SANS Digital Forensics and Incident Response Blog: Category - Case Leads

Digital Forensics Case Leads: Free tools, Treasure Hunts, Drive-by Attacks and Spying

This week's Case Leads features two free tools from AccessData and Paraben Corporation, a digital (forensics) treasure hunt to test your skills, spying, drive-by (browser) attacks and consequences resulting from Stuxnet.

As always, if you have an interesting item you think should be included in the Digital Forensics Case Leads posts, you can send it to caseleads@sans.org.

Tools:

  • Earlier this month AccessData released a new version of their popular (and free) utility, the FTK Imager. Version 3 has a number of useful features such as the ability to boot forensic images in VMWare and the ability to mount AFF, DD, E01, and S01 image formats as physical devices or logical drive letters. The latest version of the application also supports HFS+, VxFS (Veritas File System), exFAT, EXT4, Microsoft's VHD (Virtual Hard Disk) and compressed and uncompressed DMG

...


Digital Forensics Case Leads: Passwords and Voting lead the news

This week we have a man getting jailed for refusing to give up his password. Internet voting in Washington D.C. was hijacked 36 hours into testing. The new Android phone reverts back to factory settings to thwart being jailbroken. Jesse Kornblum and woanware have released updated software and quite a few good blog reads. Check out the upcoming events and if you know of anything interesting happening send us an email at caseleads@sans.org. We are always looking for new things to post.

Tools:

  • Jesse Kornblum has released a new version of ssdeep, which does fuzzy hashing. Jesse has changed the output format of the tool to better handle creating CSV files and file names with quotation marks in the name. You can find out more here.
  • Woanware has release an update to his EseDbViewer. You can see the changes

Digital Forensics Case Leads: Make it go away, the Stuxnet extended remix

Life is busy in the digital forensics and incident response world, so this week's Case Leads is short and sweet. Here are my favorite items from the last few days, enjoy!

If you have an interesting item you think should be included in the Digital Forensics Case Leads posts, you can send it to caseleads@sans.org.

Tools:

  • Harris Corporation introduces BlackJack a USB device that looks very useful for situations where one must rapidly triage systems for the presence of interesting data. According to the press release, the device boots in less than three seconds and "automatically scans and copies data by prioritizing search criteria and securely partitions search results for analysis." The device has two LEDs, one red and one green that indicate the presence or absence of items of interest.

Good Reads:


Digital Forensics Case Leads: Stuxnet, Cyber Weapons and Incident Response

Our focus this week, albeit loosely, is on Incident Response. There has been much news of late regarding the Stuxnet malware, and a couple of the more interesting perspectives are linked in the "Good Reads" section below. As forensicators and incident responders, the advent of such "weapons-grade" malware raises the stakes significantly, and we have to step up our game to match. Memory forensics becomes far more crucial when dealing with advanced threats, and Mandiant offers some help in this area with an update to their Memoryze tool. But our ability to learn from the incidents we investigate and share that information also becomes vastly more important. To help us in this area, Verizon has provided their VERIS Framework, which is a tool for gathering metrics from incident investigations so that we can begin to share and learn from the breaches that inevitably occur. The VERIS Framework isn't all that new, but deserves more attention. So read on for these and other interesting

... Continue reading Digital Forensics Case Leads: Stuxnet, Cyber Weapons and Incident Response


Quick Look - Cellebrite UFED Using Extract Phone Data & File System Dump

It is not the intent of this blog post to be an all-encompassing guide to the forensic analysis of an iPhone. Rather it is a look at some of the tools I use in my practice and how they can be applied to iPhone forensic analysis. That being said lets get to it.

Why would you use the Cellebrite File System Dump instead of the traditional Extract Phone Data ?

If the subject of your forensic analysis is collecting information regarding the telephone such as call logs, phone book, SMS, pictures, video and audio/music then you will find what you need using the standard Cellebrite processing found under "Extract Phone Data". However if you want to do a deep dive in to the file structure, Internet usage or look deep in to the applications that are being used on the device and perhaps run some of your "favorite forensic tools" against it, I highly recommend complimenting your traditional

...