What is the Scope of Computer Forensics? 45
Jety asks: "I do general-purpose tech support for a variety of individuals and small businesses. Today, one of my clients presented me with an interesting situation, which made me recommend that he get his own attorneys and computer forensics experts on the job. Above and beyond that, to satisfy my own curiosity and to have some insight to offer him in the meantime - I have some question about the scope of what computer forensics can accomplish, for this I turn to the experts of Slashdot, which can be boiled down to one issue: What exactly can a good computer forensics guy pull off of a hard drive - particularly once it's gone on to be used for a full week after the incident in question?"
"The sanitized details of my client's situation:
- Person A (my client) and Person B are business partners. Person A leaves the business, and before doing so copies a series of files to 5 CDs using Roxio under Windows XP.
- The computer continues to be used under normal circumstances for about a week.
- Person B confronts Person A, and Person A hands over the CDs to Person B.
- Person B hires a computer forensics 'expert', who claims that Person A accessed something like 3000 files during the 1 hour time span in question, when Person A was burning files to CD.
- Person A primarily wants to prove that the data he turned over on CD was the only data he took, approximately 50 word/excel type files, which we will assume to be true.
How detailed a record of file use does NTFS or WinXP keep? Can you really show what files were accessed during a one-hour time span seven days ago? Above and beyond the 'last modified' date? On a read/write/execute basis? Accessed by the system or by a user? Do commercial burning programs keep a record of burn jobs they've performed? Does the CD drive itself have any appreciable nonvolatile cache? Is there any other general insight applicable to this situation?"
Complicated Issue (Score:3, Interesting)
And short answer is, unfortunatelly: "It is impossible to know".
There data might be there. Then again, it might not be. Yes, it is possible to track many records and cross many small pieces of information. One could, for instance, detect that he burnt 6 CDs, not only 5. Or maybe he burnt 10. Maybe some filed he access where not accessed since then. Maybe the machine clock changed, or some space space with critical data was reused by the system.
Your best bet is to hire the professional, and see what he can pull out. But remember that the forensics process might compromise the machine, so make certain you are hiring a good and respectable lab to do the job, and make sure they follow all the current standards.
Re:Complicated Issue (Score:2)
Re:Complicated Issue (Score:1)
Just by using a write-blocker will not give you enough assurance he is a competent professional. I don't think that is what you said, but one can understand that this way.
Make sure you do a good background ch
Re:Complicated Issue (Score:2)
Some data points:
NTFS Access Time (Score:4, Informative)
The only sure way to delete a hard drive (Score:4, Interesting)
When a file is "deleted" in NTFS, that space is marked as free and the record of that file is still there. After that, it is sort up to chance whether that space will be reused (or parts of that space - more likely). So odds are, after one week, assuming it is just Joe User's machine, a file will most likely still be at least partially accesible.
The only way to be sure that a drive has no data is to "zero" it out (that is, assign a 0 to each and every bit on the drive). Still, I have heard that some forensic techs can detect the inetria of a bit's previous value - they can tell what was there before. I read a Slashdot comment somewhere today that mentioned that it takes multiple cycles of randomizing and zeroing out the bits on a hard drive to get the job done. Or you can just strap it into a cement chasis and drop it in the Hudson (is it OK to make two lame jokes about eliminating a hard drive in one post?).
Re:The only sure way to delete a hard drive (Score:1)
Re:The only sure way to delete a hard drive (Score:2, Informative)
===WARNING, VERY INCOMPLETE AND SIMPLISTIC ANALYSIS===
The point is that, magneticaly speaking, we don't have 0's and 1's. Lets day that for a given data system, 0 is marked by -5 Magnetic Field Unities, while 1 is marked by 5 Magnetic Field Unities. Now, of course, the hardware itself is not digital (given number of isolated
Re:The only sure way to delete a hard drive (Score:1)
Current DoD standards call for 7 writes - several random with at least one of all zeros and at least one of all ones.
Some research in the last year using electron microscopes suggests that to really make the data unreadable, 14 writes should be done.
Despite both of these, modern (in excess of 20 GB) drives are using increasing levels of abstraction where without intimate knowledge of the drive firmware logic AND the full contents of the drive ROM AND the elec
Re:The only sure way to delete a hard drive (Score:2)
Re:The only sure way to delete a hard drive (Score:2)
Re:The only sure way to delete a hard drive (Score:3, Informative)
Re:The only sure way to delete a hard drive (Score:2)
Copied files (Score:5, Insightful)
Re:Copied files (Score:2)
Sure, but you can assume those files are compromised, and try to figure out how to minimize the affect. Not knowing what other files might have been compromised means that you have to treat the entire system as compromised.
Plenty (Score:5, Interesting)
Person A left company AA and started company BB then started taking customers. Attorney for AA got a court order allowing inspection of all magnetic media. Of course, by the time I was allowed access to the drive, several months had passed during which time "something had gone wrong with the computer" and "I think the repair shop had to format one of the drives". Yeah, right.
In any case, they thought that a basic reformat of a DOS hard-disk removed all the data. As I started pulling off and saving directory-fragments and disk sectors which showed that they had illegally installed specialized and unusual software belonging to the former employer as well as lists of names of clients they made fundamental mistake #2 - they started blabbing "explanations" for the data I was recovering. As a former law-enforcement employee I simply listened attentively to their stories...and included the additional incriminating evidence in my report.
Never even had to go to court and testify.
Things are more complicated, today. You are right to get a computer forensic expert involved. Many of the disk-recovery services like Drivesavers [drivesavers.com] provide forensic services in addition to data-recovery.
Re:Forensics Training (Score:3, Interesting)
I don't do this primarily, but... (Score:2)
As said, I'm not a pro - I do something else for a living. I have done forensics professionally, and we won (
Re:Forensics Training (Score:3, Interesting)
Law Enforcement in some states will allow civilians to volunteer time assisting with some types of cases. You might be able to help a police officer and get training.
Many of the forensics software vendors offer training. This is tool-specific and wouldn't emphasise the legal context as much.
SANS also has a training program. I ha
Mostly none by dafault. (Score:1, Informative)
You need a good NTFS tutorial... (Score:5, Insightful)
Pretty detailed. User account, time at a minimum.
Can you really show what files were accessed during a one-hour time span seven days ago?
Yes.
Above and beyond the 'last modified' date?
Yes.
On a read/write/execute basis?
In a roundabout fashion. I'm not as familiar with NTFS as I would need to be to give a good yes or no or yes with limitations. It keeps records of modification (write) and access (read) so the only unknown is whether one could tell if a file was merely read or executed. It is a journalling file system, so depending on how exactly it performs journalling, it may even be possible to find out which parts of a file were modified in the case of writes. This is less likely as journal records are, presumably, overwritten with new records over a short period of time.
Accessed by the system or by a user?
If I remember correctly, NTFS does record the date of creation, modification, and access with the user performing each action. Many "system" actions are performed in the user's name since, technically, the user is running the system program.
Do commercial burning programs keep a record of burn jobs they've performed?
Many programs do keep a short log of actions. They won't necessarily detail files involved, though. You'll be lucky if such a log tells you how much data was written to the disk in MB. This might actually be just as useful.
Does the CD drive itself have any appreciable nonvolatile cache?
No.
Is there any other general insight applicable to this situation?
Yes:
Person B hires a computer forensics 'expert', who claims that Person A accessed something like 3000 files during the 1 hour time span in question, when Person A was burning files to CD.
This points to a very simple search of all files modified, accessed, or created during that time period. Please note that this could indicate a virus scanner or system backup utility running in the backup as much as it indicates a cd writing program. Viruses can also exhibit this behavior. Try to find out how many files were accessed in the previous 24 hours before this particular hour, and the following 24 hours. It could be that every hour during that time had several thousand files uniquely accessed.
Person A primarily wants to prove that the data he turned over on CD was the only data he took, approximately 50 word/excel type files, which we will assume to be true.
Quite frankly, if he needed 6 CDs to burn 50 word/excel files... well, let's just say that you should explain to him that you try to assume nothing so that you can have the best view of the facts.
Also note that if data backups are made of the computer on a daily/weekly/regular basis, it may be that one can use those to show useful data about your client's use of the computer. An interesting tactic would be for your client's attornies to request a detailed log of computer use for the week previous and the week following the incident to establish a pattern of use. Request all possible backups. Request... well, everything. The attorney will know what you mean.
Lastly, keep in mind that your client has already 'confessed' - the only thing left to determine is not whether he is guilty, but how guilty. Chances are good that even if he didn't do more than he says he will have a hard time proving that he has fully complied.
Lastly: Don't become personally involved, or emotionally invested. Your client will be, and he may even be pulling you into it without knowing it. Understand that anything you say to him may be used in any forthcoming legal case, and you may find yourself more involved than you desire to be.
-Adam
You think you might be a forensic professional? (Score:1)
Lesson 2: Making sure the computer doesn't know what you did anymore requires using a method to destroy the physical harddisk. There is almost no software method secure enough to make it actually impossible. Try Mt Doom, a forge or a sledgehammer.
Practical advice for your p
Re:You need a good NTFS/Law tutorial... (Score:1)
Pants on Fire (Score:1)
Re:Pants on Fire (Score:2)
Roxio logging? (Score:1)
Depends (Score:2)
If these were important files... (Score:2)
In that case, a reputable data recovery lab should be hired for this one. They can do some pretty extensive stuff, but don't be surprised if they come back to you with nothing. Nonetheless, I would think that's your best bet on this one.
Chain of Custody and Preservation of evidence (Score:2, Insightful)
You mention that the drive has been used for a period of time since the original forensics expert examined it. That could be a problem.
Ideally, the orignal forensics expert would have used a write blocking device (hardware) and carefully made a bit for bit (dd, encase, etc.) image of the drive.
That image is evidence and should be made a
Re:Chain of Custody and Preservation of evidence (Score:1)
FTK (Forensic Tool Kit) is made by Access Data.
http://www.accessdata.com/ [accessdata.com]
Atomic Force Microscopes (Score:1)
hypothetical indeed (Score:2)
"investment potential" as the TITLE of and WITHIN all
if XP opens every file (all 3000 of them) then NTFS records me as opening all those files.
guess what-- even if I only copy 50 of them, I've opened all of them.
"Something" accessed 3000 files in one hour (Score:2)
If there's a pattern to
Ad hoc forensics (Score:1)
The first question is this: do the parties need to retain legal counsel? If A and B are shaking hands and good to go, great. If not, they need to retain counsel.
If counsel is retained, then they need to work with their clients to find a reputable computer forensics expert. And that's all there is to it,
Above and Beyond (Score:2)
Some things can be fixed to start at a certain time but the way that you work it's easier just to have every
Oops - wrong place - please mod down (Score:2)
Other programs can access files, too. (Score:1)
Re:Other programs can access files, too. (Score:2)
Riiiight.. (Score:2)
It's there but seldom enabled... (Score:2)
Trouble is, unless this was specifically enabled, it didn't record anything -- auditing is typically not done, since it's a performance hit (think double the number of system calls every time an audited object is hit) and it makes logfiles fill up very quickly.
Yes. Lots of NTFS Artifacts can be found (Score:1)