M889_1

Introduction to computer forensics and investigations

About this free course

This free course provides a sample of Postgraduate level study in Mathematics: http://www.open.ac.uk/postgraduate/qualifications/f04.

This version of the content may include video, images and interactive content that may not be optimised for your device.

You can experience this free course as it was originally designed on OpenLearn, the home of free learning from The Open University - www.open.edu/openlearn/science-maths-technology/computing-and-ict/introduction-computer-forensics-and-investigations/content-section-0

There you’ll also be able to track your progress via your activity record, which you can use to demonstrate your learning.

Copyright © 2016 The Open University

Intellectual property

Unless otherwise stated, this resource is released under the terms of the Creative Commons Licence v4.0 http://creativecommons.org/licenses/by-nc-sa/4.0/deed.en_GB. Within that The Open University interprets this licence in the following way: www.open.edu/openlearn/about-openlearn/frequently-asked-questions-on-openlearn. Copyright and rights falling outside the terms of the Creative Commons Licence are retained or controlled by The Open University. Please read the full text before using any of the content.

We believe the primary barrier to accessing high-quality educational experiences is cost, which is why we aim to publish as much free content as possible under an open licence. If it proves difficult to release content under our preferred Creative Commons licence (e.g. because we can’t afford or gain the clearances or find suitable alternatives), we will still release the materials for free under a personal end-user licence.

This is because the learning experience will always be the same high quality offering and that should always be seen as positive – even if at times the licensing is different to Creative Commons.

When using the content you must attribute us (The Open University) (the OU) and any identified author in accordance with the terms of the Creative Commons Licence.

The Acknowledgements section is used to list, amongst other things, third party (Proprietary), licensed content which is not subject to Creative Commons licensing. Proprietary content must be used (retained) intact and in context to the content at all times.

The Acknowledgements section is also used to bring to your attention any other Special Restrictions which may apply to the content. For example there may be times when the Creative Commons Non-Commercial Sharealike licence does not apply to any of the content even if owned by us (The Open University). In these instances, unless stated otherwise, the content may be used for personal and non-commercial use.

We have also identified as Proprietary other material included in the content which is not subject to Creative Commons Licence. These are OU logos, trading names and may extend to certain photographic and video images and sound recordings and any other material as may be brought to your attention.

Unauthorised use of any of the content may constitute a breach of the terms and conditions and/or intellectual property laws.

We reserve the right to alter, amend or bring to an end any terms and conditions provided here without notice.

All rights falling outside the terms of the Creative Commons licence are retained or controlled by The Open University.

Head of Intellectual Property, The Open University

978 1 47300 165 7 (.epub)
978 1 47300 070 4 (.kdl)

Contents

- Introduction

- Learning outcomes

- 1 Setting the scene

- 2 A bit of practical fun

- 2.1 Finding passwords

- 2.2 Windows File Analyzer (WFA) – Windows XP

- 3 Additional activity

- Conclusion

- Keep on learning

- Glossary

- Acknowledgements

Introduction

Computer forensics is an exciting area, often glamorised (and its capabilities exaggerated) in films and television shows like CSI, NCIS and Spooks. You may have heard the area described using slightly different words, each of which may bring to mind different activities.

Activity 1

Write down all the topics that you can think of that might be encompassed by the term ‘computer forensics and investigations’.

View discussion - Activity 1

Whether you have come from an area where you have acquired knowledge of ‘the nuts and bolts’ of how computers operate (but have had very little experience of investigations or legal aspects), or come from a management, legal, or investigatory background (but have little practical knowledge of the insides of computers and software) then this free course, Introduction to computer forensics and investigations, is for you. Part of the interest and excitement of the area of digital investigations is that it is multi-disciplinary and there are always new things to learn. This course will be quite a challenge but we hope you will find it stimulating and exciting, as well as of considerable practical value.This OpenLearn course includes adapted extracts from an Open University course which is no longer available to new students. If you found this interesting you could explore more free Computing courses or view the range of currently available OU Computing & IT courses.

This OpenLearn course provides a sample of Postgraduate level study in Mathematics.

Learning outcomes

After studying this course, you should be able to:

- understand the role of computer forensics in the business and private world

- identify some of the current techniques and tools for forensic examinations

- describe and identify basic principles of good professional practice for a forensic computing practitioner

- Apply forensic tools in different situations.

1 Setting the scene

In this course you will be looking at two short videos and then doing some practical work with your computer looking at some of the artefacts left behind by ordinary computer use. The example screen images presented here were taken on a Windows XP machine; the software will look slightly different on Windows Vista or Windows 7. Also, Windows Vista and 7 work slightly differently to XP in certain ways, so some programs work only on Windows XP.

Activity 2

Watch the video The Case of the Stolen Exams.

If you are reading this course as an ebook, you can access this video here: The Case of the Stolen Exams.

If you are reading this course as an ebook, you can access this video here: M889 - The case of the stolen exams.

Blaine:

My name is Blaine Price – I’m the Course Team Chair of the Open University course C1080 Computer forensics and investigations. I’d like to show you something I found on eBay last week.

Blaine:

This is an ad for a memory stick containing the answers for upcoming Open University exams. So I asked a friend to buy it for me. This arrived... USB memory stick, Open University branded. Let’s see what’s on it. OK, there are the files for the answers and the questions for the exams for the next year for a couple of courses. Now USB devices like this often contain serial numbers. And the computer keeps a record of almost all the USB devices ever plugged into it, including the date and time it was first plugged in and the last time it was plugged in. Let’s see what we’ve got on this one.

Blaine:

I’m going to run a program called USBDeview. This asks the computer to list all the USB devices on it and all the characteristics. Here’s the flash drive I just plugged in and it’s got a serial number, so I’ll take a note of it. Now let’s go and see if we can find a computer that’s had this memory stick plugged into it and find out whose it is.

Blaine:

I’ve heard that Crispin, one of our Course Managers, is selling things on eBay, so let’s see if he’s at his desk. He’s there, let’s see if we can lure him away.

Blaine:

Crispin, it’s Blaine here. Listen, I’ve got an Associate Dean on my back, I really need those consultancy contracts now. I’m in the Perry Building, room 12, can you run over and bring them over? Thanks, bye. That’ll keep him busy, there is no room 12!

Blaine:

Ah, he’s left himself logged in, good! I’m going to stick this Helix3 CD in to see if we can use the forensic tools to see what he’s got on his computer. It’ll take a moment to load.

Rehana:

Hi Blaine, does Crispy know you’re on his computer?

Blaine:

Um, it’s OK, he, er, asked me to find some files for him.

Rehana:

Oh, OK.

Blaine:

That was close! Let’s carry on and see if we can find the image of the disk. I’m going to run the USBDeview program again. This is the same one we ran on the other computer and we’ll see if we can find if that USB stick has been plugged in here. And there it is. The serial number there I’m sure matches the one I recorded… yep that’s it! So we know it’s been plugged in here. We don’t know if it was a long time ago or if Crispy actually was the one who put the ad on eBay, so let’s see if we can find evidence of him having put the ad on.

Blaine:

Here we’ve got a program that will show us a history of everything that’s ever been looked at on Internet Explorer in the cache. OK, here’s a list of all the files he’s looked at with Internet Explorer. And if I look down the list… there, eBay! And there is the title matching the title of the ad we saw, so we know that this computer was used to look at the ad on eBay. So we know that the ad was placed on Crispin’s machine, we need to find out that Crispin was at the machine at the time. One way to do that is to look at the operating system to see when he was logged in.

Blaine:

This program shows all the times that someone is logged in and out of this computer and we can see that someone was logged in at the time. We’ll have to check the network records to make sure it was Crispin who was logged in.

Blaine:

Finally, we really need to find the file on this computer that has the exam answers on it. So first we’ll do a search of all the files on the disk to see if it was left on here. OK… and I can see files that have ‘exam’ and ‘answers’ in them, but none of these are the ones we found on the USB stick. The other place they could be is in the Recycle Bin, if he deleted them. Let’s look there. The Recycle Bin only has half a dozen items in it and none of them match the filenames, so if they were on this disk they’ve been deleted. One other thing that people often forget is that Windows keeps a record of the files you’ve used recently. Let’s look in the ‘recently used files’ list and see what comes up. And there is it. You can see in the list of the last ten used documents that the filenames of these files were here, so these files were probably on this computer. If we had some more time, I’d take an image of this disk, take it away and look at it with another tool because when Windows deletes a file it doesn’t actually erase it, it just marks it for reuse. And if Windows hasn’t had to reuse that space, then the whole file will still be there.

Blaine:

So what do we do now? We have a fair amount of evidence against Crispin. Do we call his boss? The Dean? Campus Security? The Police? Or, should we call my boss? Did I do anything wrong? Have a look at the video. In the next video we’ll be analysing my investigation to see how I did.

Exercise 1

Could you see any problems with the investigation? Write down all the issues that you think might be a problem for securing a conviction, then watch the video The Case of the Stolen Exams – Revisited and see how many you spotted.

Video content is not available in this format.

Problems for securing a conviction

View transcript - Problems for securing a conviction

Now, let’s have a bit of practical fun.

2 A bit of practical fun

You watched some forensic activities being carried out on the video. To get a flavour of the subject area let’s have a preliminary play with some tools and use a few simple facilities and utilities to see what lies beneath – and what potentially may be useful in an investigation.

In the video The Case of the Stolen Exams – Revisited you saw a program called USBDeview, which listed all the USB devices that have been plugged into the computer. You can use that program now on your own computer to see what devices have been plugged into your computer, by downloading it from this site

Helix can be downloaded from this site. It is free but you must register to download. Click on the ‘Accept’ button and then click on the ‘Incident Response’ icon (the magnifying glass), which is the third icon down in the left-hand pane (Figure 1).

Figure 1    Incident Response window from the Helix program

View description - Figure 1    Incident Response window from the Helix program

Then click twice on the orange arrow to the right of the icon to advance to Page 3. At the bottom right-hand corner you will find the USBDeview icon. Click on it, click OK to confirm you want to launch it, and you should see the same kind of window you saw in the video. You will need to make the window wider by dragging the bottom right-hand corner or you will need to scroll right to see all the columns and note all the information that your computer is recording about the devices. Once you have finished looking, close this application. Then try the IE History Viewer, also on Page 3 of the Incident Response tools. This is the same program used in the video and if users on your computer use Internet Explorer you can see the history of websites visited.

2.1 Finding passwords

Many people think that since their passwords are hidden by asterisks (*) they are not kept on the computer. Certain protocols do keep passwords secret or do not store them but many common applications, especially web browsers, do. Before trying the tools in this section make sure you are allowed to run them. If your computer belongs to your employer and has virus or malware detection software running, then these programs may show up as hacking tools and may violate your acceptable use policy. If in doubt, use your own computer or simply follow along rather than actually running the programs.

You can see several tools with ‘Password Viewer’ in their name on Page 3 of the Helix Incident Response section; all of them should work in Windows XP, Windows Vista and Windows 7. If you have Microsoft Outlook mail files with passwords saved locally, you can try the PST Password Viewer. Similarly, if you run Microsoft Messenger you can try the Messenger Password tool. But for each of these tools you will need to know the folder where the files are stored. All the remaining password viewers should work immediately when run. Note: if you are trying these tools on a shared computer you must obtain permission from the other users before running these programs as you are likely to reveal their passwords.

Another interesting program called System Information for Windows (SIW), developed by Gabriel Topala, can be downloaded from http://www.gtopala.com/. If you try the program you will find it provides a very comprehensive audit of a computer’s hardware and software resources. If you click on the ‘Passwords’ tab you will discover that the program can find a number of installed passwords – how many will depend on how you use the computer and how far you permit passwords to be stored. In the partial screenshot of Figure 2 the details of the ‘users’ and associated passwords have been removed, but they include access details for Internet Service Provider (ISP) accounts and for Amazon, eBay and other e-commerce retailers.

Figure 2    Password display from the SIW program

View description - Figure 2    Password display from the SIW program

An even more powerful program, Windows Secret Explorer, can be found at http://lastbit.com/wse/default.asp – this finds and displays even more passwords. You would have to pay for the full version but the free demo will reveal the first two or three characters of each password as a ‘proof of concept’.

2.2 Windows File Analyzer (WFA) – Windows XP

The last utility program we will look at is called Windows File Analyzer (WFA), and it can be found at http://www.mitec.cz/wfa.html. This program was designed for Windows XP. Although it runs on Windows Vista and 7, it is not as useful on these operating systems because Microsoft changed the formats for thumbnails, shortcuts and the Recycle Bin; only the .dat functionality of WFA will work. Note that in Windows Vista and 7 you can access the Recycle Bin by looking in C:\$Recycle.Bin\\ and enabling the viewing of hidden and system files.

WFA does not need to be installed but will immediately run, after you have unzipped the download. It contains five separate utilities as shown in Figure 3.

Figure 3    The five utilities available in Windows File Analyzer

View description - Figure 3    The five utilities available in Windows File Analyzer

Within this subsection we will investigate four of these utilities (we will not be investigating Analyze Prefetch...).

2.2.1 Analysing thumbnails

The first utility, Analyze Thumbnail database…, analyses files called thumbs.db. As you may know, Windows Explorer (or My Computer) allows the contents of folders to be displayed in various ways. One of them, useful in folders containing a lot of graphics or image files, is called the thumbnail view and presents a series of small versions of the graphic image or photo. When it does so for the first time, it creates within the folder a specialist database file called thumbs.db. Thumbs.db is usually updated each time the thumbnail view is requested. Thumbnails are stored differently in Windows Vista and Windows 7 and you can try the demo version of a commercial product called ThumbnailExpert (www.thumbnailexpert.com) if you have these versions of Windows.

The thumbs.db file structure has been analysed and reverse-engineered and Windows File Analyzer and ThumbnailExpert enable its contents to be examined. Figure 4 shows a thumbs.db file analysed using Windows File Analyzer. Often you will find that a thumbs.db file in a folder contains information about files that are no longer present in that folder. Sometimes the program gives anomalous results – pictures not necessarily matching up to the file name. You then have to decide what has happened – has the database within thumbs.db been corrupted, or is the program not as good as you had hoped? There is an important lesson here: just because a program produces particular results it doesn’t necessarily mean that the program can always be relied on. In the end you may need to run some tests to find out what information a tool is providing.

Figure 4    A thumbs.db analysis using Windows File Analyzer

View description - Figure 4    A thumbs.db analysis using Windows File Analyzer

2.2.2 Analysing shortcuts

Microsoft Windows makes extensive use of shortcut or lnk files (so called because they use that extension). Most of the icons on the Windows desktop and many of the items that cascade from the start menu are lnk files. These include the documents item ‘Recent Items’ or ‘My Recent Documents’ that lists recently opened document-type files. Many individual applications also provide a list of files recently opened by that application.

For a desktop icon you can right-click the lnk file and view its properties, as shown in Figure 5.

Figure 5    Information contained in a lnk file

View description - Figure 5    Information contained in a lnk file

The same can be done for lnk files in other folders. You can also try and open a lnk file in Notepad but you’ll find much of it is unreadable. That’s where WFA’s Shortcut Analyser is helpful.

To investigate this option select the Analyze Shortcuts... option and browse to a folder in which you can expect to find a lot of lnk files (on a typical Windows XP machine this will be C:\Documents and Settings\your accountname\Recent, or if you have Microsoft Office installed you can also look in: C:\Documents and Settings\your accountname\Application Data\Microsoft\Office\Recent).

The printout version of the output is a little easier to read than the onscreen version (Figure 6).

Figure 6    Output from Analyze Shortcuts

View description - Figure 6    Output from Analyze Shortcuts

There is a surprising amount of information available – in this case we can see that the lnk file selected points to a substantive document called ACPO GOOD PRACTICE GUIDE 2006, which appears to be in PDF format as it has been given the extension ‘.pdf’, although it could actually be any type of file. The file is in a folder called D:\FORENS\Procedures. This information is the type of data we would expect to see. However, we also get some date/time stamps – where do they come from? Do they relate to the lnk file or to the substantive file? Look at the ‘Last Accessed’ times: they are all at 22:55:30 though on different dates – does that indicate some flaw in the program? The program has also picked up the Volume Serial Number – four alphanumeric characters, a dash and another four alphanumeric characters – these are recorded on to a hard disk when first formatted under a Microsoft disk formatting program. The program has picked up the computer’s name, at least as recorded in NetBIOS, and it has also apparently recorded the MAC address of the network card attached to the computer at the time. (All network cards have a unique – or almost unique – identity or address known as the Media Access Control imprinted on them so that various networking protocols can recognise them.)

If you explore similar records on your own computer you will see the Shortcut Analyzer will report on files that were viewed on CDs, USB flash drives and networked computers, even if these devices are no longer connected to the computer. Here again the tool provides clues and pointers, but you should also have a deep uncertainty as to what precise data is being collected and how it is being interpreted.

2.2.3 Analysing Index.dat

The third WFA utility we will look at is under the Analyze Index.dat... option. You may be aware that when you surf the internet using a browser, nearly all the web pages visited are copied to and then stored on your computer, so that if you revisit a website the pages can be retrieved from your hard disk rather than the browser re-requesting the pages across the internet. The location where the pages are stored is called a cache and in a Windows system using Internet Explorer they are held in a group of folders called Temporary Internet Files. The pages are not kept indefinitely but are deleted after a given time period (the precise rule depends on what browser you use and whether you have made any alterations to the default settings). The browser needs to know what files it has already stored and the ‘management’ file is called Index.dat.

Selecting Analyze Index.dat... will cause the program to interrogate the typical locations on your main hard disk for index.dat files, and also for folders containing cookies. (If you have more than one active user account in Windows the program will find several instances of index.dat.)

You will find the utility will then list all the URLs that it can find; select a column to order the information according to that column (e.g. selecting the ‘Last Accessed’ column will produce an apparent chronology of internet activity, though you may find some of the dates and times presented a little worrying). The URLs are not for each site visited but for each file retrieved from the remote site, so text and picture elements of the page will be separate. Some of the URLs are thus quite long and represent commands to a remote website – the URL http://www.google.com/search?sourceid=navclient&ie=UTF-8&rls=RNWG,RNWG:2004-27,RNWG:en&q=index%2edat+windows+structure is a request to Google using the search terms ‘index.dat’, ‘windows’ and ‘structure’.

In practice there are other more sophisticated tools to examine and analyse the internet cache. Another free one is called IECacheView (http://www.nirsoft.net/utils/ie_cache_viewer.html). This tool can also link the URLs to viewable pages and produces a wealth of additional information, as shown in Figure 7. Forensic practitioners tend to use a commercial product called NetAnalysis (http://www.digital-detective.co.uk/).

Figure 7    Output of IECacheView

View description - Figure 7    Output of IECacheView

By the way, when you have used the program you will probably find that Windows Internet Explorer has switched to ‘offline’ mode – you will need to use the File or Options menu in Internet Explorer to turn it online so that you can continue surfing the Web.

2.2.4 Analysing the Recycle Bin – Windows XP only

The last utility we will look at is accessed via Analyze Recycle Bin..., which works on Windows XP only. The location and format of the Recycle Bin changed with Windows Vista to C:\$Recycle.Bin but this program won’t analyse the new format. The Recycle Bin is, of course, the Windows facility that allows you quickly to recover an accidentally deleted file. In order for this facility to operate there is a hidden file called INFO2, and this option allows you to look at the contents of the INFO2 file (one for each Windows disk partition) without having to start the undelete process.

Figure 8    The Analyze Recycle Bin utility

View description - Figure 8    The Analyze Recycle Bin utility

Run this tool on a variety of computers to which you have easy access and make a note of the kinds of file you are able to find. Again, make sure you have permission from the users of the computers.

3 Additional activity

Activity 3

Based on what you may already know about forensic investigations of any kind, think about how the activities you have just completed might fit into an investigation and quickly record your analysis.

View discussion - Activity 3

Conclusion

In this course you watched a video showing an investigation that showed some of the artefacts left behind by everyday computing, although in a relatively unprincipled and unforensic way! You tried some forensic software (again in a non-forensic way) on your own computer. Hopefully this course will have given you a flavour of the kinds of thing a forensic investigator might look at, but you should be aware that a proper forensic investigation has quite a few more requirements.

Keep on learning

Study another free course

There are more than 800 courses on OpenLearn for you to choose from on a range of subjects.

Find out more about all our free courses.

Take your studies further

Find out more about studying with The Open University by visiting our online prospectus.

If you are new to university study, you may be interested in our Access Courses or Certificates.

What’s new from OpenLearn?

Sign up to our newsletter or view a sample.

For reference, full URLs to pages listed above:

OpenLearn – www.open.edu/openlearn/free-courses

Visiting our online prospectus – www.open.ac.uk/courses

Access Courses – www.open.ac.uk/courses/do-it/access

Certificates – www.open.ac.uk/courses/certificates-he

Newsletter – www.open.edu/openlearn/about-openlearn/subscribe-the-openlearn-newsletter

Glossary

browser

A program used to view the world wide web, such as Microsoft Internet Explorer, Netscape, Mozilla Firefox, Opera, Safari and Chrome. Also known as a web browser.

cache

A holding area for temporary files, often used to speed up regular computer processes. The best known example is the internet cache, which contains recently viewed web pages and pictures. Caches, if properly preserved, are often evidentially very important. In Windows computers there is often a set of folders called the Temporary Internet Files.

cookies

Cookies are small text files stored on a computer and installed there by a website so that it can track a user’s activities and welcome them on a return visit.

folder

Folders are a hierarchical system of organising files in places where they can be easily found on computer hard disks, CD-ROMs, USB flash drives and other storage devices. Folders are also known as directories.

hard disks

Hard disks are the main means of storing data on a personal computer. Physically a hard disk is a device approximately 10 cm × 15 cm × 2.5 cm (laptop hard disks are typically 7 cm wide). Capacities are normally quoted in gigabytes (GB). Today a new but simple home PC will have a hard disk with a capacity of 250 GB or more, but 750 GB or even 1 TB (terabyte) hard disks are not uncommon. A computer may have more than one hard disk installed and each disk can also be partitioned.

Internet Service Provider (ISP)

This is a business or other organisation that links individual users to the internet and which also provides other associated services, such as email management and web space.

lnk

lnk (sometimes written LNK in the text) is short for link. Microsoft Windows makes extensive use of shortcut or lnk files, so called because they use that extension (.lnk). Most of the icons on the Windows desktop and most of the items that cascade from the start menu are lnk files. These include the documents item, which lists recently opened document-type files. lnk files can be forensically analysed.

partition

A partition is a way to divide a hard disk so that it presents itself to the operating system as one or more hard disks. For example, although there may be only one physical disk installed, the Explorer program may report (in Windows) disks C:, D:, etc. The technique has several purposes, e.g. to separate programs from data files and hence make backing up easier, to have one or more operating systems available on the computer, to maintain an area that contains recovery files. Not all partitions are necessarily always visible: they can be hidden both for innocent and sinister reasons.

protocol

A protocol is a set of rules enabling computers and electronic devices to exchange data, etc. in an agreed, pre-defined way.

USB

Universal Serial Bus (USB) is a widely used means of connecting computers to external devices, such as printers, scanners, cameras and external hard disks.

Acknowledgements

Except for third party materials and otherwise stated (see terms and conditions), this content is made available under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 Licence.

The material acknowledged below is Proprietary and used under licence (not subject to Creative Commons Licence). Grateful acknowledgement is made to the following sources for permission to reproduce material in this free course:

Course image: Chs87 in Wikimedia made available under https://creativecommons.org/licenses/by-sa/4.0/deed.en.

Every effort has been made to contact copyright owners. If any have been inadvertently overlooked, the publishers will be pleased to make the necessary arrangements at the first opportunity.

Don't miss out

If reading this text has inspired you to learn more, you may be interested in joining the millions of people who discover our free learning resources and qualifications by visiting The Open University – www.open.edu/openlearn/free-courses.

Activity 1

Discussion

Here are some of the names we thought of; your list should include at least some of these:

- computer forensics

- forensic computing

- forensic science

- digital forensics

- network forensics

- ICT forensics

- forensic investigations

- digital investigations

- business continuity

- incident response

- computer policing

- high-tech crime investigation

- computer security

- incident management.

Back

Activity 3

Discussion

None of what we have just done by way of using these various software utilities amounts to a proper investigation, nor was it in the least bit ‘forensic’. It was not an investigation because it had no aim, structure, or desired outcome. Very little of the activity was forensic in terms of producing evidence that others can rely on:

- we did not consider whether what we were doing might have altered or contaminated original evidence

- we used tools without knowing any of the research and research methodology behind the results that were produced

- we didn’t enquire how a third party might test our results

- where we did see dates being recorded, we couldn’t be sure what the dates actually signified.

Back

Figure 1    Incident Response window from the Helix program

Description

Back

Figure 2    Password display from the SIW program

Description
Screen grab of a window showing password information
Back

Figure 3    The five utilities available in Windows File Analyzer

Description
Screen grab of the Windows File Analyzer
Back

Figure 4    A thumbs.db analysis using Windows File Analyzer

Description
Screen grab of Windows File Analyzer showing thumbnail images
Back

Figure 5    Information contained in a lnk file

Description
Screen grab of a window showing shortcut details
Back

Figure 6    Output from Analyze Shortcuts

Description
Screen grab of a window showing shortcut analysis information
Back

Figure 7    Output of IECacheView

Description
Screen grab of an internet cache display using the program IECacheView
Back

Figure 8    The Analyze Recycle Bin utility

Description
Screen grab of Windows File Analyzer showing the Analyze Recycle Bin option
Back

Problems for securing a conviction

Transcript

Blaine Price

My name is Blaine Price – I’m a Senior Lecturer in Computing at The Open University. In the last video you saw me gather evidence against one of our Course Managers who was suspected of selling exam solutions on eBay. There were a number of problems with the way I conducted the investigation. Hopefully you spotted some of these while you were watching the video. But let’s go through now and see what could have been done better.

The investigation starts OK with the initial indication that something illegal might be happening, but I quickly got carried away and started getting people to order things for me on eBay. Stumbling across some evidence is one thing, but carrying out an entire investigation on my own is another. Once I had the initial evidence, I should have reported it to senior management. After considering all the relevant laws, regulations and any other obligations the University may have, management may then choose to commission me, or someone else, to carry out an investigation. But any investigation must have a clear purpose and scope defined in advance. For example, am I to try to find all instances of exam selling in the University? Or just track down the one culprit behind this ad? Am I to search one individual’s computer or try to look at central emails servers or ask eBay for access to their data? Are my findings to be kept confidential? It’s very easy for an investigation to have ‘scope creep’, so answering these questions up front is crucial. I also need to make sure that management is advised of any relevant legal issues. For example, if I have an indication that a criminal law has been violated, then management should contact the police. But even if it is a strictly internal, confidential matter, we still have to comply with the law in terms of privacy and permitted surveillance. We also need to make sure that the person being investigated has signed the Computing Code of Conduct or Acceptable Use Policy and is aware of the rules regarding exam security and confidentiality. So let’s assume that I am now conducting a properly commissioned and scoped investigation. Let’s see what happens next.

Setting aside the fact that I had an unknown person purchase this, the first big issue is the continuity of evidence. I took the USB drive out of a previously opened envelope. We don’t know who might have touched the drive from the point the postman delivered it until I showed it to you. It should have been placed unopened, in an evidence bag, by the person who took custody of it and he or she should have signed and dated it and kept it strictly secure until the bag was personally handed to me, by which point I should have signed and dated it to show I now had custody. Now, ignoring the fact that I didn’t handle the drive using gloves, so any fingerprint or DNA evidence is now tainted, the second issue is just as crucial. I insert it into my Windows laptop, which will certainly be writing information to the drive contaminating the original evidence. Instead, I should have used a ‘write blocker’ with a forensically sound copy of the original so I could show I haven’t altered the original data. I could also use an approved forensic program like Helix, which will mount the copy ‘read-only’.

Next, I lied to Crispin to get him away from his computer and I lied to Rehana about having his permission to use the computer. As you will learn in the legal section of M889, Article 8 of the European Convention on Human Rights guarantees an individual’s right to privacy with only a few exceptions. In the UK, this is enacted in the Human Rights Act of 1998 and most other jurisdictions also have similar privacy laws. The Open University’s Computing Code of Conduct prohibits me from accessing computers without authorisation. In order to violate Crispin’s right to privacy I would need specific authorisation from senior management who should have noted why it was necessary. Further, the level of my violation of Crispin’s privacy must be proportionate to the alleged offence. For example, asking Security to strip search him would certainly be disproportionate. Most jurisdictions also have laws prohibiting unauthorised access, such as the UK’s Computer Misuse Act of 1990. So by now I’ve probably committed at least one criminal offence.

Now the remainder of my investigation reveals a number of smoking guns on Crispin’s machine: the evidence of the USB drive being plugged in, the remnants of the eBay ad in the internet cache and the exam files in the ‘recently used files’ list. I also jumped to the conclusion that he placed the ad just because I can see it in his cache. He could claim that he also discovered the ad and was about to report it. We would need to find cached pages showing the ad uploading to eBay to have a real smoking gun. The main problem with this evidence is that I found it while working directly on Crispin’s machine. This means that I was actually causing modifications to Crispin’s machine as I was examining it. Crispin could now claim that any of the things on his disk were due to my actions since it is no longer possible to separate the consequences of my actions from his and it will be impossible for someone else to reproduce the evidence because my actions have irreparably changed the contents of the disk.

Except in specialised circumstances, such as if hard disk encryption is suspected, I should work on a forensic copy of Crispin’s machine so anything I do is repeatable by another expert. Finally, I should have kept contemporaneous notes either in a notebook or on another computer in a tamper-evident format like CaseNotes. Although having a full video record is probably just as good, you probably won’t be able to afford an independent video crew in all your investigations.

These three issues are embodied in the principles for handling digital evidence produced by the UK Association of Chief Police Officers, or ACPO.

One, no action should be taken which changes data held on a computer or storage device if the evidence is to be relied on in court.

Two, if it is necessary to access live data then the person doing so must be competent and give evidence as to the relevance and implications of his actions.

And three, an audit trail must be created so a third party could examine the process and evidence and produce the same result if necessary.

So, the lessons learned from this investigation are:

Always make sure your investigation is properly commissioned and scoped by management.

If you’re going to violate someone’s privacy, make sure that you have signed authorisation from senior management and that they determined that it is both necessary and proportionate.

Make sure any evidence you gather is collected in a forensically sound manner so that others can reproduce your actions.

Take care not to contaminate the evidence unnecessarily by your actions.

Make sure evidence is stored and handled securely, preferably in tamper-proof evidence bags which are signed and dated as they’re passed from person to person.

Finally, if you can’t afford a video crew to follow you around, make sure you make contemporaneous notes, either in a bound notebook or in specialised note-taking software like CaseNotes that prevents editing after an entry has been made.

So if you do find yourself being called to perform an investigation or secure evidence, follow the Boy Scout motto and be prepared! Make sure you have the necessary tools to hand before you begin.

Back