Course list http://www.c-jump.com/bcc/

BRISTOL Cyber Security and Digital Forensics -- Autopsy Organizing Data Into a Case

1. Organizing a Case
2. What is a case?
3. Making a Case
4. Creating a Case
5. Case Metadata (optional)
6. Case Directory
7. Case Directory Contents
8. What are Data Sources?
9. Data Sources
10. What Happens to the data from a Data Source?
11. What Gets Stored in the Database?
12. Disk Image Formats
13. Disk Image Analysis
14. Volume System Analysis
15. Volume System Analysis (cont.)
16. File System Analysis
17. Orphan Files
18. File Carving
19. Carving Example
20. Carving Example (cont.)
21. Carving Process
22. Carving Process in Autopsy
23. Unallocated Space
24. Adding a Disk Image
25. Disk Image Limitations
26. Data Sources: Local Drives
27. Local Drive Analysis
28. Local Drive Analysis (cont.)
29. Making a VHD File
30. Making a VHD File in Autopsy
31. Local Files
32. Local Files (cont.)
33. Local File Sets
34. Summary

1. Organizing a Case

• Section Concepts and Goals:

• Outline the basic ideas about organizing data into a case

• Explain how to add data to the case

  • Creating cases

  • Adding data sources

  • Types of supported data sources

   

2. What is a case?

• A case is an investigation project

• A case groups the investigation data you are going to analyze

• It's up to you how many cases you create:

  • By investigation

  • By host within an investigation

• Factors:

  • Only one case can be open at a time

  • Reporting is done at a case-level

  • Cases are saved automatically -- there is no "save" feature

   

3. Making a Case

• Making a Case can be done at Startup or via the Case Menu:

   

   

4. Creating a Case

• Creating a Case involves specifying New Case Information:

  • Case Name, Base Directory, Case Type: Single or Multi-user.

  • Case data storage directory path is constructed automatically based on the case info.

   

   

5. Case Metadata (optional)

• You can optionally specify other case metadata,

  • such as Case Number, Examiner Name, Phone, Email, and Notes:

   

   

6. Case Directory

• Each Autopsy case (multi- and single-user) has a directory

• Autopsy has a notion of a "base directory", for example

  
      C:\CIT155\Cases
  
  

• Autopsy makes a folder in the base directory with the case name, for example,

  
      C:\CIT155\Cases\hw1
  
  

  where hw1 was entered as the name of the case.

• NOTE: In a multi-user cluster, all examiners need to have access to the case directory at the same network path, i.e.

  
      \\server\cases\
  
  

   

7. Case Directory Contents

• autopsy.db
  SQLite database that will store basic case info and data source info (unless it is a multi-user case)

• Export Folder: Default location to store exported files

• Reports Folder: Default location to store reports

• ModuleOutput Folder: Default location for modules to write output to

   

8. What are Data Sources?

• It's the data that you want to analyze

• Autopsy supports

  • Disk Images

  • Local Drives

  • Local Files (Logical Files/Folders)

  • Output from Autopsy Logical Imager

  • Unallocated Space Files (no structure)

   

9. Data Sources

10. What Happens to the data from a Data Source?

• What happens depends on the data source...

• The goal of this step is to populate the case database with basic information about:

  • The data source itself

  • Files inside the data source

• Example:

  • Image size and name information added from E01 files

  • File system is scanned and a record is created in Autopsy database for each file.

   

11. What Gets Stored in the Database?

• There are lots of tables, but here are some examples

  • File Metadata

    • Name and parent folder path

    • Times (modified, created, etc.)

    • Size

    • MD5

    • and so on.

  • Partition layouts

  • NOTE: The database doesn't have copies of file content. Just metadata, so it stays fairly small.

   

12. Disk Image Formats

• Supported Formats:

  • Raw (dd) single and split

  • E01

  • Raw disk images of phones (Android)

  • Virtual machine formats

• Process:

  • You point Autopsy at the first image file, it does the rest.

  • All it needs is the first image file, such as E01 -> E02, E03, etc.

  • Likewise, 001 -> 002, 003, 004, etc

  • Likewise, Image.bin -> Image(2).bin, Image(3).bin and so on.

  • NOTE: Autopsy does not validate E01 files integrity directly on import. The image has to be verified as a separate examination step.

   

13. Disk Image Analysis

• Uses The Sleuth Kit (TSK) to analyze the contents of the image.

• Detects Volume Systems that break the disk into partitions

• Detects File Systems that organize a partition so that files can be stored in them

   

14. Volume System Analysis

• Volume systems organize the disk image into one or more volumes (aka partitions).

• Partition tables are normally located near the beginning of the disk image.

• Autopsy / TSK supports variety of DOS, GPT, Mac, BSD, and Solaris partitions

   

15. Volume System Analysis (cont.)

• Autopsy will show areas of disk that are not in a volume (unused space):

   

• Each volume is analyzed to look for a file system.

• If no volume is found (partition-less drive), the entire image is analyzed for a file system (typical for Flash media)

   

16. File System Analysis

• File Systems allow files to be stored

• Typically located at beginning of disk image or inside of a volume

• Supported Formats: NTFS, FAT, exFAT, HFS+, IS0 9660, Ext2/3/4, YAFFS2, UFS

   

17. Orphan Files

• Orphan files are those that are deleted and no longer have a parent folder.

• Also known as "unallocated" files.

• In Autopsy they are accessible in the $OrphanFiles folder.

• Finding orphan files in FAT file systems is time intensive.

  • Every cluster must be read and analyzed.

  • Can be disabled when image is added as data source to the case

   

18. File Carving

• Files associated with pictures, documents, executable files, etc. can be deleted by the user.

• Carving recovers deleted files without relying on the file system knowledge.

• Carving relies solely on the file structure internals. For example,

  • JPEG, PDF, Word documents, EXE files can be carved.

• Carving is needed when the File System no longer has pointers to the file content.

   

19. Carving Example

• file1.jpg before deletion:

   

   

20. Carving Example (cont.)

• file1.jpg after deletion:

   

   

21. Carving Process

• Scan each unallocated block to see if a file type starts there

• When found, scan for a footer for that type.

• More complicated carving scenarios possible if a file is fragmented on the file system

• In most cases, carving starts and ends with data blocks containing file header and footer.

   

22. Carving Process in Autopsy

• Autopsy includes PhotoRec - Open source carving tool.

• It runs on unallocated space.

• Carved files are added into a special $CarvedFiles folder.

  • NOTE: This is technically not done when the data source is added. Carving is done with the ingest modules.

   

23. Unallocated Space

• Unallocated space in Autopsy is represented as files.

• Directly in a volume or in a $Unalloc folder

• Named based on:

  
      Unalloc_ParentID_StartByte_EndByte   
  
  

   

   

24. Adding a Disk Image

• Add Data Source:

  • add Path - Ignore orphan files in FAT file systems - Time zone: (GMT-5:00) Amenica/New York - Sector size: Auto Detect

• Hash values (optonal)

  • NOTE: These values will not be validated when the data source is added

   

   

25. Disk Image Limitations

• No RAID

• No Logical Volume Management

• No Bitlocker

   

26. Data Sources: Local Drives

• Local drives are your C: or E: drives

• You can analyze them:

  • Preview a live system (i.e. triage)

  • USB-attached device (optionally via write blocker)

   

27. Local Drive Analysis

• Same process as disk images:

  • Scan for Volumes

  • Scan for File Systems

  • Add files to database

• Will need to run as administrator to access all drives.

• Analysis cannot be performed if USB device is removed

   

28. Local Drive Analysis (cont.)

29. Making a VHD File

• Making a VHD File allows to make a sparse VHD image for analyzing a local drive.

  • Useful for triage situations

• When data is read, Autopsy determines if it has seen that sector before. If not, it saves a copy.

• If you analyze the entire drive, you'll get a complete image.

  • We'll cover this more in the later Triage section

   

30. Making a VHD File in Autopsy

• To make a VHD file in Autopsy:

  • Choose "Make a VHD..." option

  • By default it will pick a file name in the case folder

  • Choose the "Update Database..." option if you want Autopsy to update the case database to refer to the VHD file after it is complete.

  • Otherwise, it will have a reference to drive \\.\E: (or something similar)

   

31. Local Files

• Local files are those that are stored on your computer's file system.

  • Collection of JPEG files or Word docs, etc.

  • L01 files (logical evidence files)

• Process:

  • User specifies file or folder to add

  • Folders are recursively added

  • Basic info about each file is added to DB

    • Times are ignored

  • Files are not copied or moved

    • Manually copy if they are on USB

   

32. Local Files (cont.)

33. Local File Sets

• Local files added and grouped together in the UI by the Data Sources

   

   

34. Summary

• Data sources are what you add to a case

• Adding a data source means that its structure is analyzed and metadata is added to the database

• Autopsy supports disk images, local drives, and local files