digital forensics · digital forensics common analysis mistakes and pitfalls christian prickaerts ....
TRANSCRIPT
![Page 1: DIGITAL FORENSICS · DIGITAL FORENSICS Common analysis mistakes and pitfalls Christian Prickaerts . ... –In charge of digital forensic investigations –Expert witness testimony](https://reader031.vdocument.in/reader031/viewer/2022022508/5ad239777f8b9a92258cd59c/html5/thumbnails/1.jpg)
DIGITAL FORENSICS
Common analysis mistakes and pitfalls
Christian Prickaerts
![Page 2: DIGITAL FORENSICS · DIGITAL FORENSICS Common analysis mistakes and pitfalls Christian Prickaerts . ... –In charge of digital forensic investigations –Expert witness testimony](https://reader031.vdocument.in/reader031/viewer/2022022508/5ad239777f8b9a92258cd59c/html5/thumbnails/2.jpg)
About me
• Christian Prickaerts – Teaching SANS 408 & 508
• My day job – Head of forensics team @ Fox-IT – In charge of digital forensic investigations – Expert witness testimony
![Page 3: DIGITAL FORENSICS · DIGITAL FORENSICS Common analysis mistakes and pitfalls Christian Prickaerts . ... –In charge of digital forensic investigations –Expert witness testimony](https://reader031.vdocument.in/reader031/viewer/2022022508/5ad239777f8b9a92258cd59c/html5/thumbnails/3.jpg)
Time is of the essence
• Talking about time –Timelining is hot! –New artifacts added constantly
• Same mistakes made –Over and over again
![Page 4: DIGITAL FORENSICS · DIGITAL FORENSICS Common analysis mistakes and pitfalls Christian Prickaerts . ... –In charge of digital forensic investigations –Expert witness testimony](https://reader031.vdocument.in/reader031/viewer/2022022508/5ad239777f8b9a92258cd59c/html5/thumbnails/4.jpg)
What time was this file copied to the USB drive?
![Page 5: DIGITAL FORENSICS · DIGITAL FORENSICS Common analysis mistakes and pitfalls Christian Prickaerts . ... –In charge of digital forensic investigations –Expert witness testimony](https://reader031.vdocument.in/reader031/viewer/2022022508/5ad239777f8b9a92258cd59c/html5/thumbnails/5.jpg)
![Page 6: DIGITAL FORENSICS · DIGITAL FORENSICS Common analysis mistakes and pitfalls Christian Prickaerts . ... –In charge of digital forensic investigations –Expert witness testimony](https://reader031.vdocument.in/reader031/viewer/2022022508/5ad239777f8b9a92258cd59c/html5/thumbnails/6.jpg)
System time at acquisition
![Page 7: DIGITAL FORENSICS · DIGITAL FORENSICS Common analysis mistakes and pitfalls Christian Prickaerts . ... –In charge of digital forensic investigations –Expert witness testimony](https://reader031.vdocument.in/reader031/viewer/2022022508/5ad239777f8b9a92258cd59c/html5/thumbnails/7.jpg)
W32Time / Windows Time Service
• Automatic time sync – ID 35 = Good – ID 17, 29 (XP) = Bad – ID 134 (Win7) = Bad
![Page 8: DIGITAL FORENSICS · DIGITAL FORENSICS Common analysis mistakes and pitfalls Christian Prickaerts . ... –In charge of digital forensic investigations –Expert witness testimony](https://reader031.vdocument.in/reader031/viewer/2022022508/5ad239777f8b9a92258cd59c/html5/thumbnails/8.jpg)
Look for a bunch of them
![Page 9: DIGITAL FORENSICS · DIGITAL FORENSICS Common analysis mistakes and pitfalls Christian Prickaerts . ... –In charge of digital forensic investigations –Expert witness testimony](https://reader031.vdocument.in/reader031/viewer/2022022508/5ad239777f8b9a92258cd59c/html5/thumbnails/9.jpg)
Times, they are changing
• Look for system time change events
![Page 10: DIGITAL FORENSICS · DIGITAL FORENSICS Common analysis mistakes and pitfalls Christian Prickaerts . ... –In charge of digital forensic investigations –Expert witness testimony](https://reader031.vdocument.in/reader031/viewer/2022022508/5ad239777f8b9a92258cd59c/html5/thumbnails/10.jpg)
![Page 11: DIGITAL FORENSICS · DIGITAL FORENSICS Common analysis mistakes and pitfalls Christian Prickaerts . ... –In charge of digital forensic investigations –Expert witness testimony](https://reader031.vdocument.in/reader031/viewer/2022022508/5ad239777f8b9a92258cd59c/html5/thumbnails/11.jpg)
Phone timestamping
![Page 12: DIGITAL FORENSICS · DIGITAL FORENSICS Common analysis mistakes and pitfalls Christian Prickaerts . ... –In charge of digital forensic investigations –Expert witness testimony](https://reader031.vdocument.in/reader031/viewer/2022022508/5ad239777f8b9a92258cd59c/html5/thumbnails/12.jpg)
Alas….
![Page 13: DIGITAL FORENSICS · DIGITAL FORENSICS Common analysis mistakes and pitfalls Christian Prickaerts . ... –In charge of digital forensic investigations –Expert witness testimony](https://reader031.vdocument.in/reader031/viewer/2022022508/5ad239777f8b9a92258cd59c/html5/thumbnails/13.jpg)
Science behind it all
• Scientific papers published in the last 5-10 years • The Rules of Time on NTFS File System • Unification of relative time frames for digital forensics • Time and date issues in forensic computing a case study • A correlation method for establishing provenance of
timestamps in digital evidence • Computer forensic timeline visualization tool • An automated timeline reconstruction approach for digital
forensic investigations • A brief study of time • Etc, etc, etc,
![Page 14: DIGITAL FORENSICS · DIGITAL FORENSICS Common analysis mistakes and pitfalls Christian Prickaerts . ... –In charge of digital forensic investigations –Expert witness testimony](https://reader031.vdocument.in/reader031/viewer/2022022508/5ad239777f8b9a92258cd59c/html5/thumbnails/14.jpg)
Observational skills
![Page 15: DIGITAL FORENSICS · DIGITAL FORENSICS Common analysis mistakes and pitfalls Christian Prickaerts . ... –In charge of digital forensic investigations –Expert witness testimony](https://reader031.vdocument.in/reader031/viewer/2022022508/5ad239777f8b9a92258cd59c/html5/thumbnails/15.jpg)
Logic dictates
• You have lots of tools at your disposal • But they are not intelligent (enough)
• No. 1 tool? – (Your) grey mass
![Page 16: DIGITAL FORENSICS · DIGITAL FORENSICS Common analysis mistakes and pitfalls Christian Prickaerts . ... –In charge of digital forensic investigations –Expert witness testimony](https://reader031.vdocument.in/reader031/viewer/2022022508/5ad239777f8b9a92258cd59c/html5/thumbnails/16.jpg)
Absence of evidence isn’t evidence of absence
- Carl Sagan
![Page 17: DIGITAL FORENSICS · DIGITAL FORENSICS Common analysis mistakes and pitfalls Christian Prickaerts . ... –In charge of digital forensic investigations –Expert witness testimony](https://reader031.vdocument.in/reader031/viewer/2022022508/5ad239777f8b9a92258cd59c/html5/thumbnails/17.jpg)
![Page 18: DIGITAL FORENSICS · DIGITAL FORENSICS Common analysis mistakes and pitfalls Christian Prickaerts . ... –In charge of digital forensic investigations –Expert witness testimony](https://reader031.vdocument.in/reader031/viewer/2022022508/5ad239777f8b9a92258cd59c/html5/thumbnails/18.jpg)
Evidence of absence is evidence of absence
- Christian Prickaerts?
![Page 19: DIGITAL FORENSICS · DIGITAL FORENSICS Common analysis mistakes and pitfalls Christian Prickaerts . ... –In charge of digital forensic investigations –Expert witness testimony](https://reader031.vdocument.in/reader031/viewer/2022022508/5ad239777f8b9a92258cd59c/html5/thumbnails/19.jpg)
The picture is never complete, ever...
![Page 20: DIGITAL FORENSICS · DIGITAL FORENSICS Common analysis mistakes and pitfalls Christian Prickaerts . ... –In charge of digital forensic investigations –Expert witness testimony](https://reader031.vdocument.in/reader031/viewer/2022022508/5ad239777f8b9a92258cd59c/html5/thumbnails/20.jpg)
How representative is your dataset
![Page 21: DIGITAL FORENSICS · DIGITAL FORENSICS Common analysis mistakes and pitfalls Christian Prickaerts . ... –In charge of digital forensic investigations –Expert witness testimony](https://reader031.vdocument.in/reader031/viewer/2022022508/5ad239777f8b9a92258cd59c/html5/thumbnails/21.jpg)
How complete is your dataset?
![Page 22: DIGITAL FORENSICS · DIGITAL FORENSICS Common analysis mistakes and pitfalls Christian Prickaerts . ... –In charge of digital forensic investigations –Expert witness testimony](https://reader031.vdocument.in/reader031/viewer/2022022508/5ad239777f8b9a92258cd59c/html5/thumbnails/22.jpg)
Local IE history vs proxy
![Page 23: DIGITAL FORENSICS · DIGITAL FORENSICS Common analysis mistakes and pitfalls Christian Prickaerts . ... –In charge of digital forensic investigations –Expert witness testimony](https://reader031.vdocument.in/reader031/viewer/2022022508/5ad239777f8b9a92258cd59c/html5/thumbnails/23.jpg)
The name is not the content
![Page 24: DIGITAL FORENSICS · DIGITAL FORENSICS Common analysis mistakes and pitfalls Christian Prickaerts . ... –In charge of digital forensic investigations –Expert witness testimony](https://reader031.vdocument.in/reader031/viewer/2022022508/5ad239777f8b9a92258cd59c/html5/thumbnails/24.jpg)
Sorting by time
![Page 25: DIGITAL FORENSICS · DIGITAL FORENSICS Common analysis mistakes and pitfalls Christian Prickaerts . ... –In charge of digital forensic investigations –Expert witness testimony](https://reader031.vdocument.in/reader031/viewer/2022022508/5ad239777f8b9a92258cd59c/html5/thumbnails/25.jpg)
Sorting by logical order
![Page 26: DIGITAL FORENSICS · DIGITAL FORENSICS Common analysis mistakes and pitfalls Christian Prickaerts . ... –In charge of digital forensic investigations –Expert witness testimony](https://reader031.vdocument.in/reader031/viewer/2022022508/5ad239777f8b9a92258cd59c/html5/thumbnails/26.jpg)
Field of view issues
![Page 27: DIGITAL FORENSICS · DIGITAL FORENSICS Common analysis mistakes and pitfalls Christian Prickaerts . ... –In charge of digital forensic investigations –Expert witness testimony](https://reader031.vdocument.in/reader031/viewer/2022022508/5ad239777f8b9a92258cd59c/html5/thumbnails/27.jpg)
When was this document last printed?
![Page 28: DIGITAL FORENSICS · DIGITAL FORENSICS Common analysis mistakes and pitfalls Christian Prickaerts . ... –In charge of digital forensic investigations –Expert witness testimony](https://reader031.vdocument.in/reader031/viewer/2022022508/5ad239777f8b9a92258cd59c/html5/thumbnails/28.jpg)
![Page 29: DIGITAL FORENSICS · DIGITAL FORENSICS Common analysis mistakes and pitfalls Christian Prickaerts . ... –In charge of digital forensic investigations –Expert witness testimony](https://reader031.vdocument.in/reader031/viewer/2022022508/5ad239777f8b9a92258cd59c/html5/thumbnails/29.jpg)
Attribution and action
• Analysis of data in RAM
![Page 30: DIGITAL FORENSICS · DIGITAL FORENSICS Common analysis mistakes and pitfalls Christian Prickaerts . ... –In charge of digital forensic investigations –Expert witness testimony](https://reader031.vdocument.in/reader031/viewer/2022022508/5ad239777f8b9a92258cd59c/html5/thumbnails/30.jpg)
Unallocated space
![Page 31: DIGITAL FORENSICS · DIGITAL FORENSICS Common analysis mistakes and pitfalls Christian Prickaerts . ... –In charge of digital forensic investigations –Expert witness testimony](https://reader031.vdocument.in/reader031/viewer/2022022508/5ad239777f8b9a92258cd59c/html5/thumbnails/31.jpg)
Carved LNK file
![Page 32: DIGITAL FORENSICS · DIGITAL FORENSICS Common analysis mistakes and pitfalls Christian Prickaerts . ... –In charge of digital forensic investigations –Expert witness testimony](https://reader031.vdocument.in/reader031/viewer/2022022508/5ad239777f8b9a92258cd59c/html5/thumbnails/32.jpg)
Internet Explorer
![Page 33: DIGITAL FORENSICS · DIGITAL FORENSICS Common analysis mistakes and pitfalls Christian Prickaerts . ... –In charge of digital forensic investigations –Expert witness testimony](https://reader031.vdocument.in/reader031/viewer/2022022508/5ad239777f8b9a92258cd59c/html5/thumbnails/33.jpg)
Registry artifacts
![Page 34: DIGITAL FORENSICS · DIGITAL FORENSICS Common analysis mistakes and pitfalls Christian Prickaerts . ... –In charge of digital forensic investigations –Expert witness testimony](https://reader031.vdocument.in/reader031/viewer/2022022508/5ad239777f8b9a92258cd59c/html5/thumbnails/34.jpg)
Tooling
Hey Wilson, what forensic tools are you using these days?
![Page 35: DIGITAL FORENSICS · DIGITAL FORENSICS Common analysis mistakes and pitfalls Christian Prickaerts . ... –In charge of digital forensic investigations –Expert witness testimony](https://reader031.vdocument.in/reader031/viewer/2022022508/5ad239777f8b9a92258cd59c/html5/thumbnails/35.jpg)
Tool validation
http://windowsir.blogspot.com/2013/06/there-are-four-lights-lnk-parsing-tools.html
![Page 36: DIGITAL FORENSICS · DIGITAL FORENSICS Common analysis mistakes and pitfalls Christian Prickaerts . ... –In charge of digital forensic investigations –Expert witness testimony](https://reader031.vdocument.in/reader031/viewer/2022022508/5ad239777f8b9a92258cd59c/html5/thumbnails/36.jpg)
Summertime, and the living is… well, whatever
Viewed on November 11
Viewed on May 28
![Page 37: DIGITAL FORENSICS · DIGITAL FORENSICS Common analysis mistakes and pitfalls Christian Prickaerts . ... –In charge of digital forensic investigations –Expert witness testimony](https://reader031.vdocument.in/reader031/viewer/2022022508/5ad239777f8b9a92258cd59c/html5/thumbnails/37.jpg)
Fish are jumping and the cotton is high...
Windows explorer
Acrobat PDF reader
![Page 38: DIGITAL FORENSICS · DIGITAL FORENSICS Common analysis mistakes and pitfalls Christian Prickaerts . ... –In charge of digital forensic investigations –Expert witness testimony](https://reader031.vdocument.in/reader031/viewer/2022022508/5ad239777f8b9a92258cd59c/html5/thumbnails/38.jpg)
Eventlog Explorer in Summer
![Page 39: DIGITAL FORENSICS · DIGITAL FORENSICS Common analysis mistakes and pitfalls Christian Prickaerts . ... –In charge of digital forensic investigations –Expert witness testimony](https://reader031.vdocument.in/reader031/viewer/2022022508/5ad239777f8b9a92258cd59c/html5/thumbnails/39.jpg)
Eventlog Explorer in Winter
![Page 40: DIGITAL FORENSICS · DIGITAL FORENSICS Common analysis mistakes and pitfalls Christian Prickaerts . ... –In charge of digital forensic investigations –Expert witness testimony](https://reader031.vdocument.in/reader031/viewer/2022022508/5ad239777f8b9a92258cd59c/html5/thumbnails/40.jpg)
Test your tools
I’ve upgraded this tool
to be more awesome!
![Page 41: DIGITAL FORENSICS · DIGITAL FORENSICS Common analysis mistakes and pitfalls Christian Prickaerts . ... –In charge of digital forensic investigations –Expert witness testimony](https://reader031.vdocument.in/reader031/viewer/2022022508/5ad239777f8b9a92258cd59c/html5/thumbnails/41.jpg)
Test your hypotheses
![Page 42: DIGITAL FORENSICS · DIGITAL FORENSICS Common analysis mistakes and pitfalls Christian Prickaerts . ... –In charge of digital forensic investigations –Expert witness testimony](https://reader031.vdocument.in/reader031/viewer/2022022508/5ad239777f8b9a92258cd59c/html5/thumbnails/42.jpg)
Final thoughts
• You are looking at the result of certain activity, not at the activity itself
• There might be an alternative scenario that produces that specific pattern