Windows Live Messenger Forensics: Contact List Artefacts. Dennis Cortjens

Transcription

1 Windows Live Messenger Forensics: Contact List Artefacts Dennis Cortjens 29th of February, 2012

2 Contents 1 Document Information Description Version History Project Information Introduction Problem Position Questions Main Sub Goal Scope Planning Activities Milestones Global Overview Organization Team Information

3 Chapter 1 Document Information 1.1 Description This document is the project plan for the Windows Live Messenger Forensics: Contact List Artefacts project. This small project is part of the CyberCrime and Forensics subject of the System and Network Engineering course. 1.2 Version History Version Date Author Comments Status th of February, 2012 D. Cortjens first version of the Project Plan draft Table 1.1: Version History 2

4 Chapter 2 Project Information 2.1 Introduction Microsoft s instant messaging service has been around for quite some time. It started in 1999 with the launch of MSN Messenger and was renamed to Windows Live Messenger in Nowadays it still is a widely used messaging service, especially among young people. It is a popular way of communicating with each other, even though instant messaging is being moved to cloud services such as Facebook. The service and its application has changed a lot through the years. A lot of features have been added which leave behind artefacts. Although not all feature are turned on by default, like saving chat history, and therefor won t leave behind anything. There are however some artefacts left behind by default which are interesting from a forensic point-of-view and have become an useful source of information in criminal cases. 2.2 Problem MSN Messenger and Windows Live Messenger save the user s contact lists at every login. These contact lists are saved in the STG file format for MSN Messenger and the first versions of Windows Live Messenger. They are saved in the EDB file format for the latest versions of Windows Live Messenger. Both file formats use encryption to secure the data within the file. There are applications developed which are able to decrypt the files and export the data inside to a report. For the STG files Forensic Box is often used and for the EDB files this is LiveContactsView. These applications have their short commings. Forensic Box is old and is no longer maintained. There is no known developer or website. In older cases STG files are still found, despite Microsoft renaming the application and changing the file format six years ago. Investigating the STG files oftenly results in an unknown error when opening with Forensic Box, especially file from the latest version of MSN Messenger. The latest version of LiveContactsView is from 2010, but there hasn t been an update ever since. Although Windows Live Messenger has changed a lot over the last two years. A major disadvantage of LiveContactsView is, that it s not listing the address of the user in the report. This makes it very difficult to trace the user s address back to the EDB file and the associated report. Both applications have the disadvantage of not being able to decrypt multiple files in a bulk process. This is a problem, because MSN Messenger and Windows Live Messenger saves the contact list at every login which means a lot of files. Therefor investigating STG or EDB files is a time consuming task. Another issue with Windows Live Messenger is, that it saves the EDB files in different subfolders. These folders can differ from /new/ to /old/, /old1/, /old2/ and so on, increasing the investigation time by needing to browse through the files. The world of Digital Forensics world is in need of a full and automated process for investigating the data inside EDB and STG files. 3

5 2.3 Position A literature study on Windows Live Messenger artefacts resulted in two articles on SciVerse (Elsevier). In 2006 Mick Dickson researched artefacts of MSN Messenger version 7.5. He mentioned that this version of MSN Messenger left very little artefacts on the local computer and that some of them only appear in the memory or Windows swap file [1]. He didn t mentioned the presence of STG files on the local computer, although they were present in that version of MSN Messenger. In 2007 Wouter S. van Dongen researched artefacts of Windows Live Messenger version 8.0. He mentioned that this version of Windows Live Messenger left artefacts on the local computer that could give an overall picture of an users activities. He also mentioned the presence of STG files on the local computer [2]. These findings are outdated, because they describe old versions of MSN Messenger and Windows Live Messenger. However, they are a good basis and reference for this research. 2.4 Questions Main How could the forensic analysis of MSN Messenger and Windows Live Messenger contact list artefacts be improved, automated and logged to reduce the time needed to investigate these artefacts? Sub The main question is researched with the following subquestions: 1. Which artefacts are left behind by the lastest version of Windows Live Messenger? 2. What is the locations of the contact list artefacts? 3. What are the characteristics of the contact list artefacts? 4. What is the forensic value of these characteristics? 5. Can the forensic analysis of the contact list artefacts be automated? 2.5 Goal The goals are set by the following subquestions: Which artefacts are left behind by the latest version of Windows Live Messenger? Determine which artefacts are left behind by the latest version of Windows Live Messenger by testing it against the work of Van Dongen and by researching the application itself. What is the locations of the contact list artefacts? Determine the possible locations of the contact list artefacts. What are the characteristics of the contact list artefacts? Determine the characteristics of the contact list artefacts, including the content. What is the forensic value of these characteristics? Determine the forensic value and validity of the contact list artefacts. Can the forensic analysis of the contact list artefacts be automated? Determine whether or not it is possible to automate the contact list artefact analysis by creating a analysis tool. This tool should be able to decrypt a contact list file on every location, process its content and log all the steps of the analysis. 4

6 2.6 Scope This project is limited by the following scope: It focuses on the contact list artefacts of the latest version of Windows Live Messenger; It focuses on the forensic value and validity of the artefact files; The analysis tool will be written in Python and will be command line based; All other artefacts are research in basic if there is enough time for it or will be mentioned as further work. 5

7 Chapter 3 Planning 3.1 Activities The following activities are defined: Activity Time Deadline Write plan DRAFT 8 hours 29/02/2012 Write plan FINAL 4 hours 02/03/2012 Literature study 8 hours 02/03/2012 General artefact research 8 hours 07/03/2012 Contact list artefact research 12 hours 14/03/2012 Build analysis tool 16 hours 21/03/2012 Test analysis tool 4 hours 23/03/2012 Create presentation DRAFT 8 hours 23/03/2012 Create presentation FINAL 4 hours 26/03/2012 Write report DRAFT 20 hours 28/03/2012 Write report FINAL 8 hours 30/03/2012 Total 100 hours 30/03/2012 Table 3.1: Activities 3.2 Milestones The following milestones are defined: Milestone Deadline Plan is written (FINAL) 02/03/2012 Contact list artefact research is completed 14/03/2012 Analysis tool is build 21/03/2012 Presentation is created (FINAL) 26/03/2012 Report is written (FINAL) 30/03/2012 Table 3.2: Milestones 6

8 3.3 Global Overview Figure 3.1: Gantt Chart 7

9 Chapter 4 Organization 4.1 Team Name Role Skills D. Cortjens student/researcher Project Managing, Forensics and Programming Table 4.1: Team 4.2 Information The project documents and files will be held in a GIT repository. The GIT repository is stored on the server and has a specific folder structure as shown in table 4.2. Folder Subfolders Description documents literature The subfolder with all the literature used for researching the projects subject. plan The subfolder with all the source files and latest PDF file for the project plan. report The subfolder with all the source files and latest PDF file for the project report. tool - The folder and possible subfolders with the source files for the analysis tool. Table 4.2: Folder Structure 8

10 Bibliography [1] Mike Dickson, An examination into MSN Messenger 7.5 contact identification, [2] Wouter S. van Dongen, Forensic artefacts left by Windows Live Messenger 8.0,