DFIRCON Spring 2021 - Live Online

Overview

Any baker knows that if you bake with the wrong ingredients, the result will fail. The same holds true for digital evidence collection.

Investigators often respond in high-stress environments where many different entities are critically scrutinizing the collection process. Personnel need to be properly trained and equipped to work in less-than-optimal surroundings, and they must be confident that they have managed the scene, identified all necessary data, collected it in a properly defensible manner, and maintained its integrity.

One of the most common scenarios that can cause headaches is receiving an evidence file (usually an E01), and being expected to provide answers immediately. The common approach is to mount the image and then start running carving and other tools against it. These automated tasks can take many hours (and sometimes days) just by themselves!

Overview

There is no second chance when seizing or acquiring data. Make sure you get it right the first time.

Portable devices bring their own set of challenges to the table. These devices are more ubiquitous than computers. Seldom is the case today that does not include a cellular device. Unfortunately, there is no standard for cellular operating systems. Even within brands, there can be vastly different data storage. This course section will introduce students to several devices and the tools that will acquire them.

Investigators and first responders should be armed with the latest tools, digital container access techniques, and enterprise methodologies to identify, access, and preserve evidence across a vast range of devices and repositories. They must also be able to scale their identification and collection across thousands of systems in their enterprise. Enterprise and cloud storage collection techniques are now a requirement to track activity that has been intentionally and unintentionally spread across many devices. Responding to these many systems cannot be accomplished using the standard "pull the hard drive" forensic examination methodology. Such an approach will result in lost opportunities due to the time it takes to forensically image entire hard drives. Furthermore, investigators need actionable intelligence as quickly and responsibly as possible. This course section lays the foundation for evidence collection, from initial arrival on a scene to the fundamentals of understanding data at rest and properly identifying the devices, interfaces, and tools that will be needed to carry out collection successfully.

We will also explore the myriad of acquisition hardware and software, not to mention adapters and identification, so that you can make the best decisions about the data.

Overview

Quick Win Forensics prioritizes locating, extracting, and processing the 1 percent of digital evidence you need to move a case forward.

Given that 99 percent of the necessary evidence typically will exist in 1-2 percent of the data acquired, it is easy to see how a great deal of time can be wasted following the normal procedures in today's digital forensics world. Instead, let's focus on this 1-2 percent and perform a very rapid triage collection that can be used to start our investigation sooner!

Far too often, computers are seized in an "on" state, and immediately powered down because, "that is how we've always done it." With today's computers, this means you are throwing away (essentially destroying) many gigabytes of data. The RAM in a computer holds a treasure trove of data, from keystrokes to network connections, running services, and, quite importantly, passwords and decryption keys. With the vastly increasing spread of file-less malware, in many cases the only place that evidence will exist is in memory. Another often-overlooked factor is full disk encryption. In cases like this, "live" acquisition will be your only hope.

Overview

Cloud computing and storage is becoming more and more common. Do you know how to collect these critical data?

When we think about acquisition, it usually involves opening the side of the computer, removing the hard drive, connecting to a write blocker or imaging equipment, and completing the task. While this does not necessarily result in an inaccurate assessment, it does not address a great deal of the access and acquisition questions surrounding so much data today. If full disk imaging is necessary, then it is certainly easier and quicker to do it directly from the storage itself. But what happens with devices such as iPads, Surface Books, and other equipment held together by glue instead of screws?

Volume Shadow Copies contains a wealth of historic data that are of great use to investigators. Knowing how to access and collect data from these shadow copies is critical in cases involving the Windows operating system.

Battlefield Forensics is considered the bleeding edge of digital forensics. It requires in-depth knowledge of where the most valuable data reside on the computer and how to get at them as fast as possible. An effective battlefield forensicator needs to be extracting actionable intelligence in 90 minutes or less, but the clock does not start when the forensic imaging is done. Rather, it starts from the moment you lay your hands on the device.

This course section will teach you how to identify and access data in non-traditional storage areas. In today's world, so much data live off site, and there are very few methods in place to access and properly acquire those data. We will identify these locations, including SharePoint, Exchange, webmail, network locations, cloud storage, and social media, not to mention Dropbox, Google Drive, and the Internet of Things. This also includes RAID storage and how to best collect these devices regardless of configuration. Moving to the forefront of most Enterprise investigations, we will be examining vSphere and virtual machine collections as well!

Overview

Apple must be approached entirely differently from traditional devices.

This course section will explore the fundamentals of acquiring data from Apple devices. Compared to Windows, there are very few tools and techniques available when it comes to acquisition of Apple products. The tools that exist can be quite expensive, and free tools are simply few and far between. In this course section, will acquire memory and identify systems that are running CoreStorage technology and full disk encryption. We will also visit the challenges posed by APFS. Many of the Apple systems are closed systems, in that you simply cannot remove the hard drive because it is soldered directly to the motherboard. The uniqueness of the data storage demands alternative methods of acquisition.

In this course section, you'll learn how to access and forensically image iPads, MacBooks, and other HFS+ devices, working at the command line, as well as how to build a free acquisition boot disk to image even the latest macOS versions on current hardware.

Not to be left out, the pervasive Internet of Things is controlling our fridges, thermostats, security cameras, and door locks. It is listening passively and waiting patiently for an instruction to perform. In this course section, you will learn how these devices communicate, and more importantly, who is controlling them.

Overview

Tools fail, techniques become outdated, but do not let that hold you back.

You have traced an artifact back to an IP, email, or web address. Now what? In this course section you'll learn the best methods to determine attribution, from proper collection to legal documentation.

The usefulness of file and stream carving cannot be overstated. Some data simply do not live in the defined file space that can be readily accessed by a viewer. From partially overwritten to deleted data, we will explore techniques you can employ when traditional tools fail.

Data carving is an increasingly important skill. Once the reference to a file is destroyed, how can the data still be recovered? File carving tools will assist in this, but examiners must understand the limitations of their tools. Without the proper pieces of the original file, a carver is useless.