[Day 2] 2. Cyber Forensics Essentials

Imaging Digital Data

• Imaging creates a sector-by-sector copy of the data, preserving details and avoiding alterations to the original.

• Linux Command for Imaging:

  bashCopy
  dd if=/dev/sdb2 of=/home/sunbeam/test/sdb2.img bs=512 count=8
  

  • if: Input file
  • of: Output file
  • bs: Block size
  • count=8: Copies only the first 8 sectors of
    Copy

    sdb2

• The size of the target folder (e.g.,

  Copy

  test

  ) must be equal to or larger than the source (e.g.,
  Copy

  sdb2

  ) for successful imaging.

• Always work on the images, not the original data, to preserve integrity.

Software Used

• FTK Imager: An open-source tool for creating digital images.

Note

• A portion of hard disk space (approximately 10%) is reserved to manage bad sectors.
• Bad Sector: Damaged storage area on a hard disk, making it unusable.

Steganography

• The practice of concealing information within another message or physical object to avoid detection.
• Can hide various types of digital content:
  • Text
  • Images
  • Videos
  • Audio

Network Forensics

NBNS Protocol

• NetBIOS Name Service (NBNS): A networking protocol that translates human-readable names into IP addresses.
  • Part of the NetBIOS-over-TCP/IP (NBT/NetBT) suite.
  • Similar to DNS.
  • Known as Windows Internet Name Service (WINS) on Microsoft systems.

Active Directory and Packet Information

• Finding Names and IPs:

  • NBNS packets broadcast computer names and IP addresses.
  • The computer capturing these packets to list names with IPs is called the Master Browser.
  • Master Browser is determined by OS level and uptime.

• Finding Active Directory Usernames:

  • Use Kerberos.
  • Active Directory uses:
    • LDAP versions 2 and 3
    • Microsoft’s version of Kerberos
    • DNS

• Browsing History:

  • Check the DNS query cache to identify which queries were sent by which user.

• Detecting Malware Downloads:

  • Inspect FTP traffic. If not present, check HTTP traffic.
  • HTTPS blocks such websites, but HTTP may allow them.
  • Use traffic analysis to trace malicious websites or downloaded items.

• Identify the type of packet carrying specific information to analyze effectively.