Updates
WRF Review
Andrew Hay posted a glowing review of Windows Registry Forensics on Amazon recently. I greatly appreciate those who have purchased the book and taken the time to read it, and I especially appreciate those who have taken the time to write a review.
DFwOST
Speaking of books, it looks as if DFwOST has been picked up as a text book! Pretty cool, eh? I certainly hope Cory's proud of this...this is a great testament to the efforts that he put into the book, as he was the lead on this...I was just along for the ride.
One of the interesting things about this is that I've heard that other courses may be picking this book up as a resource, in part due to the focus on open source...many of the digital forensics courses out there are held at community colleges that simply cannot afford to purchase any of the commercial forensic analysis applications. Also, I do appreciate the "tool monkey" comment from the blog post linked above...let's start folks out with an understanding of what's going on under the hood, and progress from there. The age of Nintendo forensics is over, folks!
If that's the case for you, either as an instructor or individual practitioner, consider my other books, as well...I focus on free and open source tools almost exclusively, because...well...I simply don't have access to the commercial tools.
NoVA Forensics Meetup
Just a reminder...our next meetup is Wed, 3 Aug, starting at 7pm. One of our members who attended our last meetup has offered to facilitate a discussion regarding some recent cyber activity and how it affects what we do. I'm really looking forward to this, as I think that it's a great way for everyone to engage.
For location information, be sure to check out the NoVA Forensics Meetup page on the right-hand side of this blog.
PFIC
The agenda for PFIC 2011 has been posted, and I'll be presenting on Tuesday afternoon. My presentation will be (hopefully) taking the "Extending RegRipper" presentation a bit further. It works as it is now, but one of the things I want to do is provide a means for the analyst to designate (via both the UI and CLI) to select which user profiles to include in scans.
Bank Fraud
Yet another bank is being sued by a small business following online banking fraud. Brian Krebs had done considerable work in blogging about other victims (most recently, the town of Eliot, ME). What should concern folks about this is that once the victim is breached and the money transfers complete, a battle ensues between the victim and the bank. What isn't happening is this equation is that even with all the press surrounding this, there continue to be victims, and instead of focusing on better security up front, efforts are expended toward suing the bank for "inadequate security measures". Should the bank have had some sort of anomaly detection in place that said, "hey, this connection isn't from an IP address we recognize..."? Sure. Should there be some other sort of authentication mechanism that isn't as easily subverted? Sure. There are a lot of things that should have been in place...just ask anyone who does PCI forensic assessments, or even just IR work.
One of the things Brian has recommended in his blog is to do all online transactions via a bootable live CD. I think that this is a great idea...say your Windows system gets infected with something...if you boot the system to a live Linux distribution, this won't even "see" the malware. Conduct your transactions and shut the system down, and you're done.
Another measure to consider is something like Carbon Black. Seriously. Give the guys at Kyrus a call and ask them about their price point.
Cell Phones As Evidence
Christa Miller recently had a Cops2.0 article published regarding how LEOs should approach cell phones/smart phones. Reading the article, I think that all of it is excellent advice...but you're probably wondering, "what does this have to do with Windows IR or DF work?" Well, something for analysts to consider is this...if you're analyzing a Windows computer (ie, laptop) confiscated as part of a search warrant, be sure to look to see if a phone has been sync'd to the system. Did the user install iTunes, download music, and then load the music on their iPhone? If so, the phone was likely synced/backed up, as well. Is the Blackberry Desktop Manager installed? Did the user back their phone up? If so, the backup files may proved to be significant and valuable resources during an investigation.
Did you map all of the USB removable storage devices that had been connected to the system? You don't need to have the management software installed to copy images and videos (hint, hint) off of a phone...just connect it via a USB cable and copy the images (which will likely have some very useful EXIF data available).
analyzemft 2.0 Released!
Matt Sabourin updated David Kovar's analyzemft.py to make it completely OO! David has done some great work putting the tool together, and Matt's extended it a bit by making it OO, so that it can be called from other Python scripts.
The project is now hosted on Google Code.
Andrew Hay posted a glowing review of Windows Registry Forensics on Amazon recently. I greatly appreciate those who have purchased the book and taken the time to read it, and I especially appreciate those who have taken the time to write a review.
DFwOST
Speaking of books, it looks as if DFwOST has been picked up as a text book! Pretty cool, eh? I certainly hope Cory's proud of this...this is a great testament to the efforts that he put into the book, as he was the lead on this...I was just along for the ride.
One of the interesting things about this is that I've heard that other courses may be picking this book up as a resource, in part due to the focus on open source...many of the digital forensics courses out there are held at community colleges that simply cannot afford to purchase any of the commercial forensic analysis applications. Also, I do appreciate the "tool monkey" comment from the blog post linked above...let's start folks out with an understanding of what's going on under the hood, and progress from there. The age of Nintendo forensics is over, folks!
If that's the case for you, either as an instructor or individual practitioner, consider my other books, as well...I focus on free and open source tools almost exclusively, because...well...I simply don't have access to the commercial tools.
NoVA Forensics Meetup
Just a reminder...our next meetup is Wed, 3 Aug, starting at 7pm. One of our members who attended our last meetup has offered to facilitate a discussion regarding some recent cyber activity and how it affects what we do. I'm really looking forward to this, as I think that it's a great way for everyone to engage.
For location information, be sure to check out the NoVA Forensics Meetup page on the right-hand side of this blog.
PFIC
The agenda for PFIC 2011 has been posted, and I'll be presenting on Tuesday afternoon. My presentation will be (hopefully) taking the "Extending RegRipper" presentation a bit further. It works as it is now, but one of the things I want to do is provide a means for the analyst to designate (via both the UI and CLI) to select which user profiles to include in scans.
Bank Fraud
Yet another bank is being sued by a small business following online banking fraud. Brian Krebs had done considerable work in blogging about other victims (most recently, the town of Eliot, ME). What should concern folks about this is that once the victim is breached and the money transfers complete, a battle ensues between the victim and the bank. What isn't happening is this equation is that even with all the press surrounding this, there continue to be victims, and instead of focusing on better security up front, efforts are expended toward suing the bank for "inadequate security measures". Should the bank have had some sort of anomaly detection in place that said, "hey, this connection isn't from an IP address we recognize..."? Sure. Should there be some other sort of authentication mechanism that isn't as easily subverted? Sure. There are a lot of things that should have been in place...just ask anyone who does PCI forensic assessments, or even just IR work.
One of the things Brian has recommended in his blog is to do all online transactions via a bootable live CD. I think that this is a great idea...say your Windows system gets infected with something...if you boot the system to a live Linux distribution, this won't even "see" the malware. Conduct your transactions and shut the system down, and you're done.
Another measure to consider is something like Carbon Black. Seriously. Give the guys at Kyrus a call and ask them about their price point.
Cell Phones As Evidence
Christa Miller recently had a Cops2.0 article published regarding how LEOs should approach cell phones/smart phones. Reading the article, I think that all of it is excellent advice...but you're probably wondering, "what does this have to do with Windows IR or DF work?" Well, something for analysts to consider is this...if you're analyzing a Windows computer (ie, laptop) confiscated as part of a search warrant, be sure to look to see if a phone has been sync'd to the system. Did the user install iTunes, download music, and then load the music on their iPhone? If so, the phone was likely synced/backed up, as well. Is the Blackberry Desktop Manager installed? Did the user back their phone up? If so, the backup files may proved to be significant and valuable resources during an investigation.
Did you map all of the USB removable storage devices that had been connected to the system? You don't need to have the management software installed to copy images and videos (hint, hint) off of a phone...just connect it via a USB cable and copy the images (which will likely have some very useful EXIF data available).
analyzemft 2.0 Released!
Matt Sabourin updated David Kovar's analyzemft.py to make it completely OO! David has done some great work putting the tool together, and Matt's extended it a bit by making it OO, so that it can be called from other Python scripts.
The project is now hosted on Google Code.