EnCase Endpoint Investigator Fundamentals 5/25/2016

Transcription

1 EnCase Endpoint Investigator Fundamentals Guidance Software 1 About Us Tony Balzanto Tony Balzanto is an instructor in the Orlando, FL office of Guidance Software s Professional Development and Training division. A 20+ year retired law enforcement professional and an entrepreneur who founded two digital forensic consulting firms, Tony has been a digital forensic practitioner for 16 years and has obtained the EnCE, CFCE and DFCP digital forensic certifications. Eddie Garren Eddie Garren is an instructor in the Chicago, IL office of Guidance Software s Professional Development and Training division. Eddie has 10 years experience in state and federal law enforcement, 5 years experience teaching digital forensics to law enforcement officers as an instructor with NW3C. Eddie has been a digital forensic practitioner for 17 years, has a Masters degree in Network Security, and holds the CISSP and EnCE certifications. 2 Guidance Software, Inc. 1

2 Master Title EnCase Endpoint Investigator 3 Overview EnCase Endpoint Investigator A secure system allowing for connection and interrogation of remote computer systems PREVIEW AND ACQUIRE: Volatile data On-disk data Sector level Logically THREE COMPONENTS: Examiner SAFE Servlet 4 Guidance Software, Inc. 2

3 Components Examiner A Windows-based forensic workstation properly licensed to run the EnCase Examiner client software. SAFE Secure Authentication For EnCase A command line application, running as a Windows service, that provides secure communication between the Examiner and servlet. Provides functionality for user authentication, enforcement of administrative, examination, and network permissions, and logging of EnCase system operations. Servlet A small command-line application installed on endpoint nodes that permits secure communication with its SAFE. The servlet is bound to only one SAFE. 5 Security Encryption Implementation of EnCaseEndpoint Investigator Super-user SAFE account, called Keymaster, created using EnCase prior to SAFE installation; Public/Private key pair generated by EnCase Asymetric encryption of SAFE SAFE Public/Private key pair and machine file created during SAFE setup Private key protected by a unique Machine ID Machine file and Keymaster public key sent to Guidance to obtain a SAFE certificate signed by the Guidance private key. The signed certificate is coupled with a signed copy of the SAFE s public key and returned as a setup file Guidance private key is validated, encrypted machine ID is decrypted and checked against the SAFE s machine ID to ensure a rogue SAFE cannot be setup by a malicious user Upon validation of all information, SAFE installation completes 6 Guidance Software, Inc. 3

4 Communication SAFE - Examiner Examiner must have a copy of the SAFE s public encryption key Examiner s public key must be available to SAFE and SAFE administrator must create an account on SAFE for examiner SAFE - Servlet Similar to communication between the SAFE and examiner Servlet contains a copy of the SAFE s public key, which is used to setup a symmetrically encrypted session between SAFE and servlet SAFE - Examiner Brokered by the SAFE, which sends both the examiner and servlet a copy of a randomly generated encryption key to protect communication between servlet and examiner during the session 7 SAFE SAFE Configuration Administrator account, named Keymaster, controls user, user roles, and network setup and configuration. Security of SAFE server must be considered as SAFE permits access to disk stored data without regard for file permissions SAFE can only be installed with the assistance of Guidance and as such, a long-term view should be taken when deciding on deployment hardware and configuration. 8 Guidance Software, Inc. 4

5 Servlet EnStart Created during SAFE setup and bound to SAFE by SAFE public key Supported operating systems: Windows through 10 OS-X (PPC and Intel) through (El Capitan) AIX HPUX Linux Solaris Novell 9 Overview 10 Guidance Software, Inc. 5

6 Configuration Network, Roles, and Users Network Administrator configurable to control examiner access to specific network areas or entire network Roles Administrator configurable link between the network and users Control that parts of the network users can access and the examination tasks they can perform Users Examiners that have access to EnCase Endpoint Investigator Each user has their own EnCase Public/Private key pair 11 Demo Time Preview Allows the examiner to browse the endpoint s disks and volumes, RAM and process memory, and mounted file-based volumes (e.g., mounted encrypted containers). Data can be examined and acquired in same manner as locally connected evidence. Snapshot Captures volatile data, such as running processes, open network ports, and network connections. Additionally hashes processes, identifies hidden processes, identifies DLLs files, and detects spoofed MAC addresses. 12 Guidance Software, Inc. 6

7 Master Title Questions / Comments 13 Thank You Tony Balzanto Instructor II Guidance Software Tony.Balzanto@GUID.com Eddie Garren Instructor III Guidance Software Edward.Garren@GUID.com Guidance Software, Inc. 7