Difference between revisions of "Forensics"

From YobiWiki
Jump to navigation Jump to search
Line 99: Line 99:
 
** To wipe a max of the unallocated space of e.g. hda1, just create a big file and wipe it: (this doesn't wipe slack space!)
  
** To wipe a max of the unallocated space of e.g. hda1, just create a big file and wipe it: (this doesn't wipe slack space!)
 
** dd if=/dev/zero of=/bigfile bs=512 count=$((2*$(df |gawk '/hda1/{print $4}')))
  
** dd if=/dev/zero of=/bigfile bs=512 count=$((2*$(df |gawk '/hda1/{print $4}')))
  +
* secure-delete: tools to wipe files, free disk space, swap and memory
 
* [http://dban.sourceforge.net Darik's Boot and Nuke (dban)]: secure harddrive deletion
  
* [http://dban.sourceforge.net Darik's Boot and Nuke (dban)]: secure harddrive deletion
 
* [http://www.sysinternals.com/Utilities/SDelete.html SDelete] from Sysinternals
  
* [http://www.sysinternals.com/Utilities/SDelete.html SDelete] from Sysinternals

Revision as of 22:07, 28 November 2006

Links

Lists

Tools

Generic forensic tools

  • The Coroner Toolkit
    • apt-get install tct
    • grave-robber: collecte d'infos et empreinte -> /var/cache/tct/data
    • lazarus: reconstitue les fichiers présents dans les clusters non référencés
    • mactime: liste les fichiers dont le mactime a été modifié depuis une certaine date
  • Sleuthkit & Autopsy (GUI)
    • apt-get install sleuthkit (conflict with tct??)
    • apt-get install autopsy
    • A lot of tools
    • Some very nice articles online to learn how to use them.

On live systems

Dumping data supports

  • ddrescue
    • apt-get install gddrescue
    • Seems to work better than the next one (not to be confounded with...)
  • dd_rescue
    • apt-get install ddrescue
  • CloneIt
    • Networked Harddisk Replication System
    • cf also netcat on NetworkSecurity
  • H2cdimage
    • To recover badly damaged CD/DVDs

Guessing the filesystem used

  • testdisk
    • apt-get install testdisk
  • gpart
    • apt-get install gpart
  • disktype
    • apt-get install disktype

Recovering files from filesystems

From ISO9660

  • dares
    • Description: rescue files from damaged CDs and DVDs (ncurses-interface)
      Dares scans a CD/DVD image or a CD/DVD for files. This also works when the filesystem (ISO-9660 or UDF) on the disc is damaged and cannot be mounted anymore.
    • apt-get install dares
    • Note that it helps recovering a logically damaged image, if the disk is physically damaged, first use sth like gddrescue to cope with IO errors.

From ext2

  • e2undel
    • apt-get install e2undel
  • recover (and gtkrecover)
    • apt-get install recover

Agnostic (any fs)

  • foremost
    • Description: a forensics application to recover data
      foremost is a console program to recover files based on their headers and footers for forensics purposes.
      foremost can work on disk image files, such as those generated by dd, Safeback, Encase, etc, or directly on a drive. The headers and footers are specified by a configuration file, so you can pick and choose which headers you want to look for.
    • apt-get install foremost
    • Very good, nice progression report
    • Example:
      foremost -t avi -t mpg -t wmv -t mov -q -v -i /dev/hda -o /path/recovered
  • Magic Rescue
    • very same purpose than foremost, very fast (but I didn't have yet the chance to compare it to foremost), no false positive, but less formats supported
    • Comes with dupemap, a very handy tool to delete duplicates in recovered files (can work also against a backup to keep only new recovered files).
      Example: dupemap delete,report /path/recovered
    • To compile correctly dupemap, install libgdbm-dev
  • recoverjpeg
    • Idem but focuses on jpeg only
    • apt-get install recoverjpeg
  • photorec
    • This one comes with testdisk, promises a lot of different formats (pdf, raw images, zip, wma etc etc) but seems to create a lot of false positive (at least experienced with mpg)
    • apt-get install testdisk

Recovering information from files

  • Trace! by Workshare
    • Windows-based tool for showing all Microsoft Office documents meta-information
    • Quite heavy and requires Microsoft .NET to be installed

Anti-forensic resources

Old stuff...

Récupération des données volatiles

Identification

  • Nom du système et version
    • uname -a
  • Date et heure
    • date
  • Paramètres réseau
    • ifconfig | grep "inet addr"

Configuration

  • Uptime
    • uptime
  • Applications installées
    • rpm -qa OU dpkg --get-selections
  • Configuration réseau
    • ifconfig -a
  • Table de routage
    • netstat -arn
  • Stratégie de mots de passe
    • cat /etc/pam.d/passwd -> /etc/pam.d/other -> /etc/pam.d/common-password
  • Comptes utilisateurs
    • cat /etc/passwd
  • Groupes
    • cat /etc/groups

Activité

  • Utilisateurs connectés
    • w (who)
  • Processus en exécution
    • ps auwx
  • Sockets ouvertes & processus propriétaires
    • netstat -anptuw
    • s'aider éventuellement de /etc/services
  • Table ARP
    • arp -a

Historique

  • Connexions locales & distantes
    • last -f /var/log/wtmp (et autres wtmp.N...)
  • Echecs de connexion
    • cf syslog
  • Derniers fichiers accédés
    • ls -alRu
  • Dernière connexion de chaque utilisateur
    • lastlog (lastlog|grep -v "\*\*.*\*\*")
  • Dernières commandes passées
    • history (à faire pour chaque user ou cat ~/.bash_history ou cat ~/.history)

Sniffers

  • ifconfig -a|grep PROMISC
  • Processus ayant ouvert un fichier
  • lsof...
  • Processus ayant ouvert une socket
    • for fd in $(find /proc -name fd); do echo $fd; ls -al $fd|grep socket;done;

Dump de la RAM

  • copier /proc/kcore

Récupération des données persistantes

  • dd
  • dd_rescue (apt-get install ddrescue), see also gddrescue
    • error-tolerant version of dd for rescuing data
  • strings
  • file
  • md5sum

See also

Retrieved from "https://wiki.yobi.be/index.php?title=Forensics&oldid=1535"