Slashdot Mirror

http://www.accessdata.com/products/digital-forensics/mobile-phone-examiner On-the-Fly Decryption of Operating System and Logical Data of iOS

The fact is:
The FBI has a whole suite of tools for copying hard disks and other digital media in 1:1 format very quickly A couple of them are EnCase and FTK (both of which I found on This Wikipedia page.) Just at a glance, there are over a dozen tools the FBI could have used to make a 1:1 copy of the hard disk they were searching for.
If it were a criminal investigation I would assume they would have to take at least some hardware anyway for original evidence.
If it were a civil deal I can't imagine a single instance in which the need to grab that equipment was so damn urgent that they'd be obligated to screw over a business.

Take my commentary with a grain of salt though....I've never been raided by the FBI, and I'm sure they can get approval to do anything in the name of protecting MPAA or RIAA's interests, since so much of the work that justifies the FBI's existence comes directly from the pockets of industry in greasing the wheels of government.

Hello,

Here is a list of data recovery programs I have put together. Some of them may be a little old, for floppies or optical media only, but should still be useful. Unless otherwise noted, they are all for Microsoft Windows.

A-FF Labs - NTFS Undelete and Partition Find and Mount
Access Data - FTK Imager
Acronis - RecoveryExpert
Advanced NTFS Recovery - NTFS Recovery (may handle FAT32 as well)
bitMART - Restorer Ultimate
Brant, Dmitry - DiskDigger
BriggSoft - Directory Snoop
CGSecurity - TeskDisk and PhotoRec
Convar - PC Inspector File Recovery
Digital Assembly - Adroit Photo Recovery (pictures only)
DiskInternals - NTFS Recovery
DIY Data Recovery - iRecover
DTI Data - Recover It All
DataRescue.Com - PhotoRescue (intended for flash RAM cards, which are typically formatted with FAT, may work with other devices as well)
EASEUS - Data Recovery & Security Suite
Fsys Software - DFSee
Gibson Research Corp. - Spinrite
Gillware - GillWare File Viewer
Higher Ground Software - Hard Drive Mechanic Gold
Kato, Brian - Restoration (also here)
LC Technology -
[Continued in next message, as for some reason, Slashdot would not let me post in its entirety (too many URLs?). AG]

Hello,

Here is a list of data recovery programs I have put together. Some of them may be a little old, for floppies or optical media only, but should still be useful. Unless otherwise noted, they are all for Microsoft Windows.

A-FF Labs - NTFS Undelete and Partition Find and Mount
Access Data - FTK Imager
Acronis - RecoveryExpert
Advanced NTFS Recovery - NTFS Recovery (may handle FAT32 as well)
bitMART - Restorer Ultimate
Brant, Dmitry - DiskDigger
BriggSoft - Directory Snoop
CGSecurity - TeskDisk and PhotoRec
Convar - PC Inspector File Recovery
Digital Assembly - Adroit Photo Recovery (pictures only)
DiskInternals - NTFS Recovery
DIY Data Recovery - iRecover
DTI Data - Recover It All
DataRescue.Com - PhotoRescue (intended for flash RAM cards, which are typically formatted with FAT, may work with other devices as well)
EASEUS - Data Recovery & Security Suite
Fsys Software - DFSee
Gibson Research Corp. - Spinrite
Gillware - GillWare File Viewer
Higher Ground Software - Hard Drive Mechanic Gold
Kato, Brian - Restoration (also here)
LC Technology -
[Continued in next message, as for some reason, Slashdot would not let me post in its entirety (too many URLs?). AG]

FTK Imager from AccessData (download page) is free to download for windows and will carve partitions, files, and even file fragments from disk. It reads NTFS, HFS+, and ext2/3 filesystems. This is the same tool that's used by law enforcement when they image PCs for criminal cases.

I had a drive where the file system was shredded, so I loaded the drive into FTK Imager (its free, about halway down the page), did a search of the raw space of the drive for the file name I needed, found the relevant $i30 reference (its in there), jumped to the relevant sectors on the disk using ftk imager's goto command , carved out the hex with ftk imager's copy hex command, dumped it into a hex editor, and saved the file under the extension. It worked perfectly.

Uphill, both ways, in the snow.

This is the ultimate last resort if you absolutely, have to, get a file back.

Any box that doesn't run Windows confuses most investigators.

You are far from correct. A lot of forensic investigators I have talked to actually use linux at times to do things such as image drives which is safer to do on linux than Windows and they are not straight Windows users.

Yep, all their tools are Windows-specific.

The reason they do use Windows tools most of the time is because the tried and true forensic applications are developed for Windows such as Forensic Toolkit Pro http://www.accessdata.com/products/ftk/ and EnCase http://www.guidancesoftware.com/products/ef_index. asp and since they work and have been well tested on Windows it makes little sense to increase the likelyhood of problems by porting these applications to other OS's. The other big reason most tools are Windows centric is obviously because Windows is the most widely used OS and people like to use what they already have and know.

Windows may not be the greatest OS, and I know people love to bash it, but that does not mean the Windows tools developed for forensic investigations are of low quality. I work as a software developer in this field so I have a decent view on what the situation is and your comment was way far off.

Whoops, I forgot a link.
FTK (Forensic Tool Kit) is made by Access Data.
http://www.accessdata.com/

Another nifty tool from AccessData that plugs nicely into the FTK is the Registry Viewer. Using the FTK you can find all the Windows registry files on the drive. The Registry Viewer (obviously) will open them and allow you to view just about any key/value including encrypted keys like the Protected Storage (Internet Explorer autofill and Outlook/Outlook Express saved passwords).

Since I enjoy tooting my own horn from time to time, the information referenced in this article was obtained by me and my co-worker (I shamelessly admit to working for WhiteCanyon) using AccessData's FTK and Registry Viewer. It was quite a bit of fun to see our results hit national T.V. :)

Related links:
Digital Forensic Tool Testing Images
Brian's Tools - Includes links to SleuthKit and Autopsy
Forensic Tool Kit free trial

FTK is a nice tool to play around with for Windows users, especially with the testing images. The free trial does have a limit of 5,000 files per image so if you create or work on testing images you may have to get rid of extraneous junk and leave the good stuff. SleuthKit and Autopsy are great for the *nix environment. After you get those tools working you might give Scan of the Month challenges 24 and 26 from The Honeynet Projecta shot. They're both pretty fun and challenging. Don't worry if you don't know what you're doing. Both of the challenges have writeups done on how to accomplish the tasks and what tools were used if you need guidance.

whenever someone accesses a file ending in .gif, .jpg, .bmp or .png using their browser, forward a copy of that file to the police

A US government agency keeps a list of hashes for known files which contain illegal material and make it available for people working in computer forensics.

Images which pass through proxy and mail servers, could be checked at random against the list to flag potential offenders. Of course, checking hashes on every file that passes through an ISP's proxy and mail servers would likely be infeasible, but at least a best attempt could be made which could allow a focus to be moved to where it is most likely needed.

I can just see the "sharing violation" and "file in use" message boxes flying everywhere.

The solution to this is to go beneath the file system. Read raw sectors from the disk and interpret FAT or NTFS yourself. You run the risk of corrupt data if a file changes while you're reading it, but it's about the only way to snag registry files and the like while the system is up and running.

AccessData FTK Imager is capable of doing just that, and it was used for this purpose in Operation Firewall. It was also used to create disk images of mounted BestCrypt virtual drives (hint to baddies: dismount your BestCrypt virtual drives before leaving your desk).

Disclaimer: I work for AccessData.

Elcomsoft's #1 competitor is Access Data based in Orem, UT. I've known people who worked for them and they say they aren't concerned about the FBI coming after them because the FBI is a major user of their software.

That doesn't change the fact that their software techinically violates the DMCA.

-bk

dBase module

Or a $75 service. Password Crackers Inc.

In reality, the biggest difference between grep and so-called "forensics" software is the emphasis on examining the data without modifying it and maintaining the chain of custody and audit trail. In fact, many experienced computer investigators do their jobs with little more than DD, grep, and various other Unix utilities. Most of the digital forensics software out there simply attempts to make this funcionality more accessable to your less tech saavy investigator. (The problems caused by inexperienced/unqualified investigators performing this type of analysis are beyond the scope of this response.)

I am currently the designer and project lead for a cross-platform open source (GPL) digital evidence processing suite. It is intended to bring together the various functionalities required to perform this type of work, and (ideally) operate on whatever platform the investigator desires. Our primary development platform is RedHat 7.1.

There are currently software packages out there that attempt to do this, including EnCase and The Forensic Toolkit in the commercial arena and The Coroner's Toolkit in the open source arena, however they lack the broad filesystem support and/or true ease of use to make them usable by everyone. The other barrier is price as EnCase, for example, costs thousands of dollars per copy.

We're well funded, and have already done a significant amount of work. We have some of our core components functional and plan on starting beta testing and releasing our first code drop later this year. If this field interests you and you'd like more information, or you work in the investigative field and have thoughts on what you'd like to see in such a tool, I'd love to hear from you.