[Day 3] 1. Disk imaging in Cyber Forensics

Using Containers for Anonymity

• Containers allow the use of tools without installation or leaving a trace.
• Dockerfiles of images are stored locally and can be retrieved even after deletion.
• Solution:
  • Pull an Ubuntu image.
  • Access the shell inside the container.
  • Perform tasks; commands will be removed with the container. However, container logs or misconfigured Docker setups might still leave traces. Deleting images doesn't remove associated Docker metadata unless explicitly cleared.

BitLocker Key Storage

• The BitLocker key is stored securely in the system.
• If the motherboard fails, accessing the encrypted hard disk may require recovery keys stored elsewhere.
• Recovery keys are often stored in Microsoft accounts, Active Directory, or printed/saved during setup.

Checking Machine Communication

• Command:
  Copy

  netstat

• The use of
  Copy

  netstat

  is valid but may add that it’s being phased out in favor of
  Copy

  ss

  on modern Linux systems.

Netstat Options in Windows and Linux

• Important Options:
  • Copy

    -a

    : Displays all active connections.
  • Copy

    -b

    : Displays the executable involved.
  • Copy

    -n

    : Displays addresses and port numbers in numerical form.
  • Copy

    -r

    : Displays the routing table.
  • Copy

    -s

    : Displays per-protocol statistics.
  • Copy

    -t

    : Displays the TCP connections.

Showing All Processes

• Linux Command:
  Copy

  ps

• Windows Command:
  Copy

  tasklist

• Copy

  ps aux

  provides detailed process information on Linux, and
  Copy

  tasklist /v

  in Windows adds verbose output.

First Responder Steps at a Cybercrime Scene

• Scenario: Hacked mail server.
  1. Secure the scene and prevent tampering.
  2. Document the state of the system.
  3. Take backups and imaging of critical data.
  4. Analyze logs for anomalies.
  5. Identify potential entry points and mitigate them.

Port Mirroring

• Port mirroring copies traffic from one port to another for monitoring.
• Supported by some firewalls for analysis.

Imaging with

Copy

dd

Command

• Disk/Partition Imaging: Imaging refers to creating an exact copy of the entire disk or partition, capturing all data, including files, metadata, and unused space, for analysis or backup purposes.

  1. Identify the disk using

     Copy

     sudo fdisk -l

     .

  2. Create and mount a partition:

     bashCopy
     sudo fdisk /dev/sda
     sudo mkfs.ext4 /dev/sda1
     sudo mkdir /mnt/test
     sudo mount -t auto /dev/sda1 /mnt/test
     

  3. Perform operations, e.g., creating files, copying configuration files.

     bashCopy
     sudo nano report.txt
     sudo cp /etc/fstab .
     

  4. Unmount the partition and image it:

     bashCopy
     sudo umount /dev/sda1
     sudo dd if=/dev/sda1 of=/image/case1.img
     

Verifying Integrity with Hashing

• Use hashing to verify image integrity:

  bashCopy
  sudo md5sum /dev/sda1
  md5sum /image/case1.img
  sudo sha1sum /dev/sda1
  sudo sha1sum /image/case1.img
  

  • Take screenshots of hash values.

Copying Images

• Copy and verify integrity:

  bashCopy
  sudo cp /image/case1.img /demo/
  sudo md5sum /image/case1.img
  sudo md5sum /demo/case1.img
  

Mounting DD Raw Format Images

The image must have a recognizable filesystem to be mounted directly.

1. Mount the image:

   bashCopy
   sudo mkdir /mnt/dd-demo
   sudo mount -t auto /demo/case1.img /mnt/dd-demo/
   

2. Work with the mounted image:

   bashCopy
   sudo nano test.txt
   sudo umount /mnt/dd-demo
   

Changing Image Extensions

• Rename the image and mount it:

  bashCopy
  sudo mv /demo/case1.img /demo/case1.pdf
  sudo mount -t auto /demo/case1.pdf /mnt/dd-demo/
  

• Verify file type:

  bashCopy
  sudo file /demo/case1.pdf
  sudo file /etc/hosts
  

Mounting Commands Verification

• Check mounting commands:

  bashCopy
  sudo tail -20 /var/log/auth.log | grep mount
  

• Look for suspicious activity, e.g., mounting PDFs.

Live Hard Disk Imaging

• Live hard disk imaging captures the state of a disk while the system is running, preserving data in its current state, including any active processes or temporary files. This contrasts with regular imaging, which is performed on a powered-off or disconnected disk to ensure data consistency and avoid changes during the imaging process.

• Live imaging carries risks of data inconsistency and should be done cautiously.

• Commands:

  bashCopy
  sudo mount -t auto /dev/sda1 /mnt/test
  sudo dd if=/dev/sda1 of=/image/case2.img
  

  • Regular imaging does not involve mounting and typically uses:

    bashCopy
    sudo dd if=/dev/sda1 of=/image/case1.img
    

---