Slashdot Mirror
Windows Incident Forensics with Knoppix Helix
Daehenoc writes "After finding Windows Forensics and Incident Recovery while looking around for forensics tools, I found this instead: Helix Incident Response and Forensics. It's a customized version of Knoppix which you can use in an online or offline style - put it in when Windows is running and you can retrieve a stack of useful information and send it to a network share. Or boot a suspect system with the CD and get access to useful forensics tools like sleuthkit!"
this is pretty cool and all, but I'd really like to see a Knoppix disc with a bunch of anti spyware stuff on it. Would make my life *much* easier.
Anyone know if they ever got Linux to be able to actually write to NTFS?
I don't think Microsoft will be endorsing this any time soon, and most Microsoft ITs don't even know that you can use a linux system to diagnose Windows problems. Unfortunatly, this is a case where it's a neat tidbit of information, but don't expect it to gain widespread use until the major news sources do a report on it, a la Firefox, and the IE debacle.
War isn't about who's right. It's about who's left.
Witness: I don't know what happened. i was just sitting there typing... when all of the sudden... THE BLUE SCREEN OF DEATH
Detective: Were you running Windows?
Witness: Yes... how did you know that?
Detective: Many, many days of experience, Maam.
Detective 2: Yet another case closed!
For some reason there never was a second episode.
See my journal for slashdot ID's by year. Mine created in 2005. http://slashdot.org/journal/289875/slashdot-ids-by-year
http://www.e-fense.com.nyud.net:8090/helix/
It keeps their server from suffering a slashdot-induced meltdown.
...they'll be booting the web server off one of these soon.
Your head a splode
What will be really nice is: if we can have read write support for NTFS. Right now (AFAIK) only read only support is there. Recently my friend had a virus in his computer and Norton couldn't remove it. So I booted his computer with Knoppix only to find that the filesystem was NTFS and thus I was unable to remove the infected file. NTFS rw support would surely aid in troubleshooting.
The disk cloning tool included in the CD, g4l, looks like a ripoff of g4u, right down to the variable names.
No credit is given to the author of g4u, and he isn't very happy about the situation. More details on his web site.
To me, it seems to set a very poor example when the open source community engages in such blatant intellectual property rights violations.
60,000 of these!
sigs, as if you care.
Helix does this, as do many other live Linux cds geared toward forensics and system recovery.
Look at the included apps list, f-prot and clamav are both included, and quite capable of detecting Windows viruses.
Pay more attention.
The Helix distribution is meant to serve a very specific purpose: Incident response and gathering evidence. The tools included in the distribution are excellent for both Windows and Linux incident response (i.e. penetration, compromise, etc). When inserted into a Windows machine, it provides excellent tools for gathering evidence from hardware storage and memory storage. You can also use it in two fashions for Linux incident response: 1) Immediate response (just insert the CD have access to non-compromised programs), and 2) bootable in case the target system has been shutdown (a common reaction when an admin finds a server has been compromised). Because it is based on Knoppix, it does a great job at recognizing hardware, including useful tools, etc. With the Helix distribution, and good sized USB/Firewire external harddrive, you have everything you need to gather critical evidence when a system has been compromised. I have also read the Windows Incident Recovery book. While I found it not very complete (very little discussion of the actual gathering of evidence, and discussion of evidence preservation) it did have some good Windows information. However, the best environment for analysis is Linux because of the open source nature, and the capabilities of its included toolsets. If you are interested in this area, I highly recommend the training provided by SANS (http://www.sans.org/) in their Track 8: Systems Forensics. Its expensive, but the information and tools are well worth it.
...live Linux discs that do almost the exact same thing. Some do it better, some worse. I like FIRE and Knoppix-STD, I'm giving Whoppix a whirl right now.
Go here, hit Ctrl-F, and search for "forensics" or "recovery" - I think you'll be pleasantly surprised.
Knoppix STD
Helix:
I have tried out Knoppix STD before and thought it was pretty good so I guess I'll have to test this one out and compare them..
For anyone wanting to know where Knoppix STD is available from: http://knoppix-std.org
You would be suprised how big computer forensics is, especially within government agencies. In fact, a quick Google Search can show you this.
The FBI has an entire laboratory set up for computer forensics, as a part of their Computer Analysis and Response Team.
The Secret Service has established the Electronic Crimes Special Agent Program
(ECSAP), that trains agents to conduct forensic examinations of computers.
Many local police stations are setting up Cyber Crime units.
The National Security Agency (NSA) has a huge program training people for computer forensics.
The United States Department of Justice (DoJ) has a program as well.
The National Science Foundation is setting up a Scholarship For Service program in schools all over the nation to train students to take government positions in the area of computer crime.
In fact, just about every government agency has a cyber crime program. Police units are establishing their own as well.
When you show up to a crimminal's home, you have to secure their computer and investigate it in a forensically-sound way (or bag and tag it and take it back to the lab where you will be doing a more in-depth investigation.) Forensics tools for Windows are important because a large percentage of responses are on Windows machines (following the market share trend of Windows.) You can't just tear through a system like a bull in a china shop, or you will change timestamps and volatile information, and a good defense will get the crimminal off based on the lack of integrity of the investigation. This is why getting a tested and reliable tool that can be demonstrated in court is very important.
Yes, crimes happen on and evidence is located on computers now.
-Child Porn
-Drug runner contact lists
-Pictures of Crimes in-action
-Hacking
-Credit Card fraud
-Online Fraud
-Network Intrusion
-Email exchange detailing crimes
-Electronic warfare
-Cyber-terrorism
to name a few.
*-*-*-*-*-*-*-*
"We are Linux. Resistance is measured in Ohms."
I want to tag onto this comment by adding an explanation of why a forensics tool being open source in nature makes it an ideal environment.
In computer forensics, you cannot use just any tool in an investigation. Your goal is not only to obtain a forensically-sound investigation of the system (one which allows you to analyze and obtain evidence without changing the system information on the duplicate), but also to obtain this information in such a way that it is admissible in court. Finding all of the evidence in the world will not help you if you cannot put the crimminal away.
In the forensics world, there is something called the "Daubert rules" for acceptance for court. This basically tests a forensic tool's reliability and trustworthiness in being used as a form of evidence in court, to assure that the technique doesn't alter or damage the evidence in a way that it should not be admissible in court.
This tests looks at, in the case of a forensics tool:
1. whether the theory or technique can be and has been tested
2. whether it has been subjected to peer review and publication
3. the known or potential error
4. the general acceptance of the theory in the scientific community
5. whether the proffered testimony is based upon the expert's special skill
With 2., this becomes much easier if the tool is open source, although it is not impossible with closed source software. With open source, the entire community can review the software and test it, oftentimes free, as many open source tools go.
So, although it does not have to be open source, open source lends itself well to the forensics community.
*-*-*-*-*-*-*-*
"We are Linux. Resistance is measured in Ohms."