Archives For Computer Forensics

While doing some research on Linux forensics, I stumbled upon an excellent paper written by Gregorio Narvaez.  The paper is titled, “Taking Advantage of  EXT3 Journaling File System in a Forensic Investigation”.  Those of you who have performed linux forensics before know that the EXT3 filesystem dealt our field a serious blow with regard to file recovery.  When a file was deleted in EXT2, the pointer to the file inode within the directory entry was removed.  This severed the link between the file name layer and the meta-data layer, but all of the block pointers within the inode were maintained.  Thus, we could fully recover deleted files, but could not tie them back to their original filenames.  When EXT3 emerged, things took a nastier turn.  Now, instead of removing the pointer to the inode when a file is deleted in EXT3, all of the block pointers within the inode are deleted.  This makes data recovery in EXT3 much, much more difficult.  Luckily, the developers threw us a bone:  the EXT3 journal keeps copies of recently modified inodes, including complete copies of previously deleted block pointers!

Continue Reading…

. @ Good information on decoding Windows prefetch path hashes by Yogesh Khatri http://t.co/f4xfW42c
@chadtilbury
Chad Tilbury

I had the good fortune to attend a High Tech Crime Investigation Association meeting in Singapore last week.  Attendees were primarily from the Singapore business community and represented a good cross section of forensic disciplines.  After giving a talk on Windows Shadow Copy forensics, I sat in on chapter business that included preparation for the annual HTCIA Asia Pacific conference in Hong Kong.  I thought I would provide the details in case anyone will be nearby in December:

Fifth Annual HTCIA Asia Pacific Training Conference

December 5-7, 2011

Cliftons, Hong Kong

http://2011.htcia.org.hk/

Why Windows NTFS fixup values matter in digital forensics -> http://t.co/aK0S3aTf #DFIR
@chadtilbury
Chad Tilbury

“Companies should not be behaving like supercookie monsters, gobbling up personal, sensitive information without users’ knowledge.”

– Ed Markey, Co-Chairman of the US House Bi-Partisan Privacy Caucus, calling for a FTC investigation into the increasing use of “supercookies”.

http://markey.house.gov/index.php?option=content&task=view&id=4527&Itemid=125

FTC Asked to Investigate Supercookies

Note: This post originally appeared on the SANS Forensics blog

Daunting as it may seem, one of the most wonderful aspects of Windows forensics is its complexity.   One of the fascinating aspects of digital forensics is how we often leverage conventional operating system features to provide information peripheral to their original design.   One such feature is the Windows NTFS Index Attribute, also known as the $I30 file.  Knowing how to parse $I30 attributes provides a fantastic means to identify deleted files, including those that have been wiped or overwritten.

Continue Reading…

How big is a Zettabyte? Continue Reading…

$I30 (NTFS INDEX Attribute) parser from @ http://t.co/sShGNgE <- Awesome!
@chadtilbury
Chad Tilbury

Consortium for Digital Forensic SpecialistsAugust was a busy month for CDFS, with the official launch, introduction of the website, and open membership enrollment.  Membership is growing fast and, if the mailing list is any indication, the organization is already working to support the digital forensics field.   Why should you care?  Here is what a student of mine from Texas had to go through just to have the privilege of continuing to practice forensics.

As most of you are aware, multiple states have enacted legislation to require private investigator licenses for those conducting digital forensics.  My colleague had a successful, long standing forensics practice in Texas performing data recovery and forensic investigations.  Continue Reading…

Geolocate pictures without EXIF data -> Google image search is incredible. http://t.co/ehH2iJY #DFIR #privacy
@chadtilbury
Chad Tilbury