Slashdot Mirror
Vista For Forensic Investigators
Ant writes "SecurityFocus has a two-part article offering a high-level look at changes in Windows Vista that a computer forensic investigator needs to know about. Part 1 covers the different versions of Vista available and Vista's built-in encryption, backup, and system protection features. Part 2 continues with a look at typical user activities such as Web browser and email usage."
The smart people already use drive encryption via TrueCrypt and other methods.
This may make it easier for the not so completely stupid criminals to protect themselves, but I doubt it will have any real effect.
People are stupid. Thats why they get caught.
If someone uses encryption, then obviously they are trying to hide somthing illegal or unlawful.
In Linux, encryption is done with unusual and special commands in conjuction with mounting a "loop" device to a filesystem; requiring administrator privileges to try to encrypt data like that, and adding to the subversion of a system with evidence of a corrupt administrator.
What kind of administrator would allow encryption on a filesystem? Obviously, a criminal.
Information is meant to be free, and open source. Encryption is somthing we would expect Mycrow$oft to use to help criminals be found by the good god-fearing men and women of the DEA/FBI/CIA/GATT/IMF/IRS just to atone for their sins.
Good people use OSX.
Call me,
Eve.
I would've figured that the investigators' computers would be too slow from running Vista to investigate much of anything.
'Loose' is when your pants are three sizes too big. 'Lose' is when you misuse 'loose'.
One misconception is that encryption in Vista is turned on "by default." Actually, it is not. In fact, it is not even available in most versions of Vista. Vista is available in five SKUs, only two of which support encryption (a feature known as "BitLocker", or "BitLocker Drive Encryption" - BDE). Vista Home Basic, Media Edition, and Business *do not* support BDE. Vista Enterprise and Ultimate - the two more expensive editions - do support BDE. Also, encryption is not turned on by default. An important step during encryption involves defining the encryption and decryption keys. This cannot be done by default by someone other than the owner of the system. If it could, then that someone else would be able to gain access to the secure data - exactly what is trying to be controlled.
Please mod me only (+) Underrated or (-) Troll
I think this video walkthrough is prima facae evidence
http://www.youtube.com/watch?v=EPeUAF_CuR8
I see from TFA that they're shitting themselves at the prospect of widespread drive-level encryption. They console themselves with the fact that only the high-end Vista versions support BitLocker.
But in the end, encryption offers only limited protection. If some well-resourced hostile authority wants to take you down, there's endless options for framing you up. For instance, they could mess with your ISP's logs to fabricate http hits to k1dd13 pr0n sites, or infect your box with a bot that hits such sites on your behalf, which will cause the hits without messing with the ISP's logs...
-- In the beginning was the WORD, and the WORD was UNSIGNED, and the main(){} was without form and void...
...since they'll get you to provide them your encryption key by using the same old fashioned methods they've always used to get information.
...the only time I see forensics being used in conjunction with Vista is when poor old Granny Millie takes her 4 year old PC to Best Buy and bashes poor young Timmy James(just working there to save up enough for prom) over the head with it (and thus killing him on the spot) after trying to install Windows Vista(the lifestyle simplifier) which she had recently been "coerced" into purchasing there on her last visit.
After reading the article (I know we're not supposed to do that) I'm a little confused on if you backup an encrypted volume if the backup is also encrypted. If not, doesn't that defeat the whole purpose of encrypting that data in the first place?
You know, I have one simple request. And that is to have sharks with frickin' laser beams attached to their heads!
that the article mentions Slashdot and Register as a reference for a Microsoft OS.
Sorry, I can't resist a dig at that stupid concept.
If your OS is *disgustingly, *alarmingly inefficient with resources, you can stick a thumbdrive in it and cross your fingers that the email you just spent half an hour typing on will go through.
In other news if your car gets 1.4 miles per gallon, you can drive around with a few 50-gallon drums of gasoline to get you through out of those tight spots.
My turnips listen for the soft cry of your love
10/10, would read again. ;)
Part of my job entails working with law enforcement officials in the field of digital forensics. They have told me that the use of any encryption system by criminals is very low, to the point of non-existent. This is fortunate for the Police, as it makes it easier for them to keep these scumbags off the streets (unfortunately a lot of the crime they deal with is child pornography). There are so many barriers to Bitlockers use (TPM, correct version of Vista, off by default etc etc), that its widespread use just doesn't seem likely. If the bad guys aren't using EFS and other encryption systems now, and these are easy to implement, why would they bother of going through the hassle to use Bitlocker? There are also laws being enacted in certain countries to force the bad guy to give up passwords/ keys etc (ie we are going to lock you up until you give it to use so you may as well do it now...).
"They looked deep into my soul and assigned me a number based on the order in which I joined"
"oops, that was the destroy all data password".. sorry about that i was so shaken up by being jailed when i am innocent that i was confused and gave you the wrong one.
---- Booth was a patriot ----
it's not a bug, it's a feature!
"Vista For Forensic Investigators"
Aren't there already too many versions of Visa to choose from?
How are they going to find anything looking through Windows?
09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C1 bottles of beer on the wall. Take one down, pass it round... Oh, umm...
Move along please!
Engineering is the art of compromise.
if i remember correctly from 4-5 years ago.. BDE also stood for "borland database engine".. or in colloquial english, the spyware that kazza installed.
now microsoft has made it a feature in their new os, giving us greater spyware value by cutting out the middle man!
VLC FOR MAC IS DYING! IF YOU DEVELOP, PLEASE SAVE IT!!
You mean ... all those 3-letter-government-organisations are criminal organisations? Organized crime in the top echelons of the US government?
Now that I think of it... a lot starts to make sense, you know...
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Reading those comments, more than the article itself.
Peruse them and you might notice something. Well? Right. A handful deals with the problem of having your notebook stolen, while the majority discusses the effects of it on a search. I.e. more people being concerned of the effects to a search than to having your computer stolen.
Makes me wonder... does it tell me something 'bout the people here or about the governments we live in?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
When Lenny finds a locked door or something with a padlock on it, he'll ask the owner once, nicely, to effect an entry. And if they want to be a prick and not cooperate, out comes the bolt cutters or the ram.
Mit der Dummheit kämpfen Götter selbst vergebens.
The past rulings indicate and its rather clear that the 5th amendment only applies if you hurt yourself with the information disclosed. There is a "Fisher Test" of requirements to get around the 5th:
." 351?
1) evidence exists
2) the person has a key for getting/finding the evidence
3) producing the key does not link the evidence to the person (aka authentication)
Fisher v US
Its like you have evidence in your safe but so do other people, so they can force you to open the safe despite the 5th- is my understanding of the ruling. Where it gets really tricky is when they offer immunity to get around the 5th as a setup to tie the person into some other crime they trump up from that evidence.
Biometrics are another issue that I'm not sure they have rulings supporting. USA vs Dioniso has "The Fourth Amendment provides no protection for what "a person knowingly exposes to the public, even in his own home or office . . .
They rule that publically available information can not be hidden later on is my understanding and the example given was a persons' face. To me this indicates its possible that biometrics being public (fingerprint) could be taken from you with no 5th amendment protection. Naturally, the police can attack your security any way their please without your help and can lift your biometrics in many ways without going threw the court and I suspect when that situation is raised they possibly will extend the line of thought started on this case.
I am not a lawyer.
Democracy Now! - uncensored, anti-establishment news
The macintosh home folder security is called "filevault", and uses encryption to encrypt the entire user home folder, where most of the user information is. The actual key to the vault is large (128bit aes?) and is stored at the start of the vault, but the key is encrypted using the password the user provides when it is created. Another copy is stored there, encrypted using the master password's certificate, which is encrypted using the master password. So if you lose your password and lose the master password, the data is truly gone forever, and there is no "back door" at Apple. There's nothing stopping you from deleting the master key, it's one document easily located. There is no known back door to the filevault system, and the system is very careful to point out if you lose the password and master password, your data is irrecoverable. The master key requires you to enter a password because the key itself is also encrypted, so simply having access to the master key certificate is not useful in breaking into a locked vault, because the master password is required still.
From what I have heard, all rumor and third-party, windows' encrypted home folders is worthless from a true security standpoint. I have been told that there is a master key in use similar to the master password in OS X, but that it is not one that the user makes, it comes pre-made from microsoft. No one outside microsoft has the private key to unlock that certificate. So if you lose your password, YOU are screwed, but if microsoft really wanted into your data they could get into it. (or let someone else into it) I don't know if there is a documented way to erase this copy of the image's crypto key encrypted with microsoft's back door password. Also I wonder if an administrator could simply reset the password on the account and then login with the new password to just waltz by the entire security of the system?
How much of this is fact and how much is fiction? We have seen time and time again that security by secrecy and security by "but we would NEVER misuse our master key" is a complete laugh, because (A) the secret ALWAYS gets out, and (B) someone ALWAYS ends up misusing the master key. In this respect I feel sorry for the windows users because the wolves are guarding the sheep.
Sidenote: OS X also has a built-in feature that lets you create a regular encrypted disk image. When you make one of those, the machine's master password is not used to store another encrypted copy of the image key as with filevault, so those disk images have only one actual key. I use this to store a password list on my flash drive because of how easy they are to lose, and I am completely confident that anyone that finds the flash drive will be absolutely unable to access my information. I assume that a 3rd party solution is required for windows users?
Somewhat OT, but I have also been told that it's essentially impossible for even an administrator to just read another user's data on the same hard drive, that they have to "take ownership" of the files to read thm, thus altering the data. Yet viruses apparently can multiply at will, infecting all accounts on the computer. Why is it that the viruses have no problem circumventing windows security while at the same time it's nigh imposible for the administrator to do the same thing? Tha does not make sense.
I work for the Department of Redundancy Department.
People are stupid. Thats why they get caught.
Damn Straight. This is what you should remember whenever there is news coverage of a notorious cracker getting arrested, or some huge identity theft ring being broken up.
It is not the crimes you KNOW about, it's the ones you DON'T KNOW ABOUT that are the real issue.
Smart criminals not only do not get caught, they aren't even being looked for because their crimes go undetected.
Considering the NSA were "consulted" by MS, they must have a key. DVD Jon is just the person to "jimmy" the lock on this door.
I wonder how the Chinese and Russians view this "consultation"?
Gizmos Gagets For Ninjas