CASE STUDY Open Source Digital Forensics

Transcription

1 CASE STUDY Open Source Digital Forensics OVERVIEW Introduction Digital forensics is the application of science to the identification, collection, examination, and analysis of data while preserving the integrity of the information and maintaining a strict chain of custody for the data. Data refers to distinct pieces of digital information that have been formatted in a specific way. (NIST SP ). Digital forensics is a very broad area that has many uses beyond investigating computer crimes. Many organizations employ digital forensics to investigate computer intrusions, examine malware, and investigate misuse of corporate computers. This case study highlights some of the challenges facing digital forensics as well as lessons learned supporting the digital forensics community with open source tools. Tom Dunn Georgia Tech Research Institute (GTRI) Open source digital forensics tools were originally seen as the leaders for innovation in the digital forensics space. According to Hal Pomeranz, SANS Institute faculty fellow, The Coroner s Toolkit and The Sleuth Kit were the way people did forensics [in the 1990 s] In that era you learned with open source tools It s now completely gone the other way. Many folks exclusively use [proprietary tools such as] EnCase, FTK, Internet Evidence Finder, etc. that have grown up over the last 10+ years. (Pomeranz, 2012) Open source digital forensics tools still play an important and active role in the digital forensics space. In fact, Hal Pomeranz observed the deeper you get and more advanced the (SANS Institute) classes are, the more open source tools become the predominate toolset in the class. As you move into higher- level courses, we re trying to prepare people to extend the field, do their own research, and deal with advanced adversaries constantly changing their tactics. The toolsets you use for that are often open source tools to get in and look at a deep, low- level. (Pomeranz, 2012) This case study highlights some of the challenges facing digital forensics as well as lessons learned supporting the digital forensics community with OPEN SOURCE DIGITAL FORENSICS TOM DUNN NOVEMBER 14,

2 open source tools. This case study is the result of interviews of numerous experts in the open source digital forensics field as part of the Department of Homeland Security s Homeland Open Security Technology project < Background None of the interviewees reported any problems using open source digital forensics tools in court cases. As Brian Carrier said, The entering of evidence is more about the examiner, their approach and techniques. (Carrier, Brian Carrier Interview, 2012) Ryan Spanier repeated this sentiment when he said You are good as long as you know what tools you have, what tool versions you used, which is stuff you need to record anyway. (Spanier, 2012) The interviewees did report some cultural and regulatory issues in digital forensics. Some of these are legal requirements, such as finding exculpatory evidence, that cannot be changed by software (open source or closed source). Jon Stewart described a mentality where you were expected to review all the evidence. In child pornography cases, it s not uncommon to find one million pictures Some law enforcement attitudes want to know all the evidence and review all the evidence. It s unfeasible to see one million pictures. (Stewart, Jon Stewart Interview, 2012) Many times the mandates to review all evidence and report on all the evidence come from standard procedures or may be mandated by a district attorney or branch chief. If you can get enough evidence to the prosecutor for a plea, the case is closed. Digital forensics is used in many more areas than criminal cases, where the focus is on tying a person to an event in a way that s admissible in court. Corporate operations use digital forensics tools to identify malware, detect intrusions and for internal investigations. According to Ryan Spanier, There is a decent following for (corporate operations) but it s not on the top of the list for most people. The Sleuth Kit works for that and we ve used it for that. (Spanier, 2012) Scaling is a huge issue in digital forensics, which can be viewed on three axes: Digital devices are getting larger, there are more digital devices, and their contents are far more complex. At the same time the staff of digital forensics examiners are growing slowly (if at all) and deadlines are not increasing. Evidence size is growing exponentially. Jon Stewart said nobody has felt the multi- core crisis more than digital forensics investigators. Hard disks have kept doubling even as Moore s Law hasn t. CPUs aren t faster, they are multi- core, but commercial vendors haven t done a good job adapting to that reality From a computation problem, we re dealing with very large evidence sets and computation power hasn t changed since single core. We have to adapt to multi- core Parallelism is a very hard problem in computer science. (Stewart, Jon Stewart Interview, 2012) People have more digital devices. The case backlog isn t just because of the size of the media, but a huge increase in demand placed on digital forensics investigators; nearly every crime now includes digital evidence. Those devices are storing ever more complex data. Digital forensics practitioners have to be versed in more file formats and the structures they contain. (Stewart, Jon Stewart Interview, 2012) OPEN SOURCE DIGITAL FORENSICS TOM DUNN NOVEMBER 14,

3 Lessons Learned Automation A significant lesson learned by the digital forensics community is the need for automation to keep up with the growing evidence size and increasing complexity of electronic data. Doug Koster called automation the reason I started writing my own code [the TAPEWORM framework] years ago. (Koster, 2012) Hal Pomeranz echoed that sentiment when he said Having a toolset that includes things like The Sleuth Kit means I can automate a lot of my workflow. I have a bunch of scripts that do processing in the background while I look at interesting artifacts. That s a win. If you know what you re doing you can get major throughput increases through automation. (Pomeranz, 2012) One of the technical skills that information technology staff (e.g., programmers and system administrators) are expected to master is the ability to write automation code for repetitive tasks. This is often called scripting and the resulting automation code is a shell script, or script for short. Open source tools are generally highly scriptable, and this carries over into open source digital forensics tools like The Sleuth Kit, which is highly automatable through scripting. This skill has a direct relevance for a successful digital forensics examiner. Hal Pomeranz explained, I m dealing with a case right now where I need to process three or four dozen system images. If I tried to do this serially using some of the standard [proprietary] tools, I d never get it done. But because I can quickly write small shells scripts, Perl programs, etc. I can be doing lots of automatic processing in the background while I m working on specific artifacts that pop out as interesting. The ability to program provides so much leverage for forensic analysts! It s a shame that more time isn t devoted to teaching these skills in typical forensic curricula. (Pomeranz, 2012) Tune-ability Most of the interviewees pointed to the need to tailor the digital forensics workflow to suit the needs of a particular case. Automation may result in spending time processing evidence that a particular case won t need. For example, automating steps in evidence collection for CPU intensive like keyword indexing won t help a case that only needs image evidence. Hal Pomeranz, pointed out Typically, you re looking for very specific stuff. Commercial digital forensics suites are generally Swiss army knives that get everything and you can look at what you want. I can get into the information I want much more quickly with open source tools and avoid the waiting time processing (data the case may not need). That s a huge win if you have the background to use them effectively. (Pomeranz, 2012) Open source tools are generally highly scriptable, and this carries over into open source digital forensics tools like The Sleuth Kit, which is highly automatable through scripting. OPEN SOURCE DIGITAL FORENSICS TOM DUNN NOVEMBER 14,

4 Brian Carrier described Digital forensics is more of a crime scene. When you start searching for evidence you don t know what you re searching for, but you ll know it when you see it. If you look at textbooks and processes for crime scenes, you start with a survey to look around to find the obvious stuff (to get your bearings and find out what rooms are important). Then you move on to an in- depth grid search. (Carrier, Brian Carrier Interview, 2012) There are a lot of analyses that can be done very quickly (e.g., registry analysis, looking for malware, looking at autorun keys, looking at what devices were plugged in). Mostly these read one file and don t grow as fast as your hard drive size. These tasks are akin to Brian Carrier s initial survey to identify what s important. It allows you to perform a triage to identify which lines of evidence are worth pursuing. Other things, like hash analysis and keyword indexing, are much slower. They require you to read all the content of the hard drive. These tasks are akin to Brian Carrier s in- depth grid search. The details of the case determines if its worthwhile to run them. As Jon Stewart points out It s very rare when you get a case and know nothing about it. In the law enforcement community you know what the case is about, you have an investigation. Ever case is different. You may not perform every step in a standard operating procedure (SOP) if it isn t relevant to the case. He continued Automating the tasks alone isn t the answer. Even if we speed them up and make them reliable a particular case may not need to do everything in the SOP. (Stewart, Jon Stewart Interview, 2012) Brian Carrier points out the potential of open source tools, The other story to be told, more relevant to open source vs. closed source, is about the frameworks. The Sleuth Kit and Autopsy potentially can be a game changer. We are not going to provide everyone with everything they want. Other tools are very closed nature, you can t extend them and add a lot of functionality to them. We re providing this infrastructure and basic functionality, but you are free to get modules & plugins from third parties besides us. This empowers the investigator more, who can try an investigative module from someone else without exporting, importing, copying files around from tool to tool. (Carrier, Brian Carrier Interview, 2012) Understanding Capabilities There is a lack of understanding of what digital forensics does and what its capabilities are. One of the significant lessons learned affects the entire digital forensics community, open source and closed source. Hal Pomeranz observed Law enforcement are often surprised and may say oh, I can do that? There are lots of missed opportunities. People get by with bad forensics. Look at the Casey Anthony verdict 1, forensics was a significant player but a forensics tool was broken and nobody noticed for a long time. The failure to notice could have significantly changed the outcome of that case. We need, as digital forensics people, to do a better job of making it known to people what our capabilities are and what our limits are. Both for law enforcement & corporate incident response (who can do a better job by not damaging forensics evidence during collection). (Pomeranz, 2012) 1 Digital forensics software, developed by John Dennis Bradley, was used by the prosecution to indicate that Casey Anthony had conducted extensive computer searches on the word chloroform 84 times, suggesting that Anthony had planned to commit murder. Bradley later discovered that a flaw in his software misread the forensic data and that the word chloroform had been searched for only one time. OPEN SOURCE DIGITAL FORENSICS TOM DUNN NOVEMBER 14,

5 He continued with live capture of memory images as an example, If you can do it, I can tell you so much more (e.g., recover encryption keys, tell if full- disk encryption is used), but it s still SOP to pull the plug and image the hard drive. In a case I m working right now I have stacks of hard disks but no memory dumps. That kind of thing, knowing what we can do and using it to strategically plan investigations, would be a huge win. It s on us as a digital forensics community to get that out there. (Pomeranz, 2012) Cost Open source digital forensics tools provide access to high-end digital forensics tools with a low cost (primarily training and operations costs). Some of the open source digital forensics tool capabilities are industry leading. For example, Jon Stewart calls The Sleuth Kit far and away the best filesystem parser. (Stewart, Jon Stewart Interview, 2012) Digital forensics tools are a very niche market. The number of people who need a copy of any digital forensics tool is small, and the knowledge required to develop these tools is quite high (digital forensics deals in a lot of lowlevel, esoteric details). This tends to put high- end, closed source digital forensics tools out of the range of practitioners who are not well funded. Even law enforcement, who does get steep discounts, cannot necessarily afford all the tools they need to keep up with the rapid change in the technology industry. (Pomeranz, 2012) As Ryan Spanier says, Open source tools let me get things I wouldn t have gotten without paying money. From an education standpoint it allows someone to teach forensics at an affordable cost (EnCase) doesn t show you how forensics works, it s all GUI driven. Like trying to teach motherboards by going into Windows and looking at the device manager. The only feasible way to teach forensics is with open source tools. (Spanier, 2012) Christopher Witter pointed out another benefit of open source tools, the ability to scale deployments based on business needs. As he described it, Open source tools allow me to process data that much faster than proprietary tools, since I can run multiple instances. My workflow is usually structured I process an image (performing maybe 16 different functions). I can use 5 different machines on a piece of evidence, running 5 different functions, each with their own resource constraints, getting the results that much faster. No need for a dongle that acts as my license for the year. Don t need to take 3 licenses to run a piece of evidence on 3 analyst workstations. I can run in parallel and break it up on an individual scale with staff or systems. File carving is very resource intensive; virus scanning Open source digital forensics tools provide access to high-end digital forensics tools with a low cost (primarily training and operations costs). OPEN SOURCE DIGITAL FORENSICS TOM DUNN NOVEMBER 14,

6 is very resource intensive. The cost of making copies of hardware is insignificant to licenses. This gives me the ability to scale to my needs based on business case. From a law enforcement perspective, a forensics guy is often the sole guy for his department. To use open source and bootable distributions, all those PCs are idle when everyone goes home, and he can ramp up his investigations since he is not limited by licenses. I ve done that many times, not just in whose not around but also by using older hardware that s deprecated and going to be put out to pasture. All I needed was memory, CPU cycles. All I needed was cycles, not support on the hardware since it s not mission critical. (Witter, 2012) Results Focus on the Next Challenge Open source software forensic tool developers need to be focused on the challenges ahead, not the challenges in the past. Digital forensics naturally lags the technology industry, which is already one of the fastest changing industries. Digital forensics developers have to start investigating new technologies when they come out and start getting adopted by consumers. Windows 7 came out a few years ago and forensics tools are just now getting tools to deal Windows 7 specific artifacts and what they can tell us. Hal Pomeranz observed, Now we re looking at a platform change. We re now looking at smartphones and tablets and moving away from general purpose PCs. The tools and techniques we need to analyze those platforms will be different We re moving more towards proprietary platforms not documented by vendors. You re faced with black box testing to figure out what an artifact means, what an action does to the state of an artifact. It really slows down research. All the work we did on NTFS was in spite of Microsoft, reverse engineering the filesystem. It was a mysterious blob we analyzed with a hex editor. (Pomeranz, 2012) Ryan Spanier echoed that concern when he said, I haven t done anything with mobile devices, but they are becoming important. I wouldn t say it has become critical where you have to have it now, but I know one day I have to analyze them. (Some forensics tools) need to have the user s cooperation (to run), and may only access user data (when system and user data are on separate partitions). Malware is going to have access to both partitions and you can t get access to that. (Spanier, 2012) Memory forensics is an example of a green field technology area, where open source digital forensics tools lead. According to Jon Stewart, Volatility is now the leading edge of memory forensics. Some proprietary tools do it, but often the Volatility tools do it first. (Stewart, Jon Stewart Interview, 2012) Without a focus on the challenges ahead, open source digital forensics risks repeating the problems encountered when handling disk images using full disk encryption. Years ago it was apparent that every company would adopt Full Disk Encryption. Its adoption was initially driven by laptops that were stolen, lost or broken. Now full disk encryption is mainstream. Microsoft is shipping BitLocker, and there are a number of third party tools and solutions available. With exception of Joachim Metz s library for Microsoft BitLocker, there has not yet been any Full Disk Encryption support in open source digital forensics. If an organization is using full disk encryption you can t analyze that data without the encryption key (often you have to get an escrow key or be given the key/password). (Stewart, Jon Stewart Interview, 2012) OPEN SOURCE DIGITAL FORENSICS TOM DUNN NOVEMBER 14,

7 When there aren t any open source tools to deal with that data, you have to use proprietary tools. It was pretty clear that a lot of investigations would require full disk encryption analysis, but it s a hard problem from an engineering standpoint. You can t just stay up late and solve it on your own. It takes a concerted effort to deal with that level of engineering. The open source community is hampered by dependence on volunteer/contributory work. The people paid to work on digital forensics are commercial software vendors (who have interest in keeping up with trends) or government contractors (many of whom don t get open source software). The government needs to shepherd directed research & development for anticipating the hard problems. The open source tool needs to be available when the technology shows up in an investigation, rather than 2 3 years past when technology showed up in evidence. If open source digital forensics doesn t address that problem they ll always lag behind the commercial vendors and it will keep adoption from spreading. (Stewart, Jon Stewart Interview, 2012) Fragmentation Jon Stewart described a barrier to entry problem for open source digital forensics tools that results in fragmentation where people don t consolidate on the best tools. When an investigator needs a tool, and has the desire to understand things for himself, he may write his own tool. That s all well and good. Maybe he is not familiar with the tools that are out there; they don t do exactly what he wants; or they don t have the documentation he needs to understand what the current tool can do. (Stewart, Jon Stewart Interview, 2012) What s not good is when other people start using those one- off created tools. Some are scripts someone threw together for their need, but technology might be 5 years old when you use it. Web browsers may have changed, but the tools haven t been updated. They may not be applicable to the current tools you re using. As an example, there are a half dozen windows registry analysis tools. Some do the same things; some are more basic and low level. Over the years people scratch their own itches and they re out there, but there is no consolidation or professionalization. (Witter, 2012) (Stewart, Jon Stewart Interview, 2012) In the larger open source software community, other organizations have professionalized tools. You have the Apache community that has people in charge of releases, forces writing unit tests and requires documentation. They have people working together towards one goal. It would be nice to have a standard set of tools with a standard release schedule for some (not all) of the digital forensics tools. Those tools that are used primarily should get funding to further their capabilities regularly. (Witter, 2012) (Stewart, Jon Stewart Interview, 2012) It would also be useful to have organizational support for training and documentation, such as creating easy- to- use how to guides. One interviewee mentioned that the Federal Law Enforcement Training Center (FLETC) in Brunswick, GA, might be a good place to involve in this. This is because many state & federal investigators go through FLETC to get trained, currently on EnCase or FTK. There is not a lot of documentation on The Sleuth Kit other than its website, and those are very technical. (Stewart, Jon Stewart Interview, 2012) Another hurdle facing the open source digital forensics community is having basic introductory information. This information helps bridge the gap between the top 10% of investigators (only the top 1% can read source code) and the 90%. For example, how to videos with introductory material can introduce analysts to open source digital forensics tools, make the tools easier to use, and help adoption spread. Jon Stewart said That s a lesson I ve learned from my time in the commercial forensics space, but haven t seen it in the open source space. They don t all have to be provided OPEN SOURCE DIGITAL FORENSICS TOM DUNN NOVEMBER 14,

8 by a central organization, they can be bottom up. As an example, there is a [proprietary] tool called X Ways that has a guy in the UK make 5 minute how to tutorial videos, one per week, not even paid by X Ways. (Stewart, Jon Stewart Interview, 2012) Proprietary vendors do a good job with that. Proprietary tool vendors do road shows, attend conferences, have blogs, offer training. To spread adoption you have to put in that legwork. Validation A primary lesson learned is the need to continuously validate forensics tools. Some people assume if a tool is open source it has had lots of validation, but in speaking to the developers of open source digital forensics tools, and my own experience, they get a lot of feedback. Hal Pomeranz said Not a lot of people go out and kick the tires to find those that don t seem to be working right. (Pomeranz, 2012) Hal Pomeranz concluded Having a community of digital forensics people who are all talking to each other will help, and disseminate tools to a wider audience. It will lead to tools being used more frequently. (Pomeranz, 2012) Jimmy Weg concurred, stating We should be grateful to those folks who publish papers based upon many hours of research. (Huber, AFoD Interview with Jimmy Weg, 2012) One of the nice things about open source tools is that even if you don t use them for investigations you can use them to validate results from proprietary digital forensics tools, as well as the reverse use proprietary tools to validate open source digital forensics tools. Unfortunately software will have bugs, especially in a field changing as fast as information technology. If you stick with one tool you ll be blind to those bugs. Your toolkit should include many tools. Hal Pomeranz said I periodically check my work even if it means a hex editor (to see a bit that The Sleuth Kit is reporting to me). (Pomeranz, 2012) Jimmy Weg echoed this sentiment, saying Aside from validation, I never use a tool unless I understand what it does and what the artifact means. So, I do my homework, determine why I should look for a given artifact, and then look for a tool that finds it reliably. (Huber, AFoD Interview with Jimmy Weg, 2012) To be admissible in a United States court, evidence must be both relevant and reliable. The reliability of scientific evidence, such as the output from a digital forensics tool, is determined in a pre- trial Daubert Hearing where the judge determines if the underlying methodology and technique used to identify the evidence was sound, and whether as a result, the evidence is reliable. Brian Carrier believes open source digital forensics tools have a Having a community of digital forensics people who are all talking to each other will help, and disseminate tools to a wider audience. It will lead to tools being used more frequently. Hal Pomeranz OPEN SOURCE DIGITAL FORENSICS TOM DUNN NOVEMBER 14,

9 huge benefit over their closed source counterparts, you can verify it. (Carrier, Brian Carrier Interview, 2012) One of the Daubert guideline categories is acceptance of published procedures by the scientific community. To show acceptance, closed source digital forensics tools may point to the number of sales they have. It is important to note that acceptance of a tool is different than acceptance of the procedure the tool performs. (Carrier, Open Source Digital Forensics Tools: The Legal Argument, 2003) REFERENCES Carrier, B. (2012, Oct 30). Brian Carrier Interview. (T. Dunn, Interviewer) Carrier, B. (2003). Open Source Digital Forensics Tools: The Legal Argument. Huber, E. (2012, Aug 2). AFoD Interview with Jimmy Weg. Retrieved Nov 5, 2012, from A Fistful of Dongles: com/2012/08/afod-interview-withjimmy-weg.html Huber, E. (2011, Jan 10). An Interview With Hal Pomeranz. Retrieved Oct 31, 2012, from A Fistful of Dongles: interview-with-hal-pomeranz.html Koster, D. (2012, Oct 22). Discussion With Doug Koster. NIST SP Guide to Integrating Forensic Techniques into Incident Response. NIST. Pomeranz, H. (2012, Oct 31). Hal Pomeranz Interview. (T. Dunn, Interviewer) Spanier, R. (2012, Oct 10). Ryan Spanier Interview. (T. Dunn, Interviewer) Stewart, J. (2012, Oct 11). Jon Stewart Interview. (T. Dunn, Interviewer) Stewart, J. (2012, Oct 3). Scalable Forensics With The Slueth Kit and Apache Hadoop. Open Source Digital Forensics Conference. Wikipedia. (2012, July 10). Digital forensics. Retrieved Nov 1, 2012, from Wikipedia: wiki/digital_forensics Witter, C. (2012, Oct 23). Christopher Witter Interview. (T. Dunn, Interviewer) OPEN SOURCE DIGITAL FORENSICS TOM DUNN NOVEMBER 14,