Forensic Software Research Articles

Cooperative mode: Comparative storage metadata verification applied to the Xbox 360

This work addresses the question of determining the correctness of forensic file system analysis software. Current storage systems are built on theory that is robust but not invincible to faults, from software, hardware, or adversaries. Given a parsing of a storage system of unknown provenance, the lack of a sound and complete analytic theory means the parsing's correctness cannot be proven. However, with recent advances in digital forensic theory, a measure of its incorrectness can be taken.We present FSNView, an N-Version programming utility. FSNView reports exhaustively the metadata of a single disk image, using multiple storage system parsers. Each parser reports its perspective of the metadata in Digital Forensics XML, a storage language used recently in a study on differential analysis. We repurpose the tools used for studying the changes in file systems from time to the changes in file systems from perspective. The differences in metadata summaries immediately note bugs in at least one of the tools employed. Diversity in tools and their analysis algorithms strengthens the analysis of a storage subject.We apply file system differencing to study the external storage of the Microsoft Xbox 360 game console. The console's storage serves as an exemplar analysis subject; the described strategy is general to storage system analysis. The custom volume management and new-though-familiar file system are features typical to an embedded system analysis. Two open-source utilities developed solely for analyzing this game console, and a third developed for general file system forensics, are extended to compare storage system metadata perspectives. We present a new file system and revisions to the DFXML language, library, and differencing process, which were necessary to enable a principled, automatic evaluation of storage analysis tools.

Development and Specification of a Reference Architecture for Agent-Based Systems

The recent growth of agent-based software systems was achieved without the development of a reference architecture. From a software engineering standpoint, a reference architecture is necessary to compare, evaluate, and integrate past, current, and future agent-based software systems. The agent systems reference architecture (ASRA) advances the agent-based system development process by providing a set of key interaction patterns for functional areas that exist between the layers and protocols of agent-based systems. Furthermore, the ASRA identifies the points for interoperability between agent-based systems and increases the level of discussion when referring to agent-based systems. This paper presents methodology, grounded in software forensics, to develop the ASRA and provides an overview of the resulting architectural representation. The methodology uses an approach based on software engineering techniques adapted to study agent frameworks-the libraries and tools for building agent systems. The resulting ASRA can serve as an abstract representation of the components necessary for facilitating comparison, integration, and interoperation of software systems composed of agents.

Ten years of computer forensic tool testing

Barbara Guttman, James R. Lyle and Richard Ayers give an overview of the Computer Forensic Tool Testing project at the National Institute of Standards and Technology, setting out the test procedures, criteria and test data sets for computer forensic software tools, together with a brief illustration of some of the failures that they encounter that can affect digital evidence.

Manipulation of hard drive firmware to conceal entire partitions

Tools created by the computer hacking community to circumvent security protection on hard drives can have unintentional consequences for digital forensics. Tools originally developed to circumvent Microsoft's Xbox 360 hard drive protection can be used, independently of the Xbox 360 system, to change the reported size/model of a hard drive enabling criminals to hide data from digital forensic software and hardware. The availability of such concealment methods raises the risk of evidence being overlooked, particularly as triage and on-scene inspections of digital media become more common. This paper presents two case studies demonstrating the process using Western Digital and Fujitsu branded drives. It outlines the difficulties faced by standard computer forensic analysis techniques in revealing the true nature of the drive and finally provides suggestions for extra checks to reveal this type of concealment.

An empirical comparison of data recovered from mobile forensic toolkits

Mobile devices are increasingly being used as a source of digital evidence in criminal investigations. Mobile forensic toolkit manufacturers have responded to this trend by developing recovery methods capable of recovering evidence from the ever growing range of mobile device models. However, there is a considerable amount of concern as to the reliability of evidence produced from forensic software, with a number of authors documenting difficulties verifying evidence when it is obtained. This paper reports on a comparison of data recovered by a selection of software based methods available in three mobile device forensic toolkits. The results provide the first empirical evidence that there is considerable variation in results between recovery methods in terms of the proportion of data recovered from different devices by different toolkits. In addition, the results suggest that a forensics investigator will face serious challenges verifying the data recovered using one method using the data recovered by another.

Extraction of Electronic Evidence from VoIP: Identification & Analysis of Digital Speech

The Voice over Internet Protocol (VoIP) is increasing in popularity as a cost effective and efficient means of making telephone calls via the Internet. However, VoIP may also be an attractive method of communication to criminals as their true identity may be hidden and voice and video communications are encrypted as they are deployed across the Internet. This produces a new set of challenges for forensic analysts compared with traditional wire-tapping of the Public Switched Telephone Network (PSTN) infrastructure, which is not applicable to VoIP. Therefore, other methods of recovering electronic evidence from VoIP are required. This research investigates the analysis and recovery of digitised human voice, which persists in computer memory after a VoIP call. This paper outlines the ongoing development of a software tool, the purpose of which, determines how remnants of digitised human speech from a VoIP call may be identified within a forensic memory capture based on how the human voice is detected via a microphone and encoded to a digital format using the sound card of a personal computer. This digital format is unencrypted whist stored in Random Access Memory (RAM) before it is passed to the VoIP application for encryption and transmission over the Internet. Similarly, an incoming encrypted VoIP call is decrypted by the VoIP application and passes through RAM unencrypted in order to be played via the speaker output. A series of controlled tests were undertaken whereby RAM captures were analysed for remnants of digital audio after a VoIP audio call with known conversation. The identification and analysis of digital audio from RAM attempts to construct an automatic process for the identification and subsequent reconstruction of the audio content of a VoIP call. This research focuses on the analysis of RAM captures acquired using XWays Forensics software. This research topic, guided by a Law Enforcement Agency, uses X-Ways Forensics to simulate a RAM capture which is achieved covertly on a target machine without the user's knowledge, via the Internet, during or after a VoIP call has taken place. The authors assume no knowledge of the technique implemented to recover the covert RAM capture and are asked to base their analysis on a memory capture supplied in the format of a file with a ‘.txt’ extension. The methods of analysis described herein are independent of the acquisition method applied to RAM capture. The goal of this research is to develop automated software that may be applied to a RAM capture to identify fragments of audio persisting in RAM after a VoIP call has been terminated, using time domain and signal processing technique, frequency domain analysis. Once individual segments of audio have been identified, the feasibility of reproducing audio from a VoIP call may be determined.

Computer Software-Related Litigation: Discovery and the Overly-Protective Order

Litigation involving allegations of intellectual property infringement concerning computer software is some of the most complex, time consuming, and expensive litigation in which private parties engage. Certain practices in discovery, including, most significantly, the use of poorly drafted discovery agreements that also include “overly protective” orders, increase that expense dramatically. Regardless of whether the allegation is patent infringement, copyright infringement, or trade secret misappropriation, prosecuting and defending the assertions in the case requires a probing analysis of the computer source code. In these types of cases, both parties will engage forensic software analysts to assist the lawyers in preparation for trial and to provide expert witness testimony for the court. The forensic software analysts will dissect the computer source code, often examining the source code of both parties, looking for signs of infringement or misappropriation as well as for technical explanations for similarities in the way the code is written or structured. But first, the computer source code must be disclosed to the opposing party. Such disclosure is almost always done pursuant to a protective order, typically stipulated to by the attorneys. Lawyers often agree to protective orders that significantly and unnecessarily increase the costs of discovery. Attorneys should pay careful attention to the provisions addressing the requirements of production and analysis. Additionally, attorneys must understand the consequences of the clauses contained in protective orders in these types of litigation. As described in this article, it is possible to provide robust protection for disclosed source code while at the same time not unnecessarily and dramatically increasing the cost of discovery by weaponizing the protective order. The goals of this article are three-fold. First, we seek to help lawyers understand the process of forensic software analysis. Second, we provide a set of model clauses aimed at avoiding pitfalls in the design of the discovery process, including model clauses for a protective order of appropriate scope and with appropriate protections from further disclosure of the source code that is produced. Third, for judges who are asked to intervene in discovery battles, including fights over the proper scope of a protective order, this article is meant to assist in evaluating the parties’ arguments.

Blast Wave Parameters for Spherical Explosives Detonation in Free Air

Several formulations have been published to define the characteristic parameters of an incident blast wave. In almost all previous work, the charge examined has been TNT explosive and overpressure has been the main parameter examined. In this paper, we describe an investigation based on three explosives, TNT, PETN and ANFO, which has been conducted by considering three parameters: overpressure, duration and impulse of the positive blast wave phase. Calculations of the three parameters were conducted using TM5-855 through the tool CONWEP and AUTODYN. The positive overpressures were calculated using the new forensic software ASIDE. The evolution of these blast wave parameters is expressed by combining the laws of two approaches: the forensic approach and the security approach. TNT equivalents are expressed in terms of pressure and impulse for the comparisons of ANFO and PETN.

An Approach for Validation of Digital Anti-Forensic Evidence

ABSTRACT e-crime is increasing and e-criminals are becoming better at masking their activities. The task of forensic data analysis is becoming more difficult and a systematic approach towards evidence validation is necessary. With no standard validation framework, the skills and interpretation of forensic examiners are unchecked. Standard practices in forensics have emerged in recent years, but none has addressed the development of a model of valid digital evidence. Various security and forensic models exist, but they do not address the validity of the digital evidence collected. Research has addressed the issues of validation and verification of forensic software tools but failed to address the validation of forensic evidence. The forensic evidence collected using forensic software tools can be questioned using an anti-forensic approach. The research presented in this paper is not intended to question the skills of forensic examiners in using forensic software tools but rather to guide forensic examiners to look at evidence in an anti-forensic way. This paper proposes a formal procedure to validate evidence of computer crime.

Software v. Software

In recent years, litigation over software in the United States and elsewhere has skyrocketed. Partly that's due to the 1998 case State Street Bank & Trust v. Signature Financial Group, which established that most kinds of software are patentable. Partly it's due to the fact that you can easily and surreptitiously make a copy of copyrighted source code and put it on a flash drive or send it by e-mail. And partly it's due to increasing reliance on computers and the increasing value of the software that runs businesses and equipment. Clearly, it's in society's best interest to resolve these lawsuits as efficiently and equitably as possible. But settling such disputes can get exceedingly technical, and few people have the expertise to parse source code- the human-readable form of a program, to determine what, if anything, has been illegally reproduced. A program that runs something as simple as a clock radio can have thousands of lines of code; a more complicated device, such as an airplane, can have millions. That's why automatic software forensics tools are so useful. Just as software for analyzing DNA has become crucial in resolving criminal cases and paternity suits, tools that can quickly and accurately uncover illicit software copying are becoming key to copyright infringement litigation.

Using ESI discovery teams to manage electronic data discovery

Introduction The importance of electronically stored information (ESI) in litigation has increased greatly over the past decade. Responding to the "discovery" requests made by all litigating parties has become a significant management function and cost center for organizations engaged in litigation. Today, over 92% of all business records and data are created and stored electronically; most are never reduced to hard copy. After civil litigation is filed, a pre-trial "discovery" phase occurs during which courts require litigants to identify and produce potentially relevant information to their adversaries. Settlements often occur before a trial is held, making ESI produced during the discovery phase and evaluated by the parties often determinative of litigation outcomes. Managing discovery of electronic information requires close coordination among managers with widely diverse technical IT expertise, litigation experience and operational authority. Multi-disciplinary "ESI Discovery Teams" are a key mechanism that can be used to achieve the necessary coordination and continuing oversight over enterprise discovery activities, particularly in larger organizations. A 2007 litigation survey of 253 U.S. corporations reveals that 83% had new lawsuits filed against them in 2006 implicating e-discovery management.1 The most common subject of these law-suits was labor/employment, contract enforcement and personal injuries. Litigation was also significant at smaller companies surveyed, 17% had at least one lawsuit claiming $20 million or more, and at mid-sized companies, 98% reported one or more lawsuits of $20 million or larger. Costs of litigation are high, 71% of the companies reported litigation costs exceeding $1 million per year and 40% had litigation costs over $5 million per year, excluding settlements or judgment amounts. Over half the U.S. firms surveyed use outside e-discovery IT vendors to collect, identify, verify, recover and produce ESI and 30% reported using outside legal counsel with special expertise in e-discovery. These e-discovery vendors had revenues of $1.95 billion in 2006, a 50% increase over 2005, and $130 million was spent for forensic software, data recovery and production.

Validation and verification of computer forensic software tools—Searching Function

The process of using automated software has served law enforcement and the courts very well, and experienced detectives and investigators have been able to use their well-developed policing skills, in conjunction with the automated software, so as to provide sound evidence. However, the growth in the computer forensic field has created a demand for new software (or increased functionality to existing software) and a means to verify that this software is truly “forensic” i.e. capable of meeting the requirements of the ‘trier of fact’. In this work, we present a scientific and systemical description of the computer forensic discipline through mapping fundamental functions required in the computer forensic investigation process. Based on the function mapping, we propose a more detailed functionality orientated validation and verification framework of computer forensic tools. We focus this paper on the searching function. We specify the requirements and develop a corresponding reference set to test any tools that possess the searching function.

Evidentiary Implications of Potential Security Weaknesses in Forensic Software

Computer forensic software is used by lawyers and law enforcement to collect and preserve data in a “forensic image” so that it can be analyzed without changing the original media, and to preserve the chain of custody of the evidence. To the extent there are vulnerabilities in this software, an attacker may be able to hide or alter the data available to a forensic analyst, causing courts to render judgments based on inaccurate or incomplete evidence. There are a number of legal doctrines designed to ensure that evidence presented to courts is authentic, accurate and reliable, but thus far courts have not applied them with the possibility of security weaknesses in forensic software in mind. This article examines how courts may react to such claims, and recommends strategies that attorneys and courts can use to ensure that electronic evidence presented in court is both admissible and fair to litigants.

Agents, Trojans and tags: The next generation of investigators

In a statement the Council of the European Union has recommended that member states should introduce clandestine remote searches of computers as a standard investigation method to combat cybercrime. At present, there is little analysis of the consequences such a development will have in the UK. The use of remote forensic software tools by law enforcement agencies has been, however, controversially discussed elsewhere and most notably in Germany where the Federal Constitutional Court had the opportunity to analyse the issue. This paper describes the use of this investigation method in Germany and analyses the reaction of the German and some other legal systems to give a first indication of the likely issues that its use in the UK will raise.

Criminal investigation and forensic tools for smartphones

The technological capability of mobile devices, in particular Smartphones, makes their use valuable to the criminal community as a data terminal in the facilitation of organised crime or terrorism. The provision of best evidence admissible in a Court of Law requires a thorough understanding of the legal precepts of law under which such admissible evidence may be obtained and proffered. Equally, in the digital age, this evidence must be obtained and presented in a manner which not only ensures admissibility but is also irrefutable. The paper is a technical overview of the currently available forensic software tools that are developed to carry out forensic investigation of mobile devices and terminal/device examination procedures.

An analysis of the accuracy and usefulness of Vinetto, Pasco and Mork.pl

The majority of forensic examiners in the UK use a Microsoft Windows-based platform together with a proprietary forensic application to carry out their analyses. These commercial forensic software packages tend to carry considerable licensing costs, as does the Windows operating system itself. In comparison, Linux is free and contains many forensically useful native tools. Additionally, there are free and open source applications available that have been created specifically for use in computer forensics examinations. This paper assesses the accuracy and usefulness of three such tools: Vinetto, Pasco and Mork.pl and compares the results with those of proprietary tools. We conclude that whilst a computer forensics examiner who is familiar with commercial, Windows tools, is unlikely to switch completely to a Linux-based platform, they may well consider investing the time necessary to learn how to use these free tools in order to have an alternate platform to validate their results.

Software Forensics. By Robert Slade

The digital forensic practitioner, whether he has no previous knowledge of software forensics or is an expert, will find value in this interesting book. In a sparse field, a book on software forens...

Dealing with forensic software vulnerabilities: is anti-forensics a real danger?

The idea that malicious hackers could theoretically 'fatally compromise' forensic software and evidence with a few exploits has been on practitioners' minds since the beginning of the millennium. Conferences such as the Digital Forensics Research Workshop have generated serious discussion of the technical and legal implications of such theories. According to a paper published by the Stanford Law School (2007), ''to the extent there are insufficient 'external' sources of authenticity, a proponent of forensic evidence will need to demonstrate the accuracy of the forensic software itself.''^1 Federal Rule of Evidence 901 provides that evidence may be authenticated by ''describing a process or system used to produce a result and showing that the process or system produces an accurate result.''^2

A Simple Image Hiding Technique: What You May Be Missing

Recent posts to image newsgroups describe a new image hiding technique that is easy to implement and hard to spot. Criminals are utilizing common software to embed illegal graphics inside normal pictures. The files containing these embedded pictures could easily slip past an unsuspecting examiner. This article makes examiners aware of the hiding technique and the strengths and weaknesses of current forensic software and describes how to expose the hidden graphics.

Planning and Building a Taiwan Cyber Forensic Laboratory

The problems of safeguarding cybersecurity have gotten much worse in recent years. The risks in cybersecurity are increasing rapidly in our country. Because the cybersecurity defenses and computer crime investigation systems of our government and businesses have been threatened, the damage of cybercrime for national security and public security will become more critical, even more than violent crime and economic crime. The national cyber forensics mechanism and laboratory will play a crucial role in dealing with cybercrime. In 2003, our government conducted a research of digital evidence, the standard procedure of the operations and cyber forensic laboratory. It included the organization, training, technical capability, legislation, and operation procedures. In 2004, our government made a policy to build the first nationwide cyber security and forensic laboratory. It will be one of the major cybersecurity defense mechanisms in Taiwan. Our bureau (MJIB) made a plan and got the additional budget to build a cyber forensic lab this year. This study has four aspects: 1) The study of reliable cyber forensic software and hardware; 2) The standard of the operating procedures of cyber forensics; 3) Training courses for the examiner, including an internationally well-known certification system in cyber forensics; and 4) The study of certification for the cyber forensic laboratory. Cyber forensics is still in its early stages in Taiwan. More professional cyber forensic manpower is needed, as well as a certified cyber forensic mechanism. It is expected that cyber forensics will become increasingly important for cybersecurity policy and management in the future. Hence, building a certificated laboratory and establishing the SOP of cyber forensics from this study can be the basis to cultivate cyber forensic capabilities in our country. In this way, law enforcement will get more help from our laboratory. The laboratory, through its operation, also enhances the ability of Taiwan's cyber forensic professionals and provides more convincing digital evidence in court. Furthermore, it can consolidate cybersecurity systems and the e-Taiwan environment.