Cloud Computing Implications to Digital Forensics A New Methodology Proposal

Transcription

1 Clud Cmputing Implicatins t Digital Frensics A New Methdlgy Prpsal Fabi Marturana marturana@liber.it Abstract This paper deals with a nvel apprach t digital investigatins, aimed at ptimizing law enfrcement s tasks, cncerning digital evidence acquisitin, examinatin, analysis and reprting, and reducing investigatin cmplexity and peratinal csts. In the face f Internet s pervasiveness and massive market penetratin f high-perfrming and lw-cst handset devices, resulting in a wrldwide diffusin f cybercrimes, digital frensics seems indeed t be facing severe challenges which, if nt taken seriusly, may rapidly jepardize the achievements f many years f frensic research. Mtivated by this, the authr prpses a mdel t perfrm cmplex data prcessing which explits clud cmputing capabilities, n the ne hand, and mdern mbile handsets capabilities, n the ther hand, which can be explited n the crime scene t perfrm live and pst mrtem artifact analysis. The paper prvides the reader with the design guidelines, architecture cmpnents, interfaces, functinal and nnfunctinal requirements f a clud-based frensic platfrm implementing the s-called frensics-as-aservice delivery strategy. The prpsed framewrk cnsists f a clud-based server-side and a client side, running n an Andrid smartphne r tablet. The client-side, in particular, cnsists f a cllectin f pen surce frensic tls and an Andrid sftware applicatin, specifically develped fr the purpse. Authr Fabi Marturana is a PhD student in the University f Rme Tr Vergata s Cmputer Science, Systems and Prductin Department. His research interests include Cmputer and Mbile Frensics, Infrmatin Security and Clud Cmputing. He hlds a MS in Electrnic Engineering frm Plytechnic f Turin and c-authred papers n his research tpics. 1. Intrductin During a digital investigatin, frensic analysts are used t perfrming queries, indexing data, calculating hashes, extracting features and crrelating partial data t narrw the search and slve the case. As lng as investigatin cmplexity, n the ne hand, and amunt f data t analyze, n the ther, allwed it, frensic data prcessing ccurred in sequence n stand-alne frensic wrkstatins. Unfrtunately, Internet s pervasiveness and market availability fr cheap and sphisticated mbile devices with large strage capacity, have changed the landscape, resulting in an increase f digital investigatin cmplexity

2 and cntributing t the glbal diffusin f cybercrimes as well. Such crimes, n the ne hand, are evlving at an astunding pace, fllwing the same dynamic as the inevitable penetratin f cmputer technlgy and cmmunicatin int everyday life. Whilst sciety is inventing and evlving, at the same time, criminals are deplying a remarkable adaptability in rder t derive the greatest benefit frm it. Digital frensics, as a cnsequence, seems t be facing new challenges which, if nt taken seriusly, may rapidly render the actual frensics techniques bslete and even nt practicable. Current trends in cmputing and cmmunicatins technlgies have indeed shwn grwing amunts f disk strage and bandwidth available t rdinary cmputer users, resulting in significantly larger frensic data, with regards t the ability t prcess them in a timely manner. Perfrming cmmn frensic tasks, such as keywrds indexing and image thumbnail generatin against a captured image, indeed, may take much f the available time befre an investigatin can even begin. As a cnsequence, digital frensics practitiners, attempting investigatins using a single wrkstatin as a platfrm, will be very sn cmpletely verwhelmed by backlgs. A pssible slutin t vercme the issues utlined abve is then t develp a new frensic paradigm expliting capabilities ffered by clud cmputing. New discussins are indeed emerging, amng frensic practitiners, n whether the clud ecsystem culd be adpted r even extended t delivery law enfrcement s frensic tasks as-a-service. Clud cmputing and Internet s pervasiveness have indeed radically changed the way infrmatin technlgy services are created, delivered, accessed and managed. Clud cmputing has innvated infrmatin technlgy, enabling tasks frmerly carried ut by well-runded cmputers and servers t be perfrmed n a mbile device such as a smartphne. This new service delivery paradigm has the ptential t becme ne f the mst transfrmative develpments in the histry f cmputing, s why nt use this technlgy in yur favr then?. Being available n the clud and being independent f the device used, indeed, a pl f available resurces such as applicatins, prcesses and services can be rapidly deplyed, scaled and prvisined, n demand. Fr this reasn using clud cmputing t deliver n demand frensic services culd be an effective new way t supprt digital investigatins, allwing clud rganizatins, service prviders and custmers, t establish frensic capabilities and reducing clud security risks. In this regard, the paper s aims at describing the design guidelines f a secure frensics-as-aservice delivery platfrm expliting clud cmputing and mbile devices capabilities t supprt live and pst mrtem investigatins n the crime scene. The platfrm is designed t prvide investigatrs with a wealth f cmputing capabilities t cnduct a live analysis n the crime scene with the stand-alne client device. The same device may be used t cnnect t the clud platfrm as well, in rder t uplad frensic data t the server-side fr remte prcessing. The remainder f the paper is rganized as fllws: Sectin 1 describes the prpsed platfrm, the server-side architecture, the functinal and nn-functinal requirements and the client-server interfaces. Sectin 2 deals with the architecture and the functinal requirements f the client-side, running n a mbile device and then cnclusin and pssible future research directins are discussed in the last tw sectins f the paper. 2. The Server- Side T prvide a viable slutin t the abve utlined issues and fllwing n previus wrk by Marturana et al., the authr prpses a mdel fr distributed frensic data prcessing, called frensics-as-a-service delivery platfrm, aimed at expliting clud-cmputing capabilities. The prpsed slutin assumes that frensic images captured by the client-side sftware, may be divided int smaller fragments and upladed 2

3 in parallel t the server-side platfrm t manage massive uplads mre efficiently. The server-side will be respnsible fr acknwledging the fragments received and frwarding them t selected servers in the clud. Expliting distributed file system s capability t replicate files, image fragments are then exchanged amng the selected servers, and mre cpies f the captured image are then rebuilt t assure redundancy. T allw frensic tasks, such as keywrd searching, t be split and perfrmed in parallel n different servers, the authr have indeed made the assumptin that a frensic image can be cnsidered as the natural unit f strage and prcessing. It is indeed pssible t run remte prcesses n a set f distributed cmmdity servers capable f caching in RAM and prcessing image files, allwing cmplex frensic tasks t be quickly perfrmed in parallel. In this scenari few dependencies place cnstraints n the distributin f files r require cmplex distributed synchrnizatin. 2.1 Service architecture, functinal mdel and interfaces The main architectural cmpnents f the server-side, summarized in Figure 1, are: a central prcess, called Orchestratr (O), a number f remte Frensic Prcesses (FP), a cmmunicatin interface (i.e. CSt-SS) between the client-side and the server-side f the platfrm, fr service request and result delivery, and an internal interface (i.e. O-t-FP) fr data exchange amng the clud servers. On the CS-t-SS interface, the Orchestratr will be in charge f: Accepting incming service requests; Initiating utging cmmunicatins; Aggregating and delivering results; While n the O-t-FP interface, it will be in charge f: Distributing captured image fragments, nce upladed, amng available remte Frensic Prcesses; Keeping trace f captured images retained by each remte Frensic Prcess; Distributing prcessing tasks amng available remte Frensic Prcesses, with regards t retained images; Sending flush cmmand t remte Frensic Prcesses fr deleting retained frensic data when needed. Remte Frensic Prcesses will be respnsible fr: Receiving, acknwledging and string captured image fragments; Prcessing captured images; Deleting retained images and frensic data upn Orchestratr request; Delivering results t the Orchestratr. 3

4 2.2 Server- side functinal requirements Frensic data prcessing requests and utput delivery requirements f the prpsed frensics-as-a-service delivery platfrm are described as fllws: Uplad f a live digital media lgical acquisitin t the server-side. The authr cnsiders here a live frensic scenari in which a lgical cpy f all the pwered-n digital devices (i.e. cmputers, tablets, mbile phnes, smartphnes, PDAs etc.), fund at the crime scene, is transmitted t the server platfrm. A secure cnnectin available at the crime scene (e.g. a VPN tunnel upn a Wi-Fi r a 3G data link) shall be used t uplad images. Alternative data transfer prcedures shall be cnsidered in case the crime scene is nt under netwrk cverage, such as the acquisitin f a frensic images at the scene and cnsequent uplad, nce back at the frensic lab. Uplad f a pst mrtem digital media lgical r physical acquisitin t the server-side. In this scenari, a pst-mrtem investigatin n digital artifacts is cnducted in a frensic lab. Physical and lgical cntent f such digital artifacts shall be acquired and upladed t the serverside platfrm. A secure netwrk cnnectin available at the lab shall be used t uplad images. Once upladed, data shall be retained by the platfrm fr the whle duratin f the investigatin and may be queried at any time. On-demand analysis f the infrmatin upladed t the server-side. Once upladed t the platfrm, it shall be pssible t access and prcess frensic images at any time. The fllwing is a list f pssible peratins that shall be executed: 1. OS infrmatin retrieval: it shall be pssible t garner infrmatin abut the digital artifact s perating system; 2. Deleted file retrieval: it shall be pssible t use carving tls t extract the list f deleted files frm unallcated space and slack space; 3. File classificatin by categry r extensin: it shall be pssible t classify the cntent f the analyzed image n the basis f statistics n file type, metadata, extensin, average dimensin etc.; 4. Installed applicatin sftware list retrieval: it shall be pssible t retrieve the list f installed sftware; 5. Web brwsing cache, ckies and histry repsitry analysis: it shall be pssible t extract web brwsing evidence, cncerning navigatin cache and histry, list f stred ckies, and related t different brwsers (e.g. IE, Firefx, Chrme, Opera, Safari etc.); 6. Saved chat/im cmmunicatin retrieval: it shall be pssible t retrieve evidence cncerning saved chat and instant messaging sessins, if stred lcally; 7. Saved Skype calls, chat and messages: it shall be pssible t retrieve evidence cncerning saved Skype calls, chat and messaging sessins, if stred lcally; 8. Lcal database extractin: it shall be pssible t retrieve databases and extract relevant evidence frm the s; 9. Digital timeline creatin: it shall be pssible t rebuild the sequence f events and actins happened in a specific timeframe; 10. Encrypted file retrieval: it shall be pssible t extract encrypted files; 11. Cntent-based indexing: it shall be pssible t index image cntent t ptimize queries; 12. Cryptgraphic hash calculatin: it shall be pssible t calculate r verify files digest; 4

5 13. Keywrd searching: it shall be pssible t search fr keywrds. 2.3 Server- side functinal requirements The present sectin deals with nn-functinal requirements that cmplete the prpsal: Platfrm-independence. The utlined requirements shuld be met regardless f the emplyed machine architecture and perating system. Scalability. The platfrm shuld be able t scale hrizntally and the additin f mre distributed machines shuld lead t prprtinal imprvement in frensic tasks executin time. Efficiency. The extra wrk perfrmed by the platfrm t distribute data and queries amng its ndes, as well as t cllect results, shuld be negligible cmpared t the ttal executin time. Rbustness. Being a distributed system, the service delivery platfrm includes many cmpnents that ptentially fail at any times. It shuld fall n the platfrm t detect and recver frm such exceptinal cnditins and ensure the same level f cnfidence in the end result as in the traditinal case. Extensibility. It shuld be easy t add a new functin, as a building blck f the Frensics-as-a- Service delivery platfrm, r replace an existing ne. Therefre, writing a prcessing functin frm scratch t meet a new requirement shuld be cmpliant t the prpsed mdel. Interactivity. T imprve the user interactive experience, in such distributed slutin, it shuld be pssible t perfrm the time-cnsuming prcessing in the backgrund (n clud machines) while allwing peratrs t issue queries and t view partial results as sn as they becme available. Ease f administratin. It shuld be easy fr administratrs t perate the distributed system and minimal assumptins shuld be made abut the underlying infrastructure (e.g. perating system services). 3. The Client- Side In this sectin the authr describes a Java implementatin f the client-side, develped fr the purpse, which integrates with the clud-based server-side described in sectin II and implements the requirements discussed later n. The authr used sme ppular frensic Linux-based distributins (e.g. Helix, Knppix and DEFT Linux) as a reference pint fr reusing well-knwn extractin tls. The client-side f the prpsed platfrm, running n a mbile device (e.g. a smartphne r a tablet) with Andrid perating system, is thught t be prtable and very flexible. It is in charge f acquiring, dividing int independent fragments f smaller size and uplading lgical and physical images f digital artifacts, in parallel, t the server-side platfrm, and sending cnsequently prcessing requests, based n the acquired data, t the server-side. 3.1 Client- side architecture The client-side utlined abve, in turn, is lgically divided int tw parts: a target-side, including a set f Windws extractin tls, installed n a data partitin f the micr SD card, and an app-side, including an Andrid App installed n the OS partitin, which includes the graphical user interface and the client sftware. The bidirectinal interactin between the app-side and the target-side is straightfrward as it is pssible t use the micr SD card as a repsitry that can be used by bth the app-side and the target-side. The app-side, indeed, is in charge f cnfiguring (e.g. writing) script files n the micr SD and reading 5

6 the data acquired frm the target-side. The target-side, in turn, is respnsible fr reading the cnfiguratin scripts, executing them, cllecting and writing results n the micr SD. The implemented slutin avids, therefre, cmplex prtcl interactins and synchrnizatin between the parties. The client-side architecture, including the described functinal cmpnents, is summarized in Figure 2: 3.2 Client- side functinal requirements Client-side implementatin requirements, with regards t the app-side, have been discussed in the previus sectin. T summarize, the app-side shall be able t: Manage the graphical user interface which interacts with the target-side fr live and pst-mrtem artifact analysis; Cnfigure scripts n the micr SD that launch frensic acquisitin tls n the target-side; Read results written by the target-side n the micr SD and shw them via graphical user interface; Redirect the target-side acquisitin twards an external strage device. Mst f the requirements f the target-side are based n the cnsideratin that a live analysis f pweredn artifacts may be critical during an investigatin as it may prvide imprtant clues t first respnders n the crime scene. In particular, pwered-n artifacts cntain memry-resident infrmatin, such as passwrds and encryptin keys that will be lst after rebting. It als happens that artifacts under investigatin, such as critical servers, may nt be pwered-ff r affrd disruptin t service, and must be analyzed with live frensic techniques. In a live frensic scenari, the target-side shall be able t: Acquire current system time against an accurate time surce; Acquire and analyze artifact data in rder f vlatility (OOV): Physical memry dump, pen files, pen netwrk cnnectins, swap space; Encrypted file systems where yu d nt have key t unlck; List f active prcesses; Windws registry; Temprary file systems; Message digests f gathered evidence. In a pst mrtem frensic scenari, the target-side shall be able t: Acquire a lgical r physical image f each pwered-ff artifact; Analyze lcal file systems t recver specific files; Recver deleted files frm unallcated space and slack space; Analyze windws registry t find installed applicatins, cnnected USB devices etc.; Create a timeline f events; Search fr hidden data (steganalysis). 6

7 Part f such requirements have been already implemented in the current release f the client-side. Details abut planned future implementatins are prvided in the next sectins. 4. Cnclusin A traditinal digital investigatin implies that, using stand-alne frensic wrkstatins, analysts are able t perfrm varius frensic tasks in sequence, against limited datasets extracted frm target artifacts, and evaluate crrespndent results. Unfrtunately this scenari is changing rapidly as the grwing size f strage devices, n the ne hand, and prliferatin f multi-vendr mbile devices, n the ther hand, are causing investigatin delays and increasing cmplexity f digital frensics tasks. As a cnsequence, there is an urgent need t find nvel slutins t imprve digital investigatin effectiveness. T slve the issues utlined abve, the paper described an investigative platfrm fr distributed frensic data prcessing, aimed at taking advantage f bth mbility and clud cmputing capabilities, called frensics-as-aservice delivery platfrm. The platfrm cnsists f a server-side spread acrss a multitude f cmmdity servers in the clud, and a client-side running n a mbile device (e.g. a smartphne r a tablet) with Andrid perating system, which can be easily deplyed n the crime scene t perfrm live and pst mrtem frensic tasks. The prpsed slutin is based n the assumptin that each frensic task may be divided int a set f independent subtasks, running in parallel n a multitude f cmmdity servers in the clud. It is pssible t identify frensic images as the natural units f distributin amng the clud servers since independent file peratins, such as keywrd searching, may be split and perfrmed in parallel n different servers. In the distributed scenari where few dependencies place cnstraints n the distributin f files r file fragments, it may be quite easy t reduce delays and increase efficiency by caching each subtasks dataset in remte servers RAM, as lng as the subtask is up and running. The prpsed cludbased platfrm will take the respnsibility f activating remte prcessing tasks and cllecting partial results, allwing cmplex peratins t be quickly perfrmed. The client-side f the prpsed platfrm is very imprtant as well, as it may prvide investigatrs with a wealth f frensic prcessing capabilities n the crime scene, besides being the access pint t the frensic clud. Architecture cmpnents, interfaces, functinal and nn-functinal requirements f bth server-side and client-side have been examined t prvide the reader with interesting implementatin guidelines. A prttype implementatin f the clientside has been described in sme detail. 5. Future Wrk Given the relevance f the tpic, a grwing interest is emerging amng frensic practitiners twards clud cmputing implicatins t digital frensics. Within few years, the demand fr prcessing digital tasks as-a-service will prbably increase amng practitiners and investigatrs wh will experience this new way f perfrming frensic investigatins. Pssible future research areas n the subject may be: Extending the client-side capabilities t implement: (a) a secure platfrm fr n-demand remte supprt n the crime scene by lab analysts, (b) live windws registry acquisitin and analysis, (c) live windws temprary and lg file acquisitin and analysis, (d) live and selective file system preview and analysis and (e) live extractin f munted encrypted partitins cntent. 7

8 Perfrming and evaluating benchmarks t cmpare advantages and drawbacks f delivering frensic supprt services in huse r cntract ut t a specialized clud service prvider, frm the technical, ecnmic, rganizatinal and legal standpint, Perfrming and evaluating benchmark with traditinal digital frensics tls and techniques that may be adpted in similar situatins. 8