Book Review: Digital Forensics With Open Source Tools

DFWOST: No dongle? No problem!

No dongle? No problem, says it all! Authors, Cory Altheide and Harlan Carvey, deliver a superb, field guide for digital forensic practitioners. This book is not a textbook on how to perform digital forensics, but a guide for the veteran or new forensic examiner to reference, to extend his/her analysis capabilities with open source tools. The authors bring their years of real world experience at practicing digital forensics, into a single publication.
Digital Forensics With Open Source Tools (DFWOST) begins by defining "free" vs. "open" and the digital forensic process, as well as the benefits of using open source tools. DFWOST quickly moves into setting up the examination workstation, that the examiner/analyst will use to perform the digital forensic examination; regardless, of the host operating system of your forensic machine.
While the book is not a textbook on how to perform a digital forensic examination, it does outline basic digital forensic concepts and terminology that the forensic examiner must comprehend to utilize the open source framework that the book mainly focuses upon, The Sleuth Kit.
From here, the book goes into depth with Windows, Linux, and Mac OS X operating systems and how to use open source tools to identify, parse, and "forensicate" the various system artifacts.
The book's final chapter focuses on automating forensic analysis and extending capabilities with open source tools Finally, the appendix is full of free, non-open source tools that you should become familiar with and integrate into your digital forensic toolkit. Remember, there are many ways to skin a cat! [Disclaimer: no kitteh's were harmed in compiling this book review :)]

Here's why I am giving this book a five star review:

1) Altheide and Carvey walk the reader through compiling a forensic examination workstation to utilize for a digital forensic investigation. It's full of tips, command line refreshers, and best practices delivered from experienced digital forensic professionals with perfect symmetry (i.e., "It is best to complete Y, to avoid Z").

2) In regards to symmetry, Altheide and Carvey do an awesome job of describing The Sleuth Kit Tools, breaking down the common TSK prefixes and each layer of TSK tools, which for new examiners can be task within itself. If you are new to TSK, DFWOST is the perfect companion.

3) Altheide and Carvey eliminate the barrier of just having OS specific forensic tools. Linux and Mac OS X users can now play in their own sandbox, using their own toys (Of course, Linux and Mac users knew this all along).

4) Chapter 8 on File Analysis is the longest chapter (41 pages in length), covering analysis of image files, audio and video files, archive files, and documents. This chapter breaks down a file's content and metadata. DFWOST puts file analysis into a practical and digestible format, that a new examiner should be able to apply immediately to a forensic investigation.

5) The book's length, based on the subject matter is spot on and not too cumbersome (255 pages including Appendix on Free, Non Open Tools). Just as Carvey done with Windows Registry Forensics (WRF), Digital Forensics With Open Source Tools (DFWOST) takes a sniper approach (@cpbeefcake reference) on the subject matter. Depending on what type of reader you are, you may knock it out in a single reading session; or, it may take several reading sessions, which will allow you to follow along, complete the examples, and exercises outlined in the book.

6) Lastly, the DFWOST print version that I purchased is signed by both authors. I was able to catch both authors at the Open Source Digital Forensics Conference last week in NoVa. Thank you gentlemen!

The book's content, length, and practical application make it a necessity for the digital forensic examiner's toolkit! Now, go forth and 'forensicate', DFWOST-style!

Read what others are saying about DFWOST on Amazon, SANS DFIR blog, and on the Forensicaliente blog.

Computer Forensics: Top 5 Posts and More

Here are the top 5 all-time CFS blog posts:

1. Computer Forensic Book Review: Mac OS X, iPod, and iPhone Forensic Analysis DVD Toolkit
2. Book Review: Windows Registry Forensics
3. Intro to Report Writing for SANS DFIR blog.
4. Forensic 4cast Awards "The Digital Forensic Oscars"
5. Internet Evidence Finder Part II: Intro to IEF v3.3 for SANS DFIR blog

CFS blog continues to receive awesome traffic (thank you). Keep those bookmarks, RSS feed subscriptions, and tweets coming! If you have a blog and have linked to CFS let me know; as I'll be more than happy to add you to "My Blog List". I'm working on another book review that I hope to post soon. The readers seem to enjoy the book reviews, just as I enjoy writing the reviews.

So how are readers being directed to the CFS blog? 


Here are the top search keywords:

1. internet evidence finder v3.6.0
2. "forensic discipline" "computer forensics"
3. cindy murphy "cell phone evidence extraction process"
4. digital forensic report template
5. "mac memory reader"
6. day finder v3.3
7. dfrws 2010 challenge winner
8. internet evidence finder
9. internet evidence finder v3.3
10. mac forensics book

Newsworthy Items

• Lee Whitfield with Forensic 4cast recently posted his 2010 statistical report.
• It's not too late to submit your nomination for the "2011 Digital Forensic Oscars"
• Ken Pryor posted Dereliction of Duty to his Digital Forensics blog.
• Harlan Carvey added some new plugins to RegRipper and are available for download via RegRipper site here.
• Eric Huber posted 408 with Eric on the AfoD blog.
• The Apple Examiner is always cooking up something fresh. If you conduct Macintosh or iOS digital forensic examinations, this is a good reference for you.
• Cyber Crime 101 podcast has had several good episodes recently (Nicely done Joe!)
• Episode 25: Life After Law Enforcement with Eric Huber
• Episode 23: Forensics on A Budget with Ken Pryor
• Solid-State Drives (SSDs) have dominated the news this past week. Checkout SANS Digital Forensics Case Leads from March 3rd.

Forensic Tools

• RegRipper- If you are not ripping, your missing it! (*updated March 9, 2011)
• Jonathan Krause's Free Computer Forensic Tool listing (*updated March 3, 2011)
• SIFT Workstation, which I believe will be updated to v2.1 in the next few weeks.
• The Sleuth Kit v 3.2.1 (*released February 27, 2011)

Job Opportunity links

• New York State Police is looking for a civilian computer forensic analyst here. (Application deadline is March 30, 2011)
• Media Exploitation/ Computer Forensic Expert- Ft. Bragg, NC. (Top Secret/SCI Required)
• (Job Number: 015724)

Book Review: Windows Registry Forensics

Harlan Carvey has done it (again) and continues to raise the bar. It's a must read for the digital forensic analyst! Harlan has brought his many years of experience and research in forensic analysis of the windows registry, into one book. As Rob Lee (SANS Institute) stated, “Windows Registry Forensics provides extensive proof that registry examination is critical to every digital forensic case.”

Dave Hull, fellow SANS Computer Forensic blog editor and SANS Instructor, is the Technical Editor for Windows Registry Forensics (WRF).           

The book contains sidebars, tips, notes, and various analysis concepts of registry forensics, which the author highlights. Of course, this book wouldn’t be complete without tools. Windows Registry Forensics paperback includes a CD that contains forensic tools and code (w/perl, of course), discussed in WRF.

In Chapter 1 (Registry Analysis), Harlan goes into the structure of the registry, which consists of binary data, and for the most part is unbeknownst to the user. Nomenclature of the windows registry (i.e. keys, sub-keys, values, and data) and analyzing registry cell structure data is covered thoroughly in this chapter.

In Chapter 2 (Tools), Harlan discusses free and open source tools to the reader, which can immediately be used for conducting his/her own analysis of registry artifacts, such as Reg Ripper, Autoruns, Regshot, and MiTeC Registry File Viewer (RFV). This chapter walks the reader through live response and forensic analysis of registry artifacts using various free tools.

Chapter 3 (Case Studies: The System) and Chapter 4 (Case Studies: Tracking User Activity) go hand-in-hand. These chapters are the practical application portion of the book, providing the reader with real-case examples, and outlining registry forensic artifacts (or lack thereof…remember, the absence of an artifact in itself is an artifact). Harlan discusses how to crack the SAM using free tools (e.g. Cain, OphCrack). I’ve read a lot of material the last few years covering USB device artifacts; I’ve not seen a more detailed analysis of USB artifacts through registry forensic analysis, until reading Windows Registry Forensics. The case studies chapters also cover real world scenarios (e.g. The Trojan Defense, Tying It Together) and how the analyst’s investigative goals can be guided by using registry analysis, during the intrusion investigation or forensic examination.

In summary, there are a few grammatical and “print shop” errors that should have been caught by the publisher prior to printing the book; however, that does not keep me from giving this book a 5-star review. Once an author submits a final manuscript to a publisher, the publisher is responsible for ensuring the book and content are print (”showroom”) ready. Once again Harlan delivered an exceptional reference book to digital forensic community!

What I’ve taken away from this book is the registry key structure and its nomenclature, key time stamps (data correlation and understanding LastWrite times), deleted registry keys, and the registry redirector (i.e. 64-bit OS calling on 32-bit application in registry). If you want to sharpen your forensic analysis skills, look no farther than Windows Registry Forensics. There’s a key for that!

Computer Forensics: What's in a name? After all it's only a name.

"What's in a name? That which we call a rose by any other name would smell as sweet." -William Shakespeare

While this may hold true in a literary setting, what about computer/digital forensics? How important is a name? I think as a community we need to truly define ourselves. The community seems to be steering towards digital forensics (computer forensics, mobile device forensics, etc. as sub-disciplines). John J Barbara had a two part series in DFI News on the Digital Forensic Sub-Disciplines, which was a great article outlining these sub-disciplines and ASCLD/LAB defining the lifecycle of one discipline into the next. Where does one discipline begin and where does one end? 

For example, while you (forensic examiner/analyst) are performing a forensic analysis of a forensic image you carve out a deleted video (.AVI) of the alleged crime (e.g. armed robbery) from the suspect's seized computer. The case officer/investigator requests you to "enhance" the video quality to aid in the "forensic identification" of a second suspect. Have you crossed over from the computer/digital forensic discipline into video forensic analysis sub-discipline? Can you testify as a forensic video expert?

I've had the opportunity to explain these separate disciplines of computer forensics and mobile device forensics to a jury. A lot of people feel that because you are an "expert" in the area of computer forensics that you should automatically be an "expert" in mobile device forensics. There are a lot of gurus out there that live and breathe mobile device forensics and are experts in the field; however, I'm not one of them. As a community and a computer/digital forensic discipline we must know where these boundaries exist and educate not only ourselves, but our teams/clients/attorneys/officers, etc. about these sub-disciplines. Remember, as the expert it is your responsibility to establish those boundaries with clients/attorneys and a jury.

With these disciplines/sub-disciplines, it also brings up another ongoing issue in the community. What do we call ourselves? Are you a computer forensic technician/examiner/analyst, a digital forensic technician/examiner/analyst? The king of drive-bys, Ovie Carroll, brought up this very topic in this week's CyberSpeak. Besides telling us to go "PreFetch Ourselves" in this episode, Ovie discusses some important issues about the community defining itself (nothing but love for the Ovie).

You wouldn't call an engineer, a technician; nor should you assume your technician is an engineer. Same methodology applies to computer forensics. A forensic technician/first responder's training and expertise will differ from a forensic analyst. Just as a forensic examiner and forensic analyst are different. Each person interacts with the digital evidence in a different manner with separate job duties and goals.

So are you a technician, examiner, analyst, expert or even a scientist? These titles have been discussed on several forensic mailing lists in the past and the debates are always interesting.


Honorable Mentions

• More on Volume Shadow Copies on Harlan's blog. Also here and here.
• The NYC4SEC meetup is going on right now. Follow @NYC4SEC and checkout the group's website.
• Indy Digital Forensics Group is up and running. Our December meeting and met a group of great forensic folks from law enforcement, e-discovery, corporate/ir, educators, etc. January meeting we formed an ASDFED chapter. If you are driving distance within Indianapolis and looking at getting involved this is a great opportunity. Contact Rob Zirnstein (President of Indianapolis ASDFED Chapter) if you would like to join our chapter or attend meeting. Our meetings are posted on the ASDFED website.
• Ken Pryor's Brief Update on his Digital Forensics Blog. Also Part II of Ken's Forensics on less-than a shoestring budget on the SANS Computer Forensics and Incident Response Blog.
• TaoSecurity: Wanted: Incident Handler in Michigan
• CyberSpeak Jan 16, 2011- PreFetch Yourself
• The Apple Examiner is a great resource for iOS forensic investigations (formerly MacOSXForensics). Also news today that MacMarshal released Mac Memory Reader, a free command line acquisition tool for capturing RAM on Mac computers.
• Windows Registry Forensics by Harlan Carvey is now available. If you follow @Syngress on Twitter you may have caught the 50% off sale yesterday only on this book. I have mine ordered and looking forward to receiving it.

 If you read a book you like or one that was a very painful process from beginning to end, write about it and share your viewpoints. Write an amazon book review. This is good for providing feedback to the author and it is good for the forensic community because you can let others know what books they need to have on their bookshelf and books they should not waste their money on.

Thank you for the kind feedback and continuing to follow my blog; keep those tweets, e-mails, and page views coming! My next blog post I plan to share some forensic projects I'm working on and the power of sharing what you know outside of the computer forensic community.

Computer Forensic Book Review: Mac OS X, iPod, and iPhone Forensic Analysis DVD Toolkit

I recently finished reading Mac OS X, iPod, and iPhone Forensic Analysis DVD Toolkit by (Ryan Kubasiak and Sean Morrissey) and was somewhat surprised to find there were no reviews on Amazon. I've submitted my Amazon review and I’m sharing it here with you on my blog.

The book introduces the reader to the Mac OS X operating system and common Apple hardware (i.e. iPods, iPhones, iMacs, etc.) out there today. The intended audience is digital forensic investigators, security professionals, and law enforcement. If you've read a Syngress digital forensics book such as Harlan Carvey’s Windows Forensic Analysis, Second Edition, you are familiar with how these books encourage a hands-on learning approach through exercises and the use of specific forensic tools. This book follows the same path and, like Carvey’s book, offers a DVD filled with exercises, images, and tools for the DIY forensicator.

The authors provide an excellent overview of the Macintosh operating system and include topics such as disk partitioning and Apple Disk images (DMG). For example, chapter 4 is dedicated to the HFS+ file system used by Macintosh computers and drills down to disk level file system forensics. While Brian Carrier's File System Forensic Analysis book touches on Apple partitions, the Mac OS X iPod, and iPhone Forensic Analysis DVD Toolkit book dives even more deeply into the file system structure and nomenclature.

This book demystifies topics such as FileVault (Apple's answer to file encryption) and  Time Machine. It includes content on decrypting FileVault and restoring files from a Time Machine backup. The authors draw on their extensive experience and research to provide best practices, tips, and tricks for preserving and forensically acquiring data from Mac file systems. The authors extensively cover email, Safari based internet artifacts, chat logs, photos, videos, documents, .plists, and other valuable forensic evidence that can be recovered from a Macintosh.

The authors provide an extensive tool set with the accompanying DVD that includes both proprietary and open source tools that can be used to acquire and analyze devices such as Apple computers, iPhone and iPods. The Appendix is full of How-To's that deal with such issues as Bootcamp and virtualization, setting up a Macintosh computer for forensic use, and capturing volatile data on a Mac when conducting digital forensic triage on-scene of an incident.

If you are a digital forensic practitioner and want to learn Macintosh forensics, I highly recommend this book. Now is the time to become familiar with Macintosh and iOS forensics. If you have not had to image or analyze a Macintosh yet, you will. This book makes a great addition to your computer forensic library and is a resource for conducting Macintosh forensic examinations. If the authors pursue a 2nd edition of the book, I'd like to see more information on iOS devices (Note: Late breaking...it appears there is a book in the works iOS Forensic Analysis: for iPhone, iPad and iPod Touch), iDisk ("data from the cloud"), plists, low-level disk forensics, and maybe a chapter on tying it all together for the investigator/examiner when responding to an incident.

So if you are debating whether or not to add this book to your computer forensic reading library, Chapter 4: HFS Plus File System and Chapter 7: Acquiring Forensic Images are invaluable for an investigator/examiner; from Catalog Files in the HFS Plus File System, to imaging an iPod from your forensically configured Macintosh. This book will be an immediate reference tool for me when I’m performing Macintosh digital forensics.

Author's Note: As I stated initially in this blog post, I was disappointed to not see any reviews on Amazon for this book. If you read a book, whether you enjoyed the book or it was a painstaking process, share that information with others. Write a blog post (contact me and I'd be more than happy to share your book review with the forensic community via CFS blog) or publish a book review online. Remember, the community needs you!