of the London Metropolitan Police C3i Project, for which he was a member of the Design and Proposal Team. Jim's career as a Technical Consultant also includes time with the University of Pennsylvania and the FDNY. His time working in the diverse network security field and expert knowledge of operating systems and network products and technologies have prepared him for his current position as a Senior Digital Forensics Investigator with a large wireless carrier. His responsibilities include performing workstation, server, PDA, cell phone, and network forensics as well as acting as a liaison to multiple law enforcement agencies, including the United States Secret Service and the FBI. On a daily basis he investigates cases of fraud, employee integrity, and compromised systems. Jim is a member of HTCC, NYECTF, InfraGard and the HTCIA.

viii

Craig W r i g h t (CISSP, ISSAP, ISSMP, CISA, CISM, CCE, GNSA, G7799, GWAS, GCFA, (;LEG, GSEC, GREM, GPCI, MCSE and GSPA) has personally conducted over 1,200 IT security related engagements for more than 120 Australian and international organizations in the private and government sectors and now works for BDO Kendall's in Australia. In addition to his consulting engagements Craig has also authored numerous IT security related articles as well as being involved with designing the architecture for the world's first online casino (Lasseter's Online) in the Northern Territory. He has also designed and managed the implementation of many of the systems that protected the Australian Stock Exchange. He also developed and implemented the security policies and procedural practices within Mahindra and Mahindra, India's largest vehicle manu(acturer.

ix


Contents Chapter 1 Digital Forensics and Analyzing Data . . . . . . . . 1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 The Evolution of Coiiiputer Forensics . . . . . . . . . . . . . . . . . .2 Phases of lligital Forensics . . . . . . . . . . . . . . . . . . . . . . . . . . 4 C ollec ti o 11 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 I’reparatioii . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 1)ifficulties W h e n Collecting Evidence froin Nontraditional Devices . . . . . . . . . . . 10 Hardware 1 )ocumentation Ilifficulties . . . . . . . . . . .15 11it5cu 1ti ec W 11t‘n C 011 ect i ng Ilata from 1t.i id Arrays. SAN. and NAS Devices . . . . . 17

11iffic u 1ties W h en C: o11ecti ng l h t a from Virtual Machines . . . . . . . . . . . . . . . . . . . 19 1)ifficulties W h e n Conducting M e m o r y Acquisition and Analysis . . . . . . . . . . . . . . . 19 Exa 111i n a t i o n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Utility of Hash Sets . . . . . . . . . . . . . . . . . . . . . . . . . 22 I>ifliculties Assoc.iated with Esmiining a Sycteni with Full Disk Encryption . . . . .23 A1t er n a t ive Foren sic I’ 1-0c esses . . . . . . . . . . . . . . . . . .24 Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Aiialysis of 1‘ Single (:oniputer . . . . . . . . . . . . . . . . . 27 Analysis of .I 11 Eiiterprise Event . . . . . . . . . . . . . . . . .30 Tools for 1)ata Analy4c . . . . . . . . . . . . . . . . . . . . . . . 32 Reporting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 Keferences . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 Solutions Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . . . 38

Chapter 2 Seizure of Digital Information

. , . . . . . . . . . . 39

I tit roduc ti on . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Defining Iligitd Evidence . . . . . . . . . . . . . . . . . . . . . . . . .

40

43

lligital Evidence Seizure Methodolo&? . . . . . . . . . . . . . . . 46 . xi

xii

Contents Seizure M e t h o d o l o g y in D e p t h

...................

48

Step 1: Digital Media Identification . . . . . . . . . . . . . . Step 2: Minimizing the C r i m e

50

Scene by Prioritizing the Physical Media . . . . . . . . . .

50

Step 3: Seizure o f Storage Devices and Media . . . . . . To Pull the Plug or N o t to Pull the Plug, That Is the Question . . . . . . . . . . . . . . Factors Limiting the Wholesale Seizure o f Hardware . . . . . . Size o f Media . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Disk Encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Privacy C o n c e r n s

.............................

51 52 54 54 55 56

Delays R e l a t e d to Laboratory Analysis . . . . . . . . . . . . . . Protecting the T i m e of

57

the Most Highly Trained Personnel

................

58

T h e C o n c e p t o f the First R e s p o n d e r . . . . . . . . . . . . . . .

61

O t h e r Options for Seizing Digital Evidence . . . . . . . . . . . . . R e s p o n d i n g to a Victim of a C r i m e W h e r e Digital Evidence Is Involved . . . . . . . . . Seizure Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Previewing O n - S c e n e Information to D e t e r m i n e the Presence and Location of Evidentiary Data Objects . . . . . . . . . . . . . . . . . . . . . . Obtaining Information from a R u n n i n g C o m p u t e r . . . . Imaging Information O n - S c e n e . . . . . . . . . . . . . . . . . . . Imaging Finite Data Objects O n - S c e n e ............ Use of Tools for Digital Evidence Collection . . . . . . . . . C o m m o n Threads within Digital Evidence Seizure . . . . . . . D e t e r m i n i n g the Most Appropriate Seizure M e t h o d . . . . . . .

62

69 70 72 73 76 78 81

Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

83

65 66

Works Cited . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

85

Solutions Fast Track

88

..............................

Frequently Asked Questions

........................

Chapter 3 Introduction to Handheld Forensics . . . . . . . .

90

93

Digital Forensics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . W h a t Is the H a n d h e l d Forensic Impact? . . . . . . . . . . . . . . . .

94 95

Digital Forensic Foundations . . . . . . . . . . . . . . . . . . . . . File System Differences . . . . . . . . . . . . . . . . . . . . . . .

95 96

Contents

...

xiii

Static versus Active . . . . . . . . . . . . . . . . . . . . . . . . . . 97 Storage Capacity Differences . . . . . . . . . . . . . . . . . . .98 Iiiiagiiig Techniques . . . . . . . . . . . . . . . . . . . . . . . . . 99 Evidence (hllection . . . . . . . . . . . . . . . . . . . . . . . . . . 100 First Responder . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102 Chllcction to Handling . . . . . . . . . . . . . . . . . . . . . . . . 104 Pl)A Hmdling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104 Cellular Hxidling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106 Evidence I’reservation . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108 Maintain the Ilevice . . . . . . . . . . . . . . . . . . . . . . . . . . 109 Maintain a Forensic l h t a Connection . . . . . . . . . . . . . . . . 110 Forensic (;rack Tools . . . . . . . . . . . . . . . . . . . . . . . . . . 111 Analysis ,I nd IXeporting . . . . . . . . . . . . . . . . . . . . . . . . . . . 112 Bibliography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112

Chapter 4 PDA, Blackberry, and iPod Forensic Analysis 113 Introductioii . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1’1lA Background Information . . . . . . . . . . . . . . . . . Components of 3 PI>A . . . . . . . . . . . . . . . . . . . . . . . . PDA Forensics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Investigative Methods . . . . . . . . . . . . . . . . . . . . . . . . . Step 1 : Esaminatioii . . . . . . . . . . . . . . . . . . . . . . . . . . Step 2: Identification . . . . . . . . . . . . . . . . . . . . . . . . . . Step 3: Collection . . . . . . . . . . . . . . . . . . . . . . . . . . . . Step 4:Ilocuiiiei~tation . . . . . . . . . . . . . . . . . . . . . . . . PIlA Investigative Tips . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 levice Switched O n . . . . . . . . . . . . . . . . . . . . . . . . . . Ilevice S\vitched Off . . . . . . . . . . . . . . . . . . . . . . . . . . llevicc in its (:radle . . . . . . . . . . . . . . . . . . . . . . . . . . . Ilevice not in its Cradle . . . . . . . . . . . . . . . . . . . . . . . . Wireless (:onnection . . . . . . . . . . . . . . . . . . . . . . . . . . Expansion (:arc1 in Slot . . . . . . . . . . . . . . . . . . . . . . . . Expansion Sleeve llemoved . . . . . . . . . . . . . . . . . . . . . . . . Ikployiiig 1’1 >A Forensic Tools . . . . . . . . . . . . . . . . . . . . . 1’1IA Securc . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . P1IA Seizure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . EnCase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I 11t ro du ct io n to t h e Blackberry . . . . . . . . . . . . . . . . . . . . .

114 . 114

114 114 115 115 116 116 116 137 117 117 117 118 118 118

118 119 119 119 119 120

~iv

Contents

O p e r a t i n g S y s t e m o f the B l a c k b e r r y . . . . . . . . . . . . . . .

120

B l a c k b e r r y O p e r a t i o n and S e c u r i t y

120

...............

Wireless S e c u r i t y . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S e c u r i t y for Stored Data

120

..........................

121

Acquisition of Information Considerations ..........

121 121

D e v i c e is in the " o f f " State

122

Forensic E x a m i n a t i o n o f a B l a c k b e r r y

................

.....................

D e v i c e is in the " o n " State . . . . . . . . . . . . . . . . . . . . . .

122

Password P r o t e c t e d

122

...........................

Evidence Collection

..........................

122

Unit Control Functions ........................

123

I m a g i n g and Profiling

.........................

123

Attacking The Blackberry

.........................

123

S e c u r i n g the B l a c k b e r r y ( R I M ) . . . . . . . . . . . . . . . . . . . . .

124

I n f o r m a t i o n H i d i n g in the B l a c k b e r r y ( R I M ) . . . . . . . .

124

B l a c k b e r r y ( R I M ) Signing A u t h o r i t y Tool

124

..........

i P o d Forensics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The iPod

..................................

i P o d Features

.............................

T h e i P o d as O p e r a t i n g S y s t e m

................

Drive F o r m a t s - Apple H F S + O r FAT32 . . . . . . . . . T h e i P o d S y s t e m Partition . . . . . . . . . . . . . . . . . . . . . . Application Formats

........................

124 125 126 127 128 128

129

Misuse o f an i P o d . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

130

i P o d Investigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

130

Timeline Generation ..........................

131

Lab Analysis

133

................................

Remove Device from Packaging T h e iPod restore process T h e iPod and W i n d o w s The Registry

.................

.......................

..........................

...............................

setupapi.log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . T h e i P o d and L i n u x User Accounts

.............................

.................................

133 134 136 136 137 138 138

D e l e t e d Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

138

i P o d T i m e Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

139

Contents

xv

Registry Key (:ontaining the iPod’5 USB/Fire\vire Serial Number . . . . . . . . . . . . . . . . . 139 iPod Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140 1)iskInternals Music Recovery . . . . . . . . . . . . . . . . . . . 140 Recover M y il’od . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140 1111 ‘ind the il’od . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141 Sunimary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142 Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142 Solutions Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143 Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . . 146

Chapter 5 E-mail Forensics ........................

147

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148 Where to Start? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148 E-niail Terniinoloby . . . . . . . . . . . . . . . . . . . . . . . . . . . 148 Here is ‘in example HELO exchange . . . . . . . . . . . . 149 Functions of E-niail . . . . . . . . . . . . . . . . . . . . . . . . 150 Archive Tvpes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150 Server Storage Archives . . . . . . . . . . . . . . . . . . . . . . 151 Lotus Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152 Novel1 (;roupWise . . . . . . . . . . . . . . . . . . . . . . . . . 152 Locd Level Archives . . . . . . . . . . . . . . . . . . . . . . . . 152 Ingredient\ of E-niail . . . . . . . . . . . . . . . . . . . . . . . 154 M‘iilbos Arc-hive . . . . . . . . . . . . . . . . . . . . . . . . . . . 155 Other Assockited Files of the Archive . . . . . . . . . . . . 155 Mess‘ige . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155 Attachnlel1t\ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156 Forensic Acquisition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157 Processing L o c ~ lMail Archives . . . . . . . . . . . . . . . . . . . . . 158 Step 1 -Accluisition Outlook PST file . . . . . . . . . . . . . . 158 Step 2-l’rocessing . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158 Using I’araben’s E-mail Examiner . . . . . . . . . . . . . .1 59 Using MS Outlook for l’rocessing Outlook Express Files . . . . . . . . . . . . . . .162 Processing Server Level Archives . . . . . . . . . . . . . . . . 163 Step 1 Acyiisition . . . . . . . . . . . . . . . . . . . . . . . . . . 163 Step 2 I’rocessing . . . . . . . . . . . . . . . . . . . . . . . . . . 164 U h g 0nTrac.k I’owerControls . . . . . . . . . . . . . . . . . . 164

xvi

Contents Using Paraben's N e t w o r k E-mail E x a m i n e r ( N E M X ) Deleted E-mail Recovery

.....

....................

166 168

Eudora Mail ..............................

169

Outlook PST

169

.............................

Network Archives ..........................

169

C h a p t e r 6 Router Forensics . . . . . . . . . . . . . . . . . . . . . . . Introduction Network

171

...................................

Forensics

172

..............................

172

T h e H a c k i n g Process . . . . . . . . . . . . . . . . . . . . . . . . . .

172

T h e I n t r u s i o n Process

172

S e a r c h i n g for E v i d e n c e

......................... ..........................

An Overview of Routers

173

.........................

174

W h a t Is a R o u t e r ? . . . . . . . . . . . . . . . . . . . . . . . . . . . .

174

The Function of a Router

174

The Role of a Router R o u t i n g Tables

......................

.........................

174

..............................

Router Architecture

175

..........................

176

Routing Protocols ............................ RIP

176

....................................

177

OSPF ................................... Hacking Routers

...............................

Router Attacks

Denial-of-Service Attacks R o u t i n g Table P o i s o n i n g

Chain of Custody

Incident Response Summary

......................

179

.......................

180 .........

181

181

............................

182

.......................

............................. ..............................

...............................

.....................................

S o l u t i o n s Fast T r a c k

178

............................

Volatility o f E v i d e n c e Case R e p o r t s

178

.......................

Attacks and Persistent Attacks

Investigating Routers

Compromises

178

..............................

Router Attack Topology

Hit-and-Run

177

.............................

Frequently Asked Questions

.......................

182 183 184 184 185 185 186

Contents

Chapter 7 Legal Issues of Intercepting WiFi Transmissions

xvii

. . . . . . . . . . . . . . . . . . . 189

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190 WiFi Technology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190 Authentication and Privacy in the 802.11 Standard . . . .192 Privacy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193 Understanding WiFi R F . . . . . . . . . . . . . . . . . . . . . . . . . . 195 Scanning I Subject::

Pictures of my neck in zip file

Content-Type:

multipart/mixed;

Content-Type:

text/plain

Attached

is the file neck.zip,

boundary=boundarystring

which has been base64 encoded.

- -boundarystring Content-Type-

--boundarystring

application/octet-stream;

name= "neck. zip"

E-mail Forensics • Chapter 5

Content-Transfer-EncodinqContent-Disposition-

157

base64

attachmentl filename:"neck.zip"

H52QL•D6AJFBALJHL•HK•LNS8•J••SNLJKNLFDLSHFLSHDLFSHLKDNC8•9SA•IHN3•FNSA8•HLDBJSUF93H

FSLBNCOISAY890EYOAHFLNC739HFOEBOASHOFHSODIY8930...

OAIHOFIDHF8920DFNSOFNDOSGU03UQAFLASNFDLIU03WQJFOSIFH0319AHFDALHFNB: --boundarystring--

Q" Does

this message have an attachment?

A: Yes it is a file names neck.zip

Q" Was

there anyone C C in this message?

A: Answer" N o there is ilo C C in the header. This is a very simple example of an e-mail but it allows for an illustration of the basic components of the e-mail.

Forensic Acquisition There are many tools that can process through e-mail archives. Each tool has its positive and negative points and those should be evaluated prior to purchase. However, no matter which tool you purchase, you will want to insure that you test properly and understand how it goes about its forensic validation. Since there is no standard available on how to process all the different proprietary mail formats, each tool can receive slightly different results in the processing. Here are some helpthl tests for your e-mail examination tools. 1. H o w does it compute the hash value? Before you cross validate your tools, it will be important to find out if they are both using the same premise for validation. Some tools do not include all of the components of" the mail message in the computation of the hash value. Generally the hash should include the header, bod> and when applicable the attachment. It has become c o m m o n for the attachn~ent to also be extracted and hashed independently as well. 2. Was the tool designed for forensics? The processing of mail for forensics is a different process then just reading the mail archive.Your tool of choice should be able to recover deleted data from the archive as well as recover the deleted data t}om the archive.

www.syngress.com

158

Chapter 5 ,

•

E-mail Forensics

C o m p a n y support. The company should be willing to support you as a forensic examiner with good d o c u m e n t a t i o n explaining the process their application uses for processing as well as support for court purposes if it is required.

The following examples are processed using different tools and show what the end results should be. For complete information on any tool, please contact the vendor of the tool for that information.

Processing Local Mail Archives T h e two most c o m m o n e-mail archives available on local systems are O u t l o o k Express and O u t l o o k PST files. They are both typically found on the desktop system o f the users.

Step 1-Acquisition Outlook PST file Typically, you will do a traditional bit-stream image of the entire drive and then extract the PST file from the drive image. When extracting the PST file from the image, it is important to use multiple tools.There are many good virtual mounting programs available that allow you to mount your acquired drive and then extract a copy of the data from that drive. This is one of the better methods for extraction since some of the common methods built into the automated forensic suites will not extract a usable PST file.

Step 2-Processing O n c e the file is extracted, you can select your tool for processing the proprietary email archive into usable messages, i will use two tools below to illustrate the differences that can be found in processing.


159

Using Paraben~S E-mail Examiner Paraben's E-mail Examiner is designed to process a wide variety of e-mail archives. One of those is Outlook PST files.To process the files with this tool, a separate import engine was designed. The E-mail Examiner is shown in Figure 5.2 and the PST Converter is shown in Figure 5.3.

Figure 5.2 Paraben's E-mail Examiner

www.syngress.com .

.

.

.

160

Chapter 5 • E-mail Forensics

Figure 5.3 Paraben's PST Converter

After you have selected the file to import, you are left with a variety of options for the actual processing of the archive. Each of the options listed in the screen shot will affect what you see as the ending data. The recovery of deleted messages through this engine works for both deleted and deleted-deleted data. However, once the mail archive is processed, the data that was recovered from deleted processing does not get tagged as being different from any of the other mail messages. It is important to remember this so you can look for other details that would tell you that those messages were recovered from that space such as the path. Once the files are processed, the details will be displayed for you as seen in Figure 5.4.


161

Figure 5.4 Processed Files

There are many things that you will notice once the archive is processed from deleted data recovery to messages with attachments.

www.syngress.com .

_

.

162

Chapter 5

°

E-mail Forensics

Using MS Outlook for processing Outlook Express files Some people prefer to use tools that are the mail clients for processing the data associated with the archive. This can be problematic because these tools are not specifically designed for forensics. So, much of the deleted data would be missed in the processing.To illustrate this I have processed the same archive (Outlook Express) with both the mail application (Figure 5.5) and a forensic application (Figure 5.6).

Figure 5.5 Mail Application

According to the mail application there is no data in the e-mail archive. Once the forensic tool has processed the archive, a variety of messages were recovered.

www, syngress.com


163

Figure 5.6 Processing with Forensic Tool

Processing Server Level Archives. As discussed previously, there are many different files to look for when processing a server level archive. D e p e n d i n g on which mail server was used, you will need to gather different data as previously discussed.

Step 1 Acquisition The acquisition stage for a server archive is different than with the smaller local stores as you do not typically do a bit-stream image and then extract the archive. Instead, in most cases you can just acquire the appropriate files where the archive data is stored. Although this is not a traditional forensic method, it is very c o m m o n based on the structt~re o~ the network archive and size.

r

www.syngress.com .

.

.

.

.

.

164


Step 2 Processing There is not a wide range of tools available for network level archives. Most tools are not design specifically for forensic processing, so you are limited in your choices of tools if you want to stay just in forensic software. However, you do have other tool options available that are designed for restoring archives for review.

Using OnTrack PowerControls "Ontrack PowerControls is a simple, yet powerful software tool for copying, searching, recovering and analyzing email and other mailbox items directly from Microsoft Exchange server backups, un-mounted databases (EDB) and Information Store files." www.ontrackpowercontrols.com PowerControls is one of the better tools available for processing MS Exchange files. It recovers both active and deleted data and can work on a variety of versions of MS Exchange. Figures 5.7, 5.8, and 5.9 show the data that has been processed.

www.syngress.com


165

Figure 5.7 Process MS Exchange PRIV.EDB file.

Figure 5.8 The Display of an Individual Account in the MS Exchange File

www.syngress.com .

.

.

.

.

.

.

.

166

Chapter 5 • E-mail Forensics F i g u r e 5.9 Convenient Message Viewer for the Review of the Content Data in the E-mail Arch ive

Using Paraben's Network E-mail Examiner (NEMX) N E M X is also a tool that can be used to process MS Exchange archives as well as Lotus Notes, and GroupWise. Built into the tool is a corruption repair utility that will also save some time in processing by attempting to bypass corruption and moving on to read the rest of the archive allowing to keep the data in its original state. Figures 5.10, 5.11, and 5.12 show some examples from processing a MS Exchange PR.IV.EDB file.

www.syngress.com

E-mail Forensics ° Chapter 5

t

Figure 5.10 A Fully Processed MS Exchange File Including Server Level Information

Figure 5.11 Tree View of the Data Typically Associated with an MS Exchange Priv.edb File

p~-

www.syngress.com

168


Figure 5.12 Opening of the Data Associated with the User Account in the MS Exchange File

Deleted E-mail Recovery The recovery of deleted e-mail messages can vary greatly on the e-mail client that was being used. Typically, you will find a couple weeks of deleted data that can still be recovered from an archive. Here are a few examples of how deleted e-mail works.

www.syngress.com


169

Eudora Mail In Eudora, messages for deletion are tagged for deletion and are no longer visible in the mailbox. These messages, however, are still in the "trash" folder and remain there until explicitly instructed to empty the trash folder.

Outlook PST In Outlook, data is taken from the active part of the archive to a recycling bin. From that point, the recycling bin is emptied based on the user's preferences. Once it is emptied, it will go into the unallocated space of the mail archive. Here it can sit for a period of weeks. Depending on tile size of the archive the recovery of this data will vary greatly.

Netwo rk Arc hives Depending on the network level archive, you will have a variety of results on deleted mail recovery. It is c o m m o n to recover a good percentage of deleted e-mail. Overall, the processing of e-nlail can be made simple by following guidelines and having the proper expectations. "I know my e-mail goes through my computer, but beyond that I don't know and I don't care as long as it goes. H o w would I know? My clock on my VC1K still blinks." (Survey Participant) N o w that you know more than the average bear w h e n it comes to e-mail, you are well on your way to becoming an e-mail forensic examiner. Always remember to keep learning, as this type of information changes constantly.

www.syngress.com


Chapter 6

171

172

Chapter 6 • Router Forensics

Introduction This chapter examines router and network forensics. This chapter is important as many attacks will require the analyst to look for information in the router or require network forensics. This requires you to have an understanding of routers and their architecture. It is important to understand where they reside within the OSI model and what role they play within network communications. Anytime you work with forensic evidence it is critical that the concept of chain of custody be understood. How evidence is handled, stored, accessed, and transported is critical, because if basic control measures are not observed the evidence may be ruled inadmissible in court.

Network Forensics Network forensics can best be defined as the sniffing, recording, and analysis of network traffic and events. Network forensics are performed in order to discover the source of security incidents and attacks or other potential problems. One key role of the forensic expert is to differentiate repetitive problems from malicious attacks.

The Hacking Process The hacking process follows a fixed methodology. The steps a hacker follows can be broadly divided into six phases: 1. Reconnaissance 2. Scanning and enumeration 3. Gaining access 4. Escalation of privilege 5. Maintaining access 6. Covering tracks and placing backdoors

The Intrusion Process Reconnaissance is considered the first preattack phase. The hacker seeks to find out as much information as possible about the victim. The second preattack phase is scanning and enumeration. At this step in the methodology, the hacker is moving from passive information gathering to active information gathering. Access can be gained in many different ways. A hacker may exploit a router vulnerability or maybe www.syngress.com

Router Forensics • Chapter 6

173

social engineer the help desk into giving him a phone number for a modem. Access could be gained by finding vulnerability in the web server's software. Just having the access of an average user account probably won't give the attacker very much control or access to the network. Theretbre, the attacker will attempt to escalate himself to administrator or root privilege. Once escalation o£ privilege is complete the attacker will work on ways to maintain access to the systems he or she has attacked and compromised. Hackers are much like other criminals in that they would like to make sure and remove all evidence of their activities, which might include using root kits to cover their tracks. This is the m o m e n t at which most forensic activities begin.

Searching for Evidence You must be knowledgeable of each of the steps of the hacking process and understand the activities and motives of the hacker.You many times will be tasked with using only pieces of" information and playing the role of" a detective in trying to reassemble the pieces of" the puzzle. Information stored within a computer can exist in only one or more predefined areas. Information can be stored as a normal file, deleted file, hidden file, or in the slack or free space. Understanding these areas, how they work, and how they can be manipulated will increase the probability that you will find or discover hidden data. Not all suspects you encounter will be super cyber criminals. Many individuals will not hide files at all; others will attempt simple file hiding techniques.You may discover cases where suspects were overcome with regret, fear, or remorse, and attempted to delete or erase incriminating evidence after the incident. Most average computer users don't understand that to drop an item in the recycle bin doesn't nlean that it is permanently destroyed. One c o m m o n hiding technique is to place the information in an obscure location such as C ' \ w i n n t \ s y s t e m 3 2 \ o s 2 \ d l l . Again, this will usually block the average user from finding the file. The technique is simply that of placing the information in an area of the drive where you would not commonly look. A system search will quickly defeat this filtile attempt at data hiding. Just search for specific types of files such as bmp, tif, doc, and xls. Using the search function built into Windows will help quickly find this type of information. If" you are examining a Linux computer, use the grep command to search the drive. Another technique is using file attributes to hide the files or folders. O n a Macintosh computer, you can hide a file with the ResEdit utility. In the wonderful world of Windows, file attributes can be configured to hide files at the command

www.syngress.com

174

Chapter 6

•

Router Forensics

line with the attrib command. This command is built into the Windows OS. It allows a user to change the properties of a file. Someone could hide a file by issuing attrib +h secret.txt. This command would render the file invisible in the command line environment. This can also be accomplished through the GUI by right-clicking on a file and choosing the hidden type. Would the file then be invisible in the GUI? Well, that depends on the view settings that have been configured. Open a browse window and choose tools/folder options/view/show hidden files; then, make sure Show Hidden Files is selected. This will display all files and folders, even those with the +h attribute set. Another way to get a complete listing of all hidden files is to issue the command attrib/s > attributes.txt from the root directory. The attrib command lists file attributes, t h e / s function list all files in all the subdirectories, and > redirects the output to a text file. This text file can then be parsed and placed in a spreadsheet for further analysis. Crude attempts such as these can be quickly surmounted.

An O v e r v i e w of Routers Routers are a key piece of networking gear. Let's know the role and function of a router.

What Is a Router? Routers can be hardware or software devices that route data from a local area network to a different network. Routers are responsible for making decisions about which of several paths network (or Internet) traffic will follow. If more than one path is available to transmit data, the router is responsible for determining which path is the best path to route the information.

The Function of a Router Routers also act as protocol translators and bind dissimilar networks. Routers limit physical broadcast traffic as they operate at layer 3 of the OSI model. Routers typically use either link state or hop count based routing protocols to determine the best path.

The Role of a Router Routers are found at layer three of the OSI model. This is known as the networking layer. The network layer provides routing between networks and defines logical


175

addressing, error handling, congestion control, and packet sequencing. This layer is concerned primarily with how to get packets from network A to network B. This is where IP addresses are defined. These addresses give each device on the network a unique (logical) address. P, outers organize these addresses into classes, which are used to determine how to move packets f'rom one network to another. All types of protocols rely on routing to move int-ormation from one point to another.This includes IP, Noven's IPX, and Apple's I)l)P. R o u t i n g on the Internet typically is performed dynamically; however, setting up static routes is a form of basic routing. Dynamic routing protocols constantly look t-or the best route to move information from the source to target network.

Routing Tables Routers are one of" the basic building blocks of networks, as they connect networks together. Routers reside at layer 3 of" the OSI model. Each router has two or more interfaces. These interfaces join separate networks together. W h e n a router receives a packet, it examines the IP address and determines to which interface the packet should be forwarded. O n a small or uncomplicated network, an administrator may have defined a fixed route that all traffic will follow. More complicated networks typically route packets by observing some Corm of metric. R o u t i n g tables include the following type of information: •

B a n d w i d t h This is a c o m m o n metric based on the capacity of a link. If all other metrics were equal, the router would choose the path with the highest bandwidth.

•

C o s t The organization may have a dedicated T1 and an I S D N line. If the ISDN line has a higher cost, traffic will be routed through the T1.

•

D e l a y This is another c o m m o n metric, as it can build on many factors including router queues, bandwidth, and congestion.

•

D i s t a n c e This metric is calculated in hops; that is, how many routers away is the destination.

•

L o a d This metric is a measurement of the load that is being placed on a particular router. It can be calculated by examining the processing time or C P U utilization.

•

R e l i a b i l i t y This metric examines arbitrary reliability ratings. N e t w o r k administrators can assign these numeric values to various links. www.syngress.com

176


By applying this metric and consulting the routing table, the routing protocol can make a best path determination. At this point, the packet is forwarded to the next hop as it continues its journey toward the destination.

Router Architecture Router architecture is designed so that routers are equipped to perform two main functions: process routable protocols and use routing protocols to determine best path. Let's start by reviewing routable protocols. The best example of a routed protocol is IRA very basic definition of IP is that it acts as the postman of the Internet~its job is to organize data into a packet, which is then addressed for delivery. IP must place a target and source address on the packet. This is similar to addressing a package before delivering it to the post office. In the world of IR the postage is a TTL (Time-to-Live), which keeps packets from traversing the network forever. If the recipient cannot be found, the packet can eventually be discarded. All the computers on the Internet have an IP address. If we revert to our analogy of the postal system, an IP address can be thought of as the combination of a zip code and street address. The first half of the IP address is used to identify the proper network; the second portion of the IP address identifies the host. Combined, this allows us to communicate with any network and any host in the world that is connected to the Internet. Now let us turn our attention to routing protocols.

Routing Protocols Routing protocols fall into two basic categories, static and dynamic. Static, or fixed, routing is simply a table that has been developed by a network administrator mapping one network to another. Static routing works best when a network is small and the traffic is predictable. The big problem with static routing is that it cannot react to network changes.As the network grows, management of these tables can become difficult. Although this makes static routing unsuitable for use on the Internet or large networks, it can be used in special circumstances where normal routing protocols do not function well. Dynamic routing uses metrics to determine what path a router should use to send a packet toward its destination. Dynamic routing protocols include Routing Information Protocol (RIP), Border Gateway Protocol (BGP), Interior Gateway Routing Protocol (IGRP), and Open Shortest Path First (OSPF). Dynamic routing can be divided into two broad categories: link-state or distance vector dynamic routing protocols, which are discussed in greater detail later in the chapter.


RIP R I P is the most c o m m o n routing protocol that uses a hop count as its primary routing metric. R I P is considered a distance vector protocol.The basic methodology of a distance vector protocol is to ~]~ake a decision on what is the best route by determining the shortest path. The shortest path is c o m m o n l y calculated by hops. Distance vector routing is also called routing by rumor.

OSPF OSPF is the most c o m m o n link state routing protocol and many times, it is used as a replacement to R I E Link state protocols arc properly called Dijkstra algorithms, as this is the computational basis of their design. Link state protocols use the Dijkstra algorithm to calculate the best path to a target n e t w o r k . T h e best path can be determined by one or more metrics such as hops, delay, or bandwidth. Once this path has been determined, the router will inform other routers as to its findings. This is how reliable routing tables are developed and routing tables reach convergence. Link state routing is considered more robust than distance vector routing protocols. One reason is because link state protocols have the ability to perform faster routing table updates.

www.syngress.com

177

178

Chapter 6 ° Router Forensics

Hacking Routers Full control of a router can often lead to full control of the network. This is why many attackers will target touters and launch attacks against them. These attacks may focus on configuration errors, known vulnerabilities, or even weak passwords.

Router Attacks Routers can be attacked by either gaining access to the router and changing the configuration file, launching DoS attacks, flooding the bandwidth, or routing table poisoning. These attacks can be either hit-and-run or persistent. Denial of Service attacks are targeted at routers. If an attacker can force a router to stop forwarding packets, then all hosts behind the router are effectively disabled.

Router Attack Topology The router attack topology is the same as all attack topologies. The steps include" 1. Reconnaissance 2. Scanning and enumeration 3. Gaining access 4. Escalation of privilege 5. Maintaining access 6. Covering tracks and placing backdoors


179

Den ia I-of-Service Attacks Denial-of-service (DOS) attacks Fall into three categories: []

D e s t r u c t i o n . Attacks that destroy the ability of the router to function.

w Resource consumption. tions simultaneously. •

Flooding the router with many open connec-

B a n d w i d t h c o n s u m p t i o n . Attacks that attempt to consume the bandwidth capacity of the router's network.

DoS attacks may target a user or an entire organization and can affect the availability of target systems or the el~tire network. The impact of DoS is the disruption of normal operations and the disruption of normal communications, it's much easier for an attacker to accomplish this than it is to gain access to the network in most instances. Smur£ is an example of a c o m m o n DoS attack. Smurf exploits the Internet Control Message Protocol (ICMP) protocol by sending a spoofed ping packet addressed to the broadcast address and has the source address listed as the victim. O n a multiaccess network, many systems may possibly reply. The attack results in the victim being flooded in ping responses. Another example of a DoS attack is a SYN flood. A SYN flood disrupts Transmission Control Protocol (TCP) by sending a large number of fake packets with the SYN flag set. This large number of half-open T C P connections fills the buffer on victim's system and prevents it f?om accepting legitimate connections. Systems connected to the Internet that provide services such as H T T P or S M T P are particular vulnerable.

www.syngress.com

180

Chapter 6

•

Router Forensics

DDoS attacks are the second type of DoS attack and are considered multiprotocol attacks. DDoS attacks use ICMP, UDP, and T C P packets. One of the distinct differences between DoS and DDoS is that a DDoS attack consists of two distinct phases. First, during the preattack, the hacker must compromise computers scattered across the Internet and load software on these clients to aid in the attack. Targets for such an attack include broadband users, home users, poorly configured networks, colleges and universities. Script kiddies from around the world can spend countless hours scanning for the poorly protected systems. Once this step is completed the second step can commence. The second step is the actual attack. At this point the attacker instructs the masters to communicate to the zombies to launch the attack. I C M P and U D P packets can easily be blocked at the router, but T C P packets are difficult to mitigate. TCP-based DoS attacks comes in two forms: •

These attacks complete the 3-way handshake to establish a connection. Source IP address can be determined here.

•

C o n n e c t i o n l e s s . These packets SYN are difficult t trace because source

Connection-oriented.

An example of a D D O S tool is Tribal Flood Network (TFN). T F N was the first publicly available UNIX-based DDoS tool. T F N can launch ICME Smurf, UDP, and SYN flood attacks.The master uses U D P port 31335 and T C P port 27665.TFN was followed by more advanced DDoS attacks such as Trinoo. Closely related to TFN, this DDoS allows a user to launch a coordinated U D P flood to the victim's computer, which gets overloaded with traffic. A typical Trinoo attack team includes just a few servers and a large number of client computers on which the Trinoo daemon is running. Trinoo is easy for an attacker to use and is very powerful in that one computer is instructing many Trinoo servers to launch a DoS attack against a particular computer.

Routing Table Poisoning 1Kouters running 1KIPvl are particularly vulnerable to routing table poisoning attacks. This type of attack sends fake routing updates or modifies genuine route update packets to other nodes with which the attacker attempts to cause a denial of service. Routing table poisoning may cause a complete denial of service or result in suboptimal routing, or congestion in portions of the network.

r

www.syngress.com

Router Forensics

•

Chapter 6

181

Hit-and-Run Attacks and Persistent Attacks Attackers can launch one o£ two types of attacks, either-hit a n d - r u n or persistent. A hit-and-run attack is hard to detect and isolate as the attacker injects only one or a few malformed packets. With this approach, the attacker must craft the attacks so that the results have sonde lasting damaging effect. A persistent attack increases the possibility for identification of the attacker as there is an ongoing stream of packets to analyze. However this attack lowers the level of complexity needed by the attacker as they can use much less sophisticated attacks. Link state routing protocols such as O S P F are more resilient to routing attacks than R I R

Investigating Routers W h e n investigating routers there are a series of built-in commands that can be used for analysis. It is unadvisable to reset the router as this may destroy evidence that was created by the attacker. The following show commands can be used to gather basic information and record hacker activity m

Show access list

m

Show clock

u

Show ip route

m

Show startup conf]gurati()n

www.syngress.com

182


•

Show users

•

Show version

Chain of Custody The chain of custody is used to prove the integrity of evidence. The chain of custody should be able to answer the following questions" •

W h o collected the evidence?

•

H o w and where is the evidence stored?

•

W h o took possession of the evidence?

•

H o w was the evidence stored and how was it protected during storage?

•

W h o took the evidence out of storage and why?

There is no such thing as too much documentation. One good approach is to have two people work on a case. While one person performs the computer analysis, the other documents these actions. At the beginning of an investigation, a forensic analyst should prepare a log to document the systematic process of the investigation. This is required to establish the chain of custody. This chain of custody will document how the evidence is handled, how it is protected, what process is used to verify it remains unchanged, and how it is duplicated. Next, the log must address how the media is examined, what actions are taken, and what tools are used.Automated tools such as EnCase and The Forensic Toolkit compile much of this information for the investigator.

Volatility of Evidence W h e n responding to a network attack, obtaining volatile data should be collected as soon as possible. Although all routers are different, you will most likely be working with Cisco products as Cisco has the majority of the market share. Cisco routers store the current configuration in nonvolatile ram (NVRAM). The current configuration is considered volatile data and the data is kept in R a n d o m Access Memory (RAM). If the configuration is erased or the router powered down all information is lost. R.outers typically are used as a beachhead for an attack. This means the router may play an active part in the intrusion. The attacker uses the router as a jumping off point to other network equipment.

www.syngress.com


183

W h e n starting an investigation you should always move from most volatile to least volatile. The first step is to retrieve R A M and N V l k A M . T o accomplish this you may use a direct connectiol~ to the console port using R j - 4 5 - R j - 4 5 rolled cable and an R,J-45-to-DB-9 female 1)TE adapter. In instances when a direct connection is not available a remoter session is the ~ext preferred method. Insecure protocols such as FTP should not be used; an encrypted protocol Secure Shell (SSH) is preferred.You should make sure to capture both volatile and nonvolatile configuration for comparison changes and documentation purposes. Cisco touters have multiple modes, so to gain privilege mode the password must be known by the analyst.

Case Reports Case reporting is one of" the most important aspects of computer forensics. Just as with traditional forensics everything should be documented. Reporting should begin the minute you are assigned to a case. Although it may sometimes seem easier to blindly push forward, the Failure to document can result in poorly written reports that will not withstand legal scrutiny. Let's face it, not all aspects of computer forensics are exciting and fun. Most of us view paperwork as drudgery. It is a somewhat tedious process that requires an eye for detail. Don't allow yourself this Fallacy. In the end, the documentation you keep and the process you follow will either validate or negate the evidence. The report is key in bringing together the three primary pieces of forensics: acquisition, authentication, and analysis. The case report will be the key to determining one of the following actions: •

Employee remediation

•

Employee termination

•

Civil proceedings

•

Criminal prosecution

W h e n the investigation is co~nplete a final written report is prepared. Some of the items found in this report will include: •

Case Sunnnary

•

Case Audit Files

•

Bookmarks

www.syngress.com

184

Chapter 6

•

Router Forensics

•

Selected Graphics

•

File Location Path

•

File Location Properties

Although this is not an all-inclusive list it should give you some indication of what should be included. Depending on the agency or corporation, the contents of the report will vary. What is consistent is that anyone should be able to use the logs and the report to recreate the steps performed throughout the investigation. This process of duplication should lead to identical results.

Incident Response Incident response is the effort of an organization to define and document the nature and scope of a computer security incident. Incident response can be broken into three broad categories that include: •

Triage. Notification and identification

•

A c t i o n / R e a c t i o n . Containment, analysis, tracking

•

Follow up. Repair and recovery, prevention

Compromises Before a compromise can be determined, investigators must be alerted that something has happened. It is best if the alert function is automated as much as possible. Otherwise, the sheer volume of log information would be overwhelming for an employee. Even with a high level of automation someone must still make a judgment regarding the validity of the alert. Once an attack has been validated it is important to reduce the damage of the attack as quickly as possible and work to restore normal business functions.


185

Summary In this chapter, we reviewed how touters can play an important part in forensics. Readers were introduced to routed protocols such as IP and we discussed how routed protocols work. In many ways, IP acts as a "postman" since its job is to make the best effort at delivery. In a small network or those that seldom change, the route that the IP datagrams take through the network may remain static or unchanged. Larger networks use dynamic routing. Administrators use routing protocols such as R i P for dynamic routing. We also looked at how attackers attack routers and how incident response relates to routers and router compromises.

Solutions Fast Track Network Forensics gl N e t w o r k forensics is the process of examining network traffic for the purpose of discovering attacks and malicious events. N e t w o r k forensics is commonly performed with a sniffer or packet capture tool.

Overview of" Routers [-¢I Routers are designed to connect dissimilar protocols. gl Routers deal with routing protocols. [---¢I C o m m o n routing protocols include R I P and OSPE

Hacking Routers gl Routers can be attacked by exploiting misconfigurations or vulnerabilities. [-----d Routers need to have logging enabled so sufficient traffic is captured to aid in forensic investigations.

www.syngress.com

186


Incident Response Monitoring for incidents requires both passive and active tasks. Incident response requires development of a policy to determine the proper response.

Frequently Asked Questions The following Frequently Asked Questions, answered by the authors of this book, are designed to both measure your understanding of the concepts presented in this chapter and to assist you with real-life implementation of these concepts. To have your questions about this chapter answered by the author, browse to www. syngress.com/solutions and click on the "Ask t h e A u t h o r " form.


187

Q:Where do touters reside in relationship to the OSI model? A: Routers are a layer 3 device. Q:Do routers pass physical addresses? A: No, not by default since routers are layer 3 devices and physical addresses are found at layer 2. Q:What do routers do with broadcast traffic? A: Routers block physical broadcast traffic. Q:Why target routers?

A" Routers can sometimes be overlooked by security professionals since so much time is placed on securing workstations and servers. Q:What is the first thing an attacker does when targeting a router? A" An attacker must first identi~} the device and be able to verify it is a router. With this done the attacker must next determine the version and model of the router. Q:What is the most important preplanning aspect of router forensics? A: You must make sure good policies and procedures are in place that specify adequate logging is taking place. Q:What type of skills are required for incident response? A" Incident response requires technical skills, investigative skills, and leadership skills. Q ' H o w would you best define the incident response process? A" Incident response is the process o£ detecting a problem, determining its cause, minimizing the damage.

www.syngress.com


Chapter 7

189

190

Chapter 7

•

Legal issues of Intercepting WiFi Transmissions

Introduction W i F i ~ a n acronym for wireless fidelity (wireless)~encompasses a number of standards that enable computers and other devices to connect wirelessly to local area networks. The proliferation of WiFi devices is a success story in standards development and represents a market that generates over $750 million per quarter in sales worldwide (Infonetics Research). Most computer systems, particularly laptops, are shipped with WiFi-compliant hardware and software as a standard feature. For example, even the least expensive laptop available at Wal-Mart is WiFi equipped. Further, the equipment necessary to set up your own W A N ~ w i t h existing computers and existing Internet service~can be obtained for less than $100. A number of organizations have chosen to make WiFi access freely available to any who would wish to connect. Dartmouth College offers free WiFi over its entire campus; Panera Bread and many Comp USA stores throughout the nation offer free WiFi access; Bradley International Airport in Connecticut and Ft. Lauderdale Airport in Florida provides free WiFi access. WiFi is a technology that is far from being in use only by the technologically advanced early adopters, and is now clearly mainstream in its adoption and use.

In this chapter, we will attempt to highlight the technology behind the WiFi explosion and how various federal laws may or may not apply to eavesdropping on WiFi communications.

WiFi Technology WiFi fits in a family of standards developed under the IEEE (I-triple-E) or The Institute of Electrical and Electronics Engineers. The IEEE is a standards body that developed the 802 family of standards. These standards describe a framework~physical media and the working characteristics~that would enable two or more devices to communicate within a network. Most notable of" these standards is the 802.3 standard, the specification for Ethernet. The Ethernet standard describes a method of www.syngress.com

Legal Issues of Intercepting WiFi Transmissions

•

Chapter 7

191

physical comnmnication in a local area network (LAN).A wide majority of computer networks now employ Ethernet as their communication standard; ahnost every computer sold includes an Ethernet jack for connecting to an Ethernet network. The success of the 8{t2.3 standard is quite likely responsible for the massive proliferation of computing networks in businesses, schools, and government Eacilities. A similar explosion in growth and success is occurring with the 802.11 standard Erom IEEE. The 8112.11 standard is a family of specifications for wireless local area networks (WLANs). Similar to the 8(t2.3 standard, it specifies the m e t h o d ofphysical communication between devices on the n e t w o r k i b u t where the 802.3 standard addresses communication over a physical link through cabling, the 802.11 standard addresses communication between devices over infrared and radio frequency (RF) transmissions. Although the use of infrared has been beneficial in some instances I short range wireless printing f'or exanlple--its use has been dwarfed by the use of radio frequency transmissions. In order to connect to a WLAN, each device on a WiFi network must possess a wireless card, or an 8()2.11 complaint radio transceiver. Some computers may have a built-in wireless card, whereas others may need to attach one through a P C M C I A or a USB interface. Within this wireless card is a transceiver tuned to a particular frequency, a frequency dictated by the 802.11 standard. Another device called an access point serves as the bridge between the devices on the wireless network and the wired local area n e t w o r k . T h e network owner configures the access point, and options for authentication and security are a v a i l a b l e i m o s t security features are disabled by default. The access point and the wireless card in a computer (or other device) communicate with one another to transfer both data and network management information over the chosen radio frequency.

www.syngress.com . . . .

192

Chapter

7 •


Authentication and Privacy in the 802.11 Standard It is important to note that within the 802.11 standard, both authentication (who is allowed to connect to the network) and privacy (who is allowed to view information off the network) are both addressed. However, users of WiFi devices rarely take the necessary steps to properly configure their WiFi network. Wireless networks are different than a physical-wired network. To join a physical network, one must have physical access to the network in order to connect to it. Therefore, physical security plays a significant role in authenticating users in physical network. Wireless networks, on the other hand, do not stay neatly contained within the walls of a b u i l d i n g ~ who's allowed on a W L A N is handled through authentication. Authentication is defined in the 802 standard as " T h e service used to establish the identity of one station as a m e m b e r of the set of stations authorized to associate with another station." (ANSI/IEEE Std 802.11, 1999 Edition (R2003)) Therefore, there must be a way to limit access to any particular W L A N ~ a n d indeed there is. O n e manner is to limit access through MAC address authentication. In this process, the access point holds a list of authorized MAC addresses. N e t w o r k interface cards with M A C addresses on the authorized list will be allowed to connect to the W L A N . If you're not on the list, the access point won't let you in. ......~:iiiiliiiii~i!i

.........................

iiiiii i

!i~.i[.!............M .. e d i a access control (MAC) addresses are unique numbers associated with n e t w o r k interface card, including wireless n e t w o r k interface c a r d s ~ .....~:, .!~i .i'~.i.i.ii.i.i.ii.!.i.ii.i.i.ieach .i!.Sii ..~..".~~'"~~'~i~'~i~iunique ~i~' is a relative term here as a n u m b e r of software utilities exist to change the M A C address of a n e t w o r k interface card.

Encryption is another m e t h o d used to control authentication. W L A N s can be set up to use a number of encryption schemes, W E P and W P A being the two most c o m m o n . Encryption controls authentication by limiting the decryption of W L A N signals. Authorized users must possess the appropriate secret key to decrypt the s i g n a l ~ a n d in fact must have the proper credentials even to connect to the access point at all. O n e would assume that equipment by default would enable either M A C access control or one of the encryption schemes to help the user manage authentication. However, this is not the case. Most access points' default configuration falls under

Legal Issues of Intercepting WiFi Transmissions • Chapter 7

193

what the 802.11 standard calls Open System Authentication. In this scheme any device that requests authentication can receive authentication and be added to the WLAN. Even though more secure manners exist for a u t h e n t i c a t i o n - - M A C filtering and e n c r y p t i o n ~ o p e n system authentication is described as default setting for 802.11 devices in the 8()2.11 standard.

Privacy In a wired LAN, privacy is controlled by the routing of information. Routers and switches on a LAN control the flow of information so that devices on a LAN get only data sent through their cable that is specifically addressed to them or is broadcast data addressed to all devices. Therefore eavesdropping on a wired network can be very difficult, usually requiring some level of physical access to the network a n d / o r direct access to the device of interest. For example, if someone were to listen to data traffic on the cable anywhere between computer X and the network switch, the eavesdropper would be able to view only traffic specifically sent to computer X. Within a W L A N , data is sent to all devices attached to the W L A N over R.F transmissions--data is not limited to traveling in specific cables to a particular computer. Since the P,.F can't be contained, a much higher level of access to data intended for any of the machines in a W L A N can be achieved without physical access to the network. Additionally, the radio waves from the access points will often exceed the limits of" the room or building where they are installed and intended for use. The 802.11 standard directly addresses this issue with rather strong language for a technology standard"

Any IEEE 802.11-compliant [station] may hear all like-[physical] IEEE 802.11 traffic that is within range. Thus the connection of a single wireless link (without privacy) to an existing wired LAN may seriously degrade the security level of the wired LAN .... To bring the functionality of the wireless LAN up to the level implicit in wired LAN design, IEEE 802.11 provides the ability to encrypt the contents of messages. This functionality is provided by the privacy service .... IEEE 802.11 specifies an optional privacy algorithm, WEP that is designed to satisfy the goal of wired LAN "equivalent" privacy. The algorithm is not designed for ultimate security but rather to be " a t least as secure as a wire .... " If the privacy service is not invoked, all messages shall be sent unencrypted.

www.syngress.com

194

Chapter 7 • Legal Issues of Intercepting WiFi Transmissions

As noted earlier in the authentication discussion, a method to keep all information private is built into the standard. Most access points are equipped with a number of encryption schemes that would allow the user to encrypt the data between the access point and the wireless card in their computer.The most c o m m o n encryption schemes are W E P and WPA. However, as is the case with the open system authentication, the default privacy setting is open with all information being sent in clear text. Important to note is that the standard states that any 802.11 compliant station/device may hear all 802.11 traffic within range.


•

Chapter 7

195

Understanding WiFi RF The F C C regulates the ownership o r t h e P,F spectrum. If-the F C C issues a license to a particular person or organizatio~, the F(;( ~ nmst closely regulate the output wattage of" the licensee and the licensee's neighbors to ensure that there is no interf)rence on either licensee's area olcoverage. To illustrate this point, we can examine the celltdar industry.: Each cellular carrier obtained the rights to particular fiequencies ill particular >,,eographic areas allocated tor use by. cell phone communications. N o other carrier can use a licensed trcquencv~ within the .,.~,eographic area of the licenseeiparticularly i f t h e lice~lsee's transmissions are interfered with.

What makes the 8(.)2.11 so available and so ubiquitous is its use of" an unlicensed portion of the radio frequency spectrum set aside for industrial, scientific, and medical (ISM) use. Users of the unlicensed ISM band do not need to purchase rights or ownership of a particular frequel~CV-"l~ersons operating ISM equipment shall not be deemed to have any vested or recognizable right to the continued use of any given frequency, by virtue ofairy prior equipment authorization a n d / o r COlnpliancc with the applicable rules." ( 4 7 C F R 18.11 l(a)) Instead, the unlicensed bands are open to all as long as certain conditions are 1net. These conditions include limiting the output watta,,e > , and all devices usin>~, this band must not cause interference with other devices on the band. It is crucial to note that WiFi devices are not the only devices using the ISM band. Cordless phones, renlote car starters, baby monitors all use this small section of unlicensed spectrunl. Most importantly, there is no license holder that can prohibit others fion~ trespassing on their spectrum holdings. In summary, it is generally accepted that the ISM bands are open to the general public.

www.syngress.com

196

Chapter 7

•


Scanning RF The airwaves are full of signals in a variety of frequencies; television broadcasts, emergency services radio dispatches, FM radios, pagers, and cellular telephones are just a few of these signals. We are all technically always receiving these signals whenever the energy hits our bodies, but in order to make sense of the signals, we need special equipment to decode or interpret the signal. To make sense of a broadcast television signal, for example, we need a television. Generally speaking, a device designed to be tunable to a wide variety of frequencies for the intent of listening in on any communications is called a scanner. There are scanners that focus on voice communicat i o n s ~ a fire/police scanner for example would enable someone to listen in on the communications of their local emergency services. There are scanners that focus on video feeds~for example there is a specialized scanner that attempts to listen in on security cameras that send their images to the main security panel via a radio link. Some of these types of communication use more complicated protocols, or specific codified languages, that enable two or more electronic devices to communicate with one another. Digital protocols are demonstrative of this in that the analog signal (a sine wave) is modulated to form approximately-square peaks and valleys that represent l's and O's of a digital message. One who eavesdrops on a digital message may be able to pick up sounds on the given frequency, but the human ear would not be able to make sense of the garbled series of tones. Many police transmissions are now digitally encoded, and often encrypted, as a mitigating measure against scanning and eavesdropping. Prior to 1992, it was legal to purchase scanning equipment capable of listening in on cellular phone conversations. In 1992, Public Law 102-556, the Telephone Disclosure and Dispute Resolution Act, was passed, amending the Communications Act of 1934. The act, which is codified at 47 U.S.C. ~ 302a(d), prohibits the authorization, manufacture, and import of scanning equipment capable of." (A) Receiving transmissions in the frequencies allocated to the domestic cellular radio telecommunications service, (B) Readily being altered by the user to receive transmissions in such frequencies, or (C) Being equipped with decoders that convert digital cellular transmissions to analog voice audio. Given that Congress chose to regulate cellular monitoring equipment there now appears to be a reasonable expectation of privacy by users of cellular phones that


*

Chapter 7

197

their conversations will not be readily susceptible to monitoring by the general public. Further, the cellular carriers themselves enhanced cell phone users' expectation of'privacy by phasing-in protocols that cause cellular phones to hop around, a group of" frequencies, thus making scanning of any one particular cellular phone or phone call very difficult. Therefbre, any electronic monitoring o£ cellular telephone conversations without appropriate legal authorization would constitute an unconstitutional search in violation of the Fourth amendn~ent (see Fourth amendment discussion later).

However, as was discussed in the Authentication and Privacy sections of this document, 802. l lx does not b), default employ any specific protocols designed to secure communications between parties. Where the Telephone Disclosure and Dispute Resolution Act restricted the scanning of cellular communications through criminalizing the sale or pu.rchase of-equipment that could intercept cellular communications, the equipment needed to scan or eavesdrop on WiFi transmission is not illegal to o w n ~ i n fact it is the same equipnmnt needed to connect to any wireless network, which is clearly not illegal to own. Further, the ISM band on which 802.1 lx com.municates is not protected b x.., a specific law highlighting its frequency; but there is a case to be lnade that some existing laws do provide eavesdropping prohibitions.

Eavesdropping on WiFi The knowledge a.nd skill required to eavesdrop on WiFi transmissions is not prohibitive, and the technology, both hardware and software, is readily available. A nuinber of software products are available that both find and listen in on WiFi transmissions. For the most part, these software packages are completely legitimate network analyzers used by network administrators to debug networks and to find access points that have been installed illegitimately on the network. www.syngress.com

198


Every communication over the W A N that is not encrypted can be grabbed from the airwaves and viewed. MAC authentication applies only to devices that wish to connect to the network~limiting who connects to a network does keep the overall network safer, particularly the information on other devices on the network, but does nothing to prevent people from intercepting unencrypted transmissions. Transmissions must have some level of encryption as a guard against any 802.11equipped device from viewing the contents of the transmission.

Legal Framework To best understand the legality of WiFi eavesdropping, we must look at how existing laws relate to WiFi technology. As we shall see, federal statutes relating to the interception of various types of electronic communications do not appear to govern the interception of WiFi transmissions.

The Electronic Communications Privacy Act (ECPA) Although WiFi transmissions fall within the meaning of electronic communications as defined in ECPA, unless the signals transmitted by WiFi devices are encrypted, they are accessible to the general public. Therefore, ECPA does not govern the interception of nonencrypted WiFi signals that are not sent by a common carrier. WiFi transmissions would fall within the meaning of " electronic communications" under ECPA. ECPA prohibits the interception of any electronic communications, regardless of the physical media of transport (U.S.C. 18 ~ 2510). ECPA defines electronic communication as "...any transfer of signs, signals, writing, images, sounds, data, or intelligence of any nature transmitted in whole or in part by a wire, radio, electromagnetic, photoelectronic or photooptical system that affects interstate or foreign commerce..." Courts have historically adopted a broad definition of what constitutes interstate commerce. Therefore the use of WLANs to transmit data, particularly if connected to the Internet, would be considered "electronic communications" within the meaning of ECPA. A computer trespasser is defined as a person who accesses a protected computer without authorization and thus, has no reasonable expectation of privacy in any communication transmitted to, through, or from the protected computer (U.S.C. 18 2510). It is interesting to note, as with the CFAA, that this definition makes no provisions for wireless eavesdroppers where no access is required. Anyone who "Intentionally intercepts, endeavors to intercept, or procures any other person to


•

Chapter 7

199

intercept or endeavor to intercept, any wire, oral, or electronic communication;" is in violation o f E C P A (U.S.C. 18 .~ 2511 (l)(a)). Although WiFi transmissions (all within ECPA's definition of electronic c o m m u nications, ECPA excludes electronic communications that are readily accessible to the general public from the ambit o ( t h e statute. Many of the attributes of typical WiFi transmissions make them readily accessible to the general public.Therefore, ECPA does not appear to govern most WiFi transmissions. First, WiFi transmissions are not scrambled or encrypted. The default setting for 802.11 standard is open system authentication with no encryption.Therefore, in a default setting with no encryption enabled, 802.11 WiFi networks do not meet these criteria. Next, WiFi transmissions are not transmitted using modulation techniques whose essential parameters have been withheld from the public with the intention of preserving the privacy of such communication. The 802.11 standard is a public standard. Further, the hardware and software required are neither controlled nor restricted items and the hardware in fact often is included as a standard feature of many computers. In fact, the only applicability of ECPA to WiFi transmissions is to those transmissions that are transmitted over a communication system provided by a c o m m o n carrier. A c o m m o n carrier is a con~pany that provides communication service for hire to the public. Some c o m m o n carriers operate WiFi networks and would be protected under ECPA. However, when the WiFi network in question is operated by a private citizen or other entity not involved in providing communication service, ECPA does not apply. See Andersen Consultitty, LLP v. l.;OP, 991 E Supp. 1()41 (N.D. Ill. 1998) (defendant did not provide electronic communication service to the public and therefore could not be sued under ECPA).

Telecommunications Act The Telecommunications Act also does not appear to govern WiFi interceptions because WiFi communications can be available to the general public. The Telecommunications Act states: " N o person not being authorized by the sender shall intercept any radio communication and divulge or publish the existence, contents, substance, purport, effect, or meaning o£ such intercepted communication to any person . . . . This section shall trot apply to the receit,ino~, di~,ulo~ino~,publishing, or utiliziny, the contents otcart), radio communicatiotl ldtich is transmitted by any station &r the tt.;c o[ the o~eneral public..." 47 U.S.C..~ 61)5 (emphasis added).

www.syngress.com

200


Computer Fraud and Abuse Act The C o m p u t e r Fraud and Abuse Act (CFAA) does not appear to apply to the intercept of WiFi signals as the Act is focused primarily on accessing (Kern, 2004) computer systems. Although there does not appear to be any case law directly on point, passively monitoring a WiFi communication would not seem to involve accessing the person's computer as the term is generally understood. The first six major statutory violations are centered on unauthorized access to a computer system, and the seventh concerns making threats of damage against a protected system (the following items are paraphrased for brevity): 1. Intentional access to a computer with sensitive government information. 2. Intentional access to a computer, without authorization or exceeds authorized access and obtains financial information from a financial institution or card issuer, any U.S. government files, or information from protected computer related to interstate or foreign commerce. 3. Intentionally, without authorization, accesses any nonpublic computer of a department or agency of the United States. 4. Knowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access, in order to commit or further a fraud 5. Accesses to a protected computer and knowingly disseminates malicious code or causes damage, reckless or otherwise, or attempted access that would have caused loss of $5000 or more, physical harm, modification of medical treatment, a threat to public safety, or damage to a government system. 6. Knowingly, and with intent to defraud, traffics in any password or similar information through which a computer may be accessed without authorization, if (A) Such trafficking affects interstate or foreign commerce; or (B) Such computer is used by or for the Government of the United States. °

With intent to extort any money or other thing of value, any person who transmits any communication containing any threat to cause damage to a protected computer.


•

Chapter 7

201

Eavesdropping on WiFi ca.l~ be done in a passive manner with no outgoing data emitting from the eavesdropping computer. No connection to an access point is required to capture data carried on the radio frequency transmissions. Therefore each section of the CFAA that mentions access (items 1-6) would specifically exclude WiFi eavesdropping.

Fourth Amendment Expectation of Privacy in WLANs Although Congress has chosen not to prohibit the interception of WiFi traffic via statute, cyber cringe investigators, as law enforcement officers, still are prohibited by the Fourth A m e n d m e n t fron~ e~gaging in unreasonable searches.The constitutional protection against unreasonable searches cxtends only to those areas in which the subject of the search has exhibited an actual (subjective) expectation of privacy and that expectation is one that society i.s prepared to recognize as "reasonable" (Kat2p. United States, 389 U.S. 347, 361 (1967)). Although an individual has a constitutionally,protected expectation oF privacy in his home,"[w]hat a person knowingly exposes to the public, even i~ his own home or oCfice, is not a subject of Fourth Amendment protection" (Kat.-, 389 U.S. at 351). " T h e Fourth A m e n d m e n t protection of the hon~e has never been extended to require law enforcement officers to shield their eyes when passing by a home on public thoroughfares" (Cal!fiornia v. Ciraolo, 476 U.S. 2(117, 213 (1986)). " N o r does the mere fact that an individual has taken measures to restrict s o ~ e views of-his activities preclude an officer's observa-

www.syngress.com

202


tions from a public vantage point where he has a right to be and which renders the activities clearly visible" Id. (citing United States v. Knotts, 460 U.S. 276, 282 (1983)). The question becomes, then, whether an expectation of privacy in electronic communications transmitted via WiFi would be reasonable, in a Fourth Amendment sense. Although this issue has not been decided yet, the better view appears to be that such an expectation of privacy would not be reasonable in a Fourth Amendment sense. It is a basic function of WiFi transmissions that, at the option of the WiFi user, they may be encrypted and therefore effectively shielded from public view. Therefore, if a user chose not to shield his WiFi transmissions from public view through the built-in encryption~specifically specified in the WiFi standard--courts would likely conclude that the WiFi user had foregone any reasonable expectation of privacy (see United States v. Granderson, 182 F. Supp. 2d 315,321-22 (2001) defendant had no reasonable expectation of privacy when conducting drug activities behind a boarded-up window that had a slot between the boards since the defendant easily could have shielded his activities from public view by taking simple and obvious steps).


Summary WiFi, as defined by the 802.11 standard, is clearly a technology that is empowering millions to break free from the bounds of a wired inErastructure. The convenience and personal freedom aEforded by a wireless connection has fueled the enthusiasm for home networking and has cut the cost of employing networks in underfunded organizations like churches and schools. However, there is a cost in the loss of privacy of data transmitted across the wireless network if users do not take steps to encrypt the transmissions. The 802.11 standard clearly articulates that additional privacy measures, primarily authentication measures such as MAC filtering and encryption, are needed to prohibit any other 8()2.11 equipped device from connecting to the wireless access point. The 802.11 standard further articulates that encryption such as W E P and WPA must be used to protect the privacy of data on the WLAN; however, the default in the sett i n g ~ a n d the resulting default setting on most wireless devices~has the privacy/encryption feature disabled. Out-of-the-box, the device is vulnerable to eavesdropping and additional actions usually are required of the new owner to enable the security f~eatures. But one would think that eavesdropping on electronic communications would be decidedly illegal. Under the currently-existing federal statutes discussed earlier, this does not appear to be the case. The Electronic Communications Privacy A c t , 18 U.S.C. 2510, does not appear to govern most WiFi communications not owned by a communications carrier, because the communications are "readily accessible to the general public" unless security measures were taken to secure otherwise wide open communication. After reviewing the applicable laws, we see that the WiFi is positioned at a confluence of a number of technical and legal issues that make the situation rather unique. The 8(12.11 communications standard allows for wide-open, unencrypted data communications; over an unlicensed t~requency band; for which the technology to intercept the communications is not only readily available, but often unavoidable; and for which common carrier involvement is rare. It does not appear that WiFi interception are specifically addressed by the laws presented earlier~and even where WiFi interception might technically fall within the ambit of a statute, WiFi transmissions seem to be implicitly excluded elsewhere. For example, 47 U.S.C. 6115 clearly states: " N o person not being authorized by the sender shall intercept any radio communication and divulge or publish the exis-

203

204

Chapter 7

,,


tence, contents, substance, purport, effect, or meaning of such intercepted c o m m u n i cation to any person." But, as discussed earlier, the statute does not apply to c o m m u nications that are transmitted by any station for the use of the general public. Similarly, the C o m p u t e r Fraud and Abuse Act, 18 U.S.C. ~ 1030, is primarily concerned with "accessing" a "system" without proper authorization. However, eavesdropping on WiFi requires no connection or access to a computer system. Since the c o m m o n understanding of the term "access" suggests a two-way communication, a hand-shake, or some level of mutual interaction, then passive monitoring would not be a form of access. Since WiFi communications are available to the general public, most WiFi signals are lawfully open to interception under the applicable federal statutes discussed previously.

www.syngress.com


205

Regardless of the legality of WiFi eavesdropping, the public should be advised that the 802.11 family of standards places network authentication and information privacy in the hands of the network owner. Steps beyond the default install must be taken to ensure the privacy or-your data and the security of your network. It is not clear that WiFi users would have any legal recourse it" somebody eavesdropped on communications that the user had implicitly invited the world to listen to by leaving the door wide open.

Works Cited 47 U.S.C: Communication Act of 1934 47CFP,,18.111 (a); Title 47--Telecommunication Chapter I, Federal Communications Commission, Part 18 Industrial, Scientific, And Medical Equipment, Subpart A General Information, Sec. 18.111 General operating conditions, (a) Kern, Benjamin D. 2(I(i4. Whacking, Joyriding and War-Driving: Roaming Use of Wi-Fi and the Law. Santa Clara Computer and High Technology Law Journal. Infonetics Research's quarterly market share service, available at www.beerfiles.com.au/content/view/1334/0/

Solutions Fast Track WiFi Technology WiFi is a colloquial term referring to a wireless conmmnication technology described in the IEEE's 8(i)2.11 body of standards. V-,,'l WiFi covers both infrared and RE as mediums for communication--but

most WiFi devices operate in the 2.4GHz or 5GHz lq.F bands. gl

WiFi access points use an open system architecture as their default settings~ therefore additional measures such as encryption must be configured to control network access, authentication, and privacy.

www.syngress.com

206


Understanding WiFi RF 802.11 WiFi networks use an unlicensed band of the RF spectrum set aside for industrial, scientific and medical (ISM) use. The ISM band generally is considered open to the general public.

Scanning RF Scanning is a well-documented practice of listening to RF transmissions. EI A specific piece of legislation made the manufacture and sale of equipment to monitor cellular communications illegal. There is no legislation that criminalizes the manufacture, sale, or possession of equipment to monitor or intercept W i F i ~ i n fact the same equipment used to connect to a WiFi network is used to monitor traffic on a WiFi network.

Eavesdropping on WiFi A legal framework exists around the legality of both wiretaps and unlawfully accessing computer systems~including the Telecommunications Act, The Computer Fraud and Abuse Act, and the Electronic Communications Privacy Act. Applicable federal statutes do not appear to govern eavesdropping on private WiFi communications.

Fourth Amendment Expectation of Privacy in WLANs Although Congress has chosen not to prohibit the interception of WiFi traffic via statute, cyber crime investigators, as law enforcement officers, are still prohibited by the Fourth Amendment from engaging in unreasonable searches.

Legal Issues of intercepting WiFi Transmissions • Chapter 7

207

Frequently Asked Questions The following Frequently Asked Questions, answered by the authors of this book, are designed to both measure your understanding of the concepts presented in this chapter and to assist you with real-life implementation of these concepts. To have your questions about this chapter answered by the author, browse to w w w . syngress.corn/solutions and click on the "Ask the Author" form.

www.syngress.com

208


Q" Are you stating in this article that we have the green-light to go and start intercepting WiFi signals? A: No. Sorry. The point of this chapter was to show how federal statutes that govern the interception of other types of electronic communications do not squarely address WiFi technology. Further, and perhaps more important, it appears that many state wiretap laws would criminalize the interception of WiFi signals. So although the discussion here shows that the federal statutes discussed here may not address WiFi eavesdropping, the interception of WiFi may be criminalized by your State's wiretap or other laws.You should consult with your local prosecutor before attempting to eavesdrop on WiFi signals.

Chapter 8

209

210

Chapter 8 • CD and DVD Forensics

Physical Characteristics of CD and DVD Media Little has changed in Compact Disc (CD) physics since the origin of CD audio discs in 1980. This is due in part to the desire to maintain physical compatibility with an established base of installed units, and because the structure of CD media is ideal for this function. Digital Versatile Discs (DVDs) are an evolutionary growth of CD's with slight changes. It is important to understand that both CDs and DVDs are electro optical devices. There are no magnetic fields in the reading or recording of these discs, therefore, they are immune to magnetic fields of any strength, unlike hard drives Due to its immunity to magnetic fields, CD and DVD media is unaffected by Electromagnetic Pulse (EMP) effects, X-rays, and other sources of electromagnetic radiation. The primary consideration with recordable CD media (and to a lesser extent, manufactured media) is energy transfer. It takes a significant amount of energy to affect the media that the writing laser transfers to the disc. Rewritable discs (Compact Disc - 1KeWriteable [CD-1KW], Digital Versatile Disc - Rewriteable [DVD-1KW], and Digital Versatile Disc - 1Kewriteable [DVD+RW]) require even more energy to erase or rewrite data. This is in direct contrast to floppy disks and hard drives, which can be affected by electromagnetic devices such as Magnetic Resonance Imaging (M1KI) machines, some airport X-ray scanners, and other devices that create a strong magnetic field. CDs and DVDs are also immune to EMPs from nuclear detonations. It is important to understand that CD and DVD media is read with lig,ht, and recordable discs are written with heat. Using an infrared (ILK) laser, data is transferred to a CD or DVD onto a small, focused area that places all of the laser energy onto the target for transfer. It should be noted that all CD and DVD media are sensitive to heat (i.e., above 120F/49C), and recordable media is sensitive to IlK, ultraviolet (UV), and other potential intense light sources. Some rewritable media are affected by E P R O M erasers, which use an intense UV light source. Various forensic alternative light sources can provide sufficient energy to affect optical media, especially if it is focused on a small area It is not necessarily a question of heat but one of total energy transfer, which can result in heating. Both CD and DVD media are organized as a single line of data in a spiral pattern. This spiral is over 3.7 miles (or 6 kilometers [km]) in length on a CD, and 7.8 miles (or 12.5 km) for a DVD. The starting point for the spiral is towards the center

CD and DVD Forensics • Chapter 8

211

of the disc with the spiral extending outward. This means that the disc is read and written from the inside out, which is the opposite of how hard drives organize data. With this spiral organization, there are no cylinders or tracks like those on a hard drive. (The term "track" refers to a grouping of data for optical media.) The information along the spiral is spaced linearly, thus following a predictable timing. This means that the spiral contains more information at the outer edge of the disc than at the beginning. It also means that if this information is to be read at a constant speed, the rotation of the disc must change between different points along the spiral. All optical media is constructed of layers of" different materials (see Figure 8.1).

Figure 8.1 CD-R Construction

This is similar to how all optical media discs are constructed. The differences between different types of" discs are m CD-RThe •

•

•

dye layer can be written to once.

C D - R O M The reflector has the inforn~ation manufactured into it and there is no dye layer. C D - R W The dye is replaced with multiple layers of different metallic alloys. The alloy is bi-stable and can be changed many times between different states. D V D DVD's are constructed of two half-thickness discs bonded together, even when only one surf;ace contains information. Each half disc contains the infbrmation layer ti.6 Millimeter (ram) fiom the surface of the disc.

DVD media consists of two halt'--thickness polycarbonate discs, each half containing information and constructed similarly to CD media. I)VD write-once recordable media uses a dye layer with slightly different dyes than those used for C1)R media, but otherwise are very similar physically. Manufactured DVD media has the

www.syngress.com .

.

.

.

.

212

Chapter 8

•

CD and DVD Forensics

information manufactured into the reflector and no dye layer is present. Rewritable DVD media uses bi-stable alloy layers similar to those for CD rewritable media. As seen in Figure 1.1, the differences between manufactured, write-once, and rewritable media are identical between CD and DVD media. The key to all recordable media types is the presence of a reflector with the ability to reflect laser energy. Data is represented by blocking the path to the reflector either by dye or a bi-stable metallic alloy. The bottom of a CD is made of a relatively thick piece of polycarbonate plastic. Alternatively, the top is protected by a thin coat of lacquer. Scratches on the polycarbonate are out of focus when the disc is read, and minor scratches are ignored completely. It takes a really deep scratch in the polycarbonate to affect the readability of a disc. However, even a small scratch in the lacquer can damage the reflector. Scratching the top of a disc can render it unreadable, which is something to consider the next time you place a disc on your desk top-down "to protect it." A DVD has polycarbonate on both sides; therefore, it is difficult to scratch the reflector.

CD Features There are a number of distinct areas on the surface of a CD or DVD. Moving from the inside to the outside of the disc, the following areas are illustrated in Figure 8.2: •

A Spindle hole

•

B Clamping ring

•

C Stacking ring

•

D Mirror band

•

E Beginning of data area

•

F End of data area, slightly inside the outer edge of the disc

CD and DVD Forensics ° Chapter 8 F i g u r e 8.2 Areas on a CD o r DVD

F i g u r e 8.3 Batch N u m b e r on a CD-R

T h e C D standard has specific measure~nents for all of these areas; approximately 99 percent of C1)s (manu~cttlrcd or recordab].e) meet these standards. D V D measurements are similar to those for Cl)s and are considered identical.

www.syngress.com

213

214


The stacking ring is used to keep the surfaces of discs separate when stacked on a spindle. Without the stacking ring, the lacquer surface of one disc would adhere to the polycarbonate surface of the one above it. This is especially true in high humidity environments. The stacking ring and proper alignment of stacked discs is important for transporting discs. Some manufactured CDs contain identification in the mirror band, which identifies the contents of the disc. In the case of recordable or rewritable media, this is a batch number or a date code. This number is of limited value to forensic examiners, because it does not uniquely identify the disc and generally does not clearly identify the manufacturer of the disc. When considering marking discs for identification purposes, it is suggested that you avoid the data area of the disc and place such markings in the clamping ring area of the disc. Using solvent-based markers in the data area can dissolve the lacquer and destroy the reflector.

CD Sizes and Shapes CDs and DVDs come in a variety of sizes and shapes. The following are the standard sizes: •

120mm/5.25 inches

•

80mm/3.15 inches

•

Business card

Business card discs have a data area slightly smaller than that found on 80mm discs, and are rectangular in shape with either square or rounded ends. Technically, these are not specified in the standards; however, they are fairly common. Some retail stores sell recordable business card-size discs. After the initial introduction of CDs, it was found that discs could be machined into different sizes after manufacture. The variety of shapes that can be found is as wide as your imagination~one creative machining company produced a CD in the shape of a rooster. At this point, it is rare to find other sizes of DVDs; however, it is possible to develop them. The only critical aspect is the balance of the disc to prevent vibration as the disc is read. A high-speed drive may rotate the disc at speeds above 5000 Revolutions Per Minute (RPM); any slight unbalance causes vibration and noise.

www.syngress.com


•

Chapter 8

215

CD and DVD Types Choosing the right type of disc depends on a number of factors, including the quantity of data being recorded, any additional data that must be added in the future, and how long the data must be accessible. Not all users can read a DVD as easily as a CD. Therefore, for compatibility with the largest number of users, writing data to a CD makes the most sense. Because DVD recordable and rewritable discs are physically more robust than C D - R and C D - R W discs, this can be an important consideration. The choice between write-once and rewritable media is not as simple as it seems. Rewritable C D - R W discs hold less data (i.e., approximately 570 megabytes [MBI instead of" 7(}0MB when used with most applications). Additionally, all rewritable media (CD and DVD) have significant problems over long periods of time. Chances are that information written to a rewritable disc may not be readable six months or a year after the disc has been written. If the data has value after six months, using rewritable media is not recommended. Transferring data from one computer to another or short-term backups are ideal uses for rewritable media. Permanent archives, family photographs, and other such applications should only be written to write-once media. Choosing between D V D - R and D V D + R discs should be guided by the intended use of the disc. There is some evidence that D V D - R discs are more compatible with consumer DVD recorders than I ) V D + X discs, however, there are consumer players that will only read D V I ) + R discs. D V D - R discs are often the best choice for compatibility if the disc being produced contains data files. Early I ) V D - R O M drives can generally read DVD-R. discs but are incapable of" reading I ) V I ) + R discs. DVD writers that only write D V D + R / R W discs will read I ) V D - R discs.

CD and DVD Colors C D - R O M discs and audio and an aluminum reflector; Playstation® was originally light, but transparent to the

CDs are typically manufactured with clear polycarbonate however, this is not the only possibility. When the Sony released, all of its discs were black (opaque to visible IR laser light used to read the disc).

W h e n C D - R discs originally appeared, the reflector was always gold and the dye added a greenish cast to the data side (or bottom) of the disc. However, today C D - R discs can be found with silver or gold reflectors and various dye colors that give the www.syngress.com

216


data side of the C D - R disc anything from a green tint to a yellow tint to a blue tint and various other shades of these colors. The specific colors are dependent on the dye formulation being used. There are a number of different dyes and many possible changes in exact formulation that give rise to the number of different colors. Some C D - R discs have a silver reflector and the dye is a very faint yellow. U n d e r some conditions, these discs are nearly indistinguishable to the human eye from manufactured C D - R O M or C D audio discs. M e m o r e x ® released black C D - R discs that were inspired by the Sony Playstation® discs. C D - R W discs generally have a silver reflector and a dull silver data side. D V D - R discs originally had a silver reflector and a purplish tint on the data side. Today, D V D - R and D V D + R discs come in a wide variety of colors with different dye formulations. Nearly all of the reflectors for D V D - R and D V D + R are silver. D V D - R W discs appear similar to C D - R W discs, with a silver reflector and a dull silver data side. D V D + R W discs come in a variety of colors, but most have a silver reflector and a dull silver data side. Some can be hard to tell apart from manufactured D V D - R O M discs. The reasons for all of the different color dyes and reflectors are primarily cost, performance, and licensing. Today, there are no really expensive dyes in use, because a small difference in cost per disc can add up w h e n you are producing millions of discs. Annually, over a half a billion recordable discs are used each year. The performance of a dye is directly related to how the disc can be written in terms of speed and laser power. It is also a factor in the longevity of a disc. Finally, licensing terms affect this, because the dyes have been patented. For the most part, the cost difference between a lower cost license and a higher cost license can be significant depending on the number of discs being manufactured. Silk screened labels are not exclusive to manufactured discs; it is c o m m o n to silk screen C D - R blanks. Some software product distribution discs in retail packaged software products are silk screened C D - R blanks that have been duplicated with the last session left open. This means that the discs can be added to. It used to be easy to tell a recordable disc from a manufactured disc. Today, media comes in a wide variety of colors. Similarly, manufacturers have a slightly different motivation; some are producing discs that intentionally appear to be manufactured discs. Unless you have a lot of experience with such discs, it is not safe to assume that an investigator can tell the difference between a recordable disc and a manufactured


217

disc. It is recommended that you do not attempt t o exclude discs from being collected as evidence based on their appearance. Creating a policy of"collect everything" ensures that less experienced people are not faced with decisions regarding which discs to use.

CD-R Dyes The original development of CI)-P,, discs required a bi-stable dye that could be changed from transparent to opaque by a laser. The first CD-P,. manufacturer, Taiyo Yuden, met this requirement by developing and patenting a cyanine organic dye. Cyanine refers to a f'amily of organic polymer dyes that were originally formulated in 1986 fbr use in photography and spectroscopy. The term "organic" in this case refers to the use of chains of carbon and hydrogen atoms in the dye. The dye formulation that Taiyo Yuden created remains transparent until an IR laser heats it, at which point it changes color and is less transparent, thereby resulting in recordable CD media. C D - R technolow began in the early 199()s and Sony released the first CD recorder in 1993. Although the estimated life of the original cyanine organic dye was approximately l(I years, it is not clear if this was actually tested. Discs that were recorded in 1995 are still readable it they have been kept away from heat and UV light. Since then, additional types of dyes have been developed, some with different properties. Also, dye developments have allowed the recording speeds to increase with dyes that are tar more sensitive than the original. It is often claimed that phthalocyanine dye is more stable than the original cyananine, and has a life of 1()(i years. While some testing has been done regarding this, it is unclear whether phthalocyani~e dye is more stable than its claim of 100 years. The following table summarizes the types of dyes and their visible characteristics. They are listed in the order they appeared in C D - R media.

www.syngress.com

218

o

n~

.0

U

&

r~

c

E

C 0


www.syngress.com

C

~ i..L~

,

2rv~ rO r~

,

,

0

G)

c

"0 L~

-0 L~

~c

t--

c

•

"~

_C

,

c-

L~

~

L~

C

.~

c

(~

I--

N

~U

t--

E

-0

rn

c

(~ c°'"

0

I--

Z

"~

"~

._.~

N

0

,~

c

c

N

"~

0

U

nn

•


•

Chapter 8

"Formazan" is a hybrid Cyanine/PhthaloCyanine dye that was developed by Kodak.The appearance of the data side of" a C D - R depends on the combination of dye color and reflector color. Thus, a blue dye and a gold reflector results in a green appearance on the bottom of the disc. DVDs exhibit similar characteristics, but the dye formulations are not usually disclosed by the manufhcturers. While (~I)--t~, technology was jointly shared between Sony, Philips, and Taiyo Yuden iI1 tile early 1990s, the recordable media market has become far more competitive. Today a small change in dye formulation can make a difference in writing speed or other perfbrmance characteristics, and therefore are of significant benefit to media mal~uFacturers. The result is that there is less sharing of information about I)VI) dyes than there is for C I ) - R dyes.

Information Storage on CDs and DVDs The information on discs is represented by pits and latlds in manufactured discs. Extremely tight fbcusing of the laser is used to differentiate between different heights of" the reflector in the disc. The reflection from a land is in focus and in phase, whereas the reflection lCrom a pit is out of" phase. CD and DVD drive optics are designed to detect these differcnccs. Recordable media replaces physical pits with organic dye (such as Cyanine) that can be made to be opaque (or less transparent) by the application of heat. Instead of the light being reflected differently, there is a distinct contrast between a land on a recordable disc where the light is reflected strongly, and a pit where the light is reflected less strongly. The sin~ilaritv between an out-of'-f'ocus/out-of-phase pit and an opaque spot allowed CD recordable media to be read by C D - R O M drives and audio players, even though the player was designed long before recordable media existed. Rewritable media uses a slightly different technique, since the organic dye is a one-way transformation from transparent to opaque. Instead, a metallic alloy is used that has two states: crystallittc and ,~Jorplto~4_~. In a crystalline state, the alloy is more reflective than in the amorphous state: therefore, it can be used in the same manner as the pits and lands or organic dye. The difference is that additional laser power can "anneal" the alloy to return to a crystalline state. Therefore, a drive that can be used with rewritable discs has three separate power levels: read, u~rite and erase. Rewritable discs typically have one-third the reflectivity of'write-once recordable media. However, the contrast difference between a pit and a land on rewritable media is similar. Adjustments to drives in order to read rewritable discs were primarily the adjustment of~the sensitivity during reading. Drives that could automati-

219

220


cally cope with the adjustments could read rewritable media, but those that could not were unable to read rewritable media. When a disc is read, the transition between lands and pits and pits to lands is represented on binary. The spacing between these transitions serves to fill in binary zeros between the ls and is represented by the length of a pit. Pits come in eight sizes from 3T to 11T, where T is a unit of time. The ability of digital systems to measure time precisely allows for the determination of exactly how many binary 0s occur between each binary 1 transition. Decoding this t i m e - - w h i c h is the length of a p i t ~ is how the data on the disc is read. Encoding on a disc uses 14 bits to represent each 8 data bits. Each group is required to have individual 1 bits with two or more 0 bits following. The encoding of this is called Eight into Fourteen Modulation (EFM). The spacing of the 1 bits in the EFM encoding preserves the clocking of the data by not allowing either too long or too short a run of binary zeros. The translation from EFM encoding back to data bytes when reading the disc is done with a simple lookup table where each legal pattern of 14 "raw" bits from the disc has a corresponding 8-bit data byte. (This was designed circa 1980 with 8-bit 1 M H z microprocessors being common.) Complex signal processing was not required for reading CDs and is not required for reading DVDs. In the early 1980s, such signal processing was possible but too expensive for wide adoption in consumer electronics devices. Today, such signal processing is more common and less expensive, however, it is not required to read CDs and DVDs.

CD and DVD Organization and Terminology It is important to have understand the terminology used with this technology. The following is a description of the various terms that you are likely to encounter.

Border Zone A Border Zone is the area on a DVD that contains the real content of the disc,

whether it is data files, music, or videos. It is roughly equivalent to a track on a CD. A manufactured DVD is always composed of a single border zone; however, recordable discs can have multiple border zones. In some documentation, a border zone is also called a RZone. While there is no Table of Contents (TOC) on a DVD, the drive can return information in the form of a T O C by listing border zone information.


221

Lead In The lead in serves as a container for the T O C for a session on a CD. Sony-style C D text information is also recorded in this area. Originally, this was used to help calibrate the laser and mechanical components of the drive for reading the disc. The first (or only) session on a disc has 7,500 sectors (14.65MB) reserved for the lead in; subsequent sessions have 4,500 sectors (9 MB) reserved for the lead in. Using "Disc At O n c e " recording the T O C and other lead-in information is written first in this area, whereas using "Track At O n c e " recording in this area is reserved and written after the session is closed. For multi-session recording, a pointer is placed in the lead-in area to indicate the next writable location on the disc. If and w h e n the disc is finalized or closed, this pointer is recorded as either 0 or 24 bits of binary ls. Both formats have the same effect of preventing further information from being added to the disc.

Lead Out The lead out of the disc indicates the end of the C D disc or the end of a session on the disc. O n e use of the lead-out area is to tell an audio player to stop playing the disc. This area is made up of a group of sectors written at the end of the disc. The lead out for the first session is 6,750 sectors (13.5 MB) and all subsequent sessions have a lead-out of 2,250 sectors (4MB).

Philips CD Text Philips developed a technique in 1997 by which lyrics and other information could be stored on audio discs without interfering with the audio samples. Approximately 31 MB of data can be stored on a disc using this technique. This is not in c o m m o n use today, unlike Sony C D Text, which stores only the disc name, artist name, and track titles.

RZone R Z o n e is an alternate term for a border zone.

Sector Each C D sector contains 2,048 bytes of user data for data tracks and 2,352 bytes of audio samples for audio tracks.

www.syngress,com

222


Session A session is a group of one or more tracks recorded on a CD at the same time. This corresponds to a border zone on a DVD. Multi-session discs have more than a single session, which is usually a userrecorded disc that has been written to multiple times.

Sony CD Text Sony developed a technique in 1997 by which the album title, artist name, and track titles could be stored in the lead-in area of an audio disc, which allows a m a x i m u m of approximately 15KB of data to be stored on a disc. Most commercial audio discs produced by Sony have this, as well as many discs produced by other manufacturers.

TOC The T O C is recorded in the lead in for a session and contains only some information about the type of track (audio or data), the session number, and the starting address of the track. There is one T O C per session; therefore, multi-session discs have several independent TOCs. Unclosed sessions do not have a T O C , which is why an unclosed session cannot be read on a C D - R O M drive. The T O C is a list of tracks on the disc. DVDs do not have a T O C ; however, the information can be constructed from information about border zones.

Track A track is a single collection of data (audio or video) on a CD. It is c o m m o n to have multiple (up to 99) tracks on a CD. O n a DVD, a border zone (or R Z o n e ) is similar to a C D track with the exception that it is rare to find DVDs with multiple border zones. M1 manufactured DVDs have only a single border zone.

CD and DVD Sectors There are several different types of sectors found on CD media. The most basic and original form is CD Audio or CD-DA:


•

C D A u d i o 2352 bytes

•

CD-DA

223

588 16-bit stereo audio samples

Technically, audio discs contain "subcode blocks," not sectors. However, since circa 1996, most CD drives and all I)VD drives read audio subcode blocks and return the information as a 2,352-byte sector. Each subcode block is composed of 98 frames. For data formats, these sectors are composed of 98 subcode frames. Aside from the main data, subchannels P through I47 are available. P and Q have defined purposes and hold information to assist in determining the difference between "gap" and program material (the music) for audio discs, and also for holding information such as the time in the current track. Subchannels P- through W can be used in several different ways: •

Graphics for C D + G karaoke discs

•

Text information for Philips C D - T E X T

•

Other information

The next format introduced was C D - R O M Mode 1. Mode 1 was developed in 1988 with the introduction of the C D - R O M format. Each sector also contains 2,352 bytes, but much of that is used for control and error correction information.

12 Bytes Sync

4 Bytes Header

2,048 Bytes User Data 4 EDC

8 Bytes Reserved

276 Bytes ECC

Devices such as C D - i ® and the Kodak P h o t o C D ® player were introduced following Mode 1. Additional features on CDs were required to utilize the technology and the XA format was introduced. XA discs come in two formats" Mode 2 Form 1 and Mode 2 Form 2. The Mode 2 Form 1 sector layout looks very similar to that for M o d e i"

12 Bytes Sync

4 Bytes Header

8 Bytes Subheader

2,048 Bytes User Data 4 EDC

276 Bytes ECC

Mode 2 Form 2 frees up additional space in the sector for greater density, but sacrifices the second level of error correction provided by the E C C data"

12 Bytes Sync

4 Bytes Header

8 Bytes Subheader

2,324 Bytes User Data 4 Spare

DVD sectors are much simpler, because there was no audio format to build on.

www.syngress.com

224


2,048 Bytes User Data DVD sectors are composed of data frames on the physical disc. Information other than the 2,048 bytes of user data is not accessible. A DVD data flame contains 4 bytes of ID, 2 bytes of ID Error Correction Code (ECC), 6 bytes of copyright management information, 2,048 bytes of user data, and 4 bytes of Error Detection Code (EDC). Sixteen such data flames are assembled into a single 32K E C C block. It is not possible to access DVD data frames (also called E C C blocks) with consumer DVD drives.

R-W Subchannels CDs can have up to 80 additional bytes of data in the tL through W subchannels associated with each sector. For a full 80-minute disc (700 MB) this can provide more than 27 MB of additional data storage capability. The data stored in the R through W subchannels is invisible to most CD applications; therefore, it does not interfere with other uses. There are two defined uses for data for audio discs: []

C D + G G r a p h i c s for Karaoke Discs The R e d Book standard and its extensions define the content of the tL through W subchannel data for playing low-resolution graphics while playing music at the same time. This was originally used to display images on a television synchronized with Karaoke music.

•

Philips C D - T E X T Philips defines the content of the R through W subchannels to provide a means of storing text information with music. The primary application of this was to store the lyrics with the music, but it was

never adopted. Aside from these documented uses, the P~ through W subchannels can contain any other data that the creator of the disc wants to add. There are standards for how this data can be arranged and still be compatible with various C D + G players and other devices. The tL through W subchannels supply bits 5 through 0 in each byte of the 96-byte sector data. The terminology used in the Philips standards documents is as follows: •

Each group of 6 bits (R through W) is called a SYMBOL.

•

A group of 24 SYMBOLS is called a PACK.

•

A PACKET is composed of four PACKS.


225

For error correction and detection purposes, the PACK data is interleaved across eight PACKS on the disc. This reduces the effects of physical damage to the disc and allows for better error correction by spreading out the effects of a physical defect across multiple PACKS. Since there are four packs to a sector, de-interleaving all of the packs for a sector requires reading three consecutive sectors. C D / D V D Inspector version 3.{i and later (available from Infadyne www.infinadyne.corn) can de-interleave this i~formation and the write file containing all of the P,. through W subchannel information to a file. This is done on a track-by-track basis using the Copy Sectors tool. Because the P,, through W subchannel information only stores 6 bits for each symbol, there are two methods by which it can be decoded. The first is to use the standard C D - T E X T 6-bit character set and translate the information to standard American Standard Code for Information Interchange (ASCII). This results in the largest amount of text that can be stored in the P,. through W subchannel area, but restricts the text to letters, numbers, and some punctuation symbols. The other technique for decoding the I~ through W subchannel information translates the 24 6-bit symbols into 16 8-bit ASCII characters, which is capable of containing any data. C D / D V I ) Inspector can also output the 6-bit symbols as is without translation, with or without de-interleaving.

www.syngress.com

226


Figure 8.4

R-W

Subchannel

Pack

De-interleave

o ~ 2 3 4 s 6 7 8 9 10 1~ 12 13 14 is 16 17 18 ~9 20J21 22 23 Sector

+1, Pack 3

Sector

+1, Pack 2

-

-

23

-

-

22

-

-

21

-

-

20

-

Sector

+1, Pack

Sector

-

19

- -

18

1

+1, Pack 0 _

0

Sector

iector

1

2

3

4

5

6 17

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

+0, Pack 3

+0, Pack 2 ,

Sector

16

- -

15

- -

14

- -

13

- -

12

- -

11

- -

10

- -

9

- -

8

- -

7

- -

6

- -

5

- -

4

- -

3 2

-

0

1

+0, Pack 1

0

Sector

17

- -

- -

- -

1

2

3

4

5

6

7

9

10

11

12

13

14

15 J16

17

18

19

20

21

22

23

+O, Pack 0

CD and DVD Differences The principle difference between CD and DVD media is density. CD media is designed to be read with a 780 nanometers (nm) laser and the physical features on a disc are 1 to 1.5 wavelengths in width.Alternatively, DVD media is designed to be www.syngress.com


227

read with a 630-650 nm laser and the physical features are correspondingly smaller (see Figures 8.5 and 8.6).

Figure 8.5 CD Media at 30,000x

Figure 8.6 DVD Media at 30,0000x

Note that the spacing of the pits and lands does not change across the radius of the disc. This means there is more information stored at the outer edge than there is at the inner edge. The track pitch is the distance between the "wraps" of the spiral. CDs can have a track pitch from 1,5()(11tto 1,700 nm, or about two wavelengths. As detailed above, CD media is organized into subcode blocks that contain 2,352 bytes. Each subcode block consists of" 98 contiguous frames containing synchronous (SYNC) subcode information (including addressing), user data, and two levels of Cross-interleaved Xeed-Solomon Code (CIRC) that detects and corrects errors in both audio and data discs. Some C D - R . O M data formats contain an additional R.eed-Solomon Product Code (t~S-PC) that detects and corrects severe errors that are beyond the capability of the f'rame level C I R C . ir_.

www.syngress.com _ _ .

228


Conventional data discs use additional KS-PC; however, more specialized discs (e.g., Video Compact Discs [VCDs]) do not use 1KS-PC in order to take advantage of the additional space in the data sectors. This allows more bytes per second to be transferred to the computer. While it is convenient to think of CD media as being broken up into sectors, it is misleading when talking about the low-level organization of a disc, because there is a considerable amount of interleaving of sector data. To minimize the effects of physical damage, the data is stored with redundancy over a large physical area and a single sector's worth of data is spread over the distance of three sectors. This is both a positive and a negative aspect. It helps minimize the effects of physical damage to the disc; however, when a sector is damaged beyond the ability of the redundancy to correct it, three sectors are rendered unreadable. DVD media was not built on a foundation of audio players as is the case with C D - R O M technology. There is a single data format on DVD media and all sectors contain 2,048 bytes of error-corrected data.To reduce the overhead that is present on CDs, DVDs use a different mechanism whereby 16 data frames are grouped together in a single E C C block. Each data frame contains a 2,048-byte user data sector as well as some control information. This reduces the overhead considerably without sacrificing the error-correction capabilities. It implies that a DVD drive is reading and buffering at least 16 data frames (or user data sectors) at a time, whereas early C D 1KOM drives would read and buffer only a single sector at a time. The result is that DVDs have significantly more capacity than they would if the same methods for CDs were used.

CD-ROM Manufacturing Process C D - R O M and CD audio discs are manufactured by creating a glass master disc, which is then mechanically reproduced to form stamped polycarbonate discs. Aluminum is then deposited on the stamped surface to reflect the laser. The aluminum is protected by a thin coating of lacquer, usually cured by UV rays from a high intensity Xenon flash lamp. The glass master is made in much the same way as a printed circuit board or integrated circuit mask. A piece of glass is coated with a photosensitive compound, which is then exposed to a laser in much the same way a recordable disc is written to. The actual machine is called a laser beam recorder, and differs from a consumer writer in one very important a s p e c t - the glass master is blank when the process starts. Consumer "blank" recordable discs are not really blank before they are used.


229

They contain a spiral pattern that the consumer writer follows to write the data. This spiral pattern is called a pre-~roo~c. After the laser beam recorder has exposed the photosensitive c o m p o u n d on the glass master, the glass master is "developed" using a solution of sodium hydroxide, which washes away the areas that were exposed to the laser. This forms tiny pits in the surface in a spiral pattern, which become the information on the final disc. This is identical to the process used to create printed circuit boards. The glass master is then placed into a vacuum chamber where a molecules-thick layer of silver is deposited onto the disc. This is then called a metalized o~lass master. The metalized glass master is then immersed into a tank of nickel sulfamate where an electroforming technique is used to deposit a layer of metallic nickel onto the silver surface of the disc. This takes approximately two hours, and w h e n complete, the nickel is removed from the disc and becomes the father disc. The father disc is a negative (reverse) impression or what is used to form the disc. The father disc is then put back into the electroforming tank where another layer of nickel is deposited. After approximately two hours, this new layer of nickel is removed from the father disc resulting in the mother disc, which is used to create

stampers. Stampers are made from the mother disc, and are used to form the final polycarbonate discs. The term "stamper" is inherited from the phonograph record industry; vinyl records were stamped whereas CDs and DVDs are injection molded. Polycarbonate is taken in the form of small beads and heated in an injection molding machine with the stamper. The result is a 5.25-inch or 120ram disc that has the pits and lands impressed oi1 one side. This polycarbonate disc is then coated with a very thin layer of aluminum on the side with pits and lands. This is done with an electrostatic technique called sputtering (or metallization). A coating of clear lacquer or sealant is then put over the aluminum to protect it. The disc is then ready have a label silk-screened onto it. P, ecordable discs are manufactured in a similar manner, only a layer of dye is put down before the reflector and gold or silver is used instead of aluminum. Rewritable discs are made the same way, only multiple vacuum deposition steps are used to get the layers of metallic alloy. Both write-once recordable and rewritable discs have a pre-groove, which is stamped into the polycarbonate. This pre-groove is a sine wave pattern that the writer can follow to maintain tracking on the disc when writing. In addition to providing a path for the laser to follow, this pre-groove has information encoded into it www.syngress.com

230


using frequency and phase modulation. The effect is changing the spacing of the curve (see Figure 8.7). Figure 8.7 Frequency-modulated Pre-groove

The information in the pre-groove for C D - R discs is the time coding along the spiral from 0 to 63, 74 or 80 minutes. This information is called Absolute Time in Pre-Groove (ATIP). For C D - R W discs, this was expanded on to include other information about the disc such as the laser power level that is suggested for writing and the minimum and maximum speeds for writing. For DVD media, a combination of dedicated areas on the disc as well as ATIP is used to present information about the disc to the writer.

Inside a CD-ROM Drive Figure 8.8 illustrates how the actual mechanism in a C D - R O M drive (or other similar device) functions. It is interesting to note that the mechanism used in a 1982 audio player is very similar to that used in a current D V D + / - writer. Figure 8.8 CD Optics Diffraction Grating

Pola rizi n g Beam Splitter

Collimator V~ wave lens plate

Focusing lens Actual focal point

Laser Diode Concave lens Cylindrical lens Photodetector array

www.syngress.com

Disc

CD and DVD Forensics ° Chapter 8

The laser diode is a small electronic part that emits a light in the I R spectrum when an electric current is passed through it.The first step is to pass this through a diffraction grating, which acts as a filter to isolate only the correct frequency. While the laser itself is brightest at the center frequency (i.e., 780 nm for CDs, 650 nm for DVDs), there are other frequencies present. The transmission diffraction grating removes all but the center frequency of the laser. The polarizing beam splitter then divides the laser into multiple beams. O n e is the reference beam, which is directed towards the photodetector array. Three other beams are directed through the remaining optics and to the disc. The main center area is used to read the data, while two smaller areas straddle the center area and are used to maintain radial tracking. The collimator lens, quarter-wave plate, and focusing lens are used to focus these three areas on the disc. The actual focal point is below the surface of the disc where the pits and lands that make up the data content of the disc are located. Focus is maintained by moving the focusing lens to account for minute differences in the disc shape and distance from the sled. After being reflected by the disc, the three areas are reflected back through the lenses and towards the photodetector. The four areas (three from the disc and one reference) are then used to control tracking and focus with the use of four photodetectors in an arrav. All of the optical components described above are contained on the sled, which is the part that is moved to access the disc. The laser diode, lenses, and beam splitter are all contained here, as well as coils for moving the focusing lens. The same tracking technique is used w h e n writing, where the main area is writing data and the two smaller areas are used to maintain tracking and read the pre-groove oi1 a recordable disc. Figure 8.9 shows a close-up of" the sled assembly. As you can see, there is a large flexible cable connecting the sled to the circuit board, which has signals from the photodetector and to the laser and focusing coil. The two silver rails are the guides along which the sled moves as it accesses the full radius of the disc. It moves along the rails by the tracking motor.

www.syngress.com

231

232

Chapter 8

•


Figure 8.9 Sled Assembly

As can be seen in Figure 8.9, the sled (or laser pickup assembly) is a relatively small part of the overall device. It is moved across the surface of the disc by the tracking motor while the disc drive motor or spindle motor rotates the disc

Figure 8.10 Inside a CD-ROM Drive

www.syngress.com


233

As mentioned previously, the spacing of the lands and pits remains constant across the surface of the disc. CD audio players and early C D - R O M drives were designed to maintain a constant rate of information being read from the disc, which requires the rotation of the disc to be controlled to correspond to the radius where the lens is placed. The disc rotates more slowly when the lens is positioned at the outer edge than when the lens is close to the center. This requires the spindle motor to be more closely controlled than in other devices such as floppy disks or hard drives, which rotate at a constant speed. The technique of accessing the disc in this manner is called Constant Linear Velocity (CLV). The data passing by the laser is kept at the same speed even when there is more data present at the outer edge of" the disc. At the same time that the C I) drive read speed exceeded 14x, a different technique for reading discs appeared called Constant Angular Velocity (CAV), where the disc is rotated at the same speed regardless of the positioning of the laser. This forces the drive electronics to adjust for the different data rates as the laser is moved across the radius of the disc. When writing to the disc, a modification of this technique called Zoned CAV is often implemented, where the disc is rotated at several different fixed speeds depending on the radius the laser is positioned at. This limits the amount of variation in the data rate that the drive electronics have to adjust for. In modern drives there is usually one additional motor, which opens and closes the tray or otherwise moves the disc in and out of the drive. This is not available for notebook drives or for smaller CI) and DVD players.

External Interfaces All current computer CI) and 1)VD drives have two interfaces: digital data/control bus and analog audio. Sometimes a drive has both. These drives also often have a front-mounted headphone jack as well as a rear-facing analog output connector. The audio interfaces are active when the drive is playing an audio track under either manual or computer control. Today. most drives have ATA Packet Interface (ATAPI) or Serial ATA (SATA) connections only. Adapters to convert between this and other interfaces such as SATA, FireWire, Universal Serial Bus Version 2 (USB2), or Small Computer System Interface (SCSI) are common. Along with the gradual phasing out of the parallel ATA interface, it is expected that there will be more SATA drives in the future. This will lead to bridge adapters that will convert this interface to FireWire and USB2. While the highest performing interface today is still SCSI, there are no CD or DVD drives that implement any of the high-performance SCSI interfaces. N o r is www.syngress.com

234


there any real need for this, because the maximum data rate for CD and DVD drives is far below the capabilities of these implementations. This could change with BluRay and DVD HD drives, but it is unlikely that there will be a resurgence of SCSI in the near future. Native implementations of SATA and FireWire 800 without adapters are the choice for high-performance devices in the future. The data interface for a drive has little effect on the data transfer rate (or speed) of the drive. This was only a problem with USB 1.1 drives where they were limited to a maximum data rate of about 6x. Today's data interfaces significantly outperform the ability of the drive to read from the media. The performance of the parallel IDE bus is more than adequate when used with modern DMA implementations. Some people believe that the FireWire interface is superior for data transfer than USB2, because of higher speed and/or better negotiation on the bus. While this may be important for hard drives that can reach a significantly greater transfer rate, it is not important for CD and DVD drives with lower data transfer rates.

Drive Firmware It is important to understand the complexity of reading CDs and DVDs. There is a significant amount of processing that is done by the drive, between reading the pits and lands from the disc and sending data to the computer. This differs significantly from how hard drive and floppy disk data is treated, where only a small amount of post-processing is required. Floppy disk controllers in the late 1970s and early 1980s were constructed with discrete logic chips where individual gate-level integrated circuits were assembled together on a circuit board. While today a single chip accomplishes this task, the actual processing performed has not changed significantly. The first CD-R.OM drive that was sold to consumers had 4K to 8K of firmware controlling the operation of the drive. Much of the processing was accomplished by a Large Scale Integration (LSI) chip that was custom made for decoding CD data. The amount of circuitry involved was between 10 to 100 times that of a floppy disk controller. Originally, CD writers had 64K to 128K of firmware on masked R.OM (not upgradeable) chips. Today a DVD + / - writer has as much as 8 MB or 16 MB of firmware on flash memory chips, which can be upgraded by the end user. This allows for changes and bug fixes after the drive has been released. With this much firmware, such problems occur regardless of the amount of testing done by the drive manufacturer. www.syngress.com


235

The drive firmware is a specialized program to control the functioning of the drive and interacts with the LSI chip that decodes the pit and land information from the laser. There is no provision for feeding the raw information back to the computer directly~everything has to go through the drive firmware. This means that whatever limitations are built into the drive firmware are limitations as to what can be done with the disc in the drive. There is no way to bypass this. Some people have attempted to construct mechanisms by which CDs can be read without a drive and without these limitations. To date, there has been little success in this area with CDs, and none with DVDs outside of specialized university projects.

CD and DVD Logical Structure The logical structure of a Compact Disc (CD) or a Digital Versatile Disc (DVD) involves various writing techniques and the logical organization of data within a file system.

W r i t i n g to a CD or DVD Writing to a C D or DVD can be done using any of the following writing strategies" T r a c k - a t - o n c e The

most

c o m m o n form of C D recording for data discs.

D i s c - a t - o n c e The most c o m m o n way to create audio discs and DVDs. I n c r e m e n t a l R e c o r d i n g or Packet W r i t i n g Used with drag-and-drop

writing software. This is also the most c o m m o n way for non-movie DVDs to be recorded.

Incremental recording (or packer writing) is often confused with the Universal Disk Format (UDF) file system. U D F can be written using any of" the writing methods listed above, and incremental recording can be used with any file system. Track-at-once refers to writing a track and then turning off" the laser, which Forces a break in the sector encoding, thereby resulting in two unreadable sectors on the disc. A gap (usually 150 sectors in length) is then written, which inserts 2 seconds of silence between each track. The Table of Contents (TOC) is constructed from the track information, and is written automatically w h e n the writing session is closed. Disc-at-once writes the T O C first, and then writes each track. There is no gap between tracks and no unreadable sectors are created, thus allowing complete control of the T O C .

www.syngress.com

236


Incremental recording allows you to sequentially write small amounts of data to a disc without the 150-sector gap. It is commonly used for drag-and-drop writing software, which allows you to use write-once and rewritable media. There is some overhead with incremental recording on Compact Disc Recordable ( C D - R ) and Compact Disc - ReWriteable [CD-RW] media. This overhead consumes 7 sectors for each "packet" of information. In general, 7-sector packets are the size of a CD-P,. media file, and C D - R W media files are a fixed size of 16 sectors (32 KB). Most software uses 16-sector packets on DVD rewritable media. There are no packet boundaries on write-once DVD media, thus, it is difficult to determine the size of a packet. Multiple sessions can be recorded with any of these recording techniques; however, it is unusual for Disc-at-once to be used for multiple sessions. Disc-at-once is called "Session-at-once" when used with multi-session recording. All writing to optical media is done using the same laser that is used for reading, except at a higher power level. The laser changes the dye from transparent to opaque, or changes the metallic alloy in rewritable media from crystalline to amorphous or amorphous to crystalline. A change to the dye is a one-way irreversible change, whereas metallic alloy can be changed between its two states an average of 1,000 times. W h e n either Track-at-once or incremental writing are used, write-once media can be used multiple times. While theoretically it is possible to write over an area that was previously written to, drive firmware does not allow it, because it would result in an unreadable disc. The primary use of rewritable media is with incremental writing; however, it can also be written using Track-at-once or Disc-at-once. After the disc is formatted, you can replace a single packet anywhere on that disc. While two passes were originally required to erase and replace the original data, today a single-pass rewrite is possible, which allows existing information to be overwritten directly, fully replacing the existing data. Recovering data from a rewriteable disc is not possible once a full erase has been performed, because there is no data written in inter-track spaces. A full erase consists of writing over the entire surface of the disc, leaving no traces of the previous data. This is different from the quick erase operation, which leaves the data on the disc intact.An unmodified consumer drive cannot access the data on a quick-erased disc, but a modified drive can. (Instructions on how to modify a drive are located in Appendix A.)

www.syngress.com


The technique for using a modified drive is to place a different disc in the drive that is as close to the subject disc as possible. In most cases, this different disc must be completely formatted tbr use with drag-and-drop writing software; however, you do not have to use the same software as was used for the subject disc. Place the formatted disc into the modified drive and use the magnetic spindle clamp to secure it. Press the drive tray button to open and close the tray, to inform the drive that a disc change has occurred. Wait until the disc has stopped spinning and then replace it with the subject disc. Be sure to put the magnetic spindle clamp back on the disc.

Logical File Systems A file system is a mechanism for partitioning and allocating space to individual files, and provides the means to identi~ and access files. File Allocation Tables (FATs) and N e w Technology File Systems (NFTSes) are c o m m o n l y used with PC hard drives. The purpose of a file system is to provide a generic mechanism to store files. These file systems do not define the contents ot: the files. While it is possible to use FATs and NTFSes for rewritable CDs and DVDs, they are not optimized for the unique characteristics of rewritable media; they are designed for hard drives and other media that does not issue a penalty for repeatedly rewriting the same sectors. For manufactured and write-once discs, FATs and NTFSes are not suitable because of the read-only nature of the media. The file systems that are used on CDs and DVDs are completely separate from those used on hard drives. W h e n C D - R O M s were first released, there were some specialized discs that did not use any standard file system. These were mostly used in "vertical market" applications such as automobile repair and aircraft maintenance. The standard file system for CDs is called ISO-9660 and was defined in 1989. The standard file system for DVD discs is called U D E which is part of an ongoing standards process that began in 1996. Some software for writing DVD discs only writes U D E while others write U D F and I S ( ) - 9 6 6 0 . T h e actual specifications for DVD video and DVD audio discs require that you use a restricted form of U D F (version 1.01) and ISO-9660 simultaneously. Macintosh computers can use either ISO-9660 discs or their own Hierarchical File System (HFS) and HFS+ format discs, which are the same file systems that are used on hard drives. CDs were originally used for storing and playing audio. For this purpose, it was not necessary to name the songs and the technology at the same time, and did not provide reasonable ways for consumer electronics devices to display song titles.

237

238


Therefore, the first file system used on CDs was a collection of tracks pointed to by the TOC. Beginning with Windows 95, Microsoft began showing tracks on audio CDs as if they were files on a disc; thus files were called Track 1.cda, Track 2.cda, and so on. These files are created by Windows and do not actually hold the audio information on the disc. Instead, they contain the control information that enables the Windows CD player application to play the track when double-clicked. It is important to understand that there are no fries or file systems on an audio disc. There is only the track data that the T O C provides pointers to. In 1997, So W and Philips defined CD Text, which allows for storing textual information on audio CDs. However, even with this information, these audio discs do not contain a fde system. Philips CD Text information stores lyrics within the audio track information, using the same space that is used for Karaoke graphics. Sony CD Text information is stored in the lead-in area, and consists of the album, the artist, and the track names. Sony CD Text is commonly used on Sony discs and on home-created audio discs. Philips CD Text is not used today. Another difference between hard drives and CD and DVD drives is the lack of partitions. When PC-based hard drives were first introduced and M S - D O S 2.0 was released, a partition table was defined to identify separate areas on the disk that could be used for different purposes. With CD media, a single CD contains single-purpose information. Even without a partition table, it is possible to store multiple file systems on a single CD or DVD, because each file system has the ability to use different areas of the disc to point to the file system control information. Additionally, on a multi-session disc, each session can contain different file systems; however, incompatible structures such as Compact D i s k - Read Only Memory (CD-1KOM) and Compact Disk Read-Only Memory/Extended Architecture ( C D - R O M XA) cannot be present on the same disc. The High Sierra Group (HSG) file system (defined between 1985 and 1987) was the first file system designed for CDs. The original Microsoft CD EXtension (MSCDEX) program supported both HSG and ISO-9660 format discs. ISO-9660, which was adapted from HSG and adopted as a standard in 1988, was the first widely accepted CD file system intended to be used by any computer that a C D - R O M drive could attach to (e.g., all numeric data is represented in big-endian and little-endian forms that are compatible with Intel and Motorola processors). ISO-9660 replaced HSG completely; no applications for creating HSG discs remain.


239

American Standard Code for Information Interchange (ASCII) 8-bit file names are allowed with ISO-9660. However, for increased interoperability, file names are restricted to 8 characters with a 3-character extension (commonly know as "8 dot 3"), which mirrors many minicomputer and microcomputer operating systems (OSes) of the 1980s. M S C D E X did support some non-Western languages (e.g.,Japanese and Chinese), which was dependent on a technique called Multi-Byte Character Set (MBCS) and required inserting special "shift" codes into file names. This support was unique to Microsoft. In 1995, ISO-9660 was enhanced with the addition of the Joliet file system, which allows for 16-bit Unicode character file names with a maximum of 64 characters. The Joliet file system more readily supports character sets such as Japanese and Chinese, because each character is assigned a unique code. Support for Joliet and Unicode character file names is standardized and is present in different OSes other than Windows. The UDF file system was defined in 1996, and supports Unicode character file names of up to 255 characters. It also supports files that are more than 4 GB in size (a limitation of" ISO-966(} and Joliet). Due to this limitation, UDF was the default choice for DVD media. Today, the first version of UDF is still used for DVD video and DVD audio discs. The Macintosh platform has used the HFS file system since the inception of the Macintosh computer. During OS 8, the HFS+ file system was defined, which extends HFS by adding 255-character Unicode file names.The Macintosh platform is unique in that the same file system is used for both hard drives and optical media. Although the HFS and HFS+ file systems are not ideal for CDs and DVDs, they make creating discs easier than PCs running Windows.

CD and DVD File Systems The following table indicates the types of file systems that are on CDs and DVDs.

Type

Platform

Long File Names?

Large Files (Over 4GB)

Typical Use

Red Book

All

N/A

N/A

Audio

HSG

All

No

No

Early CD-ROM

ISO-9660

All

No

No

Data files Continued www.syngress.com

240

Chapter 8

,,


Type

Platform

Long File Names?

Large Files (Over 4GB)

Joliet

Windows

Yes

No

Data files, Unicode file names

Rock Ridge

Linux

Yes

No

Data files

HFS

Mac

No (31 chars)

Yes

Macintosh

HFS+

Mac

Yes

Yes

Macintosh, Unicode file names

UDF

Windows/Mac

Yes

Yes

Windows, Macintosh, DVDs, Unicode file names

Typical Use

In the chart above, "All" refers to conventional PC-type computers as well as other systems, such as embedded control systems (e.g., HVAC, elevators, and so on) and U N I X - based minicomputers. The following describes each of these file systems in more detail.

Red Book Audio Red Book Audio is defined by the Philips/Sony "Red Book" standard (also known as IEC 908), and is the specification that all audio CDs follow. The first version of this standard appeared as part of the patent on CD technology in 1982. It does not define a file system as such, because audio CDs do not have files; they have music tracks. In the original specification, tracks are identified by a number from 1 to 99. In 1997, Sony released an extension of this specification that defined a method by which text information could be stored on the disc to further identify tracks by name. This began to fulfill some of the requirements for a file system, but remains extremely primitive. So W and other record labels use the Sony definition of CD Text, which is also supported by many home CD recording tools. Each track contains subcode blocks of 588 stereo 16-bit audio samples, which are played at 44.1 KHz. Each subcode block represents 1/75 th of a second of playing time.


241

Part of the original Red Book standard was Compact Disc + Graphics (CD+G), which was a way to display graphics on a television while playing a music CD. The graphics are low-resolution (24(11 x 320) and can only be drawn slowly, but are suitable for displaying Karaoke lyrics on a screen while music is playing. This information is stored in the R through W subchannels associated with the audio samples. For each subcode block of 588 samples, there is a total of 96 bytes of graphics information. In 1997, Philips defined an extension to this specification to store textual information on the disc. This information is placed in the same R through W subchannels that are used for C D + G graphics and has the same limitations; only approximately 30 MB of'information can be stored with audio.

HSG The HSG formulated the first definition of a file system for C D - R O M discs, which was viewed as a major step for standardization, because previously there was no standard file system, which meant that C D - R O M s could not be produced for multiple computer platforms. The original support for C D - R O M s for the Microsoft Disk Operating System (MS-DOS) included support for both HSG and ISO-9660 discs. HSG is still supported by Windows 95; however, it is very difficult to find a HSG format C D - R O M today.

ISO-9660 ISO-9660 was adapted from the original HSG definition in 1988, and adopted as an international standard under the International Standards Organization (ISO).The principle differences between the two are the inclusion of time zone information and additional identification fields. The European Computer Manufacturer's Association (ECMA) standard 119 is an exact copy of the ISO-9660 standard; however, unlike the ISO-966(I standard, it can be downloaded from the ECMA Web site for free at www. ecma-inter national, org. ISO-966{) is currently the most widely supported file system interchange standard that is supported by most computers and other systems with CD drives (e.g., an elevator control system with a C D - R O M drive probably supports the ISO-9660 file system). This is generally true even when a proprietary or real-time operating system is being used. All personal computers since 1.990 support the ISO-9660 file system. The ISO-9660 file system is designed for the 8-bit ASCII character set. Some attempts have been made by Microsoft and others to support the use of alternate www.syngress.com

Z42


character sets, but this is not part of the standard and has differing levels of success when used in non-Microsoft environments. There are only three structures that define the ISO-9660 file system: the volume descriptor, the path table, and the director}, entry. The volume descriptor must be located at the 16 th sector from the beginning of the track and points to all other structures. This means that for the first session on a disc starting at sector zero, the volume descriptor is located in sector 16. For a session starting at sector 40526, the volume descriptor is located at sector 40526 + 16 (or 40542). The volume descriptor contains many important data items (e.g., the date the disc was created, and an area that can be filled in with an application identifier). If there are hex digits 01 43 44 30 30 31 01 in the contents of sector 16, there is an ISO-9660 file system on the disc. If the ISO-9660 file system is present, then for 17 characters at offset 814 (32E in hex) the creation date of the disc is present in the form of." •

4-digit year

•

2-digit month

•

2-digit day of month

•

2-digit hour of day

•

2-digit minute

•

2-digit seconds

•

1-digit tenths of a second

•

1-digit hundredths of a second

•

1-byte time zone offset from Generic Mapping Tools (GMT) in 15-minute increments. This can be positive or negative.

This time is always "local," reflecting the time zone that was set on the computer when the disc was created. Offset 575 (23F in hex) for 128 bytes is the application identifier. Many CD writing applications insert information here to indicate the software that created the disc. The root directory consists of a list of directory entries concatenated together in one or more sectors. The beginning sector number is at offset 160 (A0 in hex) in the


243

volume descriptor as a 4-byte integer in little-endian format. The length of the root directory is at offset 168 (AS in hex) as a 4-byte integer in little-endian format. By convention, the ISO-9660 file names are limited to 8 characters, with a 3character extension separated by a period. Directory names are not allowed to have extensions. N o t all writing software respects these limits and can extend the file name to as many as 212 characters. File names only use upper-case letters, numbers, and a small number of special characters. Again, not all writing software respects this, so it is not unusual to find an ISO-9660 file system with lower-case letters in the file names. ISO-9660 files must be less than 4 GB in size; however, this is often restricted by writing software of less than 2 GB. This limitation of ISO-9660 restricts the usefulness of DVD media. This is not a tCactor for DVD video and DVD audio discs, because the m a x i m u m file size is limited to less than 1 GB for those formats. The directory entries for ISO-966() contain the last time the file was modified. Because the ISO-9660 file system is not intended to be updated, the creation time of the file on the disc is always equal to the last modified time and no last access time is recorded. Until the advent of drag-and-drop recording, it was unusual to find an ISO-9660 file system where all of the files were not stored in a single contiguous range of sectors. While this is provided for in the ISO-9660 specification, it is rarely done. Currently, only drag-and-drop writing software creates fragmented files in ISO-9660 file systems. This is significant for forensic examiners because, even in cases where part of a disc has been destroyed, your ability to recover the contents of the remainder of the disc is excellent. Even without a directory, just examining the disc for file headers on sector boundaries is usually good enough to recover most c o m m o n file types (e.g., Microsoft Office documents, digital photographs, and others). Using some type of "data carving" tool on the content of the disc should be sufficient for this.

Joliet Joliet is an extension of ISO-966() that was defined by Microsoft for the Windows 95 operating system and uses a parallel directory structure to enable both standard ASCII file names and longer Unicode file names. The definition of the Joliet extension specifically addresses using up to 64-character Unicode file names and removing the restriction on a m a x i m u m directory depth of eight levels. Some writing software extends this further to allow the file www.syngress.com

!44


name to be over 100 characters in length, which appears to function correctly with current versions of Windows. The volume descriptor for Joliet is required to be in a sector following an ISO9660 volume descriptor in sector 16; usually in sector 17, 18, or 19. This volume descriptor contains 8 bytes of the sector containing the hex values 02 43 44 30 30 31 01. The same fields that are defined for the ISO-9660 volume descriptor in sector 16 are also found in this descriptor. The application identifier consisting of 64 16-bit Unicode characters is located at offset 575 (23F in hex) for 128 bytes.This content can be considerably different from that in the ISO-9660 volume descriptor. Directory entries that are used for Joliet and ISO-9660 are almost identical. The only difference is that the file names are composed of 16-bit Unicode characters rather than 8-bit ASCII characters. The number of files and the content of the files are usually identical between the ISO-9660 and Joliet directory structures. Most writing software does not support having different content, only changing the content of the file names to correspond to the requirements for the different file systems. However, this is not always the case. It is easy to create a disc with different content using freely available tools such as the "mkisofs" program. The result is that it is important to treat the separate directory structures as separate file systems. Discs using the Joliet file system have characteristics similar to the ISO-9660 file system discs, in that the files are almost always contiguous. This means that even without directory information available, it is possible to recover all of the files from those areas of the disc that are readable.

Rock Ridge In 1993, the System Use Sharing Protocol (SUSP) was defined for supporting extensions to ISO-9660. A specific implementation of this protocol is " R o c k Ridge," which deals specifically with extending the ISO-9660 file system to support Portable Operating System Interface (POSIX) attributes (e.g., user and group ID, permissions, and symbolic links for files). R o c k Ridge also supports unlimited length file names. POSIX is not commonly used today, because only Linux is considered to be a mainstream POSIX-compliant OS. Other POSIX-compliant OSes are Solaris from Sun Microsystems, Advanced IBM U N I X (AIX) from IBM, and Hewlett-Packard U N I X (HPUX) from Hewlett-Packard. Windows N T used to have a POSIX subsystem, but it has been discontinued. The mkisofs program and its derivatives are the usual source of discs used with R o c k Ridge extensions. Commercial U N I X systems www.syngress.com


245

also use Rock Ridge extensions, and have disc-writing software specific to individual manufacturers. SUSP extensions are identified by two-letter codes, and each file or directory can have as many extensions as needed. The most common R o c k Ridge SUSP extensions are N M (NaMe) and PX (PosiX). A complete list of defined SUSP extension codes is shown below. SUSP and Rock Ridge extensions are ignored by Windows and Macintosh OSes. The underlying Berkeley Software Distribution (BSD) core of OS X may be capable of using R o c k Ridge extensions. Discs with Rock Ridge extensions are mastered by software, which writes the files in a contiguous manner. Thereibre, without a valid directory, it is possible to separate the files based on header information. Each SUSP extension has a two-character identifier followed by the length of the extension. The extension codes and their meanings are shown below. Code

Description

AA

Apple extensions

CE

Continuation of extension data

CL

Child link

ER

Extension reference

ES

Extension selector

NM

Alternate (long) name

PD

Padding field

PL

Parent link

PN

POSIX device number

PX

POSIX file attributes

RE

Relocated directory

SF

File data in sparse format

SL

Symbolic link

SP

SUSP indicator

ST

SUSP terminator

TF

Additional POSIX time stamps

If you are manually examining an IS0-9660 directory structure with R o c k Ridge extensions, the most important extension types are CE, NM, and TE CE www.syngress.com

246

Chapter 8

•


extensions are not usually present, but should be recognized because they point to continued data in other sectors. The format of a CE extension is:

CE

28

1 Sector number

Offset

Length

The sector number, offset, and length are all expressed as combined big-endian and little-endian values with the little-endian value first. Each occupies 8 bytes; thus a value of 100 appears (in hex) as 64 00 00 00 00 00 00 64. The format of an N M extension is"

NM

Len

1

Flags

N a m e characters

If bit 0 (hex 01) is in the flags, the name is continued into the next N M extension entry. Bits 1 and 2 (hex 02 and 04) indicate that the name applies to the "." and ".." directory entries, respectively. The remainder of the flags are either reserved or not significant. The format of a TF extension is:

TF

Len

1

Flags

Timestamp

data ...

The flags specify what timestamps are present: Bit

Timestamp

Creation timestamp is present Modification timestamp is present Last access timestamp is present Attribute c h a n g e timestamp is present Backup timestamp is present Expiration timestamp is present Effective timestamp is present Timestamps are in long (17-byte) form The timestamps are recorded in the extension in the order that they are listed in when multiple flags are set. If bit 7 of the flags is not set, the short 7-byte form of the timestamp is present (i.e.,YMDHMSZ [Year, month, day, hour, minute, second, zone]) in binary. If bit 7 of the flags is set, the long 17-byte form of the timestamp is present, which is Y Y Y Y M M D D H H M M S S T H Z in character form. For forensic purposes, it can be assumed that if Apple extensions are not present, a Macintosh user program did not create the disc.An exception to this is some OS X www.syngress.com


247

programs that operate at the "native" BSD level. In any event, these would not be considered ordinary Macintosh user programs. The description of" the SUSP extensions is in the Institute of Electrical & Electronics Engineers (IEEE) P1281 SUSP document (see SUSP112.doc). Rock Ridge extensions are documented in the IEEE P1282 R o c k Ridge Interchange Protocol (RP,,IP) document (see RRIP112.doc). Both of these documents can be downloaded from the InfinaI)yne public File Transfer Protocol (FTP) server at ftp://ftp, cdrpro d. c o m / p ub.

UDF The Optical Storage Technology Association manages the development of" the UDF standard, which is an ongoing process that began with the release of the UDF 1.0 specification in 1995. This specification is an outgrowth of" the development of ISO13346 standard. The only PC file system for optical media that is completely updatable is UDE Even on write-once media, the deletion of" files is supported. This is a significant difference from the other file systems previously described. UDF is part of the definition of the DVD video and DVD audio disc formats. It is also used in digital cameras that record directly to CDs, stand-alone DVD recorders, and I)VD camcorders. The first consumer exposure to UI)F was in 1997 with the release of C D - R W drives that could write incrementally using a technique called packet u~ritin~. Unfortunately, in the beginning, much of" the UDF writing software did not have good error recovery, which led to a negative impression of packet writing in general. The situation has not improved much since 1997. It is common to find UDF discs that have "lost" files or directories and UDF discs with serious logical errors in the file system. Often, these discs are unreadable using the original software and Microsoft Windows. UDF file systems can utilize either 8- or 16-bit characters for file names, thus reducing space requirements when ASCII file names are used. Multi-byte characters are not used with UI)F; therefore, there can be compatibility issues with Microsoft Windows versions 95, 98, 98SE, and ME. File names can be up to 255 characters regardless of" the character set being used. There is also no limitation on the depth oC the directory structure. However, if" an excessively deep directory structure is used, there are serious performance issues on optical media.

www.syngress.com

~48

Chapter 8

•


Files can have multiple timestamps under U D F (e.g., a full set of created, last modified, and last accessed times are available). For rewritable media, this shows an accurate last access time to each file. The last access time is generally not updated for write-once media, but it can be depending on the writing software. There are many different versions of U D F and not all of them are compatible with each other (e.g., the version required for DVD video discs is 1.02, which limits files to a m a x i m u m of 1 GB in size. This limitation does not exist with other versions of U D E which limits files to 264-1 bytes in length. Other aspects of U D F change between versions; therefore, it is important to either use software that is independent of the specific U D F version, or to have the correct reader software installed on your computer. Files can be fragmented for all versions other than 1.02. This means that the content of the file can be placed in more than a single range of sectors on the disc. This is important for forensic users, because nearly all CDs written using other file systems have contiguous files. U D F uses a complicated set of descriptors to identify the volume and point to the information that defines it. The "anchor" for a U D F volume is a sector k n o w n as the Anchor Volume Descriptor Pointe (AVDP). This sector is identified by bytes 02 00 in the first 2 bytes; the last 4 bytes have a little-endian integer equal to the sector n u m b e r . T h e AVDP can be found in any of a number of areas on a disc" •

Sector 256

•

Sector512

•

Last written sector on the disc .91

•

Last written sector on disc 256

•

256 sectors after the beginning of the track

•

512 sectors after the beginning of the track

Once the AVDP has been found, there is a sector number and length (in bytes) of the volume recognition sequence at offset 16 (10 hex). This serves the same purpose as sector 16 on an ISO-9660 file system and describes the file system. There are several important values in this area that should be formatted using a forensic disc examination tool: The date and time w h e n the disc was initially created This is not the date and time w h e n the content was written to the disc, because most U D F r

www.syngress.com

•


•

Chapter 8

249

writing software supports incrementally adding files to the disc after it has been formatted. []

An application identifier that says which application created this U D F file system.

m The name given to the disc when it was formatted. This may be different from what is displayed by Microsoft Windows, and may reflect a different intent for the disc than the more up-to-date name shown by Windows. For forensic examiners, it must be clarified that while files can be deleted on write-once media, the actual file is not deleted; it just drops from the directory structure. Given the potentially fragmented nature of files, it is not a simple matter to use a data-carving tool to locate deleted files on the disc. Forensic software that supports the U D F file system must be capable of searching out these deleted files and reestablishing them for the user to access. O n rewritable media, it is possible for the writing software to reuse space originally occupied by a deleted file. However, there is a very low limit as to the number of times a particular spot on rewritable media can be updated; usually an average of" 1,000 times. This means that if a user keeps updating a file (i.e., writing to it, deleting it, and writing to it again) it would quickly wear out that area on the disc. The result is that it is unusual to find U D F writing software that will reuse deleted space on a disc before all of the never-used space has been used once. This serves to maximize media life, and is an important consideration for the authors of disc writing software. For forensic examiners, this is a significant advantage over hard drives, because until the user fills the entire disc, nothing will be overwritten and the entire history of content of the disc is available. It is rare to find contiguously recorded files on U D F discs.Just examining file headers generally will not produce valid, intact files.You must use a forensic tool specifically designed to handle U D F discs, especially w h e n there are problems with the file system. If you do not use such a tool, you are going to have a difficult time processing discs using the U D F file system.

HFS This file system was originally incorporated into the Apple Macintosh OS version 2.1 in September 1985, and is one of the few cases where a hard drive file system was implemented for optical media directly.

www.syngress.com

250


The original way to create an HFS C D - R O M disc in the late 1980s and early 1990s was to copy the data to an external hard drive that was between 500 MB and 1 GB in size, being careful not to exceed the capacity of a CD (650 MB at the time.) This disk was set up with the exact content that the C D - R O M had. The hard drive content was then copied to tape for mastering the C D - R O M . This technique was replaced by Macintosh-specific C D mastering software using the Asarte Toast program. HFS supports 31-character file names using the ASCII character set. N o provision for characters outside of the ASCII character set exists. HFS has been updated with HFS+, which provides for longer, non-ASCII file names. Since this is a hard drive file system, files can be fragmented. Depending on how the disc was created, the amount of fragmentation can be considerable. In general, however, if the disc is mastered in the usual way, there will be no fragmentation on the disc. Even though this file system was defined in 1985, it was designed to manage large files that exceed 4 GB; therefore, there is no limitation on using this file system for DVD media or larger capacity discs. Each file has a complete set of created, last modified, and last accessed timestamps. These times are expressed as big-endian binary integers in number of seconds. Unfortunately, HFS is not well suited for optical media. It has the fixed knowledge of 512-byte sectors built into it. This means that each C D or DVD sector contains four 512-byte HFS sectors.Additionally, file allocations are done based on allocation blocks, which can be any power-of-2 multiple of 512. C D and DVD media 2,048-byte allocation blocks are possible, but 4,096 and 8,192 are common. Due to the multiple sector and block sizes, it is difficult to examine an HFS file system with just a hex display of the sectors. HFS has a limited amount of text information in the file system control structures. The name of the disc is contained in the Master Directory Block, which is found in sector 0. Also in sector zero are the Partition Maps, which contain the name of the software that created the disc. It is unusual but possible to find a multi-session HFS disc. The Macintosh system does not treat multi-session discs the same way that Microsoft Windows does; therefore, the usefulness of such discs is limited. The most c o m m o n HFS discs in the USA are AOL discs that contain ISO-9660, Joliet, and HFS file systems. All of these are contained in track 1 of the disc.


Some forensic software can process HFS CDs and DVDs. Since the software for creating discs that have only the HFS file system on them is not c o m m o n for the Microsoft Windows or Linux environments, these discs are generally restricted to users with Macintosh computers.

HFS+ The HFS file system was extended to H F S + with the introduction of OS 8.1 in 1997. H F S + file names extend to a m a x i m u m of 255 characters and stores them in Unicode rather than 8-bit ASCII characters. H F S + moves the name of the disc from the Master Directory Block to the top level of the directory tree. Untbrtunately, this is not easy to find; therefore, determining this without software to interpret the H F S + file system is not practical.

El Torito The E1Torito standard closely interacts with file systems. E1Torito was originally defined as a way for computers (not just P C - t y p e machines) to be able to boot from C D - R O M discs. Prior to this, booting was restricted to floppy diskettes and hard drives. What E1Torito does is define a set of control structures so that it is possible to have a single C D - R O M disc bootable on many different hardware architectures. This means that a single disc can be booted on both PCs and Macintosh computers as long as all of the required information is present for both platforms. The E1Torito standard requires the use of sector 17 to contain the boot volume descriptor, which points to the booting catalog, which in turn points to bootable images. These images can be emulated floppy diskettes, emulated hard drives, or a m e m o r y image. Each entry in the booting catalog refers to a specific hardware platform (e.g., Intel x86, PowerPC, Macintosh, and so on). For each platform, there can be one or more bootable entries as well as additional non-bootable entries. The non-bootable entries can, in theory, be used as a primitive file system by the bootable programs. A bootable entry then identifies the emulated media type, the starting sector of the image, and the number of sectors in the image. This is then used w h e n booting from the emulated image in the same way a real floppy diskette or hard drive is booted. N o n - e m u l a t e d entries are handled differently and do not make a portion of the disc appear. Instead, the entire image is brought into memory.

251

252


The result is that it is relatively easy to take a bootable floppy diskette, transfer the files to a C D - R , and be able to boot from the copy on the C D - R . Many different writing programs assist with doing this, and provide the ability to read in a floppy diskette and place it into a disc image. Because it is c o m m o n to find computers without floppy disk drives, this can be extremely helpful.

Space Allocation by CD and DVD File Systems One of the more basic jobs of a file system is to allocate space on the media. O n hard drives, this is often accomplished with a bit map or other allocation table, because the information must be updated. O n CDs and DVDs, the requirements are different because the media is read-only. FAT and N T F S space allocation is managed on a cluster basis, a cluster being a group of sectors. This helps to minimize fragmentation. This is not necessary on readonly file systems, because there is no updating of files. Another difference is that hard drive sectors are 512 bytes in length and C D and DVD sectors are 2,048 bytes in length. This means there is already a grouping equivalent to four hard drive sectors w h e n allocating C D and DVD space. ISO-9660 does not define any space allocation information, because it is by definition a read-only file system. Files are stored contiguously on the disc and cannot be modified. Space for files and the file system control information are allocated on a sector-by-sector basis w h e n the file system is created. Joliet and R o c k Ridge are extensions to ISO-9660 and do not change how space is allocated. U D F can be the same as ISO-9660 w h e n the file system is read-only, or it can require some degree of space allocation information w h e n a rewritable disc is used. In both cases, U D F allocates space on a sector-by-sector basis.This can result in fragmentation but usually does not because of how space on rewritable media is used. In general, the entire disc is written to before any deleted space is "reclaimed" for use. The reason for this is that rewritable discs have a limited number of write/erase/write cycles for each sector.Therefore, it is optimal to spread the write/erase/write cycles over the entire surface of the disc. It should be noted that rewritable media is not generally rewritten at the sector level but at the packet level. A packet is a group of sectors just like a cluster, but is not used for allocation purposes by any of the drag-and-drop file systems. www.syngress.com


253

HFS and HFS+ use a completely different strategy for allocating space, which is to be expected because it was first defined for hard drive use. HFS knows that all sectors are 512 bytes and these are grouped into allocation blocks. Each allocation block consists of a power-of-two number of sectors (usually 2K, 4K or 8K) to accommodate the 2K CD sector size. There is an allocation block bit map that represents free and allocated allocation blocks on the media. The most c o m m o n way to construct HFS and HFS+ file systems for CDs and DVDs is to build the file system when the disc is mastered. At the beginning of CD recording, there were no CD-specific tools for creating HFS file systems; therefore, the procedure was to create the file system on a hard drive, test it completely, and then write it to a CD. It was possible then for the file system to contain fragmented files, free space, and other hard drive artifacts.

Disc Accessibility Problems Many issues can develop that make files, subdirectories, and entire discs inaccessible to the user.This occurs frequently with U D F discs, but can happen with any file system w h e n updating is supported. From a forensic standpoint, this is useful because, as files become inaccessible, they are left in their original state and not altered or deleted later.This can give the torensic examiner a w i n d o w into the previous state of the data on the disc.

ISO-9660/Joliet Fi le Systems Because of the simplicity of" these file systems, it is unusual to find a disc with a damaged file system that prevents access to one or more files. However, discs such as these can have readabilitT issues that prevent critical parts of a disc from being read, which can mean the disc is inaccessible under normal circumstances. C D / D V D Inspector can usually bypass these types of problems through a combination of using alternative sources of information and by searching (e.g., Microsoft Windows normally uses the path table to locate directories. If the path table is not readable, Windows cannot access the disc. C D / D V D Inspector can navigate through the directory structure by using information in the directory, not referencing the path table.Therefore, the disc is completely accessible under C D / D V 1 ) Inspector. A forensics examiner may encounter a disc with a large amount of space that is unaccounted for by the Disc Map tool. With ISO-9660 and, optionally, Joliet file systems on this disc, is a clear indication that either there is another file system (such as

www.syngress.com

Z54


HFS or HFS+) present on the disc that may not be readable, or possibly that the disc was created using the mkisofs tool. In the latter case, it is possible that there were files added to the disc that are not represented in the directory. Additional work is required to gain access to that data using the Copy Sectors or Sector Display tool.

UDF File Systems U D F file systems are more complicated than ISO-9660 or Joliet. Because of this complexity, these file systems are often logically corrupted or broken in such a manner as to lose one or more files or even an entire directory. This usually happens because of software errors, but can also be caused by errors w h e n updating rewritable sectors on a disc. Most of the software for writing discs using the U D F file system is focused on creating updatable discs on either write-once or rewritable media. The maturity of this software is approximately that of the FAT file system w h e n the IBM PC AT was released in 1985. There were few tools for the average user to recover from errors on floppy diskettes and file system errors were common. Today, there are only a small number of tools for repairing or recovering files from damaged U D F file systems, and they have not achieved wide market penetration. For the forensic examiner, the problems with U D F file systems are significant. W h e n files are "lost," the user often does not realize that there is an intact copy of the file on the media that can be recovered. This can be important w h e n other copies of the file have been deleted from the disc. There are very few tools that allow you to regain access to lost files, and only C D / D V D Inspector couples this capability with other forensic features.

Other File Systems Logical damage to other file systems is extremely rare. Because these other file systems are less frequently encountered, it is almost certain that an examiner will never encounter problems with HFS and other file systems.

Forensic Binary Images Typically, a binary image of a hard drive is immediately created w h e n a forensic examination begins. This is done to stem the possibility of the hard drive contents being altered during examination. As long as this binary image is an exact bit-for-bit copy of the original hard drive, it can be used as a substitute for the hard drive itself. www.syngress.com ,.=

~1


255

There are many tools that can be used to create a binary image file from a hard drive. Copying sectors from the hard drive to some other type of media (including another hard drive) is all that is required. It is common practice to perform validations on a hard drive and its image contents to make sure that they are identical. Using a hash value such as Message Digest 5 (MD5) or Secure Hashing Algorithm 1 (SHA1) can validate that this has been done. This has also been attempted with Compact Disc (CD) and Digital Versatile Disc (DVD) media, often using the same image file format. There are those in the forensic community that believe it is possible to create a binary image file that is identical to those created with hard drives; however, this is overlooks several important aspects of how such discs are written. Compact D i s k - Read Only Memory ( C D - R O M ) data discs and commercially produced DVDs can be imaged easily, because they contain one type of sector that begins with sector zero and extends to an endpoint on the disc. User-recorded discs are commonly based on the R e d Book audio and can be imaged fairly easily. User-recorded data discs are either multi-session or written with drag-and-drop software. If these types of discs involve multiple tracks, mixing the types of sectors is possible. User-written multimedia discs can involve multiple types of sectors in a single track (e.g., it is common to mix XA Mode 2 Form 1 sectors with 2,048 bytes per sector with XA Mode 2 Form 2 sectors with 2,352 bytes per sector). Many recording applications use multiple tracks where, unlike manufactured discs, the area between tracks is not readable. This presents a problem when treating a CD as a contiguous span of sectors. The Table of Contents (TOC) for a disc provides an index into the different tracks. There is no corresponding data for hard drives, which only contain the sector data. The disc T O C also provides an indication of whether the track contains R e d Book audio or data sectors, which is required to properly read the contents of the disc. Determining what types of sectors are present in a track can be accomplished by examining other control information for the sectors or by examining the file system. DVDs only have a single type of sector; however, multi-session recording is possible. The index of border zones for a disc is similar to the T O C for a CD, and is required to properly process a multi-session DVD. In order to construct a binary image of a CD or DVD, each track sector must be on the disc along with an index indicating the type of track (for CDs) and the original starting location of the track. www.syngress.com

256


C D / D V D Inspector 3.0 allows you to make a binary image file of any disc, which can later be run against that image file without the disc being present. While the image file format is specific to C D / D V D Inspector, coordination with other tools is expected.

Reproducing Forensic Images In the case of hard drives, a forensic binary image of a drive is reproducible. As long as the contents have not been altered, every image taken of a hard drive is identical as long as the scope is limited to hard drives, flash memory, and other magnetic media. This is not always the case with CD and DVD media, where reading from a disc with different drives can produce different results. This can result from different implementations of error correction strategy in the drive firmware and the hardware controlling the laser and optics. With some drives, it is possible to obtain non-reproducible results from successive imaging, which can be observed with some Pioneer DVD writers on packet-written Compact Disc 1Kecordable (CD-1K) discs. Assuming that it will always be possible to create identical forensic images from reading CD or DVD media is problematic, and calls into question evidence or forensic lab procedures should the MD5 or SHA1 hash value of such images not match. It is strongly recommended that you not attempt to compare forensic images or forensic image hash values unless the examiner is fully aware that mismatches can be "normal." A recommended procedure is to either work from the original media or to work from a single image file. When working with the original media, use proper procedures to avoid contamination by software that does not belong on a forensic computer. When working from an image file, use before and after hash values to verify that the image has not been altered. Do not attempt to re-image the media and compare images or image hash values.

Collecting CD and DVD Evidence The following sections address the number of specific considerations needed for handling and collecting Compact Disc (CD) and Digital Versatile Disc (DVD) evidence. These sections also describe how to recognize CD and DVD media, how to protect yourself while collecting this evidence, and what precautions need to be followed in order to preserve it.


257

Recognizing CD and DVD Media In many cases, it is not necessary to collect manufactured discs that contain evidence that can only be stored on recordable discs. Due to differences in color, do not separate manufactured media from recordable media. If it is necessary to limit the number of discs being collected and time does not permit any analysis of the discs, it may be necessary to select discs based on their appearance. This should be avoided whenever possible. As part of the InfinaDyne C D and DVD Forensics class, students are given a disc that has been created with a clear laser-printed color label and that intentionally looks like an America Online (AOL) disc. If inserted into a computer with Windows, this disc behaves like an AOL distribution disc. Depending on the types of cases you work on, it is possible that you will encounter such a subterfuge. The question is not whether you were able to recognize the disc as recordable, but whether or not a colleague with less experience will be able to make that identification. It is strongly recommended that you collect every disc containing evidence. Do not to be fooled into thinking that every disc contains incriminating evidence; this is exceedingly rare.

Collection Considerations As mentioned previously, CDs are resistant to scratches on the data side, but the top surface can be easily damaged. If the top surface of a disc is scratched, there is no way to recover the data and the disc is rendered unreadable.Touch only the edges of the outer rim and center hole; to avoid contamination, do not touch the fiat surfaces. CDs are manufactured with a "stacking ring" near the center of the disc, which serves to keep the bottom of one disc away from the top of the disc below it w h e n stacked on a spindle. The lacquer on the top of a disc can become sticky even under ordinary environmental conditions, and is exacerbated in humidity. W i t h o u t the alignment provided by a spindle, if two discs are placed on top of each other, the lacquer may stick to the bottom of the disc placed on top of the other disc; separating the discs can also remove the reflector from the bottom disc, which can lead to a loss of evidence. Fastening discs together with rubber bands or tape can also destroy them. R u b b e r bands bend the edges of discs, thus deforming them. Tape can adhere to the top surface of a disc and, when removed, also remove the reflector from the disc. Some types of plastic wrap can also adhere to the lacquer and remove the reflector. For

www.syngress.com

258

Chapter 8

•


these reasons, it is not recommended to wrap discs in plastic or tape, and they should not be secured by rubber bands. Ideally, discs are stacked on their original spindles. This is the best way to package discs, but may not always be practical. If the discs cannot be stacked on a spindle, they should be arranged in a stack in a paper bag and the bag taped to hold the discs in place. Properly stacking discs will also preserve fingerprint evidence.

Marking Discs As mentioned previously, discs are not impervious objects; both polycarbonate and the lacquer coating can absorb humidity and other chemicals. It is recommended that you use water-based markers for writing on discs because of the following: •

Ballpoint and rollerball pens will damage the data area of a disc.

•

Sharpie brand markers are rated unsafe by their manufacturer because they are alcohol-based, and should be avoided in order to preserve evidence.

•

Markers that are solvent-based will dissolve the lacquer coating and destroy the reflector beneath it. Such markers can also damage the polycarbonate. While it is generally safe to use solvent-based markers in the clamping ring area of a disc, it is not recommended.

[]

Other markers that are not clearly identified as solvent-based or water-based can pose a substantial risk to the data area of a disc. If there is a solvent odor when the cap is removed, the marker should not be used on evidence discs.

•

Labels can be applied to discs; however, if the adhesive is not the right type for CD use, a label can peel off of the disc, which will interfere with the disc when it is being used. R e m o v i n g such a label would likely peel the reflector from the disc, thus destroying it. The adhesive may also interact with the lacquer and possibly destroy the reflector.

www.syngress.com


259

It is generally safe to write anywhere on the top surface of a disc with waterbased markers (sold as water-based markers and as specially labeled " C D Markers"). Avoid writing in any area that already contains markings. Writing using a waterbased marker in the clamping ring area of the disc is always safe. Using labels that are placed in the clamping ring area is also safe, and will not affect the balance of the disc. These labels are commonly available and can be laser printed.

Transporting Discs As mentioned previously, discs are sensitive to excessive heat (over 49C/120F) and ultraviolet (UV) light. Care must be taken to keep discs out of the sun and out of a potentially hot car interior. Additionally, prevent discs from receiving excessive vibration, as it can erode' the surface of a disc if it comes into contact with other objects.

Documenting and Fingerprinting Discs At some point, it nlay be necessary to collect evidence (e.g., fingerprints and surface markings) from a disc. Photographing the surface of a disc to document surface markings is recommended, because in order to process the data on the disc, it may be necessary to clean it, which can compromise the surface markings. The environment inside a C1) or I)VD drive is not conducive to successfully processing fingerprints. This mea~s that fingerprints must be processed in such a manner as to not destroy the readability of the disc. Developing fingerprints with powder and photographing the results is compatible with this objective. It is possible to remove residual powder from a disc completely, even by washing the disc in plain water. We do not recommend using any cyanoacrylate (superglue) processes, which would likely leave artifacts on a disc and affect readability. Shielding the bottom of the disc can eliminate these artifacts, but excludes processing the bottom of-the disc. Any use of tape-based fingerprinting processes will destroy discs. If portions of the reflector have been removed by lift tape, it is not possible to recover the information that was written on that area or-the disc and may prevent the disc from being read. H o w to document a disc depends on the specific procedures for your laboratory. It is not recommended that you place rectangular labels on individual discs, because they can cause serious out-of-balance conditions in m o d e r n high-speed drives. If labeling individual discs is required, we recommend using "hub labels," which are small circles that go in the center of the disc covering the clamping ring. Hub labels are specifically designed for use on CDs and DVDs, and are compatible with the www.syngress.com

260

Chapter 8

*


high-speed drive environment. Most other label adhesives are not compatible with this environment, and can result in the label peeling off inside the drive. Another procedure is to take a digital photograph of the label side of a disc; markings that are placed by the person writing the disc or the user of the disc can be useful as evidence. Some automated systems for processing discs take a photograph of each disc as it is being processed. After fingerprint processing and the proper documentation of any evidence on the disc, light cleaning can be done to remove residual materials and/or contaminants (e.g., powder from fingerprint processing and substances such as cocaine) from the surface of the disc. This should be done without using any cleaning solvents.

Officer Safety CDs and DVDs are often found in areas where there are biological, chemical, and drug hazards. Polycarbonate and lacquer both absorb water and other substances, which means it is not safe to handle discs that have been exposed to hazardous substances. It is important to note that such contamination is unlikely to affect the readability or usability of a disc. Powders and liquids can contaminate discs in ways that make it hazardous for an officer to collect that disc. However, when the source of contamination is carefully removed in the laboratory, the result is a perfectly readable disc. Be aware that when put into a drive, any contaminated disc will be spun off the disc and flung into the air. It is not recommended that discs be cleaned in the field. While special handling considerations may apply to contaminated discs, evidence can be destroyed by improperly cleaning a disc; fingerprints and other trace evidence can also be lost. W h e n polycarbonate fractures, sharp fragments can be produced. Broken discs can be a significant hazard, because of sharp edges and because of tiny sharp fragments no larger than a grain of sand. Handling cracked or broken discs can result in a serious hazard if you cut yourself on broken discs or other contaminants in the collection environment.

Preparing for Disc Examination In order to conduct an examination of the digital evidence on Compact Disc (CD) or Digital Versatile Disc (DVD) media, you must have the proper hardware, software, and workstation.


Forensic Hardware It is recommended that you have two separate devices: a reliable Compact Disc ReWritable (CD-RW) drive and a recent DVD writer that can read both DVD+ and D V D - media. Recent writers should also be compatible with Digital Versatile Disc Plus Recordable (DVD+R) I)L (dual layer) media. While it may seem counterintuitive, you must use a writer-type device, because reader devices do not access open sessions on discs. This means that any incomplete drag-and-drop discs would not be accessible with a reader. Worse still, a multi-session disc that has been closed at least once and written to again with drag-and-drop writing software, will only show the finalized content; anything added after that would be invisible. It is not necessary to use a write-blocker device with a CD or DVD writer, because writing software that Cunctions without prompting is not present in Microsoft Windows. Before it will write to a disc, the CD writing capability present in Windows XP requires considerable effort on the part of the user. This writing capability also does not utilize rewritable media, such as CD-P,.W discs, making it difficult to write to a CI) or DVI) without significant user interaction. If necessary, you can disable the Windows XP CD writing capability by opening the "My Computer" window and right-clicking the drive to be changed. Select the Recording tab and uncheck the "Enable CD recording on this drive" option. ( Microsoft has indicated that they will be incorporating the ability to use rewritable CD and DVD media into the Windows Vista program. If this happens, it may not be as easy to disable writing.) Hardware and software write-blocking tools are available to prevent modification to evidence discs. (For more information contact InfinaDyne.) We have found that the Plextor 12x writers are the most capable for reading problematic CD-P, and CD-P,W discs. These drives are no longer available from Plextor, but can still be obtained on eBay. Our recommendations for reading DVD media are Plextor and Pioneer. Using the Pioneer Axx and l xx series of DVD writers for processing C D - R media, we saw non-reproducible Message Digest 5 (MD5) hash signatures when reading Compact Disc Recordable (CD-R) discs written with DirectCD and other Universal Disk Format (UDF) drag-and-drop writing software. We recommend having Ivory soap (bar; not liquid) and distilled water available for cleaning discs. Using ammonia-based cleaners (e.g., glass cleaners) can "fog" poly-

261

262

Chapter 8

•


carbonate and render a disc completely unreadable. (Read the entire E r r o r ! R e f e r e n c e s o u r c e n o t found, section before using any of these products.) Scratch filling products and disc buffing tools can help, but must be used with caution, because they can increase uncorrectable error rates or cause other types of errors.

Forensic Software There are several alternatives for collecting evidence from CDs and DVDs. Unfortunately, most forensic software does a poor job, either because it is based strictly on Microsoft Windows capabilities and Microsoft Windows file system implementations, or because it has limited support for CD and DVD file systems. The AccessData Full Tune-Up Kit (FTK) product has an imaging component (derived from the shareware ISOBuster product) that does a good job of collecting data from CDs and DVDs with any of the commonly supported file systems. The Guidance Software EnCase product has minimal support for CDs and DVDs, but can utilize the InfinaDyne C D / D V D Inspector product to process discs that it does not directly support. The ILook Investigator product has some capabilities beyond EnCase in its native form, but does not support all CD and DVD file systems correctly, nor can it deal with UDF discs that have logical errors. Other products (e.g., those from NTI) do not properly implement all of the possible CD and DVD file systems to any great extent. In general, they only support ISO 9660 and various extensions such as Joliet. InfinaDyne's C D / D V D Inspector can be used with both EnCase and FTK to collect evidence from CDs and DVDs. It can also be used with other products, although testing and certification has not been done.

Forensic Workstation A forensic workstation is one that is qualified for use in processing evidence, meaning it has" •

Proper Basic Input Output System (BIOS) configuration

•

No conflicting software

•

No contaminating data


•

The time and date synchronized properly

•

Properly licensed software

263

For the BIOS configuration, it is important to check the order of the boot devices for a forensic workstation, to ensure that you cannot inadvertently boot from an evidence CD or DVD. Doing so would seriously compromise the integrity of the workstation. In this case, no conflicting software specifically refers to drag-and-drop writing software. Products such as DirectCD, Drag2Disc, InCD, DLA, and abCD have no place on a forensic workstation; they are all invasive and difficult to disable completely. They will potentially modify rewritable media if they are present; in some cases, they will modify write-once media. This modification is unacceptable for processing evidence. The same conditions for contaminating data apply for CD and DVD processing as for hard drive processing. The workstation should not have any data from any other cases accessible. Exceptions to this can be made when other case files are present on a lab network server; however, care must be used to ensure that no crosscontamination is possible. C D / D V D Inspector generally shows the timestamp information from when the disc was written, because CD and DVD file systems contain the time zone as part of the timestamp information rather than the time zone setting on the workstation. However, when copying files from a CD or DVD, the workstation time zone setting is referenced to make the file times relative to the local time on the workstation. All software involved in processing evidence needs to be properly licensed. Anecdotal evidence of testimony has been excluded because it was based on unlicensed software.

Validation The hardware, software, and workstation all need to be validated before evidence processing can be done with confidence. The validation of a writer consists of installing the drive either in the workstation itself or in an external case, connecting the workstation, recognizing the writer by the workstation and software, and finally the successful examination of a known disc. Under normal circumstances, the MD5 signature value computed by C D / D V D Inspector should be compared to that determined by other software. Due to differ-

www.syngress.com

264


ences in how MD5 signatures are computed for multiple track discs, it is recommended that you use a single-track data disc for this purpose. The completion of all of these steps also validates that C D / D V D Inspector software and the workstation are capable of processing discs correctly using that writer. During the class, this validation is accomplished using one of the supplied discs where the MD5 signature for the disc is known.The instructor may also supply other information about the disc.

Disc Triage When an examiner is given a number of discs to be processed, it is reasonable to order them in decreasing readability to get the most easily read discs processed, and then make the results available as soon as possible. Following this, the less readable discs are then processed. Using this process makes the most effective use of both the examiner's time and the workstation time. At this point, it is assumed that all of the initial documentation gathering has been done on the collected evidence, or that it is being done as each disc is initially examined. All of the following procedures assume that the disc can be cleaned of all foreign materials and any labeling of the disc can be destroyed by the cleaning process. The first clue to a disc being difficult to read is the degree of physical damage to the disc. This is not to say that apparently undamaged discs will always be easy to read; however, it is fairly clear that any disc that is heavily scratched, cracked, or damaged in any way is going to be more difficult to read. These should be put aside for later attention. At this time, it is also reasonable to attempt to clean any. discs that are dirty or contaminated. The first rule is that if the disc is not obviously dirty or contaminated, do not clean it. Secondly, perform light cleaning only. If stubborn dirt is present, it will be impossible to read the disc. Care must be taken in handling contaminated discs. Take special precautions with discs that are cracked, because they may break, leading to sharp pieces of polycarbonate that can puncture the skin. As a first step, rinse discs with distilled water to remove surface dirt, possible drug contamination, grease, and/or oils, and so forth. Dry the disc with a soft lint-free cloth. If rinsing the disc does not remove all foreign materials, use a diluted solution of pure soap (e.g., Ivory) and distilled water and a soft lint-free cloth, preferably not woven. This specifically excludes using any detergent, dish soap, or detergentbased liquid soap; such products can react with the lacquer, label, or polycarbonate

CD and DVD Forensics ° Chapter 8

265

in undesirable ways. Wipe across the surface of the disc in a straight line, not a circular motion. O n e technique that is quite effective to protect the reflector of the disc during cleaning is to place it upside down in a .jewel case, which will hold the disc securely enough while it is being cleaned. After this treatment, any contaminants that didn't come off in the drive may require significant effort that can damage a disc. Attempt to process the disc before proceeding with any further cleaning efforts. At this point, discs that are scratched or otherwise damaged after cleaning should be put aside. The second phase of the triage operation is to begin examining a disc with C D / D V D Inspector while allowing it to continue for no more than five minutes. If C D / D V D Inspector has not gathered the directory intbrmation from the disc in five minutes, the disc should be put aside, because it requires more extensive work. All of the discs that gathered the directory information within five minutes can then be processed to completion. Next, an evaluation can be done to determine if sufficient evidence has been found or if additional discs must be examined. If so, the undamaged discs that took more than five minutes with C D / D V D Inspector should be processed. It can take significant amounts of time For C D / D V D Inspector to process a disc that has readability problems. While some or all of the files oi1 the disc may be recovered, it can take days to do so. It can take an equal amount of time to copy the information From a disc. Therefore, it is appropriate to skip any disc that takes more than five minutes to be examined, and put it aside for later processing early in the triage process. If sufl~cient evidence is collected without processing such discs, this may not be necessary. Later, if such problematic discs must be processed, the examination of the disc should be left to run as long as it takes. At this point, you are left with the discs that have stubborn dirt or physical damage. If any of these discs are partially readable and not physically damaged, you should process them with C D / 1 ) V I ) Inspector before continuing. It might also be helpful to attempt to make a copy of these discs. Discs that are physically damaged, especially with damage to the reflector, should not be put into a drive until these problems are addressed. All of the techniques for working with discs from this point on can damage them. If a disc is partially readable, all of the evidence should be collected before continuing. R e m o v i n g stubborn dirt usually requires that you use some type of" solvent. There are specific C D and DVD cleaning solutions that can help; try them first, as they are least likely to have damaging effects. I)o not use any type of cleaner based on organic www.syngress.com

266


or petroleum solvents; such solvents will remove the lacquer and reflector and can "eat" the polycarbonate. Ammonia-based cleaners designed for glass or other surfaces can be used; however, first test the cleaner on non-evidence discs. Some ammonia products can fog the polycarbonate and render the disc unreadable. All of these cleaning agents can destroy any markings on the top surface of the disc. Aside from cleaning, discs with scratches can sometimes be fixed with buffing tools, which fall into two broad categories: the consumer units for less than $50.00, and the commercial units that can range from $800.00 to $1,000.00 or more.The consumer devices are safe when used properly. Be sure to follow the directions and buff the correct side of the disc. O f primary concern is damaging the disc by removing too much material; as such, consumer devices don't remove too much and are reasonably priced. Commercial buffing systems can remove "enough" material to eliminate scratches completely, and can also remove considerable amounts of polycarbonate from a disc. This can introduce aberrations and distortions into the shape of the disc. Use such machines with great care; it is possible to take a disc that is 50 percent readable and make it 100 percent unreadable. It is recommended that you gather all possible information from such discs before using a commercial-grade buffing system. Scratch filling products can also be helpful when there are deep scratches. However, it must be clearly understood that CDs and DVDs are read with infrared light and not visible light. Therefore, scratch fillers can appear to have hidden scratches in visible light and be utterly opaque to infrared light. Selecting a scratch filler product that performs well can be difficult. Testing by Media Sciences (www.mscience.com) has found that several of these products actually make the problem worse. Discs where portions of the reflector are missing should be handled extremely carefully to prevent further damage. One suggestion is to apply a label to the disc to "lock down" the remaining portion of the reflector and prevent further peeling. Such peeling can occur when the disc is being read in a high-speed drive. Applying a fullcircle CD label can prevent this from happening. Discs that are cracked or broken in half can be processed, but it may require the disc swap process described below. The first step is to stabilize the cracked area or to rejoin the broken halves. It is recommended that you use one of the clear discs on the end of a spindle to protect the discs. Glue the top of the cracked disc or halves onto the end piece. Many common office adhesives will work, but avoid strongly solvent-based products like rubber cement and contact cement. White glue will prob-


267

ably work, although the drying time may be longer than with other adhesives. After gluing, the disc will be thicker than a standard disc and may require a modified drive in order to be read. Discs with portions of the reflector missing, with cracks, or otherwise damaged may not be able to be read in an ordinary drive, because all drives must read the Table of Contents (TOC) from the disc in order to "mount" the disc. This is how the drive determines that there is a valid disc inserted rather than a piece of cardboard. If the T O C in the lead-in cannot be read, the disc cannot be read in an ordinary drive. This is where the "disc swap" technique comes into play using a modified drive. The technique is also required for quick-erased discs. Swapping discs requires that you have a disc as close to the subject disc as possible. The type (e.g., C D - R , CD-RW, D V D - R , DVD-RW, D V I ) + R , DVD+lZW) and color (e.g., dye formulation) are important, because the drive measures the "replacement" disc and determines how to read it. When you swap in the subject disc, these parameters are retained. If" the replacement disc is not a good match, there will be problems reading the subject disc. It is not necessary that the exact dye be matched, but it is recommended that it be matched visually. This should result in a good match of reflectivity and contrast. For write-once discs, the replacement disc should have the same track arrangement and at least as much data written to the disc as the subject disc. If you have no idea what was written onto the subject disc, you can guess; you may have a singletrack data disc that is completely full (700 MB for a CD, 4.3 GB for a DVD). For rewritable media, the replacement disc should be completely formatted. The swap technique for this type of disc is as follows: u

Put the replacement disc into the modified drive and use the tray button to indicate to the drive that the disc has been changed.

•

Wait until the disc stops spinning. Attempting to stop the disc before it stops spinning can result in serious cuts. Polycarbonate spinning at high speed is very sharp.

•

Remove the replacement disc and put the subject disc in the drive. Replace the magnetic clamp. Do not touch the tray button; the idea is to not inform the drive that the disc has been changed.

Due to the hazards of exposing the drive laser, this information should only be used by qualified persons. Failure to take proper precautions can result in serious eye damage, even blindness.

www.syngress.com

268


If this disc swapping technique does not work with a disc, or the disc is too badly damaged to place into a drive, all is not lost. InfinaDyne has several contacts in the academic c o m m u n i t y that may be able to assist with discs that are otherwise unreadable. O n e system that has come to our attention can work with as little as one-eighth of a disc. Using such equipment should be a last resort and will incur significant delays and expenses.

Chapter 9

269

270

Chapter 9 ° MP3 Forensics

Introduction I remember when I got my first boombox, circa 1983. It was sea-foam green and had two tape decks and a radio. It came with batteries and was so small and portable that I could take it with me everywhere I went. Then there was my first Walkman, the size of a brick, with giant, spring-loaded headphones. And after that, my first portable CD player, which cost almost a month's wages back in 1990. Today, of course, portable music players are commonplace and mundane. Although five years ago having white iPod headphones on meant you were hip and stylish, now it just means you like to listen to tunes. But more and more, the iPod is becoming a medium to store not just music, as we will see. At a conference, I had a conversation with a federal agent about a child pornography case that he had worked on. He and his colleagues had raided the suspect's home as usual, but noticed that the suspect was strangely unalarmed and even smirking as the agents copied all the data from his computers. He continuously proclaimed his innocence. The agent remembered a presentation I had given about iPods being used to store data and noticed that the suspect had an iPod on his desk. According to the warrant served on the suspect, the agents were permitted to seize all electronic equipment capable of storing data. The agent picked up the iPod, and suddenly the suspect's demeanor and attitude c h a n g e d ~ h e turned pale and became agitated. Before the raid was finished, the suspect had confessed that he routinely erased his computers' hard drives after transferring all of his child pornography photographs to his iPod. The evidence resulted in a conviction. This section of the book will demonstrate how iPods can be used to store any type of data or information that can be stored on a regular personal computer. The data can be encrypted, hidden, and easily manipulated by the user. In this chapter, we will explore the ways to store, access, and find data stored on iPods, and the tricks people use to hide malicious data.

History In the late 1990s, digital music began to gain in popularity. The MP3 music format was portable and the sound quality was closer to that of compact discs than the analog tapes that had been used for decades prior could ever be. The MP3 format used compression so that the files were small in size and could easily be stored and listened to on a personal computer.

MP3 Forensics • Chapter 9

271

Before the paint had even dried on MP3 technology people had figured out ways to cheat the system. The new MP3 technology led to two of the first file-transferring networks: Napster and Gnutella, which allowed users to share and download music without purchasing it, leading to government and retail industry outrage and uproar. This was a gray area at first, since there were no laws on the books about file transt'erring or sharing f'rom peer-to-peer networks and individual users. Eventually Napster, Gnutella, and most other similar networks were shut down by government authority. Soon after MP3 technology caught on, the first digital media players became available, but there was still not a commercially viable way to legally purchase and download MP3s until 20(t0-2(i01, when Apple released the iPod and its iTunes online retail download service. Suddenly consumers had a very good way to legally purchase music and transfer it to their iPods or other digital media players. The digital music industry boomed, and since then it has become a powerful segment of the music business as a whole. Although there are many different brands and types of digital media devices, Apple's iPod accounts for more than 80 percent of" the digital media market, so this section of" the book will focus exclusively on the iPod.

Why Is an iPod Considered Alternative Media? iPods have standard file systems of either Apple's HFS+ or Microsoft's FAT32, which we will explore in greater detail later. These file systems are static because they are not continually transferring data like other types of file systems, such as cell phones, for instance. Because of their static nature, performing forensics on iPods is not substantially different t}om perf-orlning forensics on a regular computer hard drive. The difference between an iPod and a regular computer that makes an iPod an alternative media device is that the prinlary function of an iPod is as a music player. Only recently have iPods evolved into photo storage and video player devices. Because they are used for entertainment purposes, iPods might not be thought of as data repositories containing evidence. What follows is a detailed description of iPod forensics and the process that n~y colleagues and I perform on iPods to extract and analyze data contained on then~.

www.syngress.com

272

Chapter 9 • MP3 Forensics

Imaging and Hashing The first step in iPod forensics is to create an image of a device and hash it to ensure integrity. With digital evidence, we do not work on original evidence. Instead, we attempt to create a duplicate of the evidence. This duplicate can be an exact replica of all data contained on the device. There are two types of images: a physical image and a logical image. A p h y s i c a l i m a g e is a bit-for-bit copy of all data contained on a device, and a logical i m a g e is an image of the file system exactly as it appears on a device. Sometimes it may not be feasible to collect a physical image, and therefore a logical image is your only option. For example, you may have a warrant that will only allow you to copy a user's home directory. In that case, you would not be able to collect any data that was outside of the user's home directory. For forensic purposes, a physical image is always the preferred type. To preserve the integrity of the data, forensic examiners perform what is called a "hash" at every step of the way. A hash is a one-way mathematical algorithm that acts as a "fingerprint" of all data contained on a device. This ensures that the data has not been altered from its original state at any point during the imaging process. Hashes can be performed by using tools such as md5sum. The tool is applied to a file and returns a number that corresponds to a particular algorithm. Then the imaging is performed and the md5sum tool is rerun. If any part of that file is altered after the md5sum tool is rerun, the number will change, signifying a potential loss of evidence integrity. This will ensure that the data you are working on has not been altered. Another way to preserve the data is to use a write blocker. Write blocking a device will protect the device from any manipulation. It will essentially guard your evidence from being written to during imaging. This way, if you happen to make an error, your evidence will be protected. A write blocker typically comprises visible external hardware, such as Logibube's Forensic Talon or Intelligent C o m p u t i n g Solutions (ICS)'s Solo III. A hard drive is physically attached to one of these devices, which will ensure that no writes can be made to the evidence contained on that drive. Since iPods do not have IDE interfaces and use FireWire or USB, they cannot be synced to standard IDE imaging devices such as the Solo III without a USB adapter. Similarly, an iPod should not be synced into a forensic tower and imaged using a Windows-based tool. W h e n you plug any USB or FireWire device into a Windows machine, Windows will "touch" the device and change the files contained on the


273

device. One of the most important rules that forensic examiners must follow is not to alter evidence, including date and time stamps on evidence.

Hardware vs. Nonhardware Imaging You can image data using hardware and software operating systems. It is highly reco m m e n d e d that i f y o u have a hardware device that has a USB a n d / o r FireWire inter(ace, you should image tile data using the hardware device. Hardware devices write-block very well and they leave little room for error. An excellent hardware device is the Tableu Forensic USB Bridge, but others like it are available on the market. They are relatively inexpensive and user-friendly. A nonhardware solution, such as an operating system like Linux or 1)OS, can be configured to not automatically m o u n t a device when imaging. Linux is not a substitution for a write blocker, and is susceptible to human error.

Removing the Hard Drive It is possible to obtain an inla,~c~ by. removing the hard drive from an iPod if the iPod does not use flash memory. Please see the section "Types of iPods," later in this chapter, to see which ones contain hard drives. You can renlove a hard drive ffonl an iPod, but this is prohibitive because removing a hard drive could break the device.

Linux Another method you can use, but only if" absolutely necessary, is to employ an operating system such as Linux (or imaging.You can configure Linux to not automatically m o u n t a USB device when the device is plugged into your forensic tower.This means that in theor'> an iPod would remain untouched with files being unaffected when plugged in. This method allows for no write protection, however. If you make a lnistake, you could destroy your evidence. I suggest if" you use this method that you employ the Linux c o m m a n d dd or the I)CFL lab version, called DCt:LI)D, to image the device.The steps to perform this method follow. The first thing that you see is the f'disk output of" the device, with two partitions. In this case, the d e v i c e / d e v / s d d corresponds to the iPod device which is the target of the imaging process. The first entry in f'disk's output f o r / d e v / h a d corresponds to

www.syngress.com

274


the hard drive of the host computer used in the imaging operation and can be safely ignored (see Figure 9.1).

It is important to remember that the whole point of imaging in this way is to not mount the device.You can do everything you need to image the device without mounting. The next step is to collect the MD5 hash of the device.You can perform this step in multiple ways, such as using another hashing tool or outputting an MD5 file to another directory. The following shows the command syntax for running the md5 checksumming utility "md5sum" on the target device "/dev/sdd" and storing the result in the file "/root/ipod.before.md5" (see Figure 9.2).

MP3 Forensics

•

Chapter 9

275

Next, you view t h e / r o o t / i p o d . m d 5 file to make sure the hash is valid (see Figure 9.3). In forensics, it is good to double-check your work at every point, especially w h e n there is no hardware write protection. The next step is to create an image file from the device. This example uses the Linux "dd" command to image the data (see Figure 9.4).The BS option stands for "block size". Block size can change as desired, and has no impact oi1 the data copied, except to optimize the throughput rate of the copy by copying that many bytes on each copy operation. The next two commands are the input file and the output file. It is important to double check that an iPod device is the input file and not the output file. Putting the iPod device as the " o f " parameter could alter the contents of the evidence drive!

www.syngress.com

276


Figure 9.3 The "More" Command Displays the Contents of the File to the Screen

Figure 9.4 Imaging a Device


277

Figure 9.5 is an example of a completed dd function. Figure 9.5 A Completed dd Function

After the image is complete, perform another hash to ensure that the data has not been changed (see Figure 9.(>). Tile next step is to compare the two hashes (see Figure 9.7).

www.syngress.com

278


Figure 9.6 Performing Another Hash

Figure 9.7 Comparing the Two Hashes

MP3 Forensics ° Chapter 9

As the previoius example shows, the before and after hashes of the iPod device are the same, which means nothing on the evidence drive was altered. Additionally, a hash of the forensic copy should be made to ensure that the hash of the image file is the same as the hash or the iPod. This proves that the image contains the exactly same data as the iPod and the "dd" of the drive worked correctly.

Registry Keys It" you are using a Windows-based imaging tool such as Guidance Software's EnCase, you can use a key in the Windows Registry to write-block a USB device that is plugged into a forensic tower. This will keep Windows from writing to evidence. Doing a Web search on "write blocking USB device" will give further information on the steps necessary to carry out this procedure. It is important to remember that using Linux or a Registry key edit for imaging is a last resort. It is always better to use a hardware write-blocking device.You can find many guides online that will detail the steps you need to follow if you choose to take this route.You can also go to www.windowsitpro.com/windowsstorage/ Article / Article I I) / 4438() / 4438( 1.h tml.

Types of iPods iPods come in many different physical and firmware versions. The first generation of-iPods became available to consumers in October 2001. They had a storage capacity of-up to 1(I GB. There have been many subsequent generations of the iPod. With each ~ew generation, features became enhanced, including the addition of" color screens, and video storage and playback capability. The storage capacity increased as well. Newer iPods can have storage capacities of up to 80 GB, using a Toshiba 1.8 hard drive. The iPod Mini debuted in January 20()4. The Mini was the first iPod available in various colors and was substa~tially smaller than other models. Storage capacity for the Mini was up to 6 C,B, using a l-inch Hitachi Microdrive. The iPod Nano was the new version of the Mini. It was even sleeker and smaller and came in either black o1 white. Current Nano models have a storage capacity of up to 8 GB, using flash memory. The Nano has the ability to store and show digital photographs and video via a color screen. The iPod Shuf'fle appeared in January 2005. The Shuffle used flash m e m o r y instead of" a hard drive. The first Shuffle was smaller than a pack of gum. Unlike the

www.syngress.com

279

280

Chapter 9

•

MP3 Forensics

other iPod models, it had no LCD display. The second-generation Shuffle was even smaller than its predecessor.

File Types Supported Currently, iPods support the following file types: Advanced Audio Coding (AAC), Protected AAC, MPEG Audio Layer III (MP#), Variable bit rate M P # (MP# VBR), Audible Audiobook, Apple Lossless, Audio Interchange File Format (AIFF), Windows Audio, and Compact Disc Digital Audio, JPG, JPEG, TIE TIFE GIE PNG, BMP, PSD, SGI, MPEG-4, and H.264.

File Systems A file system is what organizes a computer's operating system. We discussed file systems at length in previous chapters. The iPod uses two standard file systems: Microsoft's FAT32 and Apple's HFS+. The FAT32 file system is compatible with Apple Macintoshes and Windows PCs. HFS+ is writable only with Macintoshes. If a user has an iPod formatted with FAT32 and both a Macintosh and a Windows-based PC, he can read and write to the iPod using both file systems. Such a user can also write and read to the iPod using Linux. The iPod is essentially a storage device and you can configure it to use almost any file system. I have used the extended 2 and 3, as well as FAT16 file systems on my iPods.

"Hacking Tools" and Encrypted Home Directories At conferences, I like to show agents some worst-case scenarios. One of the things I like to show them is an iPod Shuffle that I have manipulated to act as a devious device capable of malicious activities. I repartition the hard drive so that there is enough capacity to install a bootable Linux distribution that contains various "hacking tools," including the popular Metasploit. The iPod control folder is left intact, along with all of the other folders needed for the iPod to function normally. I start the session by showing them the Shuffle connected to its iTunes library and playing music normally through speakers. I then plug the iPod into another machine and demonstrate how to boot it into Linux without touching the host machine. I

MP3 Forensics ° Chapter 9

281

show them how I can use Metasploit or another hacking tool to break into another machine and access data on that machine. I then explain to them how the host machine is never touched while I am hacking into it using the iPod and that all evidence of these activities is going to be found only on the iPod. The point of this exercise is to show that even if an iPod appears to act like it should, it may not in fact be what it seems. Mo.jopac is another hacking tool for use with the Windows operating system. Mojopac allows a hacker to use an iPod as a virtual Windows desktop. Plugging an iPod into the USB port on a Windows computer copies the applications on that computer's desktop and allows the iPod to become a working virtual machine. For more information or to purchase this tool, go to www.mo]opac.com. Another hacking technique using iPods is called "slurping." Slurping uses a tool called Slurp that captures documents, spreadsheets, and other files from the desktop of a computer using an iPod via the computer's USB port. This can be useful or malicious. For example, a malicious user could ask you whether she can use your computer to charge up her iPod using a USB port on your computer. Once the iPod is synced to the computer, Slurp captures all the documents and spreadsheets on your computer's desktop. The original article and code can be found at www.sharpideas, net/ pod_slurp ing. p hp.

Evidence: Normal vs. Not Normal W h e n conducting an exam, forensic examiners need to know the distinction between normal data files and evidence that is not normal. Depending on the firmware and version of a particular iPod, there may be some variance in this determination throughout an analysis. For example, on older iPods, the song-naming convention displays the entire name of a song plus the music file extension, whereas on newer iPods songs are displayed with a Cour-letter code in addition to the file extension. In Figure 9.8, you see the main directory structure of an iPod Nano, which contains the iPod_Control, Device, iTunes, Music, and Artwork main directories. The N e w Folder icon is not typical.

www.syngress.com

282


Figure 9.8 An iPod Nano's Directory Structure

The Device folder contains files with some important information about the iPod, such as the firmware version and serial number such as you see in Figure 9.9.


Figure 9.9 This is the sysinfo output. You can see the serial number of the device.

O n e or-the files that tbrensic examiners note is the iTunes DB file, which provides information about music tiles, including their file type, music category, and the location on the device.This file is controlled by the iTunes software (see Figure 9.10). If a user manually moved a file onto an iPod, it would not be listed in the iTunes 1)B file. The file is found in the iPod_Control/iTunes director>

283

284

Chapter 9

°

MP3 Forensics

Figure 9.10 An Example of the iTunes DB

The iPod Shuffle has a file called iTunes SD, which provides MP3 location and song title information. The shuffle is the only iPod which contains this file. There is an example in Figure 9.11.

r

m

..

www.syngress.com


Figure 9.11 An Example of the iTunesSD File

The iPod_Control directory is the control center of an iPod. It contains the Music and iTunes directories as you see in Figure 9.12.This is where all music files are stored by def~tult. All music files are dispersed into various directories, each named F # # such as vou see ii~ Fi,mre 9 13 Further investigation of the directories reveals the actual music files themselves. N e w e r versions of iTunes will condense MP3 or other digital music formatted songs into four-letter codes tbllowed b x.... an extension, as shown in Figure 9.14, and as discussed earlier.

285

286



287

Figure 9.13 An Example of f## Music Directories

www.syngress.com

288


Figure 9.14 Example of an mp3 file on an iPod

When you are looking at digital photos or video files on an iPod, it is important to understand that the photos or videos themselves may be important evidence. The evidence could reside in plain sight on the iPod, or it could be hidden inside folders. For example, in a child pornography case, photo or video evidence might be in the default photo and video directories. Further investigation might be necessary to uncover hidden evidence. Other directories are the Contacts, Podcasts, and Notes directories. Different versions of iPods have slightly different directories. For example, the iPod Shuffle has the Shuffle DB but does not have a picture-viewing directory. If there are photos in a Shuffle directory, those photos were placed on the device manually, not using the iTunes software.

www.syngress.com


289

Uncovering What Should Not Be There Just because an iPod has been manipulated or changed from its factory configuration does not necessarily mean that there is suspicious activity going on. Many people like to change or hack their iPods. Sometimes it can be innocent, but other times it can be a telltale sign of malicious activity. Suspicious items to look for are things such as mismatched file extensions. An example is a .jpeg file with a .rap3 extension. Most forensic tools are able to detect such discrepancies by using signature analysis tools. These tools find files that have a header that is different from the extension.You can configure most forensic tools to add custom file signatures. Other suspicious items are hidden or improperly named files, which include files named something i n n o c u o u s - - f o r example, a photo that is named to look like an MP3 file. Additionally, files that should arouse suspicion could include those with blatantly outrageous names, such as "hax0r." Too many partitions indicate that an iPod is not set to the factory default and should be looked at carefully. A file system other than the standard FAT32 or H F S + installed on an iPod could indicate suspicious activity. For example, the image in Figure 9.15 appears to contain a normal iPod directory structure. However, there are a few unusual items that bear notice, such as a Knoppix directory and the syslinux.cf'g and ldlinux.sys files, which indicate that this iPod has some form of" Linux on it. Also of" note is the framework-2.5 directory. This directory contains the Metasploit hacking tool which can be found at www.metasploit.com. In this case, it happens to be D a m n Small Linux (DSL), a very small, bootable version of" the Linux operating system. There is also a slurp-audit directory, which is very suspicious.

www.syngress.com

290

Chapter 9

•

MP3 Forensics

Figure 9.15 A suspicious iPod

Figure 9.16 shows an example of an image disguised to look like an MP3 file. This is a simple and common way of attempting to hide evidence. Photos can be hidden in iTunes, which will load the disguised photo into its library and sometimes can be hidden as song files and placed into the F # # directories to avoid detection. The Music directory shows the standard F # # directories. In Figure 9.16, opening one of these directories reveals two deleted songs that have the older iTunes songnaming convention of writing the whole song. This shows that the user had a previous version of iTunes. Additionally, the file named Hidden.mp3 is suspicious because it is not using the correct naming convention of either the old version of iTunes or the new one. Also it is named Hidden.mp3 which is a suspicious name in of itself. It is also much smaller in size than the other regular music files, which indi-

www.syngress.com


291

cates that something, is wrong such as you see in Figure 9 16 In. Figure 9 16, there are two other files that are smaller in size than regular music files typically are. These files might be image files that a crafty user has attempted to hide as music files. Figure 9.16 Possible Suspect Music Files

Figure 9.16 is an example of the inside of an F # # directory. Looking at the hidden.lllp3 rite using a hex editor shows that the JFIF file header indicates that this is not an MP3 as it should be (see Figure 9.1.7).

www.syngress.com L

292


Figure 9.17 Music file with suspect header

Another tactic that users employ to disguise files is to insert text within a music file. A hidden message such as " T h e cow jumps over the m o o n at n o o n " might be inserted into an MP3 file. The MP3 will still play normally, which makes it difficult to detect. In this case, the best way to detect text within an MP3 file is through keyword searches. It is also possible to get hashes of songs from Apple and compare them to the song hashes on the suspect device. This will not show up on signature analysis because the actual file header will still match its extension. Yet another way to hide photos is to make them cover art. With the color iPods, users can match cover art to music files. Default cover art is often included in songs purchased from iTunes. There are also Web sites that have current cover art. Users have the option of changing the cover art to suit their preferences, making it a good place to hide bad photos.


293

Analysis Tools Forensic examiners can use almost any forensic tool that supports FAT32 or HFS+ for analyzing iPods, including Guidance Software's EnCase, AccessData's FTK, Brian Carrier's Sleuth Kit, and Paraben's P2. All of these tools utilize similar functionality to carry out analysis. All have a relatively intuitive user interface. The Sleuth Kit is primarily for more advanced users and runs only on the Unix/Linux platform. All of these tools are commercially available; the Sleuth Kit is downloadable free of charge. Not all o£ these tools will support the HFS+ file system, so users may be limited by particular file system parameters. All of these tools are capable of rendering image files and text files, and they have keyword search capability. A forensic examiner would use these tools in the same manner as he would in performing a static harddrive analysis.

www.syngress.com

!94


Summary This chapter of the book introduced and explained the file structure of the iPod and showed how evidence can be hidden within the iPod. In the field, I have seen everything from the standard iPod that stores only songs to completely tricked-out iPods running dual-booted operating systems full of exploits and hacks. From a law enforcement standpoint, it is very important that search warrants specify that all data storage devices, including iPods, should be acquired as potential evidence. The iPod might be the sole source of evidence that makes or breaks a case.

Index A Abella, V., 136 access

CD/DVD accessibility problems, 253-254 to computer, 204 eavesdropping on WiFi, 197-201 surfing neighbor's wireless network, 21i7 to WiFi comnmnications, 203 to WLAN, authentication for, 192-193 access point configuration of, 192-193 for connection to WLAN, 191 privacy and, 193-194 surfing neighbor's wireless network, 2()7 wardriving and, 21)1 AccessData Forensic tool kit, 133,182 Full Tune-Up Kit, 262,293 accessories cell phone, 107 PDA, 105 active device, 97-98 active memory image, 99 Advanced Encryption Standard (AES), 1211 alternative device collection of evidence from, 10-15 iPod as, 271 America Online (AOL) disc, 250,257 analysis anti-forensics, 25-26 of enterprise event, 29-31 in handheld forensics, 112 of iPod, 133

in MP3 forensics, 293 overview of, 24-25 phase of digital forensics, 4, 24-34 router forensics, 181-182 of single computer, 27-29 tools for data analysis, 32-34 Anchor Volume Descriptor Pointe (AVDP), 248-249 Andersen, S., 136 Andersen1 Cotts141tin2 L L P v. U O P , 199 anti-forensics, 25-26 AOL (America Online) disc, 250,257 Apple HFS+, Windows FAT32 vs., 127, 128 HFS+ file system, 280 iPod/iTunes, release of, 271 application formats, iPod, 129-130 architecture, router, 176 archives, e-mail e-mail local storage archives, 152-154 e-mail server storage archives, 151-152 torensic acquisition, 157-158 ingredients of e-mail, 154-157 local e-mail archives, processing, 158-166 types of, 150-151 ASCII, 250 ATA Packet Interface (ATAPI), 233 ATMs (automatic teller machines), 11 attachments, e-mail, 156-157 Attack Vector tool, 123 attacks on network, 186 on routers, 178-181, 187 attrib command, 174 authentication 295

~96

Index

in 802.11,192-193 of evidence, 79-80 automatic teller machines (ATMs), 11 AVDP (Anchor Volume Descriptor Pointe), 248-249 Ayers, P,.., 124

B backups, recovery of, 10 bandwidth, 175 batch number, CD, 213, 214 Battery Status, of Blackberry, 123 BCC (Blind Carbon Copy), 149 BellSouth Intelligent Wireless Network, 120 Best Practices, for digital forensics, 2-3 binary, analysis of, 27-28 binary image, 254-256 BINHEX, 156 biological evidence, 101 bitstream copy, 5 bitstream image, 99 Blackbag Technologies' Macintosh forensic software (MFS), 133 Blackberry (RIM) device attacking, 123 forensics, 121-123, 144-145 operating system of, 120 operation/security of, 120 PDA vs., 146 securing, 124 security for stored data, 121 Blackberry (RIM) Signing Authority Tool, 124 Blackberry (RIM) Software Development Kit (SDK), 123 Blackberry Attack Toolkit, 123 Blackberry Serial Protocol, 120 Black's Law Dictionary, 43-44

Blind Carbon Copy (BCC), 149 block size, 275 Bloombecker, Buck, 64 Bluetooth, 110 body, e-mail, 156 boot E1Torito for boot from CD-ROM discs, 251-252 process, controlled, 69 booting catalog, 251 border zone, 220 Bradley International Airport, CT, 190 broadcast traffic, 187 BTK killer, 27 buffing tools, 266 business card discs, 214

C cables cellular, seizure of, 107-108 for forensic data connection, 110-111 labeling of, 51 for router forensics, 183 California v. Ciraolo, 201 Carbon Copy (CC), 149 care of CDs/DVDs, 257-259 cleaning of discs, 264-266 Carrier, Brian, 47,293 CAV (Constant Angular Velocity), 233 CC (Carbon Copy), 149 CD Audio, 222-223 CD Text, Philips, 221,224, 238 CD Text, Sony, 222,238 CD+G, 224, 241 CD-DA, 222-223 CD/DVD CD-R dyes, 217-219

Index

C D - R O M drive, 230-233 C D - R O M manufacturing process, 228-23O colors, 215-217 differences between, 226-228 disc accessibility problems, 253-254 drive firmware, 234-235 external interfaces, 233-234 features of-, 212-214 information storage on, 219-22() logical file systems, 237-252 physical characteristics of, 210-212 R - W subchannels, 224-226 sectors, 222-224 sizes/shapes of, 214 space allocation by file systems, 252-253 terminology, 220-222 types of, 215 writing to, 235-237 CD/DVD forensics collection of evidence from, 256-260 disc triage, 264"268 forensic binary images, 254-256 forensic hardware, 261-262 forensic software, 262 forensic workstation, 262-263 validation of writer, 263-264 CD/DVD Inspector for binary image of disc, 256 CD/DVD examination with, 265 for CD/I)VD tbrensics, 262 disc accessibility problems, 253 R through W subchannel and, 225 validation before CD/DVD forensics, 263-264 CD-R color of, 215-216 construction of, 211 dyes, 217-219 C D - R O M disc

boot from, 251-252 construction of, 211 manufacturing process, 228-230 C D - R O M drive drive firmware, 234-235 external interfaces, 233-234 inside mechanism, 230-233 C D - R O M Mode 1,223 CD-RW choice of, 215 color of, 216 construction of, 211 CD-RW drive, 261 cellular industry, 195 cellular phone digital forensics of, 3 evidence collection/handling, 11-12, 106-108 first response cards, 103-104 forensic data connection, 110-111 forensics handling of, 106-108 handheld forensics issues, 94 monitoring/scanning transmissions, 196-197 CFAA (Computer Fraud and Abuse Act), 200-201,204 chain of custody, 172, 182 child pornography case, 270 Ciraolo, California v. , 201 CIRC (Cross-Interleaved Reed-Solomon Code), 227 Cisco routers, 182-183 cleaning, of discs, 261-262,264-266 clock, of iPod, 139 CLV (Constant Linear Velocity), 233 collection alternative media, 10-15 of Blackberry information, 121-122 in CD/DVD forensics, 256-260 description of, 5

297

~.98

Index

digital evidence requirements, 6-7 handheld forensics, 100-108 hardware documentation difficulties, 15-16 hashes, 6 in iPod forensics, 130-131 memory acquisition/analysis, 19-21 from NAS, 18 in PDA forensics, 115, 116 phase of digital forensics, 4, 5-21 preparation for, 8-10 from RAID, 17 from SAN, 18 from virtual machines, 19 See also digital information, seizure of collimator lens, 231 colors, of CD/DVD, 215-217 common carrier, 199 Communications Act of 1934, 196, 203-204 Comp USA, 190 Compact Disc. See CD/DVD compromises, 184 computer forensics, evolution of, 2-3 Computer Fraud and Abuse Act (CFAA), 200-201,204 computer trespasser, 198 computers as evidence, 43 information from running, 70-71 stolen, 91 connection, 110-111 Constant Angular Velocity (CAV), 233 Constant Linear Velocity (CLV), 233 convergence, of routing tables, 178 copy protection, 126 copying, 72-73 cost, 175 cover art, 292 cracked disc, 266-267

cradle, 117-118 crime scene, digital, 50-51, 78-79 criminal procedures, 42 Cross-Interleaved Reed-Solomon Code (CIRC), 227 cyanine organic dye, 217, 218

D Dartmouth College, 190 data carving, 29 connection, 110-112 push, 121 storage on alternative media, 11 See also digital forensics data objects defined, 88 description of, 81-82 as evidence, 44 location of evidentiary, 69-70 on-scene imaging of, 73-75 database, 32-33 D C F L D D command, 273 dd command, 141,273,275-277 DDoS (Distributed Denial-of-Service) attacks, 180 Defiler's Toolkit, 26 delay metric, 175 deleted data analysis of, 28-29 deleted e-mail recovery, 168-169 in e-mail archive, 158, 160 iPod and, 138-139 UDF file system and, 249 Denial-of-Service (DOS) attacks, 178, 179-180 descriptors, 248 Device Status, 123

Index

devices, alternative, 1()-15 digital evidence. See evidence, digital digital forensics analysis, 24-34 collection, 5-21 computer forensics, evolution of, 2-3 definition of, 2 examination, 21-24 Faraday device, 4 handheld forensics, 94 overview of, 36-37 phases of, 4-5 procedures/methodology for, 38 reporting, 34-35 digital information, seizure of best method for, 81-82, 90 digital evidence defined, 43-46 digital evidence, options for, 62-77 digital evidence seizure methodology, 46-54 evidence, options for seizing, 62-77 evidence seizure, common procedures, 78-80 hardware seizure, factors limiting, 54-62 media identification, 50 methodology overview, 48-49 overview oC 4()-42, 83-85 physical media prioritization, 50-51 seizure method, determining, 81-82 shutdown/boot process procedures, 52-54 of storage devices/media, 51-52 digital media player. See iPod; MP3 ~brensics Digital Versatile Disc (DVD), 211-212 See also CD/DVD digital video recorder (DVR), 14 I)ijkstra algorithms, 177 Direct Sequence Spread Spectrum (DSSS), 197

directories, iPod, 282-288 directory entry, 242 disassembly, of iPod, 133-134 "disc swap" technique, 267-268 disc triage, 264-268 disc-at-once, 235,236 disk encryption, 55-56 Disklnternals Music Recovery, 140 distance metric, 175 Distributed Denial-of-Service (DDoS) attacks, 180 documentation in digital evidence collection, 50, 78 of discs, 259-260 hardware documentation difficulties, 15-16 in PDA forensics, 115, 116-117 for router forensics, 182, 183-184 DoS (Denial-of-Service) attacks, 178, 179-180 drive adapters, 10 drive firmware, 234-235 drive formats, 127,128 drives, for data collection, 8-9 DSSS (Direct Sequence Spread Spectrum), 197 dual boot, iPod, 129 DVD writer, 234-235,261 DVD+R, 215,216 DVD + RW, 216 DVD-R, 215,216 DVD-RW, 216 DVR (digital video recorder), 14 dyes of CD-R discs, 217-219 colors of CDs/DVDs, 215-217 dynamic events, 42 dynamic routing, 176-177

299

100

Index

E eavesdropping legality of interception of WiFi, 208 scanning RE 196-197 on WiFi, 197-201 on WiFi, legal issues, 203-205 ECC (Error Correction Code), 224 ECMA (European Computer Manufacturer's Association), 241 EDC (Error Detection Code), 224 Eight into Fourteen Modulation (EFM), 220 E1Torito, 251-252 electronic communication, 198-199 Electronic Communications Privacy Act (ECPA), 198-199,207 E-Mail Archive Card, 153-154 e-mail archives, 158-166 acquisition of Outlook PST file, 158 MS Outlook for Outlook Express files, 162-163 OnTrack PowerControls, 164-166 processing with E-Mail Examiner, 159-161 server level archives, 163-164 E-Mail Examiner, 159-161 e-mail forensics analysis of e-mail, 29 archive types, 150-151 e-mail components, 154-157 e-mail terminology, 148-150 examination tools, 157-158 functions of e-mail, 150 local level archives, 152-154 local mail archives, processing, 158-166 NEMX for, 166-169 server storage archives, 151-152 EnCase. See Guidance Software EnCase encoding CD/DVD, 220

e-mail, 156 encryption Blackberry wireless security, 120 for eavesdropping protection, 198 evidence collection and, 55-56 examination of system with full disk encryption, 23-24 WiFi privacy with, 202,203 for WLAN, 192, 193-194 energy transfer, 210 Enhanced SMTP (ESMTP), 149 enterprise event, 30-31 entertainment systems, 11 Error Correction Code (ECC), 224 Error Detection Code (EDC), 224 escalation of privilege, 173 EseUtil.exe, 164 Ethernet, 190-191 Eudora, 169 European Computer Manufacturer's Association (ECMA), 241 evidence, digital collection in handheld forensics, 100-108 collection of CD/DVD evidence, 256-260 defined, 43-46 hardware seizure, factors limiting, 54-62 information from running computer, 70-71 iPod imaging and, 272-273 MP3 forensics, 281-292 on-scene imaging of finite data objects, 73-75 on-scene imaging of information, 72-73 on-scene information, previewing, 69-70 options for seizing, 89 overview of, 88-89 preservation in handheld forensics, 98, 108-110

Index

requirements of, 3, 6-7 seizure, common procedures, 78-8(), 89-90

seizure, common threads within, 78-80 seizure example, 66-69 seizure method, determining, 81-82 seizure methodology, 46-54, 89 seizure options, 62-65 tools for collection, 76-77 victim, responding to, 65-66 volatile, router forensics and, 182-183 Evidence Eliminator, 26 examination alternative fbrensics processes~ 24 of CI)/DVI), 26()-268 description of, 21 Cull disk encryption issues, 23-24 in handheld Corensics, 112 hash sets, utility of-, 22 in PDA fbrensics, 115 phase of digital forensics, 4 Exchangeable Image File Format (EXIF), 27 expansion card, 118 expansion sleeve, 118 extensions, o f R o c k Ridge file system, 245-246 external interfaces, CD/DVI), 233-234

F F # # directories, 285,287, 29(i)-29 l Faraday device cellular phone and, 3 for collection from cell phones/PDAs, 12 for control of wireless access to cell phone, 106 function of', 4 for handheld device maintenance, 109

fast forensics, 24 FAT, 252 FAT32 Apple HFS+ vs., 127, 128 for iPod, 280 father disc, 229 FATs (File Allocation Tables), 237 FCRP (Federal Rules of Criminal Procedure), 44-45 fdisk output, 273-274 Federal Communications Commission (FCC), 195 Federal Rules of Criminal Procedure (FCRP), 44-45 Federal Rules of Evidence (FRE), 44-45 FHSS (Frequency Hopping Spread Spectrum), 197 fiber-channel SAN, 18 Fifth Generation iPod, 125 File Allocation Tables (FATs), 237 file attributes, 173-174 file extensions, 289 file formats, 126 file names HFS, 250 HFS+, 251 ISO-9660, 243 UDE 247 file system of handheld devices/hard drives, 96-97 of iPod, 271,280 iPod forensics tools and, 293 purpose of, 237 See al.,0 logical file systems file types, supported by iPod, 280 files deletion/slack space, 41 hiding, 173-174 file-transferring networks, 271 fingerprint evidence, 258,259-260

301

302

Index

FireWire CD/DVD external interfaces, 233,234 iPod generations and, 125 firmware, drive, 234-235 First Generation iPod, 125 first responders cellular phone handling, 106-108 handheld forensics, 102-104 overview of, 61-62 PDA handling, 104-106 first response cards, 102-104 flash memory collection of evidence from, 12-13 of iPod Nano/Shuffle, 125-126, 279-280 floppy disk boot from, 251,252 controllers, 234 floppy drives, 52 flow chart, 35 footers, 29 forensic analysis programs, 43-44 forensic binary images, 254-256 forensic data connection, 110-111 Forensic Examination of Digital Evidence: A Guide for Law Enforcement (National Institute of Justice), 69 forensic image, 5 forensic preview software, 69-70 Forensic Talon, Longibube, 272 Forensic tool kit (FTK),AccessData, 133 Forensic Toolkit, 182 Formazan dye, 218, 219 Ft. Lauderdale Airport, FL, 190 Fourth Amendment, 197,201-202 Fourth Generation iPod, 125 fragmentation in HFS, 250 in ISO-9660 file system, 243 in UDE 248,249

FRE (Federal Rules of Evidence), 44-45 Free Mem, 123 frequency, 195 See also radio frequency Frequency Hopping Spread Spectrum (FHSS), 197 full disk encryption, 23-24 full erase, 236 Full Tune-Up Kit (FTK), AccessData, 262, 293

G gaming machines, 13-14 Gilder, G., 57 glass master disc, 228-229 Global Positioning System (GPS), 14 Gnutella, 271 Granderson, United States v., 202 GKEP, 32 Guidance Software EnCase for CD/DVD forensics, 262 features of, 119 with iPod, 136 for iPod forensics, 293 for PDA forensics, 146 for router forensics log, 182

H hacking process, 172-174 router, 178-181,187 tools for MP3 forensics, 280-281 handheld forensics analysis, reporting, 112 Blackberry forensics, 120-124 cellular handling, 106-108 digital forensics, 94

Index

evidence collection, 100-102 evidence preservation, 108-110 first responder, 102-104 forensic data connection, 110-I 12 foundation of, 95-99 impact of, 95 iPod forensics, 124-141 PDA, 114-119 PDA handling, 104-106 hard drive data collection from RAID, SAN, NAS devices, 17-18 file system of, 96-97,237 forensic binary image of, 254-255 with full disk encryption, 23-24 of iPod, removal of', 273 storage capacity of, 98-99 hard drive interfaces, 10 hardware for CD/DVD forensics, 261-262 for data collection, 8-10 documentation difficulties, 15-16 hardware seizure disk encryption, 55-56 first responders, 61-62 lab analysis delays, 57-58 media size, 54-55 overview or. 54, 89 privacy concerns, 56-57 stolen hardware, 91 technical staff requirements, 58-60 hardware-based imaging solutions, 8 hash sets, 22 hash values, 256 hashes in digital evidence collection, 72-73 e-mail archive forensics and, 154 e-mail forensic tools and, 157 handheld device verification, I l 0 iPod imaging, 272-279

overview of, 6 unaltered data collection, 5 hazardous substances, 260 header, e-mail, 155-156 headers, 29 heat, 210,259 Helix, 76 HELO, 149-150 hex editor, 2 HFS characteristics of, 249-251 description of, 249-251 file systems for CDs/DVDs, 240 for Macintosh platform, 237,239 space allocation by, 253 HFS+ features of, 251 file names with, 250 file systems for CDs/DVDs, 240 iPod forensics tools and, 293 iPod's use of, 280 for Macintosh platform, 239 space allocation by, 253 High Sierra Group (HSG) file system, 238,239,241 hijack, 123 hit-and-run attacks, 181 hop count, 177 host bus adapter (HBA), 18 hub labels, 259-260 Hypertext Transfer Protocol (HTTP), 149

ICAC (Internet Crimes Against Children), 74 ICMP (Internet Control Message Protocol), 179, 180 I CS (Intelligent Computing Solutions), Solo III, 272

303

304

Index

identification of digital media, 50 in PDA forensics, 115, 116 IEEE (Institute of Electrical and Electronics Engineers), 190-191 IEEE 802.11 standard authentication in, 192-193 eavesdropping on WiFi and, 199 overview of, 191 privacy in, 193-194 privacy of WiFi transmissions, 203-205 protocols and security, 197 standards of, 195 IEEE 802.1 la standard, 195 IEEE 802.1 l b standard, 195 IEEE 802.1 lg standard, 195 IEEE 802.3 standard, 190-191 ILook Investigator, 262 ImageMasster, 76 imaging Blackberry forensics, 122, 123 copying/hashes vs., 72-73 finite data objects on-scene, 73-75 hard drive forensics/handheld forensics, 99 iPod, hardware vs. nonhardware, 273-279 iPod forensics, 131, 141 MP3 forensics, 272-273 IMAP (Internet Message Access Protocol), 148 incident response categories of, 184 process, 187 incremental recording (packet writing), 235-236, 247 InfinaDyne, 268 See also CD/DVD Inspector Infonetics Research, 190 information hiding, 124

information storage, 219-220 infrared (IR), 191, 210 input device, PDA, 114 Institute of Electrical and Electronics Engineers (IEEE), 190-191 Intelligent Computing Solutions (ICS), Solo III, 272 interfaces, external, 233-234 International Standards Organization (ISO), 241 Internet Control Message Protocol (ICMP), 179, 180 Internet Crimes Against Children (ICAC), 74 Internet Message Access Protocol (IMAP), 148 intrusion process, 172-173 IP address, 175, 176 iPod application formats, 129-130 deleted files, 138-139 drive formats of, 128 family/generations of, 124-126 features of, 126 forensic investigation of, 130-136 generations of, 279-280 Linux and, 138 misuse of, 130 as operating system, 127-128 pod slurping, 11 registry key with USB/FireWire serial number, 139 system partition of, 128-129 time issues, 139 tools, 140-141 user accounts, 138 Windows and, 136-137 iPod forensics analysis tools, 293 evidence, normal vs. not normal, 281-292

Index

file systems, 280 "hacking tools", 28(i)-281 imaging, hardware vs. nonhardware, 273-279 imaging, hashing, 272-273 iPod for storage, 270 MP3 technology, development of, 270-271 search warrant, 294 static file systems of iPod, 271 types of iPods, 279-280 iPod Mini description of, 125 features olc, 279 iPod Nano description of, 125-126 directory structure of, 281-283 t'eatures of', ~79 iPod Shuffle description of, 126 features of, 279-28(i) as hacking tool, 280-281 iTunes SD file or', 284-285 iPod_Control director% 285-286 \iPod_Control\Device\Syslnfo file, 139 \iPod_Control\iTunes\Devicelnfo file, 139 iPodLinux description oL 127 System Partition and, 128-129 IX (infrared), l 91,210 IrDA, 110 iSCSI SAN, 18 ISM band, 195, 197 ISO (International Standards Organization), 241 ISO-966() description of, 241-243 disc accessibility problems, 253-254 file systems for CDs/DVDs, 239

history of, 238-239 space allocation by, 252 standard file system for CDs, 237 iTunes creation of, 271 evidence in, 290 features of, 126 iPod registry key and, 139 setupapi.log and, 137 iTunes DB file, 283-284 Ivory soap, 26 i, 264

Jansen, w., 124 Joliet file system description of, 243-244 disc accessibility problems, 253-254 features of, 239 file systems for CDs/DVDs, 240 space allocation by, 252

K Katz v. United States, 201 Kern, Benjamin D., 200 Knotts, United States v., 202

L labels on discs, 258,259 for documentation of disc, 259-260 laboratory analysis, 57-58 LAN (local area network), 190 lands C D / D V D differences in, 227 CD-P, OM drive and, 233

305

306

Index

information storage on CDs/DVDs, 219-220 laptop, 190 laser CD-P,.OM manufacturing process, 228-230 writing to CD/DVD, 235-236 laser beam recorder, 228-230 laser diode, 231 law enforcement computer skills of personnel, 61-62 digital forensics by, 2 expectation of privacy in WLANs, 201-202 lead in, 221 lead out, 221 legal issues eavesdropping on WiFi, 197-201 Fourth Amendment expectation of privacy in WLANs, 201-202 regulation of RE 195 of scanning frequencies, 196-197 WiFi, unique situation of, 203-204 legal recommendations, 42 light, 219-220,259 link state routing protocol, 177 Linux for digital forensics, 9 iPod forensics and, 138,289 iPod imaging with, 273-279 rapid power loss and, 53 live system image, 23 live system information, 9 load metric, 175 local area network (LAN), 190 local storage archives e-mail, 150-151 e-mail forensics, 152-154 processing, 158-166 log

of Blackberry, collection of, 122-123 for data collection, 8 for router forensics, 182 Longibube's Forensic Talon, 272 logical file systems, 237-252 on CDs/DVDs, list of, 239-240 disc accessibility problems and, 253-254 E1Torito, 251-252 HFS, 249-251 HFS+, 251 HSG, 241 ISO-9660, 241-243 Joliet, 243-244 overview of, 237-239 Red Book Audio, 240-241 Rock Ridge, 244-247 space allocation by, 252-253 UDE 247-249 logical image, 272 Lotus Notes, 152

M MAC address, 192 Macintosh forensic software (MFS), Blackbag Technologies, 133 Macintosh platform for digital forensics, 9 file systems for CDs/DVDs, 237,239 Windows vs., 127, 128 magnetic fields, 210 mailbox archive, e-mail, 155 malware, 27-28 MAPI (Messaging Application Program Interface), 148-149 marking, discs, 258-259 Master Directory Block, 250, 251 MD5 hash, 73,274-275 MD5 signature, 263-264

Index

md5sum, 272,274-275 media, optical, 69 media, physical crime scene prioritization of, 5()-51 seizure of', 51-52 size restrictions in evidence collection, 54-55 media card, of handheld device, 1()I Media Sciences, 266 memory acquisition/analysis, 19-21 memory devices, 116 message, e-mail component, 155-157 Messaging Application Program Interface (MAPI), 148-149 metadata, 27 metalized glass master, 229 metallic alloy, 219 Metasploit, 26, 28()-281 MFS (Macintosh torensic software), Blackbag Technologies, 133 Micro-Processor, of" PDA, 114 Microsoft Outlook Express files, 162-163 Microsoft Outlook PST file acquisition or; 158 deleted e-mail recovery, 169 E-Mail Examiner trot processing, 159-161 Microsoft Windows FAT32 file system, 280 file systems for CI)s/DVDs, 238 iPod and, 136-137,272-273 Mac vs., 127, 128 memory acquisition/analysis, 2() Microsoft Windows Vista, 55 MID I files, 126 MIME (Multipurpose Internet Mail Extensions), 156 mkiso[s tool, 244,254 mobile device. See handheld forensics mobile phone. See cellular phone

Mobitex2 Radio Status, 123 Mojopac, 281 Moore, Robert, 53 mother disc, 229 MP3 forensics analysis tools, 293 collection of evidence, 11 evidence, normal v,~'. not normal, 281-292 file systems, 280 "hacking tools", 280-281 imaging, hardware vs. nonhardware, 273-279 imaging, hashing, 272-273 iPod Eor storage, 270 MP3 technology, development of, 27 ()-271 search warrant, 294 static file systems of iPod, 271 types of iPods, 279-280 • See also iPod MP3 format, 270-271 MS Exchange corruption of archives, 164 e-mail torensics, 151-152 NEMX for processing archives, 166-169 OnTrack PowerControls for processing, 164-166 Multipurpose Internet Mail Extensions (MIME), 156 multi-session disc, 261 muhi-session HFS disc, 25() Music Recover> Disklnternals, 140-141 MythTV system, 14

N Napster, 271 NAS (Network Attacked Storage) devices, 17,18

307

308

Index

National Institute for Standards and Technology (NIST), 77, 124 NEMX (Network E-mail Examiner), 166-169 network archives, deleted e-mail recovery, 169 attacks on, 186 connection, data collection via, 7 documentation of, 16 routers of, 175 Network Attacked Storage (NAS) devices, 17,18 Network E-mail Examiner (NEMX), 166-169 network forensics definition of, 172 hacking process, 172 importance of, 186 intrusion process, 172-173 overview of, 185 searching for evidence, 173-174 network interface card (NIC), 192 network layer, 174-175 New Technology File System (NTFS), 237,252 Ngwguard.db, 152 NIC (network interface card), 192 NI.J First Responders Guide (National Institute of Justice), 47 Nintendo Forensics, 21 NIST (National Institute for Standards and Technology), 77, 124 * nix base system, 9 * nixess, 20 Nolan, Joseph R., 43 Novell GroupWise, 152 NTFS (New Technology File System), 237,252 NVRAM, 182-183

O "off" state, 117, 122 officer safety, 260 "on" state, 117, 122 on-scene investigation information imaging, 72-73 information preview, 69-70 OnTrack PowerControls, 164-166 Open Shortest Path First (OSPF), 177 Open System Authentication, 193 operating system of Blackberry, 120 of iPod, 128-129 iPod as, 127-128 iPod imaging with Linux, 273-279 of PDA, 114, 116 optical media, 69 Optical Storage Technology Association, 247 OSPF (Open Shortest Path First), 177 Outlook. See Microsoft Outlook Express files; Microsoft Outlook PST file

P packet writing (incremental recording), 235-236, 247 PACKS, 224-225 Palm OS PDA file system of, 96 PDA Seizure for, 119 Panera Bread, 190 Paraben Corporation E-Mail Archive Card, 153-154 E-mail Examiner, 29, 159-161 first response cards from, 104 Network E-mail Examiner, 166-169 P2,293 Partition Maps, 250

Index

partitions file systems for CDs/DVDs and, 238 of iPod, 132,289 passwords for Blackberry, 121,122,124 examination of TPM drive, 23-24 path table, 242 PBX system, 14-15 PDA (Personal Digital Assistant) components of, 114 evidence collection/handling, 11-12, 104-1 {)6

file system of, 96 first response cards, 102-103 forensic investigation, first step of, 146 forensic tools, 119 forensics, 114-117, 143-144 forensics handling of, 104-106 handheld forensics issues, 94 investigative tips, 117-118 iPod as, 126 mishandling, impact of, 118 PDA Secure, 119 PDA Seizure, 119 pens, 258-259 persistent attacks, 181 Personal Digital Assistant. See PDA personnel certification of', 90-91 digital evidence seizure, 46-47 skilled, time management of, 58-60 PEW Internet and American Life Project, 148 Philips CD Text, 221,224,238 photodetector, 231 photographs, 16, 292 phthalocyanine dye, 217, 218 physical disks, 1{) physical image, 272 physical partition, 132

Pioneer DVD writer, 256 pits CD/DVD differences in, 227 C D - R O M drive and, 233 information storage on CDs/DVDs, 219-220 Plextor 12x writers, 261 Pocket PC, 119 pod slurping, 11, 281 podzilla, 127 podzilla 2, 127 polarizing beam splitter, 231 portable music player. See iPod; MP3 forensics Portable Operating System Interface (POSIX), 244-247 Post Office Protocol 3 (POP3), 149 power supply Blackberry examination and, 121 for cellular device, 106 for handheld device, 104-105 for iPod, 131 for PDA, 116, 117 PPA (Privacy Protection Act), 56-57 pre-groove, 228-230 preparation, for collection, 8 - i 0 preservation, of evidence, 98, 108-110 privacy in 802.11,193-194 Fourth Amendment expectation of privacy in WLANs, 201-202 scanning frequencies and, 196-197 Privacy Protection Act (PPA), 56-57 PRIV.EDB file, 166-168 Profile String log, 122 profiling, 123 programs, forensic analysis, 43-44 PST Converter, 159-160 PST file. See Microsoft Outlook PST file pull-the-plug, 52-54

309

310

Index

Q quick erase, 236

R Rader, Dennis, 27 radio frequency (RF) 802.11 standard and, 191 spectrum, regulation of, 195 spectrum, scanning, 196-197 transmissions, privacy control and, 193-194 Radio Status log, 122 RAID (Redundant Array of Independent Disks), 17-18 RAM obtaining information from, 70-71 router volatile evidence, 182-183 rapid power loss, 52-54 Recover My iPod tool, 140-141 recovery, of deleted e-mail, 168-169 Red Book Audio description of, 240-241 file systems for CDs/DVDs, 239 forensic binary image of CD, 255 RedEdit utility, 174 Redundant Array of Independent Disks (RAID), 17-18 Reed-Solomon Product Code (RS-PC), 227-228 reflector, 265,266 registry key iPod forensics in Windows, 136-137 with iPod USB/FireWire serial number, 139 write blocking USB device, 279 reliability metric, 175-176 reporting documentation in PDA forensics, 115

in handheld forensics, 112 overview of, 34-35 PDA forensics, 117 phase of digital forensics, 4-5 in router forensics, 183-184 reproduction, of forensic images, 256 resources alternative media forensics, 15 on digital forensics, 5 on handheld forensics, 112 ICAC, 74 IEEE Web site, 191 on memory acquisition/analysis, 20 Recover My iPod link, 140 slurping, 281 write blocking USB device, 279 responders, 47-49 See also first responders restore process, iPod, 134-135 rewritable media CDs/DVDs, 215 disc swap technique for, 267-268 information storage on CDs/DVDs, 219-220 space allocation, 252 writing to CD/DVD, 236 RE See radio frequency RIM Blackberry Message Center, 120 RIM device. See Blackberry (RIM) device RIP (Routing Information Protocol), 177 Roam and Radio log, 122 Rock Ridge description of, 244-247 file systems for CDs/DVDs, 240 space allocation by, 252 routable protocols, 176 Router Audit Tool, 179 router forensics chain of custody, 182

Index

commands ~br, 181-182 overview of, 185 planning, 187 understanding of touters, 172 volatility of- evidence, 182-183 routers attacks, 178-181, 187 definition of, 174 function/role of, 174-175 router architecture, 176 routing protocols, 176-177 routing tables, 175-176 Routing Information Protocol (RIP), 177 routing protocols, 176-177 routing tables convergence of, 178 information in, 175-176 poisoning, 18() P,.-W subchannels, 223,224-226 lkZone, 221

S safety, handling of- discs, 260,264 Sam Juicer, 26 SAN (Storage Area Networks), 17.18 SATA drive, 1(1,233 scanners, 196 scanning, 196-197 scratch on CD, 212 CD/DVD forensics and, 262,264,265 methods for fixing, 266 scratch filling products, 266 SCSI, 233-234 SD cards, 116 SEARCH, 71 search, 173-174 search warrant, 49,294

searches, unreasonable, 201 Searchin~ and SeizinS Computers and Obtainin~ Electronic Evidence in Criminal Investigations (Manual), 45-46, 63-64 Second Generation iPod, 125 Secret Service, 57 sectors CD/DVD, 222-224 CD/DVD differences in, 227-228 definition of, 221 space allocation by CD/DVD file systems, 252-253 of UDF, 248 security authentication in 802.11,192-193 of Blackberry, 120-121,124 privacy in 802.11,193-194 Security Event Management Systems (SEMS), 33-34 SEMS (Security Event Management Systems), 33-34 serial number, 139 server storage archives e-mail, 150-152 Lotus Notes, 152 MS Exchange, 151-152 Novell GroupWise, 152 processing, 163-164 session, 222 setupapi.log, 137 shape, of CD/DVD, 214 Shipley, T., 71 signature analysis tools, 289 silk screened labels, 216 Simple Mail Transfer Protocol (SMTP), 149 single computer, analysis of, 27-29 size, of CD/DVD, 214 slack space, 41 Slacker, 26

311

312

Index

sled, 231-232 Sleuth Kit, 133,293 Slurp, 281 slurping, 11, 281 SMTP (Simple Mail Transfer Protocol), 149 Smurf, 179 snapshot forensics, 99, 110 Snort, 33 software for CD/DVD forensics, 262 for data collection, 9 for digital forensics, 38 forensic preview, 69-70 for HFS CD/DVD forensics, 251 license for use of, 34 for WiFi eavesdropping, 197-198 Solo III, ICS, 272 Sony CD Text, 222,238 Spafford, E., 47 Spectacular Computer Crimes (Bloombecker), 64 spreadsheets, 32 sputtering, 229 SQL database, 33 stacking ring, 214, 257 stampers, 229 state Blackberry examination and, 121-122 iPod forensics and, 130 static device, 97-98 static events, 42 static file system, 271 static routing, 176 Sterling, Bruce, 57 Steve Jackson Games, 57 storage Blackberry security for stored data, 121 capacity of hard drive/handheld device, 98-99

capacity of iPods, 279 information storage on CDs/DVDs, 219-220 iPod for, 270 Storage Area Networks (SAN), 17, 18 storage devices collection of evidence from nontraditional devices, 10-15 seizure of, 51-52 StrongHold box, 109 subchannels, R-W, 223,224-226 SUSP (System Use Protocol), 244-247 SYMBOL, 224 SYN flood, 179 system clock, 139 system flow chart, 30-31 System Partition, 128-129 System Use Protocol (SUSP), 244-247

T Table of Contents (TOC) border zone and, 220 definition of, 222 of e-mail archive, 155 file systems for CDs/DVDs, 238 forensic binary image of CD, 255 lead in as container for, 221 reading, 267 writing to CD/DVD and, 235 Tableu Forensic USB Bridge, 273 Taiyo Yuden, 217 TCP (Transmission Control Protocol), 180 Telecommunications Act, 199 telephone. See cellular phone Telephone Disclosure and Dispute Resolution Act, 196, 197 terminology CD/DVD, 220-222

Index

e-mail, 148-149 Tetris, 97 text, in MP3 file, 292 TF extension, 246 TFN (Tribal Flood Network), 18(i Third Generation iPod, 125 time for data analysis, 25 iPod issues, 139 time settings, 15-16 timelines, 31,35, 131-132 timestamp CD/DVD forensics and, 263 of Rock Ridge file system, 246 with UDE 248 Timestomp, 26 TiVo, 14 TOC. See Table of Contents tools anti-forensics, 25-26 for Blackberry forensics, 123, 124 for collection, 8-10 for data analysis, 32-34 t-or digital evidence collection, 76-77 For e-mail forensics, 157-158 for fbrensics examination, 21 for handheld forensics, 111-112 fbr iPod forensics, 133, 14(I-141 for MP3 forensics, 28(I-281,293 Paraben Forensics Email Examiner, 29 for P1)A f'orensics, 119, 146 for server level archive processing, 164 software for digital forensics, 38 TPM (Trusted Platfbrm Module), 23-24, 55 track, 222, 24ii track pitch, 227 track-at-once, 235,236 Transmission Control Protocol (TCP), 18()

Transmit/Receive log, 122 Transmogrify, 26 transportation, of disc, 259 Tribal Flood Network (TFN), 180 Trinoo attack, 180 Triple DES (Data Encryption Standard), 12O

Trojan defense, 28 Trusted Platform Module (TPM), 23-24, 55 tunnel vision, 7

U U3 Smart Drives, 13 pClinux, 127-128 UDF creation of, 239 description of, 247-249 disc accessibility problems, 254 file system for CDs/DVDs, 237,240 space allocation by, 252 UDR 18(~ ultraviolet (UV) light, 259 unit control functions, of Blackberry, 123 United States, Katz v., 201 United States ~. Granderson, 202 United States ~,. Knotts, 202 unreasonable searches, 201 (]OR Aitdersett Consulting L L P ~., 199 USB adapter, 272 USB connection CD/I)VD external interfaces, 233,234 iPod generations and, 125 USB tokens, 116 user accounts, iPod, 138 user-recorded discs, 255 USSS Best Practices Guide (USSS), 47 UUCO1)E, 156

313

314

Index

UV (ultraviolet) light, 259

V victims, 65-66 video formats, 126 virtual machines data collection from, 19 testing in, 28 virtual memory, 10 VmWare Disk mount utility, 19 Voice Over Internet Protocol (VOIP) system, 14-15 volatile data on cell phones/PDAs, 11-12 collection from PDA, 116 preservation of, 9-10 router forensics, 182-183 volume descriptor, 242,244

W wardriving, 201 water-based markers, 258-259 Web site resources. See resources web-mail, 153 WEP (Wired Equivalency Protocol), 193-194 whatis.com, 95 WiFi (wireless fidelity) access vs. passive listening, 204 eavesdropping on, 197-201 Fourth Amendment expectation of privacy in WLANs, 201-202 legality of interception of, 208 overview of, 203-204 proliferation of WiFi devices, 190 P,F spectrum, regulation of, 195 scanning RE 196-197

surfing neighbor's wireless network, 207 technology, 190-194 WiFi (wireless fidelity) technology, 190-194 authentication, 192-193 overview of, 190-191 privacy, 193-194 WEE 194 WiFi Protected Access (WPA), 194 Wikipedia, 127 Window Washer, 26 Windows. See Microsoft Windows Windows registry, 136-137 Wired Equivalency Protocol (WEP), 193-194 wired network, privacy control in, 193 wireless access, 106-107 wireless card, 191 wireless connection, 118 wireless devices, 105-106 wireless local area networks (WLANs) 802.11 for, 191 authentication, 192-193 eavesdropping on WiFi, 197-201 Fourth amendment expectation of privacy in, 201-202 privacy, 193-194 wireless modem, 120 wireless securiV, 120 wireless signal, 109 Witty Worm, 19 WMA files, 126 workstation, forensic, 262-263 worms, 19 WPA (WiFi Protected Access), 194 write blocker for CD/DVD forensics, 261 for data preservation, 272 for iPod imaging, 273

Index

registry key for write blocking USB device, 279 unnecessary, 261 write-once media, 215 writer, 263-264 writing to CD/DVD, 235-237 on discs, 258-259

X XA format, 223

Z Zoned CAM 233

315


Alternate Data Storage Forensics

Data Storage

Optical Data Storage

Storage virtualization: technologies for simplifying data storage and management

Developments in Data Storage: Materials Perspective

Cloud and Virtual Data Storage Networking

Alternate Orbits

Alternate truth

Alternate Orbits

Alternate Martians

The Alternate

The Alternate

Alternate Generals

Alternate Orbits

Alternate Martians

Alternate Martians

Alternate Martians

Vampire Forensics

Molecular Forensics

Internet Forensics

Cyber Forensics

Computational Forensics

Internet Forensics

Architectural Forensics

Molecular Forensics

iPhone Forensics: Recovering Evidence, Personal Data, and Corporate Assets

Storage networks

Resilient Storage Networks : Designing Flexible Scalable Data Infrastructures (Digital Press Storage Technology (Paperback))

Energy Storage

Storage Solutions

Into the Alternate Universe

Alternate Data Storage Forensics

Data Storage

Optical Data Storage

Storage virtualization: technologies for simplifying data storage and management

Developments in Data Storage: Materials Perspective

Cloud and Virtual Data Storage Networking

Alternate Orbits

Alternate truth

Alternate Orbits

Alternate Martians

The Alternate

The Alternate

Alternate Generals

Alternate Orbits

Alternate Martians

Alternate Martians

Alternate Martians

Vampire Forensics

Molecular Forensics

Internet Forensics

Cyber Forensics

Computational Forensics

Internet Forensics

Architectural Forensics

Molecular Forensics

iPhone Forensics: Recovering Evidence, Personal Data, and Corporate Assets

Storage networks

Resilient Storage Networks : Designing Flexible Scalable Data Infrastructures (Digital Press Storage Technology (Paperback))

Energy Storage

Storage Solutions

Into the Alternate Universe

Recommend Documents