The Quarterly Magazine for Digital Forensics Practitioners

Competition!
Win 3 Digital Forensics
books from Syngress

ISSUE 09
November 2011

INSIDE
/ Using Wireshark
/ Deep Packet Inspection
/ Cryptanalysis
/ Social Network
Monitoring

BIG BROTHER
FORENSICS
Chad Tilbury takes a look at the
rise of Geo Location data and how 04

geo-artifacts can add a crucial 9 772042 061110

dimension to investigations Issue 9 / £11.99 TR Media

/ REGULARS / FROM THE LAB / INTRODUCING / Book Reviews

robservations, 360, PART 2 OF TED SMITH’S our new FEATURE ON XBOX Forensics
news, irq & more… X-Ways Forensics Forensic Uncertainty Extrusion Detection

DF9_OFC_Cover - Online.indd 1 14/10/2011 15:54

AD9117a 19/01/2010 14:20 Page 1

Shape your future

Forensic Computing MSc Forensic Computing BSc Honours

Computer Security MSc Computer Security BSc Honours

To find out more visit dmu.ac.uk/technology or contact us:

T: (0116) 257 7456
E: [email protected] AD9117A

DF9_IFC_Ad.indd 2 11/10/2011 10:20

 / EDITORIAL

EDITORIAL
Digital Forensics Magazine is a quarterly magazine, published by
TR Media Ltd, registered in the UK. It can be viewed online at:
www.digitalforensicsmagazine.com

Editorial Board

I
Roy Isbell, Alastair Clement, Scott C Zimmerman, Rob Lee,
Angus Marshall & Sean Morrissey
t is a very interesting time for Acquisitions
digital forensics, everywhere I look Roy Isbell, Sean Morrissey, Rob Lee & Scott Zimmerman
I find numerous organisations and
Editorial
individuals who are doing great things Roy Isbell
to establish standards and codes of
News Desk
practice that will ensure that all of us Matthew Isbell
who adhere to them operate at the
Sales & Marketing
pinnacle of professionalism in all that
Matthew Rahman
we do. Rob Lee takes a look at one
Production and Design
single organisation which is attempting to unite the work that
Matt Dettmar (www.freelancemagazinedesign.co.uk)
is being done, I am sure that we will hear more from them and
Contributing Authors
we will be following their progress.
Angus Marshall, Chad Tilbury, Charmaine Anderson,
This issue we take a look at all things GEO! With the number
Christiann Beek, Curt Schwaderer, Mark Osborne, Rob Harriman,
of news items over the recent months that have raised concerns Rob Lee, Ronnie Smyth, Scott C. Zimmerman, Sean Morrissey,
over the information that Google’s mapping activities may have Sian Haynes, Ted Smith, Willem Knot
collected along with what Microsoft is purported to be collecting/ Technical Reviewers
recording with respect to geo-location data and local WiFi Dr. Tim Watson, Scott C. Zimmerman, Sean Morrissey, Rob Lee
information, it was only right that we took a look at what this & Angus Marshall
could mean to the digital forensic investigator. Once again we
are likely to be faced with protecting the privacy of the individual CONTACT DIGITAL FORENSICS MAGAZINE
whilst looking for geo-location artifacts that might just help solve Editorial
a serious crime. We hope you find the articles useful in your work. Contributions to the magazine are always welcome; if you are
Whilst watching a well known UK crime scene forensics interested in writing for Digital Forensics Magazine or would
program called “The Body Farm”, followed a few days later by like to be on our technical review panel, please contact us on
news reports of two very high profile and widely publicised [email protected]
court cases, reminded me of an article we had been sent Alternatively you could telephone us on:
some time ago regarding what is seen by some, as a huge Phone: +44 (0) 844 5 717 318
miscarriage of justice. The first of the cases was the appeal News
by Amanda Knox of her conviction for the murder of Meredith If you have an interesting news items that you’d like us to cover,
Kercher. Figuring largely in this trial was the forensic evidence, please contact us on: [email protected]
not only the analysis and results but also the way that the Advertising
evidence was handled. The second case was that of Dr. Conrad If you are interested in advertising in Digital Forensics Magazine
Murray and the death of the singer Michael Jackson this case or would like a copy of our media kit, contact the marketing team
on: [email protected].
recently included evidence collected from an iPhone.
The article that I was reminded of is not a digital forensics Subscriptions
article; however, it does have lessons that can be learnt by For all subscription enquiries, please visit our website at
www.digitalforensicsmagazines.com and click on subscriptions.
those practicing digital forensics. The article looks at the case
For institutional subscriptions please contact our marketing
of James Hanratty and the evidence used to convict him; he
department on [email protected].
was hanged for murder in April 1962. Subsequent appeals
Feedback
looked in detail at the forensic evidence, especially DNA
Feedback or letters to the Digital Forensics Magazine editor
evidence and upheld the conviction. It is not our intention to
should be sent to [email protected].
pass judgement in any way, however it is important that we
look at these cases and identify any lessons that can be learnt
Copyright and Trademarks
as we carry out investigations, analyse the results and present Trademarked names may appear in this magazine. Rather than
the results as expert witness testimony. I think that not only use a trademark symbol with every occurrence of a trademarked
will you enjoy the article but it will prove thought provoking name, we use the names only in an editorial fashion and to the
enough to relate the case to your own work. The article is a benefit of the trademark owner, with no intention of infringement
long one and whilst we have contained the bulk of the article of the trademark.
in this issue, we have saved some good bits for next issue. Digital Edition Provider
Digital Forensics Magazine uses ZMags for its Digital Editions,
/ ROY ISBELL allowing the creation of carbon neutral publications.

DF9_03_Editorial.indd 3 20/10/2011 17:15

DF9_04_Ad.indd 4 15/10/2011 11:59
 / CONTENTS

CONTENTS
/ DIGITAL FORENSICS MAGAZINE ISSUE 09

REGULARS
/ NEWS
/ 360°
06
14
16
/ ROBSERVATIONS 28
/ LEGAL EDITORIAL 31
/ COMPETITION 37
/ APPLE AUTOPSY 47
/ BOOK REVIEWS 80
/ IRQ 82

FEATURES
/ Hunting Malware with a (Wire)shark 09
Using Wireshark to detect if Malware is on your system
/ Big Brother Forensics 16
Device tracking using browser-based artifacts
/ Social Network Monitoring 22
63
Monitoring socal networks to support law enforcement
/ Meet the DF Professionals 38
An interview with Dr Andrew (Andy) Jones
/ Management of Knowledge Based Grids 42
Managing security in Knowledge Based Grids
/ Geo Tagging the Mac 48
42
Sean Morrissey looks at Geo-tagging in the Mac world
/ Cryptanalysis Using Distributed Systems 58
Investigating a project to create middleware for
distributed cryptanalytic applications
/ Digital Archiving and Data Recovery
Archiving data at The National Museum of Computing
63 24
/ Deep Packet Inspection 68
How to build DPI devices on High-speed networks
/ A Case of Forensic Uncertainty 75
75
Rob Harriman takes a look into the Hanratty conviction

LEGAL
/ Geo-location and Privacy in the EU 32
Taking a legal look at the implications for geo-location

FROM THE LAB

/ X-Ways Forensics
Part 2 of our look at this often-misunderstood tool
53 32

DF9_05_Contents.indd 5 20/10/2011 17:31

 / NEWS

NEWS
DHS claims Cyber Crime rate on the increase Windows 8 Secure Boot Blocks Secondary OS’s

Cyber experts working on the In the past month there has been great controversy over the
Control System Security claim that Windows 8, certified 64bit hardware, will carry
Program, for the Department a specific security measure that prevents the installation
of Homeland Security of secondary operating systems (such as Linux) until the
(DHS), have so far software is regarded as trusted by Microsoft.
tackled more than 300 The newest version of Microsoft’s Operating System will
requests for assistance use the Unified Extensible Firmware Interface (UEFI) and a
this year, compared secure-boot feature to boot Windows 8 rather than the more
to last year’s figure commonly used BIOS boot facility.
of 116. The Emergency The decision to use UEFI has been described by Microsoft
Response Team has had Programmers as being based on security, with the organisation
to be deployed seven times hoping to reduce the amount of malicious software (malware),
so far this year, but was only such as rootkits, infecting PC’s that use Windows.
deployed twice in 2010. However, the decision to choose the new boot method will
According to Greg Schaffer, Deputy Undersecretary of the mean that a secondary operating system or even a second copy
DHS, in a comment to All Voices Global News, most of the of windows is increasingly difficult to install and any software or
requests came from Utilities and Industries, which are now hardware must be previously signed by Microsoft or the original
more vulnerable after linking systems to the Internet. The equipment manufacturer in order to work as intended.
systems that are now at risk are considered to be part of the
critical infrastructure, which could account for the dramatic
increase in cyber attacks.
“We are connecting equipment that has never been
connected before to these global networks,” Schaffer said.
“Disgruntled employees, hackers and perhaps foreign
governments are knocking on the doors of these systems, and
there have been intrusions.”
Hackers are becoming increasingly more deceptive and are
using much more sophisticated attacks as security software
tries to keep up with the influx of new cyber threats, and
many of these attacks are beyond the resources available
to the DHS.
Most attacks consisted of monitoring personal
information of a consumer and then exploiting the
consumer’s power and Internet access. The biggest
problem is that, once compromised, these systems provide
access to a high degree of highly confidential data but also
allows for storage and transfer of illegal content through
use of covert channels.
The increase in sophisticated cyber attacks is costing
governments millions in losses each year and this figure
is ever increasing until something is done to prevent
further attacks.
The Pentagon is aiming to extend a pilot program in
the hopes that it will make networks more secure by
sharing intelligence with the private sector. This could
prove beneficial with at least twenty defence companies
already involved.

6 Digital / ForensicS

DF9_06-07_News.indd 6 20/10/2011 17:32

 In order to install software, a user
would have to disable the secure / NEWS ROUND-UP
boot facility from within the UEFI
should a signature not be provided. CYBERWAR FINDS ITS DEFENCE
THROUGH FORENSICS
However, there is no guarantee As the threat of cyberwar ever
that the firmware support to increases, various ideas have
disable the secure boot will be been put forward to reduce the
permitted by Microsoft. risk. The idea that is considered
the most farfetched is to scrap
The use of UEFI and secure boot the Internet altogether, but
presents a specific problem to many it is this idea that has most
Computer Forensic professionals who use professionals convinced.
a dual-boot system of both Windows and a Linux distribution Digital Forensics has often
played a minor part in Computer
to perform key investigations, analysis and research. Security and is often the last
Since the announcement, Linux Australia members have resort, however, it has become
complained to the Australian Competition and Consumer more and more popular and more
Commission (ACCC) and have been told by the regulator, that recognised in the last decade. Andrew
Hoog, of viaForensics, stated that
they may, indeed, have a case as long as they provide the forensics, when applied pro-actively
regulator with more information surrounding their complaint. and aggressively to a cyber security
Further comment from the ACCC describes how Linux Australia issue, can become a ‘game-changer’.
will be within their rights to pursue legal action against Hoog believes that Computer Forensics
could hold the future to Cyber defence
Microsoft, should the ACCC decide not to pursue the case. and regards the idea to scrap the
Internet as ‘not very viable’.

UK ECONOMY SPARED £140m

THROUGH ACTIONS OF CYBERCRIME UNIT
Due to a number of successful operations,
the Metropolitan Police e-Crime Unit
is to exceed previously set targets. The
PCeU claim to have already saved the UK
economy a staggering £140m in the past
six months and is well on course to exceed the
four-year ‘harm reduction’ target. This value
contributes to 30% of the intended £504m
target and relates to the amount of money saved by
successful cyber crime operations and prosecutions. The
e-Crime unit is currently using a £30m grant to build up its
resources in order to combat computer intrusion, denial of
service attacks and Internet fraud.

ELCOMSOFT CRACKS BLACKBERRY ENCRYPTION

Russian firm, Elcomsoft, has unveiled a new tool that allows
them to crack the encryption security employed by Research
In Motion (RIM) on their Blackberry Smartphones. The tool is
an upgraded version of a phone password-cracking suite that
now has the ability to decrypt the master device password on
the smartphones. The smartphones are set up so that all data
is wiped if the password is entered incorrectly 10 times in a
row and it was believed impossible to figure out this master
password. The software apparently also works on Apple
devices such as the iPhone and iPad and comes as part of
Elcomsoft’s Phone Password Breaker.

DF9_06-07_News.indd 7 20/10/2011 17:32

 Mobile Development
from Apress
The largest catalog of quality books for
Android, iPhone and iPad developers
www.apress.com/mobile

DF9_08_Ad.indd 8
Ad_A4_DigitalForensics_Apress.indd 1 11/10/2011 10:25
12/3/10 1:49 PM
 / FEATURE

HUNTING MALWARE
WITH A (WIRE)SHARK
The malware threat landscape has changed. How agile is your defence and how
can you detect if malware used in a targeted attack is present on your network?
by Christian Beek
/ ADVANCED

O
ver the years use of malware has dramatically Social media sites like Facebook and Twitter are explored for
changed, ranging from programmers exploring the their functionality and the malware authors adopt these into their
malicious possibilities of their programming code, malware design. Twitter botnets along with malware infections
copycats trying to combine code snippets, through to caused by adding a friend in Facebook are known to be in use.
organized crime and governments using custom made Platforms of choice are also shifting from desktops, servers and
malware for their purposes. Where financial gratification is laptops to mobile smartphones with Android in the lead.
the main motivator for cybercrime, it seems that espionage Authors also hide malware traffic within regular traffic and
i.e. the hunger for secrets and intellectual property is use encrypted communications to circumvent detection by
significantly on the rise. Examples include: Operation Aurora, Internet Gateway security devices, IDS/IPS or Content filters
Night-Dragon and recently Shady-RAT. These investigations (figure 1). Recent examples of malware using encrypted
started with the detection of unknown customized communication over http are TDSS and RimeCud.
malware, hiding on corporate networks and ended in large
investigations regarding Data Loss.
So how is it possible that this malware was undetected?
All companies connected to the Internet have Intellectual
Property (IP), Personal Identifiable Information (PII) or
other interesting/sensitive data stored or used in their
systems and are therefore potential targets for criminals.
Almost all organisations today need or use Internet and
email connectivity. This means that network ports Figure 1. Malware using encrypted URL’s
regarding Internet traffic, DNS and email are open to at
least a part of the network or in some cases direct to the IF YOU DO NOT HAVE THESE
desktop without any filtering or layered defence. Many
companies have their network defence technology, like a DEPLOYED AND YOU ARE
firewall, poorly configured to monitor outgoing traffic for POTENTIALLY FACING A MALWARE
suspicious patterns.
Those organisations that do monitor outgoing internet INCIDENT, HOW COULD YOU
traffic mainly monitor and filter based upon categories, but USE THE OPEN SOURCE TOOL
what if the malware uses the Internet Relay Chat traffic over
http, or is using encrypted URL’s? Malware authors know how WIRESHARK TO INVESTIGATE,
business operates and are using these channels to infect MITIGATE AND CREATE FIREWALL
or create a backdoor that allows communication with the
Command and Control servers, or sites that host multiple RULES TO DETECT AND BLOCK
malware samples.
Using spear phishing (targeted), drive by downloads / Wireshark
(opportunistic) and many other techniques, the Malware There are many security technology vendors offering in-line
authors try to infect the end-user. In addition they make devices that scan for malware threats on the network. But if
detection or reverse engineering difficult. Blocking access you do not have these deployed and you are potentially facing
to security-vendor websites, encrypting the malware source a malware incident, how could you use the Open Source tool
code, VM detection, DNS changer component, timing Wireshark to investigate, mitigate and create firewall rules
mechanisms, URL generators and hiding malware traffic in to detect and block this traffic? Once familiar to the basic
‘regular traffic’ are just some of the techniques used. workings of Wireshark, many options become available.

DF9_09-12_Wireshark.indd 9 20/10/2011 17:32

 / FEATURE

First it is important to understand where to place your

Wireshark sniffer. You should install the software on a / Mal-WareHouse
dedicated machine with enough resources to capture the Recent investigations showed that cybercriminals are using
traffic from your network. Next step is placing the ‘Sniffer’ several domains as a warehouse for hosting malware. They
program a Dynamic DNS component (using FastFlux) into their
in your network. If it is only one machine that is infected,
Dropper that tries to reach several of these domains. Once the
you could decide to place a hub between the host and its malware is detected by more than half of the AV companies,
network connection to sniff the traffic of that specific host. they remove it from the domains and upload another variant
It is not recommended that you install Wireshark on the which is yet undetected.
infected host itself. It might sound like an easy solution
but for the malware investigation you do not want to alter
an infected system. To investigate a network segment, In this dump a DNS query was made for the domain “arta.
there are two options; using an in-line network tap or romail3arnest.info” with the IP address “46.166.147.230” this
using a Span port (aka port mirroring) on the switch that query is followed by an outgoing UDP session to this address
is relevant. Using a tap versus a Span port on a switch using port 11110. Analyzing this domain, it becomes clear that
has some items you have to consider or could face during it is hosting a Palevo Command & Control server. Since it is
Incident Response: known that UDP traffic is used to communicate with the C&C
server; you want to know which machines are attempting to
• An engineer will need to configure the switch; if the owner of connect to this server. A basic filter, filtering on destination,
the switch mistakenly configures the Span port not to show all would look like the following:
traffic, you may not discover this misconfiguration; ip.dst == 46.166.147.230
• Switch configuration is not available;
• Span port is shared for other (undocumented) purposes; To be more specific you could combine this filter with the
• Switches introduce mechanisms on ingress ports that UDP destination port:
eliminate packets below a certain size or corrupt packets;
• Switches will drop packets; Spanning traffic is the switch’s ip.dst== 46.166.147.230 && udp.dstport == 10111
lowest priority. In case of overload the first traffic that will be
dropped is the Span traffic. By following the outcome of this filter, another traffic stream
• Delay on the switch while packets are copied to the Span port; is discovered; a DNS request for ‘ip.ipwhois.co.uk’.
• Capturing traffic from a 100Mb link, the Span port needs
200Mb of capacity. The picture of how this malware is communicating starts
to become clear. Once the malware is activated, it tries to
IF IT IS ONLY ONE MACHINE THAT discover the IP address of the infected host by requesting this
information from ipwhois.co.uk. Once verified, communication
IS INFECTED, YOU COULD DECIDE is established over UDP to interact with the C&C domain
TO PLACE A HUB BETWEEN that for the moment is active. Several times the malware
communicates with the C&C domain and the domain is
THE HOST AND ITS NETWORK changing now and then using fastflux technology.
CONNECTION TO SNIFF THE Mitigate this malware on the network and identify
compromised hosts, by blocking and monitoring outgoing
TRAFFIC OF THAT SPECIFIC HOST traffic on UDP port 10111. In Figure 1 we saw that encrypted
http requests were made. So how do we filter those requests
Using Wireshark in a pro-active mode, there are several out of the traffic dump? Combine the following filters:
places where you can sniff for malware traces. You can scan for
example for DNS traffic, Internet traffic, SMB traffic, RDP, FTP or tcp.dstport == 80 and http contains “GET” and ip.dst_host == xxx.
IRC traffic. It will depend on the architecture of your network in xxx.xxx.xxx
order to decide the optimal placement for effectiveness.
In the next example, traffic from a Palevo Dropper will be / Looking for Malicious Domains
examined starting with some basic Wireshark filters. In general there are some domain extensions that are often
The dropper makes use of DNS, UDP and IRC traffic. A pcap used for hosting malware. DNS queries are made to these
file was created by sniffing one of the network segments that domains before a GET request is done. If you don’t know if
the malware was reported from (figure 2). In Figure 2 we see a malware is on your network, you could create a filter like this
sample of suspicious network traffic. to get a sneakpeek:

Figure 2. Network Capture

10 Digital / ForensicS

DF9_09-12_Wireshark.indd 10 20/10/2011 17:32

 / Daily Rootkit Detection
dns contains “ru” or dns contains “cn” or dns contains “biz” or dns
contains “dyndns.org” or dns contains “cc”
Rootkits, used primarily for stealth and resilience, makes
Remember Conficker and other worms that propagate over malware more effective and persistent; its popularity is rising.
Rootkits such as Koutodoor and TDSS appear with increasing
the network? They are scanning for open-shares to put a copy frequency. More than 2 million unique rootkits; 1,200 new
of themselves into these open-shares. Microsoft is using TCP rootkits are detected every day, which means 50 rootkits per
port 445 for SMB traffic on the network including share- hour every single day. (Source McAfee Labs)
access. Statistics from SANS show that this port is highly used
during attacks (http://isc.sans.edu/port.html?port=445).
To filter for Conficker, the following filters could be used:

smb.services contains “NetPathCanonicalize” request

smb.cmd = = 0xa2 and smb.file contains “\\System32\\”

One example of a recent piece of malware using network-

share propagation is Qakbot (or PinkSlipBot). Early variants
used software vulnerabilities in order to infect systems. The
malware copies itself and tries to steal information from the Figure 3. SMB Object List
infected computer e.g. Internet Explorer “autocomplete”
information username/password and stores them encrypted
on the victim’s hard disk; then at a scheduled time (malware
creates a task) these files are transferred by using FTP to
compromised servers.
Detecting this malware on the network can be achieved
by filtering for FTP or SMB traffic. The recent variants
discovered are using several infection vectors including using
default network shares (ADMIN$, C$, D$ etc.) These default Figure 4. Morto DNS Queries
administrative network shares are created by each system.
Qakbot makes use of these default shares and enumerates shows the antivirus product name, the product version and
them. After the enumerating process, the bot tries to connect results of the malware analysis. On the same website an
with SMB over TCP using the user’s rights. After performing upload tool or browser plugin can be downloaded to submit
some checks, the malware copies itself onto the C$ or Admin$ malware samples.
share, binding the SVCCTL interface and starts a remote As mentioned before, malware tries to hide itself in regular
service to execute the dropped (and hidden) file on the traffic streams. In the examples mentioned the sniffing
victim’s computer. software was used to scan for websites, destination address,
Filtering out the traffic with Wireshark, you could build DNS traffic and SMB traffic. FTP and IRC traffic can be filtered
filters that search for SMB, FTP and SVCCTL traffic. In the past out in the same way by using these filters:
you could use a filter like below to filter out any executables in
the SMB traffic: tcp.port==21
tcp.port==6667
smb.file contains “exe”
Sometimes the malware tries to hide IRC traffic into http
After filtering out these lines, you could try to re-assemble URL’s. In that case you could use the following filter:
the files and check if they contained malware. In the past, the
company Tadong developed a plugin to filter out SMB traffic http contains “irc”
in Wireshark. Since Wireshark developer version 1.5.1, this
plugin has been integrated and is working very well. After Recently the Morto worm was discovered. This piece
you have captured the traffic or loaded a previous capture, of malware is trying to spread by compromising admin
go to the menu option ‘File’; choose the path Export/objects passwords of remote desktop connections. To compromise
followed by the option SMB. This will export all SMB traffic in the admin passwords, it contains a hardcoded list of 103
a new pane, as shown in Figure 3. unique items based on the leaked RockYou password list.
After exporting the file ‘keygen.exe’ a checksum (MD5) It also could be used to perform a denial-of-service attack.
is made of the binary. The generated hash and binary were The malware generates a lot of network traffic once active:
uploaded for scanning and verification to the website RDP scans, downloading files, receiving commands and DNS
http://www.virustotal.com/search.html. This website queries for Command and Control Servers. After running the
checks the file against 41 anti-virus engines or verifies if sample in a controlled sandbox environment, the traffic shows
the hash is known. After submission the results page a lot of DNS queries, as shown in Figure 4.

11

DF9_09-12_Wireshark.indd 11 20/10/2011 17:32

 / FEATURE

Following the data stream it became clear that this malware

also is trying to download a binary file (Figure 5). / Commercial Solutions
After a while the malware also tries to attack an IP-address In this article an open-source solution was discussed to
belonging to Google. So to detect if this piece of malware analyze network traffic for malware behavior/patterns. There
are also some commercial solutions that could be placed
is running on your network and which hosts are infected,
in-line to scan the network. Most of them are appliances with
following filters could be created for Wireshark: different capacity and a subscription model for the malware/
malicious detection signatures. Some of these commercial
Dns contains “flt1.qsl” or dns contains “t.qsl” solutions are:
http contains “/160.rar”
• FireEye Malware protection systems – FireEye has several
ip.dest== [ip-address of Google’s site]
systems that can detect, protect and analyze (0-day) malware
inline. (http://www.fireeye.com)
/ Countermeasures • Netwitness Spectrum – Spectrum is build upon the
Just using Wireshark to detect malware on your network NetWitness network monitoring platform to perform behavior
or study malware behaviour is not enough to defend your analysis of malware in the network. (http://netwitness.com/
products-services/spectrum)
company’s network. A structured malware defence supported
• McAfee NTR – McAfee Network Threat Response is an out-
by policies is needed including understanding the threats of-band appliance that captures, deconstructs, and analyzes
and the traffic streams that maybe and are used by malware. malware specific to your network. (http://www.mcafee.com/
One technical solution could be the proper implementation us/products/network-threat-response.aspx)
of an IDS/IPS; this device should complement the company’s
security policy for investigations and access control; until now,
an IDS/IPS does not monitor protected accounts.

PROTECTED ACCOUNTS
ARE EXECUTIVES, LOCAL
ADMINISTRATORS AND DOMAIN
ADMINISTRATORS, PEOPLE WHO
WILL BE THE POINT OF INTEREST Figure 5. Morto Binary Download
DURING A TARGETED ATTACK
/ Summary
Protected accounts are executives, local administrators The battle for malware creating versus detection and
and domain administrators, people who will be the point of prevention has been going on for years; do not believe that
interest during a targeted attack. Controlled access methods you’re network is malware proof. The tool Wireshark may
like RDP, VNC, Shell or CMD are not monitored by IDS/IPS. be used for several purposes including troubleshooting
Custom rules regarding this inbound traffic should be created. network related failures. In this article we have discussed
Since we are talking about Open Source tools, let’s have using it for detection of malware. For this purpose it should
a look at Snort. To monitor traffic from the Internet facing be part of any malware incident responder’s kit and be part
internal regarding RDP and VNC the following Snort rules of a malware behaviour analysis lab. It is important to keep
could be used for detection: a learning mind and most of all share your knowledge with
RDP = “|43 6f 6f 6b 69 65 3a 20 6d 73 74 73 68 61 73 68|“ the community.
TPKT (RDP) = “|03 00 00 0b 06 e0|”; “|b8 e5 0d 3d 16 00|“ Sharing and a learning attitude will bring us more together
VNC = “|52 46 42 20 30 30 33 2e 30 30|” to win the battle against malware. /

Creating a rule to monitor command shell usage over the

network or across firewalls would look like this: / Author Bio
Christiaan Beek has been working in the
CMD = “|0a 0a|C|3a 5c|”; “|0a 0a|C|3a 5c|WINDOWS|5c|”; security field for more than 12 years.
Working for national and international
companies, he gained knowledge of
Along the way you will learn and implement the new rules hacking techniques, forensic analysis,
to monitor malicious traffic; additional suggestions for malware investigations and incident
monitoring traffic would be: response. He is responsible for the
McAfee Foundstone IR & Forensics services in EMEA and
instructor of the Malware Forensics & IR class. Frequently he
• Filter outbound GET requests for files by type (.exe, .bat, .dll) shares his knowledge in several media outlets and speaks at
• Filter for encoded URL extensions events like BlackHat.
• Filter for MIME/BASE64 encoded URL extensions

12

DF9_09-12_Wireshark.indd 12 20/10/2011 17:32

DF9_13_Ad.indd 13 11/10/2011 10:26
 / LETTERS

360°
Your chance to have your say …

H
ere at digital forensics magazine we welcome feedback
and are using email and social media to allow you to / TWITTER
let us know your thoughts. The following has been
Our Twitter following has now reached over
extracted allowing us to respond and let you know what we the 2100 mark and the growth from 1750 last
are doing to answer your concerns. quarter is a testament to the tweets that we are
Send your letters and feedback to: putting out there, we are obviously providing a service that
you want to receive. Almost every day we try and tweet the
[email protected]
latest news and comment from our comprehensive newsfeed
monitoring facility allowing us to identify what is hot and what
is not in digital forensics and related subjects
Letters & Emails
FBI & Facial Recognition
Attenex Document Mapper – Update
We recently tweeted the following “FBI to launch nationwide facial
In issue 08 August ‘11 the article by Andrew Pimlott mentioned recognition service bit.ly/r41axI Upgrade and add on to AFIS”
a bit of kit called “Attenex Document Mapper”. This product which prompted the following response from @cybertheorist; I
no longer exists as a standalone product and hasn’t for a mean, really, what could go wrong? “FBI to launch nationwide
facial recognition service” and this was not the only comment.
couple years. They were bought by FTItech and integrated Clearly many of you foresee some dangers and problems with
into Ringtail, which is very expensive. what the FBI is planning and rightly so. However what I will
Brian Martin say is that this technology has been deployed in the UK for
Digital Trust, LLC some time and to date we have not heard of any miscarriages
of justice, indeed during the recent riots it is our belief that the
system came in very handy!
Thanks for the update. Whilst we do technical reviews it is
not possible for us to check every fact, especially regarding Research, Tools & Alerts
software mergers and acquisitions and we rely on our authors We often do not get direct responses to our tweets but know we
have struck a cord when we see a large number of those following
to make sure that this sort of information is as up to date as is us re-tweeting something we have put out there. By looking
possible when submitting an article. at these responses we see that many of your are interested in
information relating to new research, tools and especially any
Secure Subscrition tweets that provide in-depth information on attacks.
This prompts us to look specifically for these types of news
I would like to subcribe to your online magazine but I noticed story and tweet all that we find. To find out more you will just
that your subscription page connection in not encrypted. have to follow us “@dfmag”.
Don’t you think that is a little bit strange for a forensic and
security magazine? Is there a secure way to send my personal
information for the subscription? LinkedIn
Wilko van der Maas The DFM LinkedIn Group now
has over 880 members, an increase of over 130 since last
Thanks for pointing this out to us. Rest assured that this issue and new members are joining almost daily. Every day
has been rectified and all links to the subscription pages are members of this group post interesting news items, job
now linking securely. We do take the whole process seriously prospects and start discussions related to our industry. Here
and have spent some time ensuring that the whole system are a few of the more interesting ones:
is as secure as we can make it, so it did come as a surprise
when you pointed this out. As with any online service we PhD Programs in Digital Forensics
are at the mercy of those who wish to exploit weaknesses I am hunting down Phd programs in digital forensics in Europe;
in our systems and it is an ongoing task to make sure that possibly online. Can anyone who has “been there”, “done that”,
we are as secure as possible and respond quickly when give me some recommendations please?
vulnerabilities are identified. Donald Tabone

14 Digital / ForensicS

DF9_14-15_360.indd 14 20/10/2011 17:32

 Following Donald’s post, Amer Aljaedi also mentioned that he ever helpful community needed more information before they
was interested in learning the same information. This prompted could provide the answer he was looking for.
a number of responses from members of the group, some of Milton Markose
which have been reproduced here:
To see all the responses that Milton received you will need to
• Andrew Jones – You could try the university of Glamorgan – join our LinkedIn Group as there were just two many useful
they have a well established programme and a good lab responses to repeat them all here.
• David Billard – The program at the University of Stockholm
is a new one. They have a well equiped lab with many leading Support
software (Encase, FTK, Smart, X-Ways, Sawmill) and hardware Our dedicated Support Ticketing System available on the DFM
(XRY, Cellebrite, Paraben) tools. Courses in Digital Forensics website is where users can raise a trouble ticket if they are
(BsC) and Cyber Forensics (MsC) have been launched last year. having issues logging in or problems viewing the online version
I think there are some open PhD positions right now but I of the magazine, or just want to point out anything related to
can’t see any on the web pages our website.
• Roy Isbell – There are also Forensic PhD’s at De Montfort Only 2 support tickets were raised this quarter dealing with
University in the UK and I can put you in touch with the people 2 main issues:
running them if that would help.
• Subscription Upgrade – To upgrade from a digital
Clearly demonstrating that the collective knowledge of the subscription to a print subscription please contact the team
group is very powerful. by sending an email to [email protected].
• Change of address – This issue came up last quarter so
Forensic Examination of a Windows XP SP2 dd Image please do make sure you let us know promptly if you change
Milton posted the following question. “Please could any one your address to avoid missing your print issue.
guide/advise me on performing forensic analysis of a Windows
XP SP2 dd image?” Now a question like this was bound to get If you think you can contribute in any way to the magazine or to
a response and I do not think Milton was disappointed with the any of the discussions taking place via social media, please make
information he got back, however what he did find was that the sure that you join the groups and follow us as appropriate.

15

DF9_14-15_360.indd 15 20/10/2011 17:32

 / LEAD FEATURE

BIG BROTHER FORENSICS

One of the more revolutionary forensic artifacts to emerge in recent years is geo-location data.
Geo-location gives us the means to accurately identify the physical location of an item on
Earth. It is now possible to determine where in the world a laptop or mobile phone has been,
solely using host-based forensics. In a world of increasingly mobile devices, geo-artifacts can
provide a crucial extra dimension to our investigations. With it, we now have the potential to
answer who, what, when, why, and where…
By Chad Tilbury

/ INTERMEDIATE

T
he trend towards mobile computing is unmistakable, be adapted to mobile computers. However, devices can be
with laptop computers outselling desktops for several geo-located and can store location artifacts even if they
years. Forrester Research estimates tablets, netbooks, do not contain a GPS capability. In fact, in urban locales
and laptops to be 73% of computer sales in 2011. While an and particularly indoors, GPS can be highly unreliable.
increasing number of smartphones contain Global Positioning Technologies like WiFi network positioning and cell tower
System (GPS) radios, the technology has been slower to triangulation are commonly used to augment or replace GPS.

/ An Inside Look at a
Geo-location Service
Google Latitude is a free, popular geo-location service used to
pinpoint locations. The host device first collects environmental
information about itself, including IP address and any GPS,
cell tower, and WiFi information available. This information
is formatted into a Javascript Object Notation (JSON) file and
sent to Google. The more distinct data provided, the higher
accuracy the location estimate will be.

Google Latitude HTTPS POST Request:

{ “version”:”1.1.0”, “request_address”:true, “wifi_towers”:
[ {“mac_address”:”00-15-e9-35-8e-3d”,
“ssid”:“JOHN HOME”, signal_strength”:-70 },
{“mac_address”:”00-02-6f-79-57-ca”,
“ssid”:“DAY-SEC”,”signal_strength”:-83} ] }

The initial POST request includes data collected from the host:
the SSID and MAC address for two wireless access points
along with their relative signal strengths. Google Latitude will
perform database lookups using the provided data and return
an approximate location. Notice that coordinates, a street
address and estimated accuracy (in meters) are returned.

Google Latitude JSON Response:

{“location”:
{“latitude”:40.6441499
“longitude”:-111.4809164
“address”:
{“country”:”United States”,
“country_code”:”US”,
“region”: “Utah”,
county”: “Summit”,
“city”:“Park City”,
“street”:“Deer Valley Drive N”,
“street_number”:“1554”,
“postal_code”:“84060”},
“accuracy”:72.0} }

16 Digital / ForensicS

DF9_16-20_Big Brother Forensics.indd 16 20/10/2011 17:32

 If a device is connected to the Internet and has access to GPS, supporting HTML5, there is instantly a common language
a cellular modem, or a wireless network card, geo-location for Internet applications to request and utilize the location
data in some form is likely already being generated and of a given device. The HTML5 geo-location API can facilitate
stored. This capability has sparked a creative gold rush, with device location lookups using WiFi positioning, cell tower
an ever-increasing number of software applications racing to triangulation, GPS data, and in the worst case, simple IP
become “location aware”. At stake is a slice of the $billion address geo-location. Real-time location updates can be
mobile marketing industry. Envision walking by a restaurant requested via the “watchPosition()” function, creating a
and being alerted to a half price lunch special via your breadcrumb trail of a device’s whereabouts. From a forensic
mobile device; or arriving at a conference and immediately perspective, the HTML5 API is the best possible scenario.
pinpointing the bars and restaurants where your contacts Standardized methods lead to dependable forensic artifacts,
are located. These applications exist and digital forensic and interactions take place using the web browser, which is
examiners can use the data generated to pinpoint the location well understood by forensic examiners. With web browsers
of a device at a specific time. available on nearly every mobile device, we should expect
consistent cross-platform artifacts on laptops, tablets,
/ Introducing HTML5 netbooks, and even smartphones.
To see the future of geo-location artifacts, we need only
to review the new HTML5 standard for web development. / Understanding Browser Artifacts
While the specification is not yet final, the Internet is Geo-location artifacts demonstrate an interesting concept
moving rapidly towards HTML5 adoption. The World Wide with regard to browser-based evidence. Among the various
Web Consortium (W3C) presciently included a geo-location browser artifacts, Internet history is a fan favourite because
application-programming interface (API) within HTML5, it provides such rich information. There is no easier place to
providing scripted access to geo-location information via look to identify sites visited by a specific user at a specific
the host system browser. With every major browser now time. Browser history is so useful, a critical shortcoming is

17

DF9_16-20_Big Brother Forensics.indd 17 20/10/2011 17:32

 / LEAD FEATURE

/ How HTML5 Location

Sharing Works
In order to identify what forensic artifacts are left behind by
geo-location, we need to understand how location aware
applications interact with the web browser, and ultimately
the host system. When an application requests the current
location, the following steps occur:

1. The browser notifies the user that location data has been
requested. If the user previously shared location information
with the application, this step may be skipped.
2. Assuming the user gives permission, the browser queries the
host device using javascript and the getCurrentPosition() function.
3.The host device returns available data, including IP address, GPS
data, nearby cell towers, WiFi access points, and signal strengths.
4.Information collected is sent to a geo-location service
Image 1 for database lookups. In this example, the Firefox browser
defaults to Google Latitude. Data is sent to Google via Secure
Socket Layer (SSL) by default.
5.The geo-location service returns an approximate longitude
and latitude, which is stored in the browser document object
model (DOM) as position.coords.longitude and position.coords.
latitude and made available to the requesting application.

Image 2

often ignored; with today’s dynamic web pages, the vast / Geo-location via Mapping Services
number of web page requests goes unrecorded. When a A vast number of websites utilize mapping services from
user visits a website, a multitude of requests are completed Google, Yahoo & Microsoft for visually displaying locations.
in the background to retrieve images and advertisements, The HTML5 geo-location features allow further customization
populate web analytics, and load content from third parties. of these maps and sites are increasingly using it to identify
The content retrieved from these requests is stored within visitor locations. Instead of a hamburger franchise showing
the cache, and an entry within the cache database is created. all of its locations on a map, it can first determine the visitor’s
While the browser history database may only show the page location and show only the closest locations. Only a few lines
visited, the cache holds most of the components retrieved to of code are required to make this change; hence we should
dynamically build that page. expect to see an increasing number of geo-artifacts during
As it turns out, most browser-based geo-location artifacts our examinations. If we can find the co-ordinates used by the
are not stored within the browser history. Looking back at site to create its map, then that information can be used to tie
the HTML5 standard, this makes perfect sense. The fact that that device to a location at a specific time, with some degree
the API is JavaScript dependent is the first clue. Also, the of accuracy. These co-ordinates are routinely found as URL
multiple steps and asynchronous nature of a geographical parameters within the browser cache.
lookup indicate a lot is going on behind the scenes when In an ideal world, we would be able to determine the device
that initial web page is accessed. Luckily, data collected from location via the initial communication with the geo-location
the host must be passed to a geo-location service and those service. In practice, little of this is stored on the host system
interactions are often recorded within the browser cache. because it is conducted via the HTTPS protocol, which
When content is cached, the URLs associated with the web explicitly does not cache data. Thus we are required to analyze
request are also stored. It is within these requests that we can the by-product of the geo-location, which are the changes
mine geo-location parameters and coordinates passed to third made to the page as a result of the new location information
parties such as Google Maps. (such as a new map being drawn). The difficult part of this

18 Digital / ForensicS

DF9_16-20_Big Brother Forensics.indd 18 20/10/2011 17:32

 process is determining what requests give information about
device location. Consider finding an entry for a Google Maps / Identifying Google Maps
request using a specific set of coordinates. How can we Geo-location Data
determine definitively if those coordinates are a result of the
device being geo-located? In general, we can use the presence Google Maps is the most widely used mapping service so
we will use it to demonstrate the analysis process. Similar to
of coordinates within URL parameters as an indication reviewing search URLs to identify what a user was searching for,
of possible geo-location and then test our hypothesis by we can identify requests to Google Maps, which include location
gathering additional data. Context is extremely important information. This location information is often passed via query
when attempting to identify geo-location artifacts from cached string parameters, which are dutifully recorded, by the browser
cache. As an example, you might find the following:
map requests. A search of an address at http://maps.google.
com looks much different than a geo-location event triggered http://maps.google.com/maps?ll=40.760779%2C-111.891047
by http://twitter.com. A few heuristics:
Query string parameters for this request are denoted after the
question mark. In this case, we see the parameter “ll” used to
• Place the map requests in context with the concurrent pages request a map centred on latitude 40.760779 and longitude
being visited. Do those pages implement a geo-location feature? -111.891047. Google Maps accepts a multitude of parameters,
• If an explicit location search was accomplished in close but the ones most useful to identify device location are:
proximity to the map request (for instance, via the “q=”
Query Description
parameter in Google Maps), it is a good sign that geo-location String
did not occur Parameter
• Conversely, specific latitude and longitude coordinates used
by mapping applications in the absence of a search often
q= Replicates a search conducted in the query box of
indicate the use of a geo-location sensor http://maps.google.com

An example can better illustrate this process. Review the

ll= These three different parameters can denote
browser cache entries shown in IMAGE 1 taken from the Flickr
center= latitude and longitude of the center of a map. When
mobile site. Specific coordinates are used in the absence of vp= a device has been geo-located, its coordinates will
an obvious location search, suggesting that geo-location may often be used with one of these options.
have taken place. Our next step is to conduct a review of the
page visited, http://m.flickr.com/nearby. In this case, we find
sll= Latitude and longitude used during a business search
the page will not function without the ability to geo-locate,
strongly supporting our initial hypothesis.
cbll= Latitude and longitude for Google Street View
/ Application Specific Geo-location
Web applications can often leave their own geo-location clues spn= Source address for driving directions
similar to those found via the mapping services. Evidence
of this is seen in the Flickr example in IMAGE 2. The URL
spn= Creates a map spanning a certain latitude and
http://m.flickr.com/nearby/40.760779,-111.891047 clearly
longitude. If specific coordinates for a device
shows where that site believes the device to be located. cannot be determined, spn= can be used to show
While mapping artifacts are largely consistent, geo-artifacts approximate location.
referenced by applications are more haphazard. Thus the
number of available artifacts can be as numerous as the
saddr= Source address for driving directions
applications using geo-location services. To put this in
perspective, we will analyze the artifacts left by another
popular application with geo-location support, Twitter. sensor= Required for some queries. A true value indicates
Twitter uses geo-location to allow users to tag their posts coordinates were determined via a measurement
sensor, such as the HTML5 geo-location API
(tweets) with a specific neighbourhood, city, or exact location.
It can use an HTML5 capable browser to request latitude and
longitude and if that is unavailable will default to geo-location The IP address starts with the second character
using the device’s IP address. Interestingly, Twitter stores (66.169.216.161), and the timestamp immediately follows
the last IP address for a device along with the time the IP (1310063489493350). The timestamp is stored in PRTime,
was recorded within a cookie; even if geo-location was never which records the number of milliseconds since Jan 1, 1970 UTC.
authorized. Since an IP address can sometimes be geo- In this case, the value converts to August 2, 2011 22:18:45 UTC.
located, this can be a great artifact. A sample Twitter cookie Using an IP address geo-location database like Maxmind, we
might contain: can determine the IP belongs to Charter Communications and
appears to be located in Roanoke, Texas. Therefore, with some
k66.169.216.161. 1310063489493350twitter.com/1536250595571230 level of confidence we can say the device containing that cookie
135028186098848030133620* was in Texas on August 2, 2011. Of course geo-location by IP

19

DF9_16-20_Big Brother Forensics.indd 19 20/10/2011 17:32

 / LEAD FEATURE

/ Browser Forensics: History

versus Cache Artifacts
To see the difference between what is recorded in browser
history versus what may be found within the cache, we will
profile a simple location aware website that calculates the
driving distance between any two points and displays a map.
The specific page we will visit is www.mileage-charts.com/
search/calc.php. For HTML5 compliant browsers, an option is
given to automatically determine the starting point based on
your current location.
For this example, we will use the Firefox browser, which
provides easy live access to both the history and cached data.
Before accessing the site, all browser artifacts were cleared.
When we enter our URL into the browser, we see only one entry
in our history library (IMAGE 4). However, when the browser
Image 4 cache is reviewed using the about:cache function in Firefox,
we see a total of 116 entries representing 11 separate domains
(IMAGE 5). Each entry in the cache has multiple timestamps, a
visit count, and the ability to extract and review the cached data
(including the pictures used to generate the Google map). The
entry for maps.google.com in IMAGE 5 provides the location
coordinates identified through geo-location.
Tip: When profiling sites, you might also consider employing
a web proxy, like Paros. A web proxy can capture all inbound
and outbound web traffic and give the most complete view of
what is occurring behind the scenes, including connections
which do not result in cached data.
Image 5

address can be wildly inaccurate, so we would prefer to have more obvious than in the latest web standard, HTML5, which
additional artifacts to help bolster that claim. includes native support for device geo-location. With the major
It turns out that Twitter also makes web requests using URL browser’s adoption of HTML5, nearly every Internet connected
query string parameters like we have seen previously. You device on Earth can transmit its location. Taking advantage of the
might find any of the following supporting information in the artifacts left behind will give forensic analysts tremendous new
browser cache database: resources to track devices and build cases with stronger user
attribution. This article represents just a sliver of the currently
• http://api.twitter.com/1/geo/search.json?ip=66.169.216.161 available geo-location artifacts and I look. /
• http://api.twitter.com/1/geo/nearby_places.json?
• http://api.twitter.com/1/geo/reverse_geocode. REFERENCES
json?lat=33.0227&long=-97.2324 http://dataplusinsight.com/general/the-us-personal-computer-
• http://twitter.com/#!/search/realtime/ consumer-market-in-2015/
place%3Adallas%2Btexas http://www.w3.org/TR/geo-location-API/
http://mapki.com/wiki/Google_Map_Parameters
If no evidence was found in the cache, our next step might http://code.google.com/apis/maps/documentation/javascript/
be to review a memory dump or unallocated space. Similar to basics.html#Geo-location
Google Maps, Twitter can transmit geo-location data via JSON http://www.maxmind.com/app/locate_demo_ip
and HTTP Post requests, circumventing our ability to spy data http://www.parosproxy.org/
in the cache. The following keyword search terms have shown
success at finding Twitter data in unallocated space:
/ Author Bio
• “coordinates”:[[[ Chad Tilbury, M.S, GCFA, ENCE, has spent
• geo_enabled over twelve years conducting computer
crime investigations ranging from hacking
• screen_name
to espionage to multi-million dollar
fraud cases. Formerly a Special Agent
Thus, even a small-scale location aware implementation like the with the US Air Force Office of Special
one in Twitter can reap very useful artifacts to the investigator. Investigations, he currently works as a
computer forensic and incident response consultant. Chad
Our computing devices are becoming increasingly more
serves as a certified instructor with the SANS Institute for the
mobile, and software applications are evolving to take advantage digital forensics track. Find him on Twitter @chadtilbury or at
of this. As a result, geo-location artifacts are permeating http://ForensicMethods.com
operating systems, applications and file formats. Nowhere is this

20 Digital / ForensicS

DF9_16-20_Big Brother Forensics.indd 20 20/10/2011 17:32

 Cell
site
analysis

Computer
forensics

Audio
visual

Questioned
documents

Mobile
phone
forensics

Understanding the digital picture

MP3 players, mobile phones, laptops, As part of the UK’s largest independent For the complete picture visit
Blackberries, SatNavs, printers, CCTV, provider of forensics services, our digital www.digital.lgcforensics.com
digital cameras and more. and document investigators take a
holistic approach that draws on a whole LGC Forensics
These are the tools of a modern society,
range of innovative and traditional Tel: +44 (0)844 2641 999
painting a digital picture of our everyday Email: d&[email protected]
methods to reveal high quality digital
lives in images, emails and text. What
and documentary evidence that will
can they tell us about someone’s PLEASE QUOTE REF: DFM0410
stand up in court. Using the latest
behaviour and movements? How can IN ANY CONTACT
forensic techniques, we will work
we combine and present this evidence
closely with you to establish the facts,
to support reliable verdicts in criminal
applying years of forensics experience
and civil proceedings?
and understanding to uncover and
follow all potential lines of inquiry.

© LGC Limited, 2010. All rights reserved. 2456/OR/0210

DF9_21_Ad.indd
LGC_Digital 21 - CB2.indd 1
A4 Ads-v5 11/10/2011
07/04/2010 10:28
13:07:45
 / FEATURE

SOCIAL NETWORK
MONITORING
LEARNING TO DRINK FROM THE FIRE HOSE

Social media has moved from casual chatter

to a mainstream communication channel
by Curtis Schwaderer

/ INTERMEDIATE

S
ocial networking may have started as a vehicle underlying protocols are changing. There’s a period of time
for casual chatter among friends, but it has gone when law enforcement personnel need to be able to capture
mainstream over the past few years as a communication messages sent the old way and the new way. Since the
vehicle for businesses to interact with their customers. It has networks are growing organically, with no specifications being
also emerged as a new way for bad guys to communicate their published, companies involved in social network surveillance
plans of destruction. With the increasing use of the medium need to reverse engineer the way that the systems work.
for illegal activity comes the need to monitor the channel Another challenge that must be met relates to how the
when appropriate to facilitate law enforcement. social media applications are growing together. In the past
communications would be made through discrete vehicles;
/ Why Monitor Social Networking Services? a bulletin board, an audio conference, email or a chat
A social network service is an online service, platform, service. Now the applications are becoming intertwined, and
or site that focuses on building and reflecting relations following multiple communication sessions is difficult. Viewed
among people who share interests and/or activities. Social independently, a particular communication stream could look
network services essentially consist of a representation of innocuous, but looking at multiple related streams together
each user (often a profile), his/her social links, and a variety could reveal dangerous information. Effective surveillance
of additional services. Most are web-based and provide requires correlation between the channels that a single source
several means for users to interact, such as email and is emanating. The bad guys are now clever enough to use
instant messaging. The combination of an easily accessible, multiple types of communication platforms in parallel.
widely-used medium (the Internet) and a ‘social’ culture of
like-minded individuals has created an effective forum for / Common Techniques for Monitoring
criminal and terrorist networks, propaganda broadcasting, as Social Networking Services
well as yet another means for sensitive information to escape There are a few popular techniques for monitoring social
protected/secure networks. network services. Here’s a look at three of them:
Here are a few examples of potentially dangerous outcomes
of improper social networking use: Open Source Intelligence (OSINT)
Open Source Monitoring (no relation to Open Source
• A clerk with access to sensitive information unwittingly Software) is essentially finding, selecting and acquiring
communicates a seemingly innocent ‘status update’: “…gotta information from publically-available sources. Applied to
work late tonight…this Egyptian embassy situation is breaking social networking services, this means monitoring/inspecting
my back …” the information on social networking sites, which could
• A terrorist group creates a Facebook page with video include ‘friending’ or ‘following’ specific users or groups.
instructions of how to use and repair AK47’s This type of monitoring can yield everything from simply
• An insider purposely leaks secrets by using private determining relationships (“Sally is friends with Rita”) to real-
messages or sending files using an instant messaging client time location information (“Sally checked in at Starbucks on
10th and Grand”).
/ Challenges in Keeping up with There are some key advantages to this method. Since the
Social Network Changes information is public, there are no jurisdiction/authority issues.
There are a multitude of challenges for agencies that are Since this is often done manually, there is little technological
chartered with analyzing social network communications in investment required. Finally, this method can lead to an ‘active’
pursuit of law enforcement. As the technologies evolve, the monitoring, including gaining the target’s trust and getting

22 Digital / ForensicS

DF9_22-26_Social Network Monitoring.indd 22 20/10/2011 17:33

 access to privileged information. But, there are some obvious communications stream (e.g., the message contents). Using
drawbacks. OSINT can be a very manual operation, and since intelligent probes offers several advantages over the other
the social networking sites need to be monitored 24X7, can be methods, including:
costly to staff and generally don’t scale well. The monitoring can
be automated using specialized technology, but the investment • The approach monitors multiple targets (potentially the
is often not worth the information gained, since only public entire network) using multiple services and delivers the
communications can be obtained. monitored information in real-time
• Intelligent probes monitor and deliver information
Legal or Diplomatic Means independently of other network elements, including the
Another method is to use legal (e.g., subpoena) or diplomatic equipment used to host the IP service, which might not be
routes to access stored data (archives) and/or real-time controlled by or accessible to the monitoring organization
access via back-doors or mirror accounts. These almost • Probes are completely passive and don’t negatively impact
always require cooperation from the service provider, and the network transport paths or network elements
often times (like in the US) the legal system has vehicles • The approach requires only the authority/jurisdiction of the
to support this. For example, a social networking service network owner, not the social networking service owner
provider could be subpoenaed to provide access to stored
messages, information on social connections (‘friends’), IP
logs, etc. Additionally, back doors and/or mirror accounts INTELLIGENT PROBES
could be enabled that provided a real-time view into all of CAN BE INTEGRATED INTO
the target’s activity. These scenarios are not uncommon in US
criminal investigations. COMPREHENSIVE INTERCEPT,
There are, however, limitations and restrictions that make DATA RETENTION, AND
this approach impractical for certain uses. For example, there
are obvious jurisdiction and foreign policy issues for out-of- SECURITY SOLUTIONS,
country requests. Also, the existing subpoena mechanisms ESSENTIALLY APPEARING AS
likely don’t apply for requests outside of criminal investigation
and homeland security boundaries, such as monitoring activity
NETWORK ‘SENSORS’
on private, secure networks or trusted government networks.
Intelligent probes can be integrated into comprehensive
Passive Network Monitoring intercept, data retention, and security solutions, essentially
The last common approach is to use intelligent probes appearing as network ‘sensors’. In each case
to monitor the network. In this innovative approach, the the probes are typically provisioned and
intelligent probe is constantly monitoring the network for controlled by a centralized system such
social networking service activity (e.g., logins, messaging, as a mediation system or SIEM (security
etc.), extracting pertinent information, and automatically incident and event manager). The probes
generating the relevant records as they are detected. deliver the collected data to the same
This extracted information can be in the form of IPDRs centralized system or to another storage
(Internet Protocol Data Records, or activity logs) or the full and analytic system.

Figure 1

23

DF9_22-26_Social Network Monitoring.indd 23 20/10/2011 17:33

 / FEATURE

/ Examples of Passive Monitoring

using Intelligent Probes
Let’s take a look at a few scenarios where one network
monitoring solution, DeepProbe by IP Fabrics, Inc. is used to
generate monitor social networking activity.

Monitoring Facebook Activity

Facebook is a very popular social networking service that
connects people via several communications mechanisms,
including public messages, private messages, photos, and Table 1
videos. At the time of this writing, Facebook is ranked as
the #2 most popular Internet site by Alexa and has over 500
million users.
From Figure 2, we see that Facebook enables users to send
public messages (“wall writes”), send private messages,
instant messages, and ‘check in’ at various locations. Like
most social networking service sites, Facebook has concepts
of a profile and access control (‘friending’), where visibility to
information can be viewable by all, or just those users who
have the approval of the profile owner.
Clearly the OSINT and subpoena methods can be effective Table 2
for monitoring some Facebook communications, but what
about private messages restricted to ‘friends’ in situations In this case, passive monitoring is the only solution. The
where there isn’t sufficient jurisdiction to obtain historical primarily reason for this is because location of the social
records or a mirror account? networking servers and their owners are outside of the
jurisdiction of the organization wanting the information and
the desired information isn’t available via OSINT. An example
/ A Brief History of Social of this would be an organization outside of the USA wanting to
Networking Services monitor Facebook activity traversing their country’s networks.
Another example is a private organization that can use either
So, where and when did all this get started? Think back to the
‘70s, when computers were used by some businesses and a manual means or other technology to monitor their user’s
handful of hobbyists. Facebook pages, but are not ‘friends’ and therefore cannot see
private messages or pages.
Hobbyists: The 70s and 80s Referring back to Figure 1, the network monitor would be
Most credit BBS (Bulletin Board Systems) as the first social
networking service. These systems were independent servers
placed at a point in the network with visibility to the network
allowing users to communicate and download software. They traffic between the targeted user(s) and the Facebook
were often run by hobbyists and accessed using direct dial-up servers. This would typically be at the organizational Internet
modems. connection (for a private network) or at the Internet Service
Provider (for a public network). The probe is constantly
Early Adopters: The 90s
The Internet was just gaining popularity in the 90s and online
monitoring the network for the Facebook activity, intercepting
service providers like CompuServe and Prodigy not only gave the communications or generating the IPDRs, and delivering
users access to the Internet, but also allowed members to the collected information to another system (e.g., mediation
share files, access news, and communicate using something system, SIEM, intercept monitoring centre) for collection,
dubbed “email.” AOL soon followed and essentially ‘provided storage, and analysis. Solving this problem presents some
the Internet’ before users had access to the real Internet.
technical challenges, since in order to detect Facebook
Trendsetters: The Early 2000s activity; the monitoring system must have application and
The Internet had boomed and people were wondering who protocol knowledge used by the Facebook servers.
they could connect with. Sites like Friendster and Classmates. DeepProbe provides this capability through its IM/Chat
com popped up and gained popularity as ‘themed’,
Surveillance Modules (SMs) which offer options to intercept
demographically-driven social networking sites.
and deliver only Facebook ‘events’, which align with social
Mainstream: The Mid 2000s networking service-related IPDR records. The IPDRs are
By the mid 2000s, social networking services were delivered to the mediation system using a well-defined,
mainstream, and included the introduction of LinkedIn, secure, and reliable delivery protocol. For example, TCP is the
MySpace, Facebook, Twitter, and at least 200 more sites
transport protocol, messages are optionally authenticated and
providing sophisticated communications mechanisms such as
the ability to send public messages, private messages, instant encrypted, and all are formatted in ASN.1. Additionally, the
messages, and broadcasts (status, micro blogging). IPDRs can be delivered to multiple mediation systems, and/or
failover to hot standby mediation systems.

24 Digital / ForensicS

DF9_22-26_Social Network Monitoring.indd 24 20/10/2011 17:33

 Table 1 gives an example of Facebook communications
mechanism that DeepProbe monitors, and the resultant data
that is extracted. Note that in this example, the full message
content is delivered (e.g., messages, wall write content, etc)
and not just the IPDR.

Monitoring Twitter Activity

Twitter is another very popular social networking service,
currently ranked as the 10th most popular web site, with
over 300 million subscribers. Twitter’s unique service allows
users to broadcast real-time updates using Internet instant
messages, mobile phone SMS messages, or web updates.
Twitters messages are limited to 140 characters and due to
this limitation, Twitter’s service is sometimes called ‘micro-
blogging’. This character restriction has not diminished Figure 2
Twitter’s popularity, and instead seems to have encouraged
frequent, small updates, nicknamed ‘tweets’. Twitter boasts
600 tweets per second.
Some have speculated that two of these aspects have
made Twitter one of the most important services to monitor.
The first is the real-time nature of the broadcast updates,
which obviously could be used for coordinating potentially
damaging activities. The second aspect is the cultural effect of
the short tweets, which some users treat as comments under
one’s breath or spurious thoughts, which, when tweeted, are
broadcast to multiple ‘followers’ and could represent insider
information leaks. From Figure 3 we see that Twitter offers
access control (approving followers), broadcasting messages
via SMS, IM/chat, and web page access, as well as the ability
to send private messages.
Table 2 illustrates the Twitter communications monitored for Figure 3
fictitious user ‘ipfabricsme’. Similar to the
Facebook example, Table 2 includes the full content of the
monitored communications (e.g., tweets, message bodies,
DEEPPROBE PROVIDES THIS
etc.) in addition to the event data. CAPABILITY THROUGH ITS IM/
Other Applications Such as Chat and Webmail
CHAT SURVEILLANCE MODULES
Although not social networking services, webmail-based (SMS) WHICH OFFER OPTIONS TO
communications offer similar monitoring challenges and
requires a similar approach. The primary reason for this is
INTERCEPT AND DELIVER ONLY
the location of the Webmail servers and their owners are FACEBOOK ‘EVENTS’, WHICH
outside of the jurisdiction of the organization wanting the
information. An example of this would be an organization
ALIGN WITH SOCIAL NETWORKING
outside of the USA wanting access to Yahoo mail or Hotmail SERVICE-RELATED IPDR RECORDS
activity traversing their country’s networks. Another
example is an organization that can use their internal email Table 3 gives an example of some of the webmail events that
system (e.g., Outlook) to log traditional email, but not are detected for the Microsoft Hotmail service, and the resultant
webmail activity. data that is extracted from the event and delivered as the IPDR.
Solving this problem presents the technical challenges as The IPDR’s are delivered to the mediation system using
exist in monitoring social networking services, since in order a well-defined, secure, and reliable delivery protocol. For
to detect Webmail activity, the monitoring system must have example, TCP is the transport protocol, messages are
application and protocol knowledge of the specific Webmail optionally authenticated and encrypted, and all are formatted
services. DeepProbe provides this capability through its in ASN.1. Additionally, the IPDRs can be delivered to multiple
Webmail Surveillance Modules (SMs) which offer options to mediation systems, and/or fail-over to hot-standby mediation
intercept and deliver the full content of the communications systems. DeepProbe can be used to generate many other
or only Webmail ‘events’, which align with Webmail-related types of IPDRs, such as basic Internet access, SMTP/POP/
IPDR records. IMAPbased email, and various chat/IM services.

25

DF9_22-26_Social Network Monitoring.indd 25 20/10/2011 17:33

 / FEATURE

Table 3

/ Selecting a Probe for Social

THE IPDR’S ARE DELIVERED TO Network Monitoring
THE MEDIATION SYSTEM USING The attached box “Guidelines for Law Enforcement Personnel
provides some basic information on selecting probes for
A WELL-DEFINED, SECURE, AND lawful social network monitoring applications. But since
RELIABLE DELIVERY PROTOCOL the landscape of social networking is always changing,
selecting the equipment vendor is as important as selecting
the equipment in order for an agency to stay on top of

/ Selecting a Probe: developments in the field.

For their part, probe suppliers need to continually update
Guidelines for Law their products to follow the fast-evolving technologies
Enforcement Personnel and provide support to their customers with an ongoing
monitoring service. IP Fabrics for example runs through a
As social network monitoring will become a critical tool for
law enforcement worldwide, here are some guidelines for law set of service monitoring procedures every week, initiating
enforcement personnel to use in evaluating different suppliers communications and looking at resulting outputs to identify
of passive monitoring equipment. changes that have been made. With this level of vigilance,
The probe must be able to fully inspect every network packet law enforcement personnel have a tool to reduce the
and decode application-level protocols, so the controlling
opportunities for lawbreakers to abuse the great benefits
mediation systems don’t need to rely on billing systems,
subscriber databases, CRM systems, or other networking that social networking has to offer. /
equipment for filtering, intercept and IPDR generation.
The system should be capable of identifying and/or REFERENCES
discovering targets based on a sophisticated and flexible set
USA Today story, “Facebook says membership has grown to 750
of criteria, such as:
million,” 6 July, 2011
• DHCP or RADIUS dynamically assigned IPv4 or IPv6 addresses alexa.com list of Top Internet Sites
• Email address or partial email address BBC News story, “Twitter co-founder Jack Dorsey rejoins company,”
• VoIP user name or phone number 28 March, 2011
• Webmail address or domain
• Social networking or IM/Chat username

/ Author Bio
• Keyword/signature in a specific application
(e.g., webmail, email, etc)
• Application-level criteria can optionally include an IP/ Curtis Schwaderer is the Chief Software
subnet/DHCP/RADIUS pre-filter, giving flexibility to further Architect and cofounder of IP Fabrics,
segment/qualify the monitored network responsible for the DeepSweep™ and
DeepProbe™ network surveillance
The probe should also be able to be configured to deliver and data retention product lines.
varying amounts of intercepted information, including the Curt has over 25 years of experience
complete application flow with related content such as in the design, implementation, and
attachments, a summary of the content, IRI (Pen-Register deployment of networking hardware, software,
equivalent) or just the application session events. and multimedia systems technologies. Curt has spent
For IP traffic intercepts, the probe should be able to the last 12 years focusing on multicore processor software
qualify the intercepted traffic by layer 4 ports or application technologies and the last 6 on Deep Packet Inspection
identifiers and will monitor all subsequent dynamic IP address (DPI) and Deep APplication Inspection (DAPI)
(re)assignment. For email interception, the probe should be technologies relating to internet communications
able to deliver the entire email, even if the email address applications. Curt holds two patents in the area of
identifier was discovered after the first packet(s) in the email multimedia networks and multicore software processing
flow. Or, in IPDR applications, the probe should generate and and holds bachelor and master degrees in Computer
deliver complete IPDRs. Engineering from Iowa State University.

26 Digital / ForensicS

DF9_22-26_Social Network Monitoring.indd 26 20/10/2011 17:33

DF9_27_Ad.indd 27 11/10/2011 10:29
 / ROBSERVATIONS

ROBSERVATIONS
Our Profession: The Launch of CDFS
by Rob Lee

T
his past month saw the launch of the Consortium of Digital
Forensic Specialists (CDFS – www.cdfs.org), an organisation
formed to help professionalise the field of Digital Forensics
and Incident Response. The CDFS mission statement:
“Serving the profession, our membership, and the
community by providing leadership and advocacy as the
global representative of the digital forensics profession”.
CDFS is trying to help shape the future of digital forensics
by helping unite industry groups and organizations so that
all parties have a say in the direction of the profession. The
stated aims of CDFS is to help influence agreed upon ethical
and technical standards in the community and consequently
help to shape the future of the digital forensics profession.
Unfortunately, some form of digital forensic licensing will be I started working with CDFS as a board member as I
barrelling down on our profession. There are proposed bills believed that many industry groups had a lot in common
in U.S. congress as well as legislative actions that are taking already. While many competed with each other, I also
place in many states and countries around the world that will saw unified approaches to the profession. I also saw a
begin to regulate the digital forensic profession to ensure potential misunderstanding among lawmakers over what
a common standard that all must attain in order to perform digital forensics is and how best to regulate and manage
their jobs. In many countries, you need a license to cut hair, professionals making a living performing these services
be a plumber or to babysit. As a result, an alarming trend has for the information security, legal, and law enforcement
developed in several states regarding legislation of licensing communities. As a result, I pushed to get myself more
for digital forensic specialists as private investigators involved with the fledging organization as a whole as my
without regard to digital forensics qualifications. Many in views were aligned with the other members of the board
our profession would rather have practitioners develop the regardless the organization that we represented. If many
standards than another group such as private investigators. different organizations have different, competing standards,
CDFS started through a discussion amongst HTCIA, SANS, there are, in fact, no standards at all. The goal is to bridge the
HTCC, ISCFE, and many other groups leaning on one another gap between organizations to develop a cohesive standard
to help ensure that the profession would not be held hostage appropriate to diverse sectors of the profession. Further, our
to someone else’s standards. It is human nature to become mission is to speak on behalf of digital forensic practitioners
complacent with the status quo when it does not affect one to achieve self-regulation by professionals who understand
personally and immediately; however, regulation is coming the industry and its needs.
and it will affect you, if it has not already. So do you want to We would like to encourage you and your organization
have a voice in the outcome of such pending initiatives? to consider joining CDFS to help form the correct ethical,
professional, and technical standards. Without a group such
as CDFS, we will have many independent groups trying to
CDFS STARTED THROUGH A describe the elephant by describing the only way that they see

DISCUSSION AMONGST HTCIA, the elephant. By working together though a single umbrella
organization and maintaining the smaller groups we will be
SANS, HTCC, ISCFE, AND MANY able to form a consistent approach to Digital Forensics and

OTHER GROUPS LEANING ON ONE Incident Response across all communities. It will also allow
us to help guide the profession properly. We would like to get
ANOTHER TO HELP ENSURE THAT in front of the challenge. Licensing discussions has created

THE PROFESSION WOULD NOT a great debate in our profession on what is appropriate and
who writes the standards. I would prefer the standards to
BE HELD HOSTAGE TO SOMEONE originate from true practitioners. Have a voice… participate;

ELSE’S STANDARDS join CDFS today at www.cdfs.org and help shape the future of
our profession. /

28 Digital / ForensicS

DF9_28_Robservations.indd 28 20/10/2011 17:33

 Reviewing the latest
sports highlights

Attending a Review
Seminar online

Put your time to better use. In pursuit of your (ISC)²®

certification, attend an Official (ISC)² CBK® Review Seminar
live online, in person or on site. You’ll ready yourself for an
(ISC)² exam by refreshing your knowledge in information
security. You’ll also send a message to peers and current
employers that you’re in this game for real.
Learn more at www.isc2.org/reviewseminar

Look for an (ISC)2 Authorized Education Provider.

DF9_30_Ad.indd 29 11/10/2011 10:29

 Digital
ForensicS
/ magazine
Digital Forensics magazine keeps you up to date on all the latest
developments in the world of computer and cyber forensics.

The magazine covers the following topics areas:

/ Cyber terrorism
/ Law from the UK and rest of the world
/ Management issues
/ Investigation technologies and procedures
/ Tools and techniques
/ Hardware, software and network forensics
/ Mobile devices
/ Training
/ eDiscovery
/ Book/product reviews

CHECK OUT
digitalforensicsmagazine.com
for all the latest news and views on the world
of digital forensics (special feature articles are
available for registered users).

SPREAD THE WORD

www.digitalforensicsmagazine.com/subscribe

DF9_30_Subs Ad.indd 30 12/10/2011 17:31

 / LEGAL EDITORIAL

LEGAL EDITORIAL
The difficulty in prosecuting malware authors
by Scott C Zimmerman

S
eptember 18th, 2011 is the ten-year anniversary of
the release of the Nimda worm. This worm suddenly
appeared on the technology scene in the aftermath of
the Code Red epidemic of August 2001. The precise point of
origin of Nimda has not been identified and the identity of
the original author remains a mystery. Why is it that malware
authors seem never to be caught and prosecuted?
Consider the difficulties involved in catching a traditional
intruder; we’ll use the example of an individual attacking
and compromising a single remote system owned by
another entity.
in the way of any investigator. Since there is no clear path
• There must be sufficient evidence captured on the from the malware author to the destination system, how can
compromised system or on network devices near the investigators even begin to determine what happened? They
compromised system. can look at the malware itself.
• There must be clear indicators of which source machine(s) Each piece of compiled malware, distinct from something
interacted with the compromised system. like Javascript or HTML, is based on source code.
• Once the source machine has been identified, the Source code is what the program author actually types to
geographic location must be determined. A source machine create a piece of software; the source code is then passed
in a country that does not cooperate diplomatically with through a compiler that creates the binary. The binary
the country hosting the compromised system, one having may also be called the executable, since it can be run on a
no extradition treaty for example, is unlikely to provide any particular type of system. The binary is not a human-readable
assistance to the investigators. chunk of data, but it can be reverse-engineered into source
• If the source machine can be identified, then ownership code that humans can read. Clues in the binary can be used
must be clearly established. If the IP address of the machine as bases for additional searches: if there are unique markers
belongs to an ISP that allocates addresses dynamically, the in code that can be linked to a particular individual, the
ISP’s cooperation will be necessary. Without it, ownership investigators may have a place to start. However, a sufficiently
cannot be established. sceptical examiner will be inclined not to treat such markers
• If ownership can be established, the next step is to as infallible truth.
determine who was operating the computer at the time of the As an example, a number of computer systems at Mitsubishi
attack. If the source machine is not logging or tracking such Heavy Industries of Japan were recently infected with some
activity, the identity of the operator cannot be confirmed. unusual malware variants. Close examination of the incidents
revealed the presence of simplified Chinese characters [text]
If any of these steps breaks down, the investigation into the in the attack payload. The presence of the Chinese language
attack-and-compromise is very likely doomed to failure. brings up two questions:
One of the major differences between prosecuting a
traditional intruder and prosecuting a malware author is • Did the malware actually originate in mainland China?
the fact that there need be no direct connection between • Did the author simply wish to give the impression that the
the author and the affected remote system. The traditional malware originated in mainland China?
attacker who operates over the Internet creates a temporary
path between his machine and the destination machine: The answer is this: no one knows. It is impossible to identify
even if he is using another host as a jumping-off point, the authoritatively the country of origin without a significant
commands and instructions he uses must trace a path from quantity of additional, and reliable, evidence. Please do wish
the source to the destination. The malware author has no such any malware investigators all the luck in the world, for they
requirement: he can develop malware, attach it to a bogus shall need it.
email message, and relay the message through a poorly
configured SMTP server in an unfriendly country. In one fell I hope you enjoy the Legal Section and I would love to hear
swoop he has placed essentially insurmountable hurdles your thoughts and comments via 360. /

31

DF9_31_Legal Editorial.indd 31 20/10/2011 17:33

 / LEGAL FEATURE

MOBILE PHONES,
GEO-LOCATION, AND
PRIVACY IN THE EU
A look at mobile phone positioning systems and their legal standing in the EU
by Scott Zimmerman

/ INTERMEDIATE

M
any current smartphone models – including but The aforementioned action was brought against Microsoft
not limited to those from Apple and Microsoft – are by a citizen of the United States within the United States.
capable of acquiring and storing location information. The US does not have the same legislative approach to
Global Positioning System (GPS) satellites may provide this user privacy that is found in the EU. The US does have the
information or it may be derived from the mobile phone tower Fourth Amendment to the Constitution, but that is applicable
from which the handset receives its signal. Whatever the generally to information control between individuals and the
method involved, the end result is that the location of the US government (including law enforcement).
handset may be tracked. In some cases this capability may In the EU, the sort of privacy under examination in the
be desirable, as when a parent wishes to monitor a child who Microsoft case is governed by a document titled Directive
has borrowed the car. However, in this case the features are 2002/58/EC of the European Parliament and of the Council of
enabled with the user’s knowledge and consent. (“User” here 12 July 2002 concerning the processing of personal data and
refers to the parent who owns the mobile service plan.) the protection of privacy in the electronic communications
Mobile phone manufacturers recognize the user’s desire to sector (Directive on privacy and electronic communications),
control the generation and use of such information, and most hereafter simply called the “Directive”.
(if not all) current phone models provide an option for the user
to disable any geo-location utilities. This will of course prevent
some applications, such as street-by-street navigational
guidance, from working but this is the tradeoff for preserving
some of the user’s privacy.
Problems arise when a device’s behavior does not match
what the user expects. Normally this phenomenon is
demonstrated by a device that simply does not function when
the user expects it to do so; a crash or freeze for example.
However, there is another set of circumstances that is
arguably more problematic; when the device ignores user-
selected options and functions in an undesirable manner,
either through a malfunction or through a configuration set by
the manufacturer. We will examine the latter.
In the Legal News section of Issue 8, we saw that Google
was sanctioned by a French body for gathering unauthorized
information through the use of its Street View vehicles. They
experienced similar roadblocks in Germany over the same sort
of privacy violations against EU citizens. Now a lawsuit has
been filed against Microsoft, alleging that Windows Phone 7
devices continue to transmit geo-location data back to the
manufacturer when the camera is activated, even if the user
has disabled all such functionality. Microsoft has denied the
claims; it’s still early days, but at the time of writing it appears
that the litigation will proceed.

32 Digital / ForensicS

DF9_32-34_Mobile Phones.indd 32 20/10/2011 17:34

 As with earlier treatments of legal statutes, we will not (32) … Where the provision of a value added service
examine every clause in detail. Instead we shall look at those requires that traffic or location data are forwarded from an
potentially most germane to the Microsoft case. electronic communications service provider to a provider
Within the Directive itself, each clause is numbered; the of value added services, the subscribers or users to whom
reader will note (and may be grateful) that we will bypass the the data are related should also be fully informed of this
majority of the items. forwarding before giving their consent for the processing of
the data.
/DISSECTING THE EU PRIVACY DIRECTIVE Now we’re starting to move toward the type of data
(14) Location data may refer to the latitude, longitude and transaction that could include a firm like Microsoft. Essentially
altitude of the user’s terminal equipment, to the direction of this item covers data that moves from the mobile phone
travel, to the level of accuracy of the location information, to service provider (e.g. Vodafone) to a third-party organization
the identification of the network cell in which the terminal such as a restaurant guide: the provider of value added
equipment is located at a certain point in time and to the time services in this case might be providing discounts or similar
the location information was recorded. at restaurants in the immediate vicinity of the mobile phone
Note that the Directive does not specify any particular user. (This is a common business model for such providers.)
technology, such as GPS. The definition was likely left open to However, it is at this point that the user’s consent is
allow for future changes in technology. required: under the Directive, the mobile phone server
(15) … Traffic data may, inter alia, consist of data referring to provider may not provide geo-location information to the
the routing, duration, time or volume of a communication, to value added service provider without the user’s consent.
the protocol used, to the location of the terminal equipment Note that the Directive does not indicate which form the
of the sender or recipient, to the network on which the consent must take; it is common for end users to accept
communication originates or terminates, to the beginning, end such terms and conditions when they download, install, and/
or duration of a connection. They may also consist of the format or run an application on their mobile phones. This consent
in which the communication is conveyed by the network. is then passed to the phone’s OS and translated into the
This item is fairly straightforward: traffic data may include configuration, e.g. the Widget application may access data of
several data types such as those shown above. One term in types A, B, and C but not of D, E, or F.
this clause that is not entirely straightforward, and that is inter In the lawsuit currently aimed at Microsoft, the plaintiff
alia. Inter alia is defined in the eighth edition of Black’s Law alleges that the MS mobile phone operating system (OS)
Dictionary as simply “Among other things”. The reader can provides location information to Microsoft regardless of the
also think of it as “including but not [necessarily] limited to” user’s choices. If these allegations are true, it appears the
as used elsewhere in this very article. This wording, as above, company has run afoul of the EU Directive.
is likely designed to allow for technological progress. (35) In digital mobile networks, location data giving
the geographic position of the terminal equipment of the
mobile user are processed to enable the transmission of
communications. Such data are traffic data covered by
Article 6 of this Directive. However, in addition, digital mobile
networks may have the capacity to process location data
which are more precise than is necessary for the transmission
of communications and which are used for the provision of
value added services such as services providing individualised
traffic information and guidance to drivers. The processing
of such data for value added services should only be allowed
where subscribers have given their consent. Even in cases
where subscribers have given their consent, they should have
a simple means to temporarily deny the processing of location
data, free of charge.

UNDER THE DIRECTIVE, THE

MOBILE PHONE SERVER PROVIDER
MAY NOT PROVIDE GEO-LOCATION
INFORMATION TO THE VALUE
ADDED SERVICE PROVIDER
WITHOUT THE USER’S CONSENT

33

DF9_32-34_Mobile Phones.indd 33 20/10/2011 17:34

 / LEGAL FEATURE

The first part of (35) describes the need for the mobile Let us look at (35) in the context of the Microsoft case and
phone provider to know which communications tower the consider a user who has not given (or has revoked) permission
user’s phone is accessing; this is necessary for the provider to share geo-location data from his phone. According to the
to route voice and data traffic appropriately and does not EU Directive, the only such data that should be generated or
pinpoint the user’s location to any significant degree. The processed is that of the phone’s connection to a particular
user’s general location could be determined, possibly to a tower, i.e. the minimum required for successful mobile phone
circular area a half-kilometer in diameter in the case of a tower operation. The user’s precise latitude and longitude should
in a city, and a somewhat larger area in the country since not be calculated, let alone transmitted to another party
towers there are farther apart. without the user’s consent.
The second part of (35), after “However”, alludes to more (36) Member States may restrict the users’ and subscribers’
precise geo-location mechanisms such as GPS, though it does rights to privacy with regard to calling line identification
not do so by name. The mobile phone service provider does where this is necessary to trace nuisance calls and with regard
not need to know that the user is on the corner of X Street and to calling line identification and location data where this is
Y Avenue in order to deliver voice and data traffic. The key necessary to allow emergency services to carry out their tasks
differentiator here is the Directive’s use of the word “processing”. as effectively as possible. For these purposes, Member States
“Processing” in the data context is generally understood to may adopt specific provisions to entitle providers of electronic
mean accessing, storing, or performing operations on data. communications services to provide access to calling line
The value added service provider described above, offering identification and location data without the prior consent of
discounts at restaurants, would be processing the user data. the users or subscribers concerned.
It is important to note that in this clause of the Directive,
the geo-location information is reserved for the use of the
Member States and then only for emergency services, e.g. to
respond to a traffic collision. Readers should also note that
user permission to make use of the information under these
very limited circumstances is not required if the Member State
should request geo-location information from the mobile
phone service provider. The manufacturer of the handset has
no privileges in this area.
Clause 36 goes on to provide some definitions to ensure
all readers of the Directive are using common language (so to
speak), I have extracted one of specific interest.
The following definitions shall also apply:
(c) “location data” means any data processed in an
electronic communications network, indicating the geographic
position of the terminal equipment of a user of a publicly
available electronic communications service;

/ CONCLUSION
The European Union is very clear about how the data
relating to mobile phone users may be handled. Aside from
knowing which tower a user’s phone is accessing, any and
all user location information is under the strict control of
the user. Without consent, mobile phone providers may
not track users by latitude and longitude. If the user give
consent to have detailed location information generated,
the holder of that data may not share it with any other entity
(outside of law enforcement) without the user’s consent.
Any third parties to whom the user has given consent to
process the location data may do so only in the fashion
to which the user has consented. Finally, at all times any
organization to which the user has given such consent must
provide a timely and no-cost method for the user to revoke
said consent.
There will be a number of industries, inter alia IT, mobile
communications, legal etc. who are all waiting with great
interest to see how the current action against Microsoft
might proceed. /

34 Digital / ForensicS

DF9_32-34_Mobile Phones.indd 34 20/10/2011 17:34

DF9_35_Ad.indd 52 15/10/2011 13:50
 / LEGAL NEWS ALERT

LEGAL NEWS ALERT

Summer of 2011 has seen some very
interesting legal actions. In this issue we will
examine some groundbreaking items

Lawsuit Filed Against Microsoft Alleges Windows

Phone 7 Tracks Users Without Consent

01 September 2011, an individual filed a lawsuit against Microsoft

in the Seattle, Washington Federal court. The suit alleges that
Microsoft’s Windows Phone 7 gathers and transmits the user’s
geo-location information, even when the user has explicitly
configured the mobile device not to do so. The filing was brought
as a class action suit on behalf of all users of Windows Phone 7.
Spring 2011, the US Congress had sent letters of inquiry to
mobile phone vendors to gain some additional insight into
how much and what type(s) of information their respective
devices might gather. May 2011, Microsoft sent a response
to Congress and indicated that “Collection is always with the Spamhaus Wins Protracted Legal Battle with Spammer
express consent of the user and the goal of our collection is
never to track where a specific device has been or is going”. The
suit alleges that when the still-frame camera application under In the mid-2000s, Spamhaus, a UK entity, was offering a
Windows Phone 7 is activated, the device captures the current service designed to counter spam. They tracked domains and
geographical coordinates – latitude and longitude – of the user, IP addresses that had been shown to distribute unsolicited
along with information regarding any wireless access points commercial email (UCE) and provided the data in the form of a
in the immediate area. The suit further alleges that the mobile blacklist to customers who could then choose to drop inbound
device then transmits all of this information back to Microsoft. email traffic from the listed offenders. This resulted in greatly
The suit seeks punitive damages as well as an injunction to stop reduced amounts of unwanted email for the subscribers to the
Microsoft’s alleged information gathering activity. service. Naturally the organizations that were sending the UCE
were not happy with these events and some of them pursued
litigation against Spamhaus, claiming the blacklists interfered
/ Samsung and Apple, Inc. with their business model.
in Patent Tussle One such organization was e360 Insight, which was based
In September, Apple, Inc. filed a complaint in a German court
in Chicago, Illinois. In 2006, they filed a suit in US court against
against Samsung, claiming that the South Korean manufacturer Spamhaus for allegedly hobbling their business practices.
had infringed on the design of the iPad. The judge in the Despite the fact that Spamhaus is located in the United Kingdom;
Duesseldorf court agreed and ordered the sale of the Samsung and thus not subject to United States law; the suit was allowed
Galaxy tablet computer stopped across the whole of the
European Union. On further reflection, the judge realized
to proceed. The judge ruled in favour of e360 Insight and decreed
that such an injunction rather overstepped the bounds of the that Spamhaus should pay the plaintiff $11.7US million. On
court’s jurisdiction and amended the restriction to include only appeal, the damages were reduced to approximately $27,000US.
Germany. Samsung plans to appeal the restriction, stating A second pass through the US Court of Appeals reversed the
that Apple’s claims are without merit and the restriction
inappropriately limits consumer choice in Germany. earlier decisions and e360 Insight was ordered to pay Spamhaus
Apple is claiming that Samsung “slavishly” copied the the princely sum of $3US along with paying for Spamhaus’ court
exterior appearance of the iPad when designing the Galaxy. costs. By this time, e360 Insight had gone out of business; the
However, while the Galaxy and the iPad both have rounded company’s owner claims the closure was due solely to the vast
corners and a central control area for the user, they have
different physical aspect ratios. Samsung maintain that design expenses required to pursue Spamhaus.
cues as simple and obvious as rounded corners cannot be While no real money changed hands as a result of the extended
considered unique to a single organization or product. litigation, the finding in favour of Spamhaus sets a potentially
useful precedent in the worldwide battle against spam.

36 Digital / ForensicS

DF9_36_Legal News.indd 36 20/10/2011 17:34

 / COMPETITION

COMPETITION
/ This issue we have 3 books to give away courtesy
of Syngress: Digital Forensics with Open Source Tools,
Windows Registry Forensics & Penetration Tester’s Open Source Toolkit

/ Question
TERMS AND CONDITIONS
This competition is open to anyone aged 18 or over, except for
employees of TR Media Ltd and their immediate families. Only
As we’re focussing on Geo-location in this issue, one entry is permitted per person. Entries can be submitted
we thought we’d ask a geography question – by email only to competition@digitalforensicsmagazine.
What famous building is located at: com. TR Media shall not be responsible for technical errors in
telecommunication networks, Internet access or otherwise,
preventing entry to this competition. Closing date for all entries

38 53’ 51.75” N, 77 02’ 11.32” W

is on 31 November 2011 at 9.30am GMT. Any entries received
after that time will not be included. The correct winning entries,
chosen at random by the DFM team, will be notified by email on
01/06/2011. The winners may also be announced in Issue 8 of

/ To Enter
the magazine and on the Digital Forensics Magazine website.
Submitting your entry constitutes your consent for us to use
your name for editorial or publicity purposes, should you be
To enter the competition all you need to do is send an one of the winners. TR Media Ltd reserves the right to change or
email to: [email protected], withdraw the competition and/or prize at any time. By entering
writing ISSUE9COMP in the subject line, include your the competition, entrants are deemed to have accepted these
terms and conditions.
name address and phone number with your entry.

Digital Forensics with Open Source Tools Windows Registry Forensics Penetration Tester’s Open Source Toolkit,
By Cory Altheide, Harlan Carvey By Harlan Carvey Third Edition By Jeremy Faircloth
Digital Forensics Harlan Carvey Great commercial
with Open Source brings readers an penetration
Tools is the advanced book on testing tools can
definitive book Windows Registry. be very expensive
on investigating Windows Registry and sometimes
and analyzing Forensics provides hard to use or
computer systems the background of questionable
and media using of the Registry to accuracy. This
open source help develop an book helps
tools. The book understanding solve both of
is a technical of the binary these problems.
procedural guide, and explains the use structure of Registry hive files. Approaches The open source, no-cost penetration
of these tools on Linux and Windows to live response and analysis are included, testing tools presented do a great job
systems as a platform for performing and tools and techniques for postmortem and can be modified by the user for
computer forensics. analysis are discussed at length. each situation.

37

DF9_37_Competition.indd 37 20/10/2011 17:34

 / MEET THE PROFESSIONALS

MEET THE DF
PROFESSIONALS
Dr Andrew Jones
Interviewer: Roy Isbell

/ Interviewee Bio reservations that some of the courses are being offered as
Dr. Andy Jones joined Khalifa University of Science Technology digital forensics or computer crime are actually re-branded
and Research (KUSTAR) in August 2009 to set up and manage security courses.
the MSc in Information Security and Computer Crime. Prior On the training side, courses are delivered to meet specific
to this he had been at British Telecommunications (BT) as needs, normally based around the tools that the vendor
the head of security technology research. He also holds a provides. It is almost a moot point with many of the tools
post as a visiting Professor at Edith Cowan University and the that the providers will potentially gain significantly more
University of South Australia. revenue from the training courses than they will from the
Previously he was a principal lecturer at the University sale of the tool. This begs the question as to whether it is
of Glamorgan in Wales where he created a digital forensics actually in their interest to provide good robust forensic
research laboratory and lectured on Information Security tools that have an intuitive and well-documented GUI and
and Computer Crime. His background prior to this was 25 a respectable user manual. In many cases, the only way to
years in Military Intelligence during which time he was obtain a decent manual for the product is to attend the range
awarded the MBE. of courses offered.
Andy has a PhD in Information Security from the As to accreditation, I am all in favour and have spent
University of Glamorgan and is a member of MENSA, the some time over the last few years working with Edith Cowan
British Computer Society, the High Tech Crime Consortium University and the Australian Federal and Local police trying
and the Institute of Information Security Professionals. He to map out the requirements for qualifications and training
has published numerous articles on information security for the digital forensic environment. As to who should own
and computer forensics and five books on information the accreditation, in the UK this should be the Forensic
warfare, information risk management computer crime and Science Regulator. It cannot be the vendors, academia or the
digital forensics. practitioners, all of who have a vested self interest and must
Andy is 59 years old, is married with two grown children and be independent and at a high level.
is currently residing in Abu Dhabi in the United Arab Emirates.
His interest include, sub aqua, reading and, strangely enough, How do you see the future of your research as it relates to
computer forensics. digital forensics?
My main research interests are in residual data and the
What got you involved in digital forensics? recovery of information from ‘dead’ disks, however some
I first got into the world of digital forensics while still serving of the research that I am undertaking is to gain knowledge,
in the Army. I was running the information security inspection not of the technologies involved, but of the reasons for
team and felt that I needed to know what actions I should the failure of the user to understand the risks. Through the
take if, during a security investigation, I needed to preserve research we are trying to understand why the systems that
evidence for a potential criminal action. After much asking should be in place to prevent the exposure are not working
around, I was eventually pointed to the then Metropolitan and find processes, procedures and tools that will improve
Computer Crime Unit, run by John Austen, the only such unit in the situation. The dead disk study is in the very early stages
the country at the time. but has huge potential for the recovery of data from media
that that has been damaged or failed. I am also looking to
What are your thoughts on the current state of education extend this to investigating solid-state memory.
and training, accreditation of courses etc. as they relate to
digital forensics? What are your views on the industry standard tools used
This is a subject close to my heart, as you might imagine. to investigate digital forensics and the fact that so few are
On the education side, there has been significant progress actually validated other than by mass use?
and there are now a number of universities and colleges The tools that are available vary considerably in quality
that offer academic courses at all levels to meet the ever- and scope. On the one hand you have the universal toolkit
growing need. While this is to be applauded, I do still have type tool that carries out all of the major functions that

38 Digital / ForensicS

DF9_38-39_Meet the Professionals.indd 38 20/10/2011 17:34

 are required during a standard investigation. The problem of ways. The first of these is that this is to try and understand
with these tools is that in many cases, they have become from a business perspective what is happening from the
‘too’ commercial and have now reached the point in the streams of data that are available, so this is not necessarily
software development cycle where they have to rely on about discovering something but of understanding the
getting the next version of the tool to market, (as with optimum state. The second is that, while seeking to
most applications) and as a result there have been several understand the relevance of the available data, it is not
instances recently where the tools have failed for one reason trying to understand a specific event, but to understand the
or another. On the other hand, there are the single function implications of many events. The third is that for operational
tools that are very good at addressing a particular issue. analytics to be of value, it must operate in near real time,
These tend to be very well crafted and are produced by while the others have the ‘luxury’ of being able to take a
individuals or groups that have identified a specific need. more leisurely approach.
I much prefer the scientific approach of being able to
replicate the results with different tools as the best test of With the Internet crossing national borders how do you
whether a tool is operating as expected see digital forensics evolving to deal with the wider
investigations required in this environment?
What do you think about the relationships between digital The Internet has always existed in an international
forensic investigations, eDiscovery, operational analytics and environment since it became a publically available service.
malware analysis? What has been slow to catch up is the law enforcement
The fields of digital forensic investigations and eDiscovery and legal powers to address the new environment. This is not
have a relatively common root, although the output may a new problem, as can be seen if you look back in history to
vary. Both are about discovering the facts about what has the law of the sea. The reality is that creating and updating
taken place and both are required to be carried out in a laws take a long time and we are operating in a highly
manner that does not damage the source data and which can volatile environment, so the two will almost certainly never
be repeated. Malware analysis also has a strong affiliation to be synchronized. What is happening and improving is the
the basic search for facts, although the tools that are used harmonization of laws and cross border agreements that make
may differ. Operational analytics varies slightly in a number the capture and transportation of evidence easier. /

39

DF9_38-39_Meet the Professionals.indd 39 20/10/2011 17:34

DF9_40-41_Ad.indd 40 20/10/2011 17:35
DF9_40-41_Ad.indd 41 20/10/2011 17:35
 / FEATURE

MANAGEMENT
OF KNOWLEDGE
BASED GRIDS
Using a combination of public and private keys and X.509 certificates
to manage security in knowledge-based grids
by Sian Haynes & Stilianos Vidalis

/ INTERMEDIATE

F
ujitsu is set to bring high-performance computing (HPC) Going back to the HPC Wales Project the project is planned
to Wales. They are to provide a distributed grid under a to use a minimum of nine sites including Swansea, Cardiff,
project that is expected to take over five-years and cost Aberystwyth, Bangor, Glamorgan, Swansea Met, Newport,
up to £40 million. The grid will include over 1400 nodes spread Glyndwr and a number of other sites. The grid will allow all
across more than eight sites, linked using Fujitsu’s middleware of the sites to share and distribute resources freely and a
technology SynfiniWay that will deliver an aggregated number of pilot applications will be sponsored via HPC Wales
performance of more than 190 petaflops. to test the capabilities of the grid; for example in Newport we
Grid computing is a technology that enables people and are considering a Grid for Crime Prevention (G4CP).
machines to effectively capture, publish, share and manage
resources. There are several types of grids but the main types
are; data grids, computational grids and knowledge grids.
Data and computational grids are quite similar in
that they are used to manage and analyse data. With
technology increasing and developing at such a dramatic
rate, average computers cannot cope with the amount of
data or the calculations they are being asked to perform.
For example if a scientist is doing research about cancer
cells and their development, using conventional methods
on one machine, it could take years to complete the
calculations. However, if a grid were used to perform
the calculation, its combined computational power
would significantly reduce the time frame. To analyse a
complicated set of data could take a standard computer
a few days or even weeks to analyse. Whereas if a
grid was used to perform the same analysis it would
take considerably less because it would harness the
computational power available on the grid, parallelise the
load and allow the calculations to be performed with a
small turnaround time.
Knowledge grids are self-explanatory; their purpose is
to share knowledge. In this day and age we have come to a
point where we are using computers to create vast amounts
of data. The information overload is so big that human
beings are not able to absorb and analyse the data in a
timely manner and extract the much sought after knowledge
that will further science and better our lives. We are now at a
point where we now have to teach computers how to extract
knowledge from raw data.

42 Digital / ForensicS

DF9_42-45_Knowledge Based Grids.indd 42 20/10/2011 17:35

 Figure 1. G4CP Centre of Gravity

/ Grid for Crime Prevention establishment of global standards in the areas of cybercrime
The Grid for Crime Prevention, also known as G4CP will prevention, identification and prosecution.
stimulate, promote and develop horizontal methods and The centre of gravity of G4CP is to design and implement
tools for strategically preventing and fighting cybercrime an application that promotes collaborative working, using
and guaranteeing security and public order in the Welsh data fusion and data mining techniques, and allow knowledge
cyberspace. Furthermore, G4CP will promote a coherent Welsh discovery from raw security incident data. The application
strategy in the fields of cyber security through the exploitation was originally called Inter-Organisational Intrusion Detection
of the project’s artefacts, it will also play an active role in the System (IOIDS).
Trying to defend European cyberspace against organised
cybercrime can be seen as a complex problem with one of the
problems being that companies are afraid to report security
incidents because they feel their reputation will be damaged.
This results in many private organisations and law enforcement
agencies being forced to tackle cybercrimes with next to no
help from other organisations in the same supply chain. The
G4CP project felt that there was a need for the defenders of the
European Information Infrastructure to come together to form a
number of virtual communities in order to take action collectively
against the perpetrators of cybercrime and promote a culture of
security amongst and across the members of these communities.
The communities should allow for secure information
sharing and facilitate organisations to be proactive in
defending their networks against on-going cyber attacks.
G4CP will make grid technology attractive to those
establishments fighting cybercrime. It will also help the
uptake of grid type architectures and extend their concept
from computation grids to knowledge grids.

/ Data Grid vs. Knowledge Grids

Both grids involve the networking services and connections
of a potentially unlimited number of computing devices. The
difference is the service they provide; data grids usually
provide a service such as a “power utility grid” provides
electricity to homes and business etc. Whereas a Knowledge
Grid harnesses the power of the grid and uses it for scientific
research; e.g. if a scientist needed to analyse a data set it
could take up to a third of less time using the grid than if an
average computer was used.

43

DF9_42-45_Knowledge Based Grids.indd 43 20/10/2011 17:35

 / FEATURE

The application that G4CP plan to develop will effectively

police the cyberspace and minimise the threats against / Is Public & Private Key
authentication secure?
computing infrastructures. This will promote a coherent
European strategy in the field of crime prevention through the
exploitation of the projects products and will play an active role It is true that Public & Private Key Authentication has been used
for many years but it is a proven secure authentication method.
in the establishment of global standards in the area of crime As long as the Private Key is kept secret by the main user they
prosecution through the dissemination of the projects results. will be the only one who can de-crypt the message. The Public
G4CP also raises a lot of questions around grid & Private Key facility is well known and used for many things
management, for example if a user wanted information such as applications online. When applying for the E-Science
certificate they ask for you to create a Private Key which will
regarding denial of service attacks against web servers in later be used to authenticate your application.
Wales, once they received the result what would happen with
it? The knowledge would be stored so that if another user
needed the same information then it would be available and if this occurred with every search then the knowledge base
instead of using up resources creating the same query it could could become overloaded with information and cause the
just locate the knowledge and deliver it to the user. However, system to slow as the storage ran out. To store every query
would use thousands of terabytes. The solution would be to

THERE ARE TWO METHODS, keep the information available for a short period of time and
if the query was not called for during that time frame then to
WHICH CAN CONTROL AND delete the query. If it occurs again outside of the time frame

HELP, MONITOR USERS ON THE then the query will be developed again and held on the server.
The demand for information and harnessing the power of the
GRID AND THEIR SECURITY; grid to deliver information and knowledge faster is the key.
PUBLIC & PRIVATE KEY / Managing a Knowledge Grid
CRYPTOLOGY ALONG WITH In a communication network, a node is a connection point,
X.509 CERTIFICATES either a redistribution point or a communication end point.
However, the definition of a node does depend upon the
network and protocol layer referred too. The main goal of grid
management is to measure and publish the state of resources
at a particular point in time. To be effective, monitoring must
be done from end to end, meaning that the entire environment
and its components must be monitored.
Understandably this is no easy task, if we take HPC Wales
for example; it will provide to G4CP, 1400 nodes located
across 9 different sites. It is a huge task on its own just to
manage all the components that are required to control that
grid and its environment.

/ User Management
There has to be some form of security and authentication on
the grid to ensure that the users on the grid are accessing
material that is appropriate to them. There are two methods,
which can control and help, monitor users on the grid and
their security; public and private key cryptology along with
X.509 certificates.
Public and private key cryptology is used regularly in many
different kinds of computing projects and environments for a
secure authentication method. The main reason it is still in use is
that it helps indicate the true authors of a piece of information.
E.g. If Sian wanted to send a message to Stelios, she would
encrypt it with her private key so that when Stelios received
the message he would be able to unlock it with his public key
and read the message but because Sian encrypted it with her
private key he knows it is from Sian. There are flaws in public and
private key cryptology along with all methods of authentication,
however; this method of secure authentication is put in place as
a ‘contract’ of trust between the user and the manager of the grid.

44 Digital / ForensicS

DF9_42-45_Knowledge Based Grids.indd 44 20/10/2011 17:35

 / HPC Wales Facts
A few interesting quick facts about HPC Wales:

• Fujitsu has a £15million 5 year contract

• HPC Wales is a £40 million project that is a bid to boost the
region’s economy
• The two primary hubs will be Cardiff and Swansea which
then stretches across 8 other sites including Newport.
• Fujitsu will use primergy cluster servers based on Intel
Xeon and InfiniBand interconnect with Linux and Windows
operating systems
• More than 1400
compute nodes will
be deployed across
all the sites
with aggregated
performance of
Figure 2. E-Science Certificate (X.509) nodes exceeding
190 teraflops.

THE CERTIFICATE HOWEVER WILL

HAVE SUFFICIENT PERMISSIONS
BUILT IN STATING WHICH
SECTIONS THEY ARE ALLOWED
ACCESS TO AND IP RIGHTS
STATING THAT IT CAN ONLY BE
Figure 3. Conga GUI
INSTALLED ON ONE COMPUTER
To ensure that the grid is used on appropriate applications
or web browsers an X.509 certificate could be issued to / Author BioS
authorities who use the grid. The X.509 certificates are Siân Louise Haynes – Currently a final year
standard for a public key infrastructure for a single sign on student at University of Wales, Newport
studying BSc (Hons) Forensic Computing
and privilege management infrastructure. It basically specifies
due to complete my studies in June 2011.
(amongst other things) standard formats for public key Aspiring toward getting a job as a digital
certificates, certificate revocation lists, attribute certificates evidence technician or a role within the
and a certification path validation algorithm. forensic evidence technician field.
If we go back to the example of G4CP, we could manage
Dr Stilianos Vidalis was born in Athens,
the users on the grid via a X.509 certificate (similar to
Greece, and was raised on an island in
an E-Science Certificate). For example; when a user joins the Aegean Sea. He moved to Wales in
the G4CP (or attempts to join) they will have a face-to- 1995 where he did his undergraduate
face meeting with a member from the G4CP authority and postgraduate studies. He received
management team who will then run through an application his PhD in Threat Assessment in July
2004 from the University of Glamorgan.
process; this process will identify whether they have a need He joined the Department of Computing
for accessing the grid. If they were suitable then an X.509 of the University of Wales, Newport in
certificate with the correct permissions for accessing the grid 2006 where he is currently the Head of
would be issued to them. The certificate however will have the Centre for Information Operations. He is the programme
leader for the BSc Computer Forensics, and BSc Information
sufficient permissions built in stating which sections they
Security. Dr. Vidalis is a member of the BCS South Wales
are allowed access to and IP rights stating that it can only be Committee, a member of the E-Crime Wales Steering Group,
installed on one computer. There will also be an expiration and a member of the Military Educational Committee of
date on the certificate whereby the user would have to the Welsh OTC. His research interests are in the areas of
re-apply for a certificate close to the time of expiration, information operations, digital forensics, threat assessment,
and effective computer defense mechanisms. Dr Vidalis
therefore, if a user doesn’t wish to continue having access is involved in a number of R&D projects with the Welsh
to the grid or doesn’t have a need for it anymore there won’t Assembly Government, Law Enforcement Agencies, and
be any rogue accounts which could become vulnerable and private companies.
used maliciously. /

45

DF9_42-45_Knowledge Based Grids.indd 45 20/10/2011 17:35

 VENDOR INDEPENDENCE
the difference

ASSESSMENT | GUIDANCE | MANAGEMENT

CALL | +44 (0)1274 736223 | TODAY

www.ecsc.co.uk

DF9_46_Ad.indd 46 11/10/2011 17:11

 / APPLE AUTOPSY

APPLE AUTOPSY
As Apple loses its greatest innovator and
co-founder, Steve Jobs, new CEO, Tim Cook,
takes over the reins to introduce the new
iPhone 4S… What does this latest model
tell us about the company’s future?
by Sean Morrissey

T
he Apple world lost its greatest innovator, Steve Jobs.
His long battle with cancer came to an end on October
5, 2011. Steve had influenced generations of people and
created magical products for the world to use. His business
style, his outlook on technology was far beyond us mere
mortals. Steve revived a failing Apple and rebuilt it to become
the technology giant that it is today. But does Steve Jobs The new iPhone 4S has the dual core A5 processor, CMDA
passing signal the end of Apple, as we know it? and GSM, which gives it truly world phone capabilities.
In some ways yes, but Apple is more than one man and it The iPhone 4S has a redesigned 8-megapixel camera and
will move on. I did read that some commentators thought Apple have now added a 64GB variant to the fold; this with
that Steve believed he was immortal; the reality is quite the addition of iOS 5 and the improvements the upgraded
the contrary. Steve Jobs was cognizant enough to know his operating system brings, most notably notifications, game
mortality and therefore surrounded himself with some of the play and web browsing are faster as is the speed of the
greatest designers, innovators, managers, and engineers camera and associated functionality.
in the world. They are leaders in their respective fields, and Then there is “Siri”, an awesome application that just adds
are still hard at work at Apple innovating, designing and another dimension of getting information, dictating just about
producing some of the most anything. Siri uses Artificial
sort after technology products Intelligence (AI) to create
in the world today, building and send texts and e-mails,
upon the legacy left by Steve. set reminders, schedule
Tim Cook has been passed meetings, place phone calls,
the torch from Steve, and in get directions, play music
Steve’s first leave of absence, and is believed to be able
we saw Apple stock just to answer context sensitive
continue to grow. Tim Cook questions, like “will I need a
will be a great steward of raincoat today?”. The Siri app
Apple. I have to wonder what was originally a spinoff of a
was going through his mind project co-developed by SRI
as he launched the iPhone Ventures and the Department
4S knowing that Apples co- of Defense’s innovation arm,
founder was in his final hours. the Defense Advanced
He can surely be forgiven if his Research Projects Agency,
mind was elsewhere. or DARPA and was launched
On October 4, 2011 Tim Cook as an iPhone app in February
the new CEO of Apple introduced 2010. Apple bought the app
the iPhone 4S and not the some two months later for an
iPhone 5 as some pundits undisclosed sum. All in all, this
thought would be announced. is something really impressive.
Some critics think this was a let Apple is alive and well and
down; my opinion is that as the I am sure that we will see
iPhone 4 sold so well, why not more innovation and “cool
just improve what is there? “If it products” from this company
aint broke don’t fix it”! in the future. /

47

DF9_47_Apple Autopsy.indd 47 20/10/2011 17:35

 / FEATURE

FOOTPRINTS ON MACS –
GEOGRAPHIC ARTIFACTS
The apple world can be both stationary and mobile; from the Mac Pro to the iPhone all
have one thing in common, the Apple universe. Apple has given its customers the ability
to do many things including the ability of devices to become interconnected with ease.
This facility provides users an intuitive ability to save all kinds of data. With the coming
iCloud, more and more content will be moved to the cloud; however the move of the
content does not eliminate geographic data from the content
by Sean Morrissey

/ ADVANCED

T
oday we have OS X and iOS as the two operating • Navigate to the following path, ~/username/pictures/
systems; OS X for Apple personal computers and iOS iPhoto Library.
for the Apple mobile devices. The interoperability of the • Copy the entire file from the suspects system and then paste
two operating systems provides the facility to store the same it to the same path on your system, ~/username/pictures/
data on multiple devices. Before the rise of iOS, the Apple iPhoto Library.
universe consisted of the MacBook, iMac, and the Mac Pro. • Open iPhoto and view the results.
These all had the ability to store geographic data, mainly from
cameras that had included the Geo Positioning System data iPhoto is an application that provides the examiner a lot
(GPS) in picture files. of information about a particular image. This may be done
This was first associated with high-end cameras, but from a forensic workstation or other system connected to
today relatively cheap mobile devices can embed GPS the Internet. The following procedure will provide the same
data. Unbeknownst to Apple they also gave digital forensic information both online and offline except for geo-mapping
examiners a free forensic utility to examine this data from which will require access to the Internet.
within the operating system; that utility is Preview. The
Preview application is, by default, located on the dock • Use the copy over technique from the previous step action to
(task bar). transfer data from a locked .dmg to the same location on the
The preview application can be used to view all “exif ” forensic workstation.
(Exchangeable Image File Format) and GPS data from images • Scroll through the images until an image of relevance
that contain such. is seen.
On most newly purchased Mac devices the iLife application • Click on the image to highlight it.
suite is included; the iLife suite includes the iPhoto • At the bottom of the window to the right, is seen an “info”
application and just like Preview it is installed by default in the button. Click on this button to see the information pane as
task bar. shown in Figure 1.
iPhoto is the default container application used by Apple for
all images & video that is imported either from an iDevice, or From the Info pane the following artifacts are identified:
other source.
From within iPhoto, there is a facility called “Places”. • First the Camera model is shown, in the example above, this
In order to utilize places, the system however needs to be image came from an iPhone 4
connected to the Internet to view the pins on a map. What this • Underneath the camera model, is the EXIF data from the device
provides an examiner is a visual representation of all geo- • Next one can see the filename and MAC timestamps.
tagged data identifying the areas of the world that a suspect • Date and time when the photo was taken
may have travelled. • Last Modified date and time
From a locked .dmg (disk image) the iPhoto library may • Date and time that the image was imported.
be exported from the suspect system and copied over to • Below the MAC times, is a pinpoint on a map where the
another system that has access to the Internet to mimic image was taken; this information is gathered from the GPS
the user’s system and places within iPhoto using the data of the image. (Again the system needs to be connected to
following steps: the Internet to populate this data.)

48 Digital / ForensicS

DF9_48-51_Footprints on Macs.indd 48 20/10/2011 17:35

 So what if I wanted to know the GPS coordinates of the
image? There are two ways that we can do this. One is from
within iPhoto and the other is to navigate the file system and
use another tool that will give the same information, that
application is “Preview”. From within iPhoto, follow the steps
listed below,

• Scroll through iPhoto until a image of relevance is identified

• Select and highlight the image, go to the top menu bar
• From the top menu select “Reveal in Finder” and
“Original File”.
• This will automatically open “Finder” and show the location
within the file system that the image resides.
• From this location all you have to do is press the space
bar and “quick look” the full resolution image. From the
“quick look” view there is a button at the top of the image Figure 1. iPhoto Information Panel
that allows you to open the image with Preview.
• Once selected, the image will open in the Preview application.
• From the top Menu bar, select “tools | show inspector”
• The inspector can provide a wealth of information in regards
to images of relevance.
• Image Exif Data
• GPS Data
• Altitude
• Altitude Reference
• Image compass heading
• Direction reference – True North or Magnetic North
• Latitude
• Longitude
• GPS Time stamp

See the following image as an example of the geo-tagged data.

This procedure can be done with any image and it is not

necessary to do it from within iPhoto. Any image can be
opened with Preview providing you know where the image file
is located and connected to the Internet. The same data can
be retrieved, including all EXIF and GPS data.
Videos also contain Geo-tagged data and again it is
Apple’s mobile devices which provide the bulk of the artifacts
generated. The iDevices are able to create video and embed
geographic data within the file. As with the images, movies
can be added to the iPhoto Library when synchronising the Figure 2. Image Geo-Tagged Data
iDevice with the Mac and “exif ” and GPS data can be viewed
just like with photographs: • Locate your video of interest
• Double click on the video and QuickTime is the default
• Camera Model viewer, if not right click and select “open with” and from the
• Video dimensions and compression list select “Quicktime”
• Filename and Timestamps, • From the menu bar in Quicktime, select Tools | Inspector
• Taken • View the EXIF and Geo data
• Modified
• Imported The bulk of the geographical data is derived from Apple’s
• Geographic Data Mobile Devices, the iPad, iPhone, and iPod Touch. All these
devices now have the ability to take pictures with front and
If you wish to view the data and do not have iPhoto, you rear cameras, and populate the file with EXIF and GPS data.
are able to view the geo-tagged data with the “QuickTime” (Note: The iPad 1G and the all iPods prior to the 4th generation
application. Follow these steps: devices, weren’t capable of taking pictures).

49

DF9_48-51_Footprints on Macs.indd 49 20/10/2011 17:36

 / FEATURE

The iPhone 1G was able to take pictures, but even with

iOS upgrades did not have the necessary GPS hardware to
create GPS Data. However in iOS 3, the 2G iPhone was able to
create and populate files with GPS data, but that data actually
came from the triangulation of cell towers that the phone
was close to. Even the accuracy of the 3G, 3GS and iPhone 4
has improved over time; however sometimes the data can be
degraded in accuracy when the device is indoors.
It isn’t just GPS data from images that is found on any
iDevice, but also location-based data was found on devices
that had versions of iOS 3 and iOS 4. This was the data
set that made headlines all over the world and made the
“consolidated.db” something that made everyone in the
forensics, security, and political arenas takes notice.
Law enforcement, however, knew about location based data
way before it came to light. It was a shining moment for law Quicktime Geo-data
enforcement that was able to keep this data quiet and gave
investigators information that saved lives and solved cases. Now,
all that data is gone, but if an investigator or examiner was given
a device with iOS 3 and iOS 4.0 up to v4.3.2 the location-based
data is still there, however after v4.2.1 it now only lasts for 7 days.
This is still enough time to assist an investigation.
So, where do we look for that data if the investigator is
lucky enough to have a device that still contains location-
based data? First lets look at iOS 3.
In this version of IOS, all the data was populated into a
property list. At the time this data was not backed up and the
only way to access the data was to jailbreak the device and
acquire a physical image. Once an image was obtained; it was
easy enough to locate and view the data.
In order to view property lists, there are free and paid for
utilities. Apple has released Xcode, which is a package of free
utilities designed to assist developers. Within Xcode version 3,
there used to be a utility called “property list editor” this gave
examiners on the Mac platform a utility to view xml formatted
property lists in a human readable form.
The drawback with this application was that it was difficult
to output the artifacts. In Xcode 4 however this utility was
removed from the package. The Xcode 4 application is a Xcode Property List
suitable replacement and solves the output problem. There
has been along with Xcode and property list editor a paid • Latitude and Longitude
application that could also view property lists, Omni Outliner. • H-cells.plist (Harvested) Each is broken down by cell tower
This application can be found at, http://www.omnigroup.com encountered and separate fixes by date/time and Lat/Long.
Within the iOS 3-file system are property lists that contain Looking at the data there could be numerous fixes for the
the precursor to consolidated.db. Located at, private/var/ same tower but at different dates and time.
root/Library/Caches/locationd. Here are a few property lists • Latitude and Longitude
that may contain data relevant to an investigation. • Date and time (Absolute Time)
• Accuracy data
• Cache.plist • Compass Heading
• Date and time of the last GPS fix (Absolute Time) • H-wifi.plist (Harvested) Each set is broken down by the MAC
• The latitude and longitude of the last fix address of the Wi-Fi hotspot encountered and as the h-cells.plist ,
• Date and time of last Wi-Fi fix (Absolute Time) • Date and Time (Absolute Time)
• Cells-local.plist • Latitude
• Cell Tower information • Longitude
• Latitude and Longitude • Accuracy data
• Cells.plist • Compass heading
• Cell tower information • Altitude

50 Digital / ForensicS

DF9_48-51_Footprints on Macs.indd 50 20/10/2011 17:36

 In iOS 4 all these property lists were then combined in
to one SQLite database. Not only did this database have
up to a year’s worth of data but it was also backed up. This
was better known as consolidated.db. Even the file name
alludes to the combination of all the property lists from
iOS3. In order to view SQLite databases, there is a free utility
SQLite Database Browser, which can be obtained at http://
sourceforge.net/projects/sqlitebrowser/. Another paid
application is “Froq”. Available at http://www.colourful-
apps.com/products/mac/froq . This application is helpful in
exporting data into various formats.
The location of the consolidated.db was at /private/var/
root/Library/Caches/location.d/. First lets use the free
application to view the data, from the SQLite Database
Browser application:
Lantern Parsed Geo-data
• From the Menu bar, select File | Open Database
• Navigate to the Consolidated.db
• Select Open.

The default pane is the Database structure, which shows

all the tables within the database. To view the data go to the
Browse Data pane. From this pane, there is a drop down list
labelled “Table:” For example select Cell Location Local as
seen in the following example,
The Following data can be viewed:

• Cell Tower identification

• Time Stamp (Absolute Time)
• Latitude Lantern Visualised Data
• Longitude
• Altitude As we have previously discussed, the Apple world can
• Speed contain a large amount of geographic data designed for
• Course (Compass Heading) the user to share experiences with others and to give a
graphical representation of where people have been. As
The following tables contain the following data: stated previously, Forensic Application Developers like Katana
Forensics, Inc. have been mining and visualizing such data
Wi-Fi Location Table prior to it becoming front-page news.
• MAC Address As we wait for the coming iOS 5 and the newer iPhone(s),
• Time Stamp (Absolute Time) what do we believe these devices and the new iCloud give
• Latitude examiners? What we can expect is that there will be multiple
• Longitude copies of the same artifacts on numerous platforms. Apple
keeps changing the game to keep ahead of competitors, which
Cell Location Harvest in turn makes it incumbent on the forensic community to keep
• Cell Tower Identification up with the changes as they evolve. /
• Provider (for Example AT&T)
• Time Stamp (Absolute Time)
• Latitude / AUTHOR BIO
• Longitude Sean Morrissey is presently employed
• Altitude by Paradigm Solutions and assigned
as a Computer/Mobile Forensic
Analyst, in the Department State
Cell Location Computer Investigations and Forensics
• Cell Tower Identification Division. Sean was an Instructor of
• Time Stamp (Absolute Time) Forensics at the Defense Cyber Crime
Center, a former Law Enforcement Officer and U.S. Army
• Latitude Officer. He also authored Mac OS X, iPod and iPhone Forensic
• Longitude Anaylsis and the upcoming book iOS Forensic Analysis.
• Altitude

51

DF9_48-51_Footprints on Macs.indd 51 20/10/2011 17:36

DF9_52_Ad.indd 52 15/10/2011 11:27
 / FROM THE LAB

DISCOVERING THE EASE

OF X-WAYS FORENSICSart
P 2
In the last issue, I illustrated how easy it is to do many of the routine digital forensic processes
using X-Ways Forensics. Despite only being an overview, I still could not cover all of the
important points within a single article, so here is Part II! By the time you have read to the end,
you should have attained sufficient knowledge of XWF to pick it up and run with it.
by Ted Smith

/ INTERMEDIATE

T
he Gallery View is like no other gallery system! Not
only can the size of the pictures be resized as already
mentioned (via the General Options), but they can be
sorted by colour detection (using the ‘SC’ filter) for skin tone
or the volume of black and white pixels in the image; this is
especially useful for fraud or pornography related investiga-
tions because you can sort by skin tone for nudity or black
and white for scanned typed documents. Not only that, but
the whole file item pane can be docked or undocked from the
main interface so if you have a dual screen system you can
drag the pane (with Gallery button selected) across to one Figure 16. [Un] Dock the File Item Pane
screen and maximise it to show a larger list of graphics, leav-
ing the other screen with the remaining XWF panes. To [un]
dock, click the 3 vertical dots to the left of the ‘Preview’ button
in the bottom right pane, see Figure 16.
Like all areas of XWF, what the gallery view shows you
depends on the options and filters you have set. If you right
click a folder to recursively explore its content, but don’t
have any other filters enabled, the Gallery View will attempt
to show you a thumbnail of every file, and it will obviously
succeed if the file is a picture, whereas it will fail if it is not as
shown in Figure 17.
Based on what you have read so far, you have probably
realised that the Gallery View can be further refined to not
show files that are known system files, duplicate files, already
viewed files, and so on, so that you are then only shown Figure 17. Gallery View with no file filters enable
pictures that are actually pictures in the Gallery view, Figures
18 and 19. The list of display options is practically endless. the image into a new case has facilitated everything you have
seen so far. With other tools, it would have taken hours to
/ Refine the Volume Snapshot (RVS) have arrived at this point, or it may even have required the
At this point, readers who routinely use XWF will be installation and configuration of huge database systems
wondering why I have not yet covered the central aspect of the requiring a considerable installation and configuration effort,
tool called the ‘Volume Snapshot’, and the refinement of it, not to mention a restriction on case portability; something
which is found via the ‘Specialist > Refine Volume Snapshot’ that is no issue with XWF.
menu. I have left the explanation of it until now because I The RVS is effectively a built-in ‘pre-processing’ facility
wanted to demonstrate to you just how much you can do that allows you to specify how the data in your case is further
with XWF in just a couple of minutes, without actually having refined and/or expanded, following that initial and brief file
processed much more of the forensic image. Just dropping system traversal of the image when it was first added.

53

DF9_53-56_X-Ways Forensics, Part 2.indd 53 20/10/2011 17:36

 / FROM THE LAB

excluded or those that are excluded during the RVS process

will not be indexed subject to you ticking the appropriate
options when the indexing parameters dialogue is shown.
Again, the RVS can be conducted at a global case basis (by
clicking on the root symbol, top of left hand pane) for every
evidence object, or it can be done at a partition level of just
one evidence object (option at the bottom of the RVS dialog
box); as always, it depends what you select, or do not select,
in the left hand pane.
In addition, you might, for example, only be interested in
quickly seeing all of the e-mail in your case, so you might
untick everything else in the RVS apart from the option to
“extract e-mail messages” to save time and allow rapid
examination of what you are really after, in this example,
e-mail communications.
Once the RVS has completed, you will then have further
options available to you with regard to how you filter your
data using the Directory Browser Options again.

/ Disk Imaging
Besides the obvious benefits of using XWF for analysis, it also
makes for a superb imaging system. So much so that the stripped
down “Imaging Only” version is not free of charge (though it only
costs about £100), despite many mainstream digital forensics
outfits releasing free imaging solutions. The reason it is not free,
I expect, is because it blows the socks off every other Windows
based imaging system that I know of. As with most aspects of
XWF, I can’t explain all of its advantages and features here, but I
encourage you to explore it and the help manual.
Without creating a case, you can simply add any connected
Figure 18. Changing the filter to show files of type ‘Pictures’ device by either pressing F9 (or ‘Tools > Open Disk’ and then
selecting either the logical or physical device to add. Once
The options are fairly self-explanatory, see Figure 20; suffice chosen, simply press Ctrl + C to capture an image (or ‘File>
to say that it conducts a sequence of further analysis across Create Disk Image’). You are then presented with the dialogue
the image, such as examining and expanding all compressed box shown in Figure 21.
archives (zip, tar etc) and e-mail cabinets (pst, dbx, edb etc), Just as with most tools, you can choose either the raw or
files are hashed using one of many hashing algorithms and E01 image formats; both have various options but I’ll discuss
matched against any hash set you wish, a thorough search for the commonly chosen E01 format here.
lost partitions and files along with data carving if requested You can define the sector range to capture (useful if you
and, as usual, you can dictate whether to apply the refinement have a problematic disk), you can choose what hash algorithm
to all files, files that meet a certain filter criteria, just files that to use, whether to encrypt the image or not, how much to
have not already been excluded/hidden or a list of selected/ split the image by (if at all) but most impressive of all are the
tagged files. The ability to then go straight on and conduct compression options.
indexing is also available and files that you have already Most forensic tools utilise the open-source gzip
compression system that provides the familiar “1 to 9” scale
but XWF have devised their own levels of compression and
they are very effective indeed at intelligently compressing
only data that can be compressed in accordance to the level
you specify, as opposed to blindly compressing everything, or
not, to a specified level, regardless of whether it can actually
be compressed, or not. I conducted some tests of the imaging
speeds at various levels of compression and compared it to
FTK Imager and the Tableau Imager (TIM). I found it to be the
most versatile and efficient of them, only losing out to TIM
when using the very highest compression option that XWF
allows, and even then, the generated image was the same size
as the one created by TIM.
Figure 19. Gallery view with ‘Pictures’ filter enabled

54 Digital / ForensicS

DF9_53-56_X-Ways Forensics, Part 2.indd 54 20/10/2011 17:36

 Figure 21. Imaging disks using XWF

/ Evidence Containers
Lastly, this article would be incomplete without mention of the
evidence containers of XWF, which incorporate their own file
system that is optimised for the number of files to be added to it.
Those of you who attend large business addresses will often
be in a situation where you cannot conduct a full disk image but
will instead opt to capture a certain directory or directories of
files. Though all mainstream tools have incorporated this idea
in some way, XWF does it very well! It is specifically designed
for capturing variable amounts of live files in a very robust
and rapid way. Very recently a practitioner on our team had to
capture 12Gb of live files from a running server. Having started
this process using the AD1 custom image format of FTK Imager
and it reporting that the expected time remaining was three
hours, he tried using XWF. The resulting time taken was just 62
minutes. FTK Imager might be free, but if you work in an arena
where the option of capturing live files much faster is appealing,
Figure 20. The ‘Refine Volume Snapshot’ dialogue then I suggest you invest in XWF and use their evidence
container format. The only ‘issue’ is that you have to use XWF to
In addition to the imaging aspects, you can also ‘simply’ examine the evidence container, but this is no different from the
clone a disk. With version 16.0 onwards, not only can you other forensic tools that incorporate the idea.
clone from the start to the end of the disk, but you can also To create a container, Specialist –> Evidence File Container
clone backwards! To clone a disk, add the media in the same > New. Select or deselect the options you require (including
way as before but choose ‘Tools > Disk Tools > Clone Disk’ a decision as to how many files you want to optimise the
and select, or deselect, the option you require (Figure 22, from container to hold), add some additional metadata and click
XWF 15.9). “Next” (Figure 23). Having given XWF a location to save the
Our team has encountered many disks over the years container to, you then just continue to work in the program as
that can only be imaged from the start to a certain point on normal until you find files that you want to add to the container.
the disk; perhaps 75% through. At that point the imaging As and when you want to add folders or files to
process may fail. Using most forensic imaging and analysis the container, just right click them and select “Add to
tools, you have to accept that the evidence might be lost ContainerName.ctr” and you are presented with options for
from that disk because the partial image cannot be used due the folder(s) and file(s) you have selected (Figure 24). As
to being incomplete. However, with XWF, not only will it (in usual, select or deselect the options you want (the lesser the
most instances) still be able to open the partial E01 image options, the faster the process) to use and click “OK” to start
and present you with the majority of the data but you can the acquisition process.
then go on to clone the remaining area of the disk beyond
the damaged region and then add the “mini image” into your / RAID Analysis
case to conduct a file carve using the “RVS > Particularly XWF is famous for its ability to reconstruct RAIDs. It’s a huge
thorough file system search” to recover any other remaining topic and I cannot cover it here and do it justice, but trust me
files. In a case we had recently, a further 20K files were if you need to rebuild a RAID (any RAID), try XWF. I have even
recovered in this way beyond a damaged area of the disk, used it to add two physical disk RAID components connected
not to mention the ability to examine the partitions, folders via write blockers to XWF, reconstructed the striped RAID as a
and files of the partial incomplete image. Something that new evidence object within XWF, and then captured a physical
was not possible without XWF. image of that reconstructed RAID, as a complete and single

55

DF9_53-56_X-Ways Forensics, Part 2.indd 55 20/10/2011 17:36

 / FROM THE LAB

E01, that can then easily be used with any forensic tool of
your choice, EnCase, XWF, FTK and so on without any further
rebuilding. This is as opposed to imaging each disk separately
and then having to use XWF to piece them together as a RAID;
it’s all about providing options. My colleagues and I have had
great success in this area with XWF.
To rebuild a RAID, just add the images of your physical
disks, go to ‘Specialist > Reconstruct RAID System’, enter the
images in the order you suspect them to be (you can re-order
them as many times as needed), select the RAID type and then
the stripe size. If successful, a new evidence object will appear Figure 22. Cloning a disk
with your directory structure for the RAID.

/ Memory Analysis
If you capture the RAM of a running computer using a tool like
“DumpIt” (http://www.moonsols.com/2011/07/18/moonsols-
dumpit-goes-mainstream), you can add the image to XWF as
a logical image and it will recognise it as a memory image and
parse for you! You can conduct a header search for complete
files by again using the RVS feature.

/ Summary
XWF is fast, portable and powerful requiring minimal hardware
to run well and it’s a fraction of the cost of most mainstream
applications. Though powerful hardware is not essential
to run and use XWF, if it is used on powerful hardware with
plenty of RAM, it will process a case of dozens of images Figure 23. Preparing an XWF Evidence Container
containing millions of files and not even break a sweat.
Recently introduced features include the long awaited ability
to examine Microsoft Exchange e-mail systems (16.1-SR6 or
above recommended).
The X-Ways Software Technology team are hugely
responsive to feedback and ideas and generally respond to
support requests within a day or less (www.winhex.net) and
often provide individual replies to specific users who have
reported problems.
Once learnt, it is a tool for everyday forensics; more so than
most, in fact. Of course, you can also use it for all the in-depth
stuff, just as everyone knows.
It allows you to get things done quickly and effectively. Yes,
there is a learning curve to begin with that exceeds that of Figure 24. Adding files to an XWF Container
most forensic tools but only due to the immense features and
options provided. If you are reading this then you should not
be someone who is averse to learning. There is a saying in / Author Bio
the Linux community “When we are children, we look at the Ted Smith has been attached to HM
pictures. As we grow up, we learn to read”. In other words, just Revenue & Customs, Criminal Investigation
Directorate in the United Kingdom as a
because something is a little more difficult to use initially does digital forensics investigator for 9 years.
not mean we should shy away from learning how to use it at all. His work entails the examination of digital
I recommend the official training course delivered by evidence for a range of subjects from
X-Ways Software Technology AG that really enables you to various tax and VAT related frauds to the
importation of indecent images and other border offences.
use the tool at its best. Also, Jens Kirschner provides training He has sat on the committee of ‘F3 – The First Forensic
classes for budding XWF users; he delivered a course to my Forum’ since 2005 and has conducted in-depth studies
colleagues and I recently, and we were very satisfied with the of Linux cryptographic filesystems whilst conducting
standard of training (http://www.jens-training.com/). Other postgraduate education at Cranfield University
He is also a freelance photographer (www.
than that, the best way to learn anything is “by doing” so I tedsmithphotography.com) and, for fun, dabbles in
encourage you all to just keep using XWF, read the manual, programming. Contact him at [email protected]
and you’ll soon be hooked. /

56 Digital / ForensicS

DF9_53-56_X-Ways Forensics, Part 2.indd 56 20/10/2011 17:36

AD9117b 19/01/2010 12:49 Page 1

Forensic Computing
12-month student placements

Undergraduates: Postgraduates:
August 2010–July 2011 June 2010–May 2011

Shape your future

To find out more visit dmu.ac.uk/technology or contact us:
Technology Placement Unit
T: (0116) 257 7465/66
E: [email protected] AD9117B

DF9_57_Ad.indd 57 11/10/2011 10:43

 / FEATURE

CRYPTANALYSIS USING
DISTRIBUTED SYSTEMS
A project to create middleware for distributed cryptanalytic applications
by Charmaine Anderson & Stilianos Vidalis

/ INTERMEDIATE

N
ormally if you ask a person “what is a password?” all Computation to merge DNA with Frontier Grid. This product
they can tell you is that it is something you need to log is now used within the United States Ministry of Defence and
into a computer, email account or social networking various businesses across the country.
site. Although passwords are one of the most common
phenomena in the computing world, not many people can fully / Cryptanalytic Algorithms
appreciate what they are or why they are needed. Due to the different types of cryptography available, there
A password is a form of user authentication, they are are number of different attacks that can be used in brute-
assigned to a user through a ‘unique identifier’ (UI), such as a force applications:
username or email address, and are only associated with that
UI. The user is then able to input the UI and password, the • Ciphertext-only
computer or website will check these against each other and • Known-plaintext
decide whether or not they are associated with each other, • Chosen-plaintext (chosen-ciphertext)
which then allows or denies access. • Related-key attack
Within Windows, this is known as an NTLM or SAM Hash.
This is an encryption scheme created by Microsoft which There are a great variety of attacks that fall under the categories
will make a password ‘unreadable’. This is stored within mentioned above, some of the more popular attacks are:
the registry and/or SAM File (a username and password
storage file for every account on the machine); when a user • Differential Cryptanalysis (mathematical)
inputs the password, Windows will encrypt it and check it • Linear Cryptanalysis (mathematical)
against what has been stored. Under Linux, passwords are • Exhaustive Key Search (trial-and-error)
stored within the “.passwd” file (similar to the SAM File
found in Windows). There is one significant difference that separates hashes
There are many password crackers and brute-forcers that from all other encryption methods; in an encryption, it is
have been made available over the years, such as: possible to encrypt plaintext to ciphertext and back again,
whereas once plaintext has been hashed to ciphertext it
• Brutus is not possible to retrieve the original plaintext from the
• Cain and Abel resulting value. Therefore, mathematical attacks on these
• John the Ripper are not possible; the only attack that can be used is the
• L0phtcrack exhaustive key search.
• RainbowCrack Exhaustive key search is a term used by cryptographers,
otherwise known as a brute force attack. A simple description
However, these tools use the processing power from a of the attack is that it is “a trial and error method of trying
single node or computer in order to crack the passwords; every possible combination of characters against the
this can often become time consuming depending upon the encrypted data in an attempt to discover the key” (Cobb,
strength of the password under scrutiny. 2004). However, Ferguson et al. (2010) say that it is used on a
The solution to this is to utilise the method of parallelism “target object”, this is usually the key but the generalisation
found under the subject area of distributed systems. So leaves this open for other forms of data as well.
far, I have only come across a few tools which utilise this It is possible to say that this attack is a simple yet effective
method. An example is Distributed Network Attack (DNA), it method of cryptanalysis that is confirmed successful when
was created by AccessData in order to utilise the processing “the resulting plaintext is meaningful” (Schneier, 1996); on
power of many nodes for the purpose of speeding up the other hand, “in practice, a brute-force attack can be more
password and data recovery. After having some trouble complicated because incorrect keys can give false positive
managing the parallelism they teamed up with Parabon results” (Paar and Pelzl, 2010).

58 Digital / ForensicS

DF9_58-61_Cryptanalysis.indd 58 20/10/2011 17:36

 Figure 1. Example password files provided by hackinthebox.org

Paar and Pelzl (2010) also state “It is important to note Supercomputers can also be found under the title of
that a brute-force attack against symmetric ciphers is always distributed systems; although a supercomputer sounds like
possible in principle. Whether it is feasible in practice depends a single machine, it is in fact made of a variety of different
on the key space ... If testing all the keys on many modern components in a cluster. However, this method can be quite
computers takes too much time, the cipher is computationally expensive, therefore newer methods of distribution and
secure against a brute-force attack.” parallelism are being utilised across the globe. Grids and
It is for this reason that Schneier (1996) states that “without virtualisation are being used in order to reduce procurement
special purpose hardware and massively parallel machines, and power costs.
brute-force attacks are significantly harder” (Schneier, 1996). Over time, it has become the ‘norm’ to test crypto-systems
Cobb (2004) is able to back this up with her statement that using various methods of distributed computing and parallelism.
“in some cases, computers working in parallel can be more Providing more computational power to solve the various
powerful than one of the most powerful computers used by the algorithms and equations that are available enables researchers
NSA”. She also provides the example of RSA Laboratories RC5 to quickly and efficiently find weaknesses; which in turn allows
competitions when, in 1997, a ‘distributed computing effort’ for the recommendation of new and improved ciphers.
was able to crack the 56-bit encryption in less than 250 days.
/ Middleware
/ Distribution Using a distributed system to perform the complex
It is very difficult to define a distributed system; Oxford calculations works by taking a large task and splitting it into
Dictionaries (2010) use the definition of “a number of independent smaller, more manageable tasks for each machine to perform.
computers linked by a network”. Although this is true, it does not The results are then relayed back to a server and stored ready
explain the purpose. Professionals and practitioners in the area for the ultimate task to be complete. Middleware is used
argue that there is no single universal definition of a distributed in order to manage the smaller tasks and provide a reliable
system, there are too many grey areas that cause confusion; method of message passing between the nodes.
instead, it is best to define these through their properties: We are designing a multi-server distributed application,
which runs on a client-server environment and brute-forces
• Several independent ‘computational entities’ where each passwords. Brute-force refers to a style that does not include
has its own local memory any shortcuts to improve performance, but instead relies on
• Communication is made through message passing sheer computing power to try all possibilities until the solution
• Failure toleration of individual computers by the system to a problem is found. The application, named ‘Vrutos’, will
• The structure of the system may change during the be designed for implementation within a new Government
execution of a distributed program due to different kinds of initiative named ‘High Performance Computing Wales’, or
computers and network links existing on the system HPCW, in which 1,400 nodes across Wales will be utilised to
• Each computer has a limited, incomplete view of the system, create an easily accessible Network Grid; the aim of which is
and may know only part of the input to provide a high-performance computing infrastructure to
• There are different elements and objects of a program being education, businesses and a variety of research areas.
run or processed using different computer processors Vrutos is making use of a three-tier architecture. Three-tier
architecture introduces a server (or a “controller”) between
Distributed systems cover a wide variety of computational the client and the server. The controller can provide translation
networks such as the Internet or more localised computer clusters. services, metering services, or intelligent controller services (as
There are systems available that connect computers together to in mapping a request to a number of different servers, collating
work as one, traditionally for scientific or mathematical research the results, and returning a single response to the client).
that is far too complicated and time consuming for a single This three-tier architecture is part of the Multi-tier
machine to calculate in a reasonable amount of time. model, they are incredibly useful for flexible and reusable

59

DF9_58-61_Cryptanalysis.indd 59 20/10/2011 17:36

 / FEATURE

Figure 2. Summary of the RSA Labs RC5 Cipher Competitions

applications; by breaking an application up into tiers it The application can be controlled by the user to add or
is possible to modify specific layers as opposed to entire remove machines within the host pool; single-CPU machines
applications. The three-tier architecture that we used for the and hardware multiprocessors can be used. The ability to add
pilot consists of the following layers: and remove machines is an important feature of fault tolerance.
Applications running in the PVM may view the hardware
Presentation environment as an “attributeless collection of virtual
• Providing the user interface, processing elements” or the environment may be viewed
• Communicating with the middle layer, to allow for selection of appropriate hardware for specific
• Logic/Data Access: tasks. “The PVM system supports heterogeneity in terms of
• Authenticating the Clients, machines, networks, and applications” (netlib, 2011).
• Maintaining and managing history and back-up logs, The programming languages that are supported are C, C++
• Maintaining system and data integrity, and FORTRAN. New applications can be written using available
• Analyzing, fragmenting and assigning to nodes PVM libraries, or existing commercial software may be altered
brute-force requests. in order to support the use of PVM (the aim of which is to
utilise the shared resources within the virtual machine).
Data
• Consists of database servers / Benchmark
• Information is stored and retrieved RSA Laboratories held a number of competitions during a
• Improves scalability and performance ten-year period starting in 1997. There were different cipher
messages that each used an RC5 encryption key, the purpose
/ Experiment was to find the correct key by deciphering the message. The
In order to prove this concept, a research cycle was conducted keys for the ciphers increase in size, which in turn increases
to create the pilot application so that it could be tested the time taken to solve each:
against a benchmark. The pilot application was not designed Over the 10 years that the competitions were run, only 4 were
to break passwords, but instead to perform cryptanalysis on completed. Distributed.net is currently still running the 72-bit
a well researched cipher; this ensured that all features of the competition, having completed only 1.527% of the key search in
application were working correctly. March 2011; the time that this has been running has totalled 3,023
days so far with an estimation of a further 31,113 days before
/ Platform completion. The estimated completion is based on the number
After careful research and consideration it was decided that of keys that need to be examined (4.722 x1021) and how many
a Distributed Virtual Machine (DVM) would be used as the keys are examined per second (2.76 x1011), as this a volunteer
platform from which to work; an open source platform known distributed computing effort the number of keys per second varies
as Parallel Virtual Machine (PVM) was selected. depending on the number of nodes connected at any one time.
The terms DVM and PVM can be used interchangeably;
some may describe this form of middleware as Distributed / Test algorithm
Parallel Virtual Machine (DPVM). PVM is a project that aims RC5 is a block cipher designed by Ron Rivest in 1994, RC is
to create middleware for use in parallel computing; it is sometimes known as Rivests Cipher; it was given patent in
designed to “Allow a network of heterogeneous Unix and/or 1998 by RSA laboratories. It consists of variable parameters
Windows machines to be used as a single distributed parallel for block size, key size and number of rounds, presented as
processor... The software is very portable; the source code, RC5-w/r/b where w is the word size (not to be confused with
available free through netlib, has been compiled on everything block size), r is the number of rounds and b is the key length
from laptops to Crays” (ORNL, 2011). (in bytes) (Schneier, 1996). The number of rounds can range

60 Digital / ForensicS

DF9_58-61_Cryptanalysis.indd 60 20/10/2011 17:36

 anywhere from 0 to 255, while the key can be of length 0 to PAAR, C. & PELZL, J. 2010. Understanding Cryptography: A Textbook
2040 bits, the block size can be either 32, 64 or 128 bits. for Students and Practitioners. Germany: Springer.
RSA Laboratories (2010) have provided recommendations PARABON COMPUTATION INC. 2011. Distributed Network Attack
that a 32-bit block size is used only for experimentation Enterprise. [WWW] http://www.parabon.com/case-studies/
and evaluation, a 64-bit block size is used for a ‘drop-in’ distributed-network-attack-enterprise.html
replacement for DES, and 128-bit provides the best security; PERRIN, C. 2007. A little more about passwords. [WWW] http://www.
they also state that “such built-in variability provides flexibility techrepublic.com/blog/security/a-little-more-about-passwords/342
at all levels of security and efficiency”. RIVEST, R. 1997. The RC5 Encryption Algorithm. USA: MIT Laboratory
RC5 consists of three routines; these are key expansion, for Computer Science.
encryption and decryption. Key expansion is used for ‘user- RSA LABORITORIES. 2000. Frequently Asked Questions about Today’s
provided’ secret keys in order to expand them to fill a key Cryptography, Version 4.1. USA: RSA Security Inc.
table “whose size depends on the number of rounds” (RSA SCHNEIER, B. 1996. Applied Cryptography. USA: John Wiley & Sons, Ltd.
Laboratories, 2010). The key table is then used for both SECTOOLS.ORG. 2003. Top 10 Password Crackers. [WWW] http://
encryption and decryption. sectools.org/crackers.html
Encryption then consists of three different operations: integer THEPCSPY. 2005. Passwd Files. [WWW] http://thepcspy.com/read/
addition, bitwise XOR (exclusive or), and variable rotation. passwd_files/
Schneier (1996) describes rotations as “constant-time operations
on most processors” whilst a variable rotation is a “nonlinear
function”. The rotations themselves depend on both the key and
ENCRYPTION THEN CONSISTS OF
the data, therefore they are known as ‘data-dependant’. THREE DIFFERENT OPERATIONS:
RSA Laboratories (2010) state that “the heavy use of data-
dependent rotations and the mixture of different operations
INTEGER ADDITION, BITWISE
provide the security of RC5”, they also mention that these XOR (EXCLUSIVE OR), AND
data-dependant rotations help to defeat the attacks known as
differential cryptanalysis and linear cryptanalysis.
VARIABLE ROTATION
/ Conclusion
A pilot application to brute-force Windows and Linux passwords / Author Bios
via distributed computing and parallelism was created. The Charmaine Anderson was born in Harare,
application would be tested for functionality using a well Zimbabwe, immigrating to the UK in 1992.
She has recently completed a BSc in
researched cipher as a benchmark. Research was conducted in Forensic Computing from the University
order to discover the best tools and methods for an experiment of Wales, Newport, class of 2011. After
to be carried out. It was decided that the RC5 cipher was to be a key academic strength in the subjects
used, utilising the RSA Lab challenges that were run between of Mathematics and Computing, and
receiving a number of recognised mathematical achievements,
1997 and 2007; the application was created using PVM in C++ she has developed a very keen interest in cryptography
in order to use the exhaustive key search method of brute- and aims to pursue a career in the area. She is extremely
force. This pilot can then be developed in order to brute-force ambitious, with memberships to MENSA UK, Institute for
passwords found in operating systems such as Windows and Information Security Professionals, International Association
for Cryptologic Research, and the Chartered Institute for IT
Linux, for possible use within the HPCW initiative. / Professionals (BCS).

REFERENCES Dr Stilianos Vidalis was born in Athens,

BIC INNOVATION LTD. 2009. High Performance Computing Wales Greece, and was raised on an island ithe
Aegean Sea. He moved to Wales in 1995
Memorandum of Information. [WWW] www.bic-innovation.com/ where he did his undergraduate and
knowledge/download/162/ postgraduate studies. He received his PhD
COBB, C. 2004. Cryptography for Dummies. Indianapolis: Wiley in Threat Assessment in July 2004 from
Publishing Inc. the University of Glamorgan. He joined the
Department of Computing of the University
DISTRIBUTED.NET. 2011. Node Zero. [WWW] http://www.distributed. of Wales, Newport in 2006 where he
net/Main_Page/en is currently the Head of the Centre for
GHOSH, S. 2007. Distributed Systems – An Algorithmic Approach, Information Operations. He is the programme leader for the BSc
USA: Chapman & Hall/CRC. Computer Forensics, and BSc Information Security. Dr. Vidalis
is a member of the BCS South Wales Committee, a member
GRIFTER. 2002. SAM Files and NT Password Hashes. [WWW] http:// of the E-Crime Wales Steering Group, and a member of the
www.hackinthebox.org/modules.php?op=modload&name=News&fil Military Educational Committee of the Welsh OTC. His research
e=article&sid=5721&mode=thread&order=0&thold=0 interests are in the areas of information operations, digital
KOCH, D. KORBER, M. and TEICH, J. 2006. Searching RC5-Keys with forensics, threat assessment, and effective computer defense
mechanisms. Dr Vidalis is involved in a number of R&D projects
Distributed Reconfigurable Computing. Germany. with the Welsh Assembly Government, Law Enforcement
ORNL. 2010. PVM: Parallel Virtual Machine. [WWW] http://www.csm. Agencies, and private companies.
ornl.gov/pvm/

61

DF9_58-61_Cryptanalysis.indd 61 20/10/2011 17:36

 Maximise
Prioritise
Visualise

Call IntaForensics on 0845 0092600 for a demo and

to discuss how Lima’s end-to-end forensic case
management can work for you

tel: 0845 0092600

fax: 0845 0092601
email: [email protected]
web: www.intaforensics.com

DF9_62_Ad.indd 62 13/10/2011 15:44

 / FEATURE

DIGITAL ARCHIVING
AND DATA RECOVERY
The challenges facing a computer museum in their attempt to preserve and archive digital data
by Ronnie Smyth

/ ENTRY

D
uring World War II a manor house and associated huts The museum starts its history of computing with a rebuild of
in Buckinghamshire, England was home to the Gov- the very first computer, Colossus. Again, this was the machine
ernment Codes and Cypher School. This organisation that was developed in secrecy to crack the German Lorenz
developed into what is more commonly known today as the code. Next is the Harwell Dekatron computer or “WITCH” as
Government Communications HeadQuarters (GCHQ). Bletch- it became known. This is believed to be the oldest working
ley Park was the primary decryption centre for intercepted original computer in the world. It is a machine that was
communications from German and other Axis countries. The originally designed to process complex maths equations for the
work done here provided vital information for the war effort physics department and works using decimal based Dekatron
and saw phenomenal advances in technology including the valves rather than binary. Continuing on we move into the
creation of Colossus, the first electronic programmable digital mainframe era of computing when massive machines would
computer, designed to crack the German Lorenz codes. service multiple users at a time. As examples the museum has
a working Elliot 803, an ICL 2209 and currently in the process
/ The National Museum of Computing of being restored is an Elliot 903. Moving on from mainframe
Important work continues at the Bletchley Park site and computers we move into the personal computing era starting
is currently home to The National Museum of Computing. from the PDP8 through BBC microcomputers, Amiga, Spectrum,
Its mission is to preserve and archive the development Dragon, Atari and Macintosh. There are also examples of
of computing from the Colossus computer onwards for specialist machines designed to assist industry such as the Cray
future generations to enjoy. The museum is run entirely by Supercomputer, Air Traffic Control, and analogue computers.
volunteers on a shoestring budget with the aim to get as
many working examples as possible to create an interactive
experience rather than a dead box display.
THE WORK DONE HERE
So much can be learnt from the previous experiments in the PROVIDED VITAL INFORMATION
early days of computing when there were no standards and so
many different approaches were taken. It is possible that the
FOR THE WAR EFFORT AND SAW
next brilliant idea and step forward in computing is lurking in PHENOMENAL ADVANCES
one of these ideas but sadly at the time the technology was
not available to make it work properly. We are already seeing
IN TECHNOLOGY
a flow back to previous ways of thinking with the movement
from a standalone PC to working on the cloud. This is only
one step away from multiple dumb terminals working from a
single central mainframe computer. A further example is the
movement towards Solid State Drives, which is based on the
core memory storage technologies of the 60’s. Without the
preservations of these machines it would be impossible to
make the comparisons or learn from past experience. Often on
the very early machines we come across undocumented hacks
that have been developed by the engineers to get a little more
out of the limited technologies of the time. This makes it even
more important to preserve the original machines rather than
the associated documentation.

63

DF9_63-66_Museum Archival Project.indd 63 20/10/2011 17:37

 / FEATURE

All of these machines store data in some way that is

important to the heritage of computing and will be lost if we
are unable to acquire and archive what is stored on them.
The data recovery process for unique machines using non-
standardised techniques can cause major problems.

/ The Archiving Process

The archiving process is not too dissimilar to that of forensic
acquisition. Ultimately we are attempting to get an exact
copy of the media for the purpose of archiving and potentially
further research. Occasionally the media that we are working
on is the only remaining copy available and as a result it is
imperative that we take the proper precautions to avoid the has on it both digital data for the computer to process and
original being written to or damaged in another way. analogue data for the image on the monitor. For this example,
Often the media is decaying as a result of aging, and also a process needs to be developed that can interact with the
the hardware is not performing as well as it used to. As a specialised BBC laser disk reader and use it to extract both
result errors during the acquisition phase are not uncommon digital and analogue data, converting the analogue data into a
and require cataloguing, just as with evidence. A lot of the digital form that can be archived.
problems encountered by the museum are caused by the
lack of standardisation during the early developing years of / Ticker Tape Example
computing. With such a wide variety of hardware and media Early computer programs were stored on ticker tape or
all utilizing different protocols, different methods of storing punch card. These are literally either special post cards or
the data and a variety of different data standards; simply long strips of paper with holes punched into them to create
plugging a device into a write blocker are often not an option. binary sequences for computers (including mechanical
computers) to process. With both ticker tape and punch
/ Laser Disc Example cards being used to store both programs and data it is
As an example of the variety of media that is encountered at not as simple as capturing the ones and zeros (holes and
the museum let’s take the optical laser disc. This is the bigger paper) because certain sequences had a set meaning for
brother of the Compact Disc (CD) and is roughly the size of a specific machine and also the data being processed
a dinner plate. It is dual sided and holds roughly 200MB of wasn’t always numerical or text. This means that the
data. Originally intended to work with the BBC microcomputer context in which the tape or cards were being used is as
as part of the “domsday project”, the disc would be used to vitally important as the data itself. In order to capture the
display OS maps, text on area’s that have been highlighted data, specialist hardware has been developed which can
and display high quality photo’s which had been sent in and run through the tapes or cards at low speed, so that the
scanned by the BBC. This was quite literally “Google Maps” in original fragile paper is not damaged. Utilising light sensors
the 1980’s! Unfortunately the BBC microcomputers were not to detect the holes in the paper these can then be stored
capable of displaying the high quality images, and, as a work digitally. This digital data is then catalogued with the
around, the images were piped directly to the monitor. As a contextual data where available.
result, the laser disc containing the BBC “domsday project”
/ Magnetic Tapes & Disks
Magnetic tapes come in a wide variety of form factors and data
/ COLUSSUS REBUILD types. These have been the main form of backup and archive
To celebrate the rebuilding of a functioning Colossus a for a very long time. Unfortunately these multiple form factors
challenge was set in 2007 for anyone to try to decode a Lorenz means multiple types of hardware to read the individual tapes,
encrypted message. Colossus completed the task in about 3
which can be very expensive. Also due to the nature of the
hours 15 minutes, but Joachim Schueth using specially written
software and a laptop with 1.4 GHz CPU completed the job in media they are easily damaged, can become distorted and
46 seconds. As Schueth said: “My laptop digested ciphertext generally loose the magnetic properties over time.
at a speed of 1.2 million characters per second – 240 times This makes the recovery of these the highest priority, just
faster than Colossus. If you scale the CPU frequency by that as in evidence you acquire the most volatile information first.
factor, you get an equivalent clock of 5.8 MHz for Colossus.
Luckily the cassette tapes used for home computing were
That is a remarkable speed for a computer built in 1944. Even
40 years later many computers did not reach that speed. So simply being used to store a sound wave and these can be
the Cipher Challenge would have been very much closer had it copied and stored as a sound file as long as the recording is
taken place 20 years ago.” a lossless file type. This makes the preservation of many 80’s
classics a lot easier.

64

DF9_63-66_Museum Archival Project.indd 64 20/10/2011 17:37

 / Emulation
It is pointless saving all of this digital data if we are not / Tony Sale
able to view and process the data in the form in which it Sadly during the writing of
was originally intended. Whilst every effort is being made this article the Co-Founder
of The National Museum
to preserve and maintain the aging hardware it is inevitable Of Computing, Tony Sale,
that some machines will simply become inoperable without sadly passed away. Born in
serious and costly refurbishment. Even this may not be 1931 Sale was a talented
viable in some cases. As a result there is a requirement for engineer from an early age.
Unfortunately he was unable
the creation of emulators that are capable of processing and to fund a university education
running the programs as they were originally intended. These and so chose to join the
programs need to accept input from whatever format has been Royal Air Force. He quickly
used to archive the data and process it in the same way as gained his commission and
the rank of Flying Officer and began lecturing on radar. He
the original hardware. This is a long-term goal and the priority went on to join Marconi’s Research Laboratories in 1952. From
should always be to preserve both the machines and the data 1957 he joined MI5 and ultimately became their Principle
that we have first. Scientific Officer, specialising in communication interception.
Throughout the 70’s and 80’s Sale created several successful
software companies as the software industry was in its
/ Storage infancy. It was in 1989 that Sale first became involved in
Once we have managed to extract the data into a format that computer restoration when he was employed by the Science
can be processed by a modern PC, we have to catalogue Museum. He used his position there and his active role
the information and store the data in a format that will within the British Computer Society to create the Computer
Conservation Society. The society’s role is to preserve and
be accessible for many years to come. There is no point restore historical computers and software.
in extracting the data if it cannot be used, searched and In 1991 Sale began the campaign to save the Bletchley Park
process. In the not too distant future there will be historians site that had been earmarked for redevelopment. Recognising
who will want to study computers and the development of the importance of the site in the history of World War II Sale
wanted the story to be saved and told to the nation. In 1993
computers who may well want the original data in the original he embarked on the formidable challenge of rebuilding the
format for comparisons. The storage problem comes in two classified Colossus computer that was used for the decryption
parts. Firstly it is important to have a standardised format of Lorenz encrypted messages of the German High Command.
for archiving. Archiving is a very costly business in terms of In 2007 the Colossus was finally completed and became the
centrepiece of the Bletchley Park experience. 2007 also saw
both time and the amount of storage. Also the archive must the opening of the National Museum of Computing based in
be correctly catalogued to enable the recovery from the Bletchley Park of which Sale was a founding member and
archive. This archiving format must have the foresight to be trustee. He continued his work with the museum until the end,
almost ever expanding and also take into account the scale of proudly presenting the Colossus computer to the many tours
that visited Bletchley Park and The Museum of Computing. We
data archiving in the future. Whilst the museum is currently hope that the museum can continue that fantastic work that
archiving media megabytes in size, it will not be long before was started by this remarkable man.
the requirement expands to gigabytes and beyond as today’s
computers become “relics”.
To help reduce costs, lossless compression is a
requirement, and from a cataloguing point of view metadata
should be used to store information such as the original
hardware format, the file format, and hash of the original data.
The second issue with the archiving and storage of data is
the media that is used to hold the archives. A large amount
of time is spent by the museum attempting to access data
from media that has degraded over time, utilising hardware
that is not performing as well as it used to. There is little to
suggest that today’s archiving media will not suffer the same
fate. The aim of the archive would be to preserve the data for
future generations and so something that will fail in 50 years
time is not acceptable. In an ideal world a medium would
be found that simply does not degrade and is cost effective.
As an alternative it might be the case that a medium is used
that requires periodic maintenance to ensure good data
retention. For example I would not trust a hard disk that had
simply been placed in storage for 50 years not to seize up and

65

DF9_63-66_Museum Archival Project.indd 65 20/10/2011 17:37

 / FEATURE

/ ENIGMA
Colossus is often misquoted as being used to crack the enigma
code. Whilst the enigma code was being cracked at Bletchley
Park using the bombe machines, Colossus was being used to
crack the much more difficult Lorenz code. The Enigma was
based on a 3 wheel rotation. After every key stroke the lower
wheel would rotate around a single step. Once in every 26
steps of the first wheel changing it would engage with the
second wheel and the second wheel would rotate. The third
wheel would have the same mechanism with the second
wheel. In the later years of the war the German navy used an
enigma machine with 4 wheels. With every rotation it would
change the pathway through the machine and therefore
the outputted letter. The Lorenz codes worked on a similar
principle but with an encryption machine of 12 wheels making
it far more difficult to crack.

remain in alignment. However if the hard disk was powered techniques. Within this time the standards for backups
up and a read and re-write was performed then I would have may have changed multiple times and the backup media
faith in the medium and any failing devices could be cycled may have degraded. With the higher assurance required of
out. Ultimately as part of the maintenance schedule the data evidential integrity we might find that the backup media that
could be moved on to the larger and better backup systems. are currently in use are not suitable for long-term storage.
A further advantage of a hard disk is it modular design. If There is a requirement for an archiving standard to provide
the main PCB fails it is possible to replace it with another future proofing. This archiving standard should allow for
working PCB. If the heads fail it is possible to replace those easy emulation and lossless compression. There is also
or alternatively if it is found that there is a greater problem is requirement for a tested and trusted medium for which
then the platter could be removed. At all stages the data has the backups should be stored on. This medium should be
a reasonable chance of being recovered should the worst easy to interact with, have well defined standards, be easily
happen, thus preserving the data for future generations. maintainable if maintenance is required and have a modular
approach to assist in data recovery should it be required.
/ Copyright
Copyright laws have posed a problem for the archiving of / Conclusion
digital material for a very long time. This is especially so in the As you have seen there are many challenges being faced in
museum where we are attempting to archive the programs the archiving and preservation of digital media. Whilst many
rather than the data. The current copyright law is based upon of these issues have been resolved through standardisation
the law that has been applied to written works and in some of hardware key questions still remain about how best to
cases musical copyright. This has never really suited the preserve and archive digital material. This has impact on
requirement for digital media and has been very restrictive. digital investigations that are expected to preserve and store
Further complications arise as to who owns the copyright. digital data in evidentially sound conditions for extended
With software companies being acquired all of the time periods of time. These questions require answers now to avoid
and many software companies going bankrupt it is almost serious problems in the future. /
impossible to trace the ownership of the code. Luckily this has
been recognised in parliament and new legislation is being
proposed to exempt museums from copyright liabilities for the / Author Bio
purpose of archiving. Ronnie graduated from De Montfort
University with a First Class Honours in
/ Archiving Evidence Forensic Computing. During that time
he also worked for CY4OR as a Forensic
Whilst this article has focused on the current difficulties faced Computing Technician. He is currently a
in digitally recovering and archiving data from old machines research student at the Centre of Secure
there is a direct implication for the ways in which the industry Computing within De Montfort University
stores its digital evidence. It isn’t unforeseeable that in working towards a PhD. He is also a member of the Royal Corp
of Signals where he is involved in transmitting encrypted data
the future we may be required to reinvestigate computer
for UK Operations. In his spare time he is a volunteer at The
evidence from more than 30 years ago, just as today cases National Museum of Computing.
are reinvestigated due to new evidence or new processing

66

DF9_63-66_Museum Archival Project.indd 66 20/10/2011 17:37

 / NEXT ISSUE

COMING SOON…
A Roundup of Features and Articles for Issue 10

T
he next issue is focussing on mobile phone forensics. The release of many operating systems and the almost weekly
release of new variants, coupled with the ever expanding capabilities of the mobile device make the field of mobile phone
forensics more and more exciting. Here’s what’s coming in Issue 10:

/ Investigating the iPhone 4S

Sean Morrissey looks at the iPhone 4S and looks at what is in
store for those who are tasked with investigating these devices.

/ Challenges in Obtaining Information from

Mobile Devices for Criminal Investigations
In this feature article David Bennett looks at dealing with
the various types of mobile devices that have large storage
capacities and the challenges for forensics experts in
gathering information from the devices for use in criminal
investigations. The paper describes various forensics tools,
law challenges for the forensics examiner such as the Fourth
Amendment, and chain of custody issues that a forensics
expert could endure while gathering info from mobile devices.

/ Advanced Forensic Analysis

on Windows Mobile Systems
Raffaele Olivieri takes a look at how in the last few years
the market for hand-held devices has experienced explosive
commercial growtrh. As a consequence, their use in criminal
activities has also grown. The forensic investigation techniques
applied to phone devices have, therefore, become an
important aid to law enforcement. In this paper, we adopt a
newly introduced technique based on RAPI Tools to extract
information from the system registries and the databases of a
Windows Mobile based smartphone.

/ Chip-Off Forensics
This article is about the practice of forensic investigations – NEXT ISSUE PUBLISHED
when chips have been removed from the circuit boards, the
investigation becomes a complex and technically challenging FEBRUARY 2012
one. Some of the following areas will be covered; what it is,
how you do it, problems encountered and solutions found. Note: DFMag may change the planned
content of future issues without notice.

/ Security Testing in Real Time Systems

This feature article by Peter Wood is all about the perils and
pitfalls of security testing in Real Time Systems. Using case
studies, Peter identifies what can go wrong if security testing
is not carried out correctly.

PLUS
All of our usual features: Apple Autopsy, 360, IRQ,
Robservations and Legal news & alerts.

67

DF9_67_Next Issue.indd 67 21/10/2011 10:10

 / FEATURE

SIFTER10
PROBES
A successful new approach to building
Deep Packet Inspection devices on
High-speed networks
by Mark Osborne

/ ADVANCED

T
his article describes the current strategies for performing
Deep Packet Inspection functions for security and network
management on high-speed networks; it illustrates the
significant drawbacks of these methods. The paper introduces
CyberSifts’ HANAC architecture and the patented massively
parallel search technology Dynamic Parallel Inspection.
You don’t need to be a technologist to realise that network
usage is escalating rapidly. Smart phones, mobile broadband,
WiFi and high-speed, even fibre-optic broadband in every
home is the cause of this network phenomenon. This massive
demand for cheap network capacity has caused a technology
convergence away from expensive, legacy technology so that
most large backbone networks within network providers,
telecoms companies or large corporate and utilities use TCP/
IP on high-speed 10 Gigabit Ethernet (Gbe).
However, as these technologies have become more ubiquitous,
so has their abuse, whether from malware/spam/phishing, DDoS
attacks, terrorism and or copyright infringement. In the last year
or so, there has been an increasing volume of regulation both in
US and Europe encouraging network providers to counter these
threats to the network economy.
But many practitioners are finding that at the higher
network speeds of 10Gb/s, 40Gb/s or even 100 Gb/s, the
traditional PC server based SPAM/AV UTM appliances, Web
filters and IDS simply can’t keep up; they are just too slow.

/ The problem
How can this be when 10Gb/s routing and switch hardware is
so plentiful and cheap? The answers are the same old story for
IP based networking; it is easier to send (or route) a packet in
the IP/Ethernet world than it is to secure it. Correspondingly,
the devices doing this security work need a lot more muscle.
Most of the security tasks described above, like SPAM
protection or Intrusion monitoring require Deep Packet
Inspection technology. Fundamentally, this means processing
every byte of the transmitted packet and comparing it to a
database of a 1000 security vulnerabilities – whilst a router
typically has to compare the four bytes of the packet address
to usually a much smaller routing database.

68 Digital / ForensicS

DF9_68-72_Deep Packet Inspection .indd 68 20/10/2011 17:37

 Typically, PC based software security products like Web
filters or IPS work at speeds of up to 1 Gb/s. After this
point, the supervising operating system uses a massive
amount of resource simply moving data packets from the
NIC into memory where the application can process it. Yet
the sad truth is the majority of these “costly packets” are
of no interest to the application. In fact, it is highly likely
the first act of the system will be to read the packet and
then immediately reject it. For example, if our application
is a simple web filter, it will only need to process HTTP
GET requests on TCP port 80. On an average 10Gb/s link
over 90% of the packets will be outside this population.
Unfortunately, our application has to sort through this
majority of uninteresting packets sequentially to find the
packets that meet its processing needs. In doing this, at
10 Gb/s, the typical operating system and application
collectively will drop the majority of the packets.

/ Strategies for 10Gb/s or 40Gb/s

To overcome this problem, vendors usually adopt one of
two strategies:

• A Total Hardware solution;

• Use an Enhanced Network card;

/ The Total Hardware solution Figure 1. Interface Colouring as a solution

The Total Hardware solution often can cope with the speed
and volume of the traffic. Many vendors have developed between these different interfaces and programs makes it
hardware-based solutions to a number of security and clumsy and unmanageable
management issues in the 10Gbe or 40Gbe space. Their Over the last few years a more successful hybrid
disadvantage is that they tend to be very expensive as each approach has been developed where packets can be
of them is based on bespoke, unique ASIC architecture, and blocked or forwarded completely within hardware. In other
because of the burnt-in nature of this type of device they are cases, where there is a need for sophisticated server based
hard to change. This makes them unsympathetic to modern analysis software, our hardware reduces computational
applications as protocols and their exploitation (benevolent or load by either passing only the selected packets to the
malevolent) generate a fast moving environment. application (based on layer 2-7 DPI) or by sharing the
This type of solution is effective but unattractive; it holds no computational load by producing traffic metrics and counts
utility advantage, as it is a “one box, one function” solution. on behalf of the application. In this way a platform has
Any CTO that invests in a security solution of this type is been developed that offers complex hardware functions
unlikely to be rewarded with better usage information (for to an application, in the same way the Unix kernel offers
example) as a reward. services to any application.

/ Enhanced Network cards / HANAC

Alternatively several vendors push a 10Gbe enhanced The Sifter10 range of probes are advanced appliances
network card, these cards are highly advanced; using a combining powerful server technology, state of the art
variety of techniques such as polling & zero copy drivers, software and revolutionary Hardware Assisted Network
mutli-channel PCI interfaces, multiple DMA buffers and Application Co-operation (HANAC) support. HANAC provides
interface colouring. However, their main objective is to full Deep Packet Inspection (Layer2-7) plus Packet filtering,
move as many packets from the wire into memory as Counting/Classification and Redirection in hardware at full
possible. These can overcome in the short term many of line-rate with an extremely low latency before any resource on
the problems of operating at high speed. the server platform is utilised.
Basically, these cards help the PC server cope with Using this approach the probes break the paradigm of
volume of traffic by shifting different traffics types to a serialisation and allow bespoke packet-processing hardware
number of distinct virtual network interfaces. As shown to run in parallel with complex Intel CPU based applications.
in figure 1, different processes then can be presented This can extend the useful life of your software assets or allow
packets at a rate their programs can handle. However, you to develop flexible Linux packet applications without the
over any period of time the task of balancing traffic need to develop special hardware.

69

DF9_68-72_Deep Packet Inspection .indd 69 20/10/2011 17:37

 / FEATURE

Each of the inspection rules, which are embedded in the

execution units, can be changed dynamically. As new needs
emerge, new rules can be written and pushed into the units.
This can be done online, on the fly, or offline. In fact, these
rules can be changed in a production system and are applied
in less than 1/1000th of a second. During the application of
new rules, the system will maintain all state and continue to
apply all existing rules without interruption.
By splitting analysis rules into many discrete engines that
can run on the same data in parallel, and by embedding these
rules in the gates of an FPGA, we can achieve record-breaking
inspection throughputs of 14.88 million packets per second.
By using true hardware separation from the action
engines, there is isolation between action processing and
signature inspection logic performance. This leads to identical
performance, identical throughput, and identical latency with any
traffic load, and under full use of the system’s analysis policies.
The probes can also track state for each flow through
the use of an external memory table. This memory table
provides very high performance state memory management
to handle up to 300,000 new flows per second (10x better
than traditional firewalls), and up to 8 million concurrent
stateful flows.
The power of HANACs’ processing capability makes it a
flexible and utility platform, with a number of deployment
strategies that can be used individually for simplicity or
Figure 2. Data Stream Processing combined for sophisticated, near intelligent applications.

/ The N-tier Architecture / Deployment

Most network security and network control applications are The probe can be deployed in three typologies.
extremely parallel in their nature. For example URL filters
which check a packet for a specified URL against a blacklist • Static in-line
of 1000s or a SPAM filter, which examines an email for a list • Passive monitoring
of 1000s of blocked addresses. None of these tasks need • Advanced Co-operative processing
to be done in a serial manner (only split into one or two
concurrent tasks), this has been forced upon us because of /Static in-line deployment
the way most general-purpose computers function. It works In this scenario, users deploy the technology mainly as an
because general-purpose computers are relatively fast but alternative to a hardware appliance, where the primary
with the emergence of faster networks, the relative speed requirements are for speed and the filtering functions can
advantage of general-purpose computers has been eroded. It be specified in a static rule set and there is no need for
would be much better if the comparison work were distributed interaction with software on the host.
simultaneously amongst numerous simple processors.
This is known as a Multiple Instruction Single Data (MISD)
computational model. Using this paradigm, one data record
is shared amongst multiple computational units, each
executing different instructions on the same data. The HANAC
architecture uses this model with a patented inspection
process called Dynamic Parallel Inspection. This massively
parallel processing technique manipulates data packets into
1024 bits units and distributes them inside multiple separate
processors. Thus a large number (thousands) of simple
execution units share the data and concurrently implement
different packet matching operations.
In Figure 2, the data stream is concurrently presented to a
number of execution units (Rule 1, Rule 2, through Rule n).
Each unit is responsible for independently performing wire-
speed packet processing and outputting a number of signals.
Figure 3. Layer 1 active bridge processing

70 Digital / ForensicS

DF9_68-72_Deep Packet Inspection .indd 70 20/10/2011 17:37

 The physical network interfaces (PHY) on the Sifter10
range are provided in the form of two full duplex 10 Gigabit
pluggable XFP “sensing” modules. As shown in Figure 3,
data signals received from one PHY are directly transmitted
to the other PHY unchanged, creating a Layer 1 bridge with
latency less than 1μ second. An FPGA “forwarding engine”
controls this process and can block any packet based on the
signature patterns.
When configured in this way, the probe is a “stealth mode”
device, implemented entirely at the OSI layer 1. There is no MAC
address, or need for any layer 2/3-topology changes – making Figure 4. Snort Benefiting from Our Technology
implementation simple and detection practically unlikely.
As the device is implemented as a bump-in-the-wire,
the card has been designed to withstand host failure; for
example traffic forwarding will continue in the event of
a hard drive failure or operating system panic. However,
given the modern day requirement for five nines (99.999%)
availability, we have developed implementation scenarios
that take advantage of Linux clustering technology to
provide uninterrupted service.

/ Passive monitoring
The features of HANAC are impressive, but they have been Figure 5. Snort Benefiting from Our Technology
implemented in Linux as a normal network driver. This means
that you don’t need to learn a whole book of commands to
use it; the standard ifconfig that is used for a normal Ethernet THE SIFTER10 RANGE OF PROBES
card works just fine (Note – there are also a full set of web
and gui based management tools for those that don’t like the
ARE ADVANCED APPLIANCES
command line) COMBINING POWERFUL SERVER
Also because the hardware appears as an NIC and uses
standard driver module conventions, we don’t require a
TECHNOLOGY, STATE OF THE ART
special version of the network capture library (libpcap) and we SOFTWARE AND REVOLUTIONARY
have no unusual restrictions on its usage or serialisation. This
means the probes can run virtually any popular, proprietary
HARDWARE ASSISTED NETWORK
Linux or Open-source network applications at these much APPLICATION CO-OPERATION
faster speeds. The bottom-line: you can use free/cheaper/
better tools on your carrier class networks.
(HANAC) SUPPORT
For example, everyone’s favourite open-source software
IDS, Snort, is designed primarily for enterprise networks Without HANAC, the effective bit rate measured at the Linux
and is a typical example of a high quality monitoring interface is about 3.5 Gb/s because some have already been
application. Normally, it can monitor a few hundred lost by the operating system and the hardware. With HANAC,
megabits of traffic with a standard NIC [1]. Using HANAC’s the interface only receives the pre-selected packets, which in
pre-emptive selection technique, Snort can monitor a this case produce a traffic rate below 200Mb/s, well within the
full 10GBps of traffic without modification or the need for safe operating range of most software applications.
clumsy load balancing across the interfaces.
Figure 4 shows attack detection by Snort under increasingly / Co-operative processing
higher loads. Notice that without HANAC, as the packet rate In addition to extending the lifetime of your existing software
per second increases beyond a few hundred Mbps, Snort assets, the Sifter10 has a powerful programming API so
loses more and more attacks, quickly becoming ineffective. advanced server software can task the hardware to collect
HANAC insulates Snort’s performance from extremely high network meta-data or programmatically modify access-lists to
traffic loads. block/forward particular types of traffic.
This isn’t magic; it is because HANAC is using full layer2-7 This cooperative model is exceptionally powerful as
deep packet inspection to pre-emptively select a population of it lets traditional software development technology be
packets or pre-qualify packets that Snort will be interested in. used to develop high-speed real-time network control
The other packets that are of no interest are not captured. This applications. Until now, these types of applications had to
keeps the effective data rate at the operating system much be developed in hardware or relied on indirect/inaccurate
lower and is shown in Figure 5. sampling techniques.

71

DF9_68-72_Deep Packet Inspection .indd 71 20/10/2011 17:37

 / FEATURE

As an example, network analysis and reporting software,

which detects resource abuse, can be coded with one API call
to detect the Top-n subnets sending traffic on a particular
link. Using another call to the API, the software can set an
access-list to capture all traffic from that subnet for analysis
purposes. A third could be used to block that traffic while
the server application analyses it and forwards it on another
regular Ethernet interface. Examples of these programming
techniques are freely available for download.
Using these techniques developing your own version of
NTOP would be a few hundred lines of code.

/ Packaging
As briefly mentioned above, the Sifter10 comes as a Linux
platform. It has Web based and GUI based rule management
software. This means straight-out of the box, it can be
deployed as a passive monitoring Snort IDS on a high-speed
10Gbe network.
The appliance can also be used to monitor up to about
ten 1Gb/s LAN segments using a hierarchy of aggregation
switches [2]. Also straight out-of-the-box, the unit can be
used as a hardware version of in-line snort. If the uptime is
a particular concern, high availability and cluster options
are available. For event management, the system is fully
integrated with Sguil. As an alternative, many customers
prefer the web-based software BASE.

/ Conclusion
More and more security and network professionals are using
utility hardware in conjunction with standard PC tools to solve
complex problems in a parallel manner but also in a cost
effective manner. CUDA the use of graphics card hardware is
another example of this.
The Sifter10 is the first product that is designed to enhance
PC software with hardware assisted massive parallel packet
inspection processing. It offers the discriminating user:

• The possibility to extend the life of software assets or allows

software vendors to launch their enterprise products into the
backbone market;
• The ability to implement high speed filtering and management;
• To deploy advanced value added features into your network,
reducing churn and increasing competitive advantage.

These opportunities allow a level of visibility into networks

not previously feasible or affordable; an attractive proposition
to those with 10Gbe backbones. /
/ Author Bio
REFERENCES Mark Osborne ran the KPMG security
Kerry Cox and Christopher Gerg, Managing Security with Snort and practice for many years (1993-2003). He
has published several Zero-Day security
IDS Tools. O’Reilly, 2004, pp. 226-227
vulnerabilities (e.g. Fatajack), and has
[2] Mark Osborne, How to cheat at Managing Information Security. also been an expert witness in the “cash-
Syngress, 2006, pp. 212-213 for-rides” case. Mark has designed the
popular open-source wireless IDS/IPS
(WIDZ), as well as the largest Cyber Security System in Europe.
ACKNOWLEDGMENTS
He is the author of “How To Cheat at Managing Information
I would like to thank Livio Ricciulli and Ajoy Aswadhati for their Security”, which reached the Amazon.com Top-500.
sizable contribution to this paper.

72 Digital / ForensicS

DF9_68-72_Deep Packet Inspection .indd 72 20/10/2011 17:37

 / GET INVOLVED

GET INVOLVED
/ Authors / Technical Tools/Application Developers
As we continue to strive to bring you the latest happenings Have you created a tool or application that you would like to
in the world of digital forensics, we are on the look out for share with others? If so, then contact us immediately.
anyone who has a story to tell or something to share that Many practitioners develop their own tools and applications
would benefit the wider profession. to deal with specific situations that arise. Rest assured that
If you are… you would not be the only one who will meet that situation. So
if you are prepared to share your tools with others, we have
• researching a particular aspect of digital forensics established a tools download section on the DFM website.
• have developed a new tool that you would like to share All tools will come with the normal safety warnings
• been involved in a case that has raised specific issues regarding their use, and using our outlet will get you feedback
from your peers.
…then we want to hear from you.
/ Technical Reviewers
If you have already written an article that has not been Do you have the time and ability to technically review an
published or even one that has been published with a limited article or tool/application? Then we want to hear from you.
distribution and you would like a wider audience, we are At DFM we are always on the look out for people who are
happy to discuss its suitability for any of our publications: willing to carry out technical reviews of articles or tools/
applications. We already have a waiting list of vendors who
• Magazine would like us to provide a technical review of their products,
• Web White Paper if you would like to join our team of technical reviewers; then
• Newsletter contact us now.
Technical reviews will be published on the website and on
/Bloggers occasion in the magazine, with the review fully attributed to
If you want a slightly less formal outlet than the web site or the reviewers, if they so wish. You must not be a competitor
magazine, but still have something to say, we still want to hear or employee of the vendor who is supplying the technology
from you for the DFM Blog and/or newsletter, if you: for review, and you must have the skills and facilities to carry
out any review. This is ideal for universities or those who have
• have an opinion on a recent news item access to labs or those who have their own lab.
• a short story to impart
• need an outlet for your frustration / DO YOU WANT TO GET INVOLVED?
If you would like to get involved in any way, then drop us a line
We are looking to identify a number of you who would like or send an email to [email protected]
to be regular contributors to the Blog or maybe provide less providing a short biography and what aspect of DFM you would
formal articles for the newsletters. like to get involved with. We will then send you further details
on how to proceed, in the area you have chosen.
Join the virtual team here at DFM and “Get Involved”

Roy Isbell MSc IEng FIET FBCS CITP

Acquisitions Editor
Digital Forensics Magazine
Visit www.digitalforensicsmagazine.com
Supporting the Professional Computer Security Industry

Digital Forensics Magazine bridges the

gap between the researcher and the
practitioner… It is a well-known fact that
some of the best learning comes from
“on the job” experiences

73

DF9_73_Get Involved.indd 73 20/10/2011 17:37

 Digital
ForensicS
/ magazine

BACK ISSUES
Digital Digital
The Quarterly Magazine for Digital Forensics Practitioners The Quarterly Magazine for Digital Forensics Practitioners The Quarterly Magazine for Digital Forensics Practitioners The Quarterly Magazine for Digital Forensics Practitioners

HAPPY 1ST Competition! Competition!

BIRTHDAY!

ForensicS ForensicS
Books, books and Win one of 3 copies of
yet more books… WinHex Professional

ISSUE 05 ISSUE 06 ISSUE 07 ISSUE 08

/ magazine / magazine
1 NOVEMBER 2010 1 FEBRUARY 2011 1st may 2011 AUGUST 2011

INSIDE INSIDE INSIDE INSIDE

/ Scott Zimmerman on / Scott Zimmerman ON / bill dean on detecting / e-Discovery Tools
Chain of Custody Search & Seizure commercial grade spyware / Image Processing
/ Survey Results / Wi-Fi Forensics / cell site analysis / Hacking the Cloud
/ Criminal Profiling / Criminal Profiling / imaging a macBOOK air / Digital Forensics
/ Ethics In Computer COMPETITION! / Operational Forensics / advanced cyber probes in Sri Lanka
Forensics Bundles of goodies for on the Mac
our Anniversary Issue!
Competition!
Win copies of Kuiper
Forensics Peerlab

TRAINING & GENETIC

EDUCATION
ISSUE ALGORITHMS
& DIGITAL FORENSICS LATENT
LAW ENFORCEMENT
CYBER SECURITY
Tim Watson looks at the way that genetic
algorithms can be used in forensic tools SEMANTIC
TRAINING
Bev Nutter analyses the digital forensics challenges 04
SITUATIONAL AWARENESS
Ian Murphy looks at how Digital Forensics techniques 01 02
INDEXING
Dr Michael R Taylor explains why
conceptual search is vital in the 03

and training requirements for law enforcement & tools are used as a result of Situational Awareness analysis of large multi lingual
9 772042 061103 9 772042 061110 9 772042 061110 9 772042 061110
Issue 5 / £11.99 TR Media Issue 6 / £11.99 TR Media Issue 7 / £11.99 TR Media
data sets Issue 8 / £11.99 TR Media

/ REGULARS / INTRODUCING / Book Reviews / FROM THE LAB / REGULARS / INTRODUCING / Book Reviews / FROM THE LAB / REGULARS / FROM THE LAB / INTRODUCING / Book Reviews / REGULARS / FROM THE LAB / INTRODUCING / Book Reviews
LEGAL NEWS, 360, Sean Morrissey’s brand 3 great books from Frazer Lewis on LEGAL NEWS, 360, ROB LEE’S brand new Dissecting the Hack George Bailey on more robservations, 360, peter jones looks our new legal editor hacking the human robservations, 360, Ted Smith looks at our new FEATURE ON Digital Forensics
IRQ… AND MUCH MORE new column: Apple Autopsy Syngress and Apress Anti ForensicS Tools IRQ… AND MUCH MORE column: ROBSERVATIONS Pro-Pen Testing Netflow forensics news, irq & more… at cellebrite pa v2 scott zimmerman windows registry forensics news, irq & more… X-Ways Forensics Biometrics & Forensics with Open Source Tools

DF5_OFC_Cover - Online.indd 1 2/11/10 08:00:27 DF6_OFC_Cover - Online.indd 1 29/01/2011 15:22 DF7_OFC_Cover - Online.indd 1 20/04/2011 17:57 DF8_OFC_Cover - Online.indd 1 22/07/2011 10:09

Issue 5 Issue 6 Issue 7 Issue 8

November 2010 February 2011 May 2011 August 2011

/ The Ideal DF Course / Imaging Tool Performance / Genetic algorithms / Latent Semantic Indexing
/ Training in Law Enforcement / Netflow Forensics & digital forensics / E-discovery tools
/ DFM Training Survey Results / Cyber Security / Commercial grade spyware / Image processing
/ Mac Forensics Training Situational Awareness / Cell site analysis / Hacking the Cloud
/ Ethics in Computer Forensics / WiFi Forensics / Imaging a MacBook Air / Digital forensics in
/ Certiifications and their Role / WARPS – a Framework for / Advanced cyber probes Sri Lanka
/ Criminal Profiling Timely Information / Cellebrite pa v2
/ Effectiveness of Public / Mac OS X Network Primer
Domain Anti-Forensics Tools / Criminal Profiling
/ Steganography Application
/ Artifact Detection

ORDER ONLINE
www.digitalforensicsmagazine.com

DF9_74_Back Issues Ad.indd 74 12/10/2011 18:38

 HANRATTY REVISITED
What should the legal system do it if the forensic evidence contradicts the bulk of other evidence?
by Rob Harriman

/ ENTRY

A
s a digital forensics practitioner you ‘accept’ the and brother and Hanratty’s exhumed body. Ultimately the
evidence presented to you by your tools; as they CCRC endeavours were declared by the Court of Appeal to
say “data cannot lie” as long as your methodology have made “a strong case even stronger” and the CCRC was
adheres to scientific principles, that is. Practising in the US criticised for bringing the case in the first place.
you will observe the ‘Daubert Principles’ [Daubert v. Merrell Yet why, if the case against Hanratty really was so
Dow Pharmaceuticals] so that yours will not be junk science strong, did the CCRC refer it? If the forensic evidence flatly
testimony based on idiosyncratic, invalid, or unreliable contradicted the weight of evidence supporting Hanratty’s
science. Practising in the UK it may be that your concern is innocence how did the Court deal with this conflict? Most
with the weight of the evidence rather than the methodology importantly how careful was the court in 2002 in examining
you have employed. Wherever your location you are properly whether the forensic evidence justified its findings? When
qualified so that the court can have faith in the evidence you I started my analysis I underestimated how little real
present and for all those qualifications you are aware that information exists in the public domain, or how unhelpful
‘facts’ in the courtroom are rarely black or white. As Houdini, the FSS and the Court services would be to my investigation.
you extricate with integrity, from the intentions of lawyers Nevertheless a careful reading of the available documentation
with axes to grind while simultaneously explicating science raises a number of points calling into question the
and technology beyond the normal understanding of jury, surefootedness of the Appeal Court ruling.
judge and learned lawyer. Yours it is to capture truth in a
kernel and with forensics to focus the court upon it. The task
is Herculean, the wages of failure, hopes and reputations lost,
PRACTISING IN THE UK IT MAY BE
perchance life too. So it was not all that long ago in the United THAT YOUR CONCERN IS WITH THE
Kingdom that the directed gaze of the court extinguished the
life of James Hanratty.
WEIGHT OF THE EVIDENCE RATHER
This discussion is not about digital forensics directly but THAN THE METHODOLOGY YOU
focuses on DNA forensics. Nevertheless I hope you will find
it relevant, and thought provoking. The way that evidence is
HAVE EMPLOYED
collected, analysed and reported may have a serious impact
on the life and liberty of individuals and as such deserves all / So What Is This Case All About?
the care and attention we can muster and the avoidance of At approximately 9.30pm in August 1961 near Slough in
certainty where uncertainty exists. Buckinghamshire someone hijacked a car driven by Michael
I came upon the case of R v. Hanratty in 2007 when Gregsten and containing his lover Valerie Storie. About 9 hours
researching for an Honours degree in Forensic Computing. The later Gregsten and Storie were found in a layby. He had been shot
research remit was crime scene protocols and R v. Hanratty twice in the back of the head with a .38 Enfield revolver and was
seemed to provide fertile ground. In this particular case it dead; she was alive but had been raped and shot five times.
appears that due to the intent of the court to focus on one Since Hanratty’s execution for the murder of Gregsten, and
particular aspect of the forensic evidence presented to it that by inference, the rape and shooting of Storie copious copy
other highly relevant and potentially critical decision altering has been produced highlighting areas of dispute between
information was missed. I shall leave it to you to decide if the those believing in Hanratty’s innocence and those believing
decision of the Appeal Court was correct. in his guilt. Elucidatory starting points are the BBC Horizon
Hanratty’s execution in 1962 elicited from the outset program “The A6 Murder” at http://www.bbc.co.uk/science/
claims of a miscarriage of justice. Finally the Criminal Cases horizon/2001/a6murder.shtml., HANRATTY- The Final Verdict
Review Commission (CCRC) in 2002 referred the evidence to by Bob Woffinden, or Paul Foot’s Who Killed Hanratty?
the Court of Appeal. The Forensic Science Service (FSS) in It is important to reiterate that the evidence was deemed
the UK conducted fresh DNA investigations using the latest convincing enough to persuade the CCRC to take it to the
techniques on a handkerchief in which the murder weapon Court of Appeal. For the purposes of this article I am just going
was found and on a piece of semen stained underwear. to concentrate on the handling of the forensic evidence within
Results were compared with DNA from Hanratty’s mother the investigations and by the Court of Appeal.

75

DF9_75-79_Forensic Uncertainty.indd 75 20/10/2011 17:38

 / FEATURE

According to Horizon the polymerase chain reaction “works

/ Caveat by subjecting the target DNA to intense heat, splitting the
double stranded DNA into two separate, single stranded
I was not granted access to any of the FSS records regarding
the case and nor would they answer my questions. Instead segments. As the mixture is cooled an enzyme called a
I was politely referred to the Court of Appeal Judgement for polymerase starts to lock on to each separated single
answers. Secondly I was not granted access to the transcript stranded DNA creating an exact copy of the missing half to
of the Court of Appeal hearing on the grounds of accessibility
make a new complete double stranded segment of DNA. Each
and costs. This means that where forensic facts or opinions are
not directly attributed within the Court of Appeal judgement, cycle of PCR doubles the target DNA. By repeating the process
whether they are attributable to the FSS, or represent the scientists can soon have billions of exact copies of the DNA
opinions of the judges is open to question. It also means that they want to test. The minute quantities of DNA extracted from
I am completely unable to satisfy my key aim of ascertaining both exhibits were subjected to 34 separate cycles of PCR
how much challenging of the forensic certainties had taken
place during the hearing by the judges or by Mr Mansfield, the
magnification and this time there were results.”
counsel representing Hanratty’s family and the CCRC. In April 1998 saliva samples were taken from Hanratty’s
mother for comparison with samples taken in November 1997
from her other son Michael. These confirmed that the DNA
/ The DNA Testing profile from the knickers almost certainly came from either a
The forensic evidence available at trial was seminal fluid son of Mrs Hanratty or a brother of Michael. At a much lower
on Valerie Storie’s knickers and on her slip, identified level of probability results showed it was a son of Mrs Hanratty
as being from a blood group ‘O’ secretor, which profile or a brother of Michael who had deposited the mucus stains
matched Hanratty’s taken from his trousers and that of the on the handkerchief (Court of Appeal Section 108, 2002).
other prime suspect Peter Alphon. Interestingly 40%-50% These variations in the levels of certainty ascribed to each
of the population is blood group ‘O’, of which 80% are exhibit are notable in light of the conviction with which they
group ‘O’ secretors (Woffinden 1997:152). As for Gregsten were previously ascribed to Hanratty and Dr Whitaker’s view
he was a group AB secretor establishing the semen did expressed here in the Horizon programme.
not come from him. A handkerchief found with the murder
weapon bore traces of nasal mucus (incapable then of “We calculated that it was 2.5 million times more likely
being analysed for blood type), and evidence based upon of obtaining the DNA profile from the underwear and the
comparison of hairs and fibres was inconclusive (Court of handkerchief if it had originated from a son of and a brother
Appeal Section 106, 2002). of Mary and Michael, as compared to somebody unknown and
In March 1995, according to Horizon, the FSS “scientists unrelated to them.”
knew that Exhibit 26 (the fragment of knickers) could
hold a vital clue to the killer’s identity, if only they could Since there appears to be no clarification in the public
resurrect DNA from the decayed 30-year-old evidence. domain as to how these statistics were arrived at I am unable
The tiny piece of fabric was immersed in sterile solution, to assess their likely veracity.
shaken and centrifuged. Chemicals were added to destroy On March 22nd 2001 the Forensic Science Service recovered
any cellular debris, the DNA rich fluid refined to produce a material from Hanratty’s teeth and profiled the DNA. The
clear, colourless liquid containing pure DNA. Each drop of findings again substantiated a match with the DNA found on
refined solution will usually contain hundreds of strands of the handkerchief and on the knickers thereby strengthening
DNA, but with evidence as old as this the question was if the the case against Hanratty. The Appeal Court placed the
minute amount of DNA extracted would be enough to create evidence from the handkerchief centre stage “it has been
a profile. Unfortunately no such profile was obtained at this possible for Dr Whitaker… to state with what a non-scientist
time (BBC Horizon, 2002). would regard as equivalent to absolute certainty or almost
In 1997 Exhibit 35 had emerged from police files. This was absolute certainty as makes no difference that the DNA profile
a man’s white handkerchief in which the murder weapon had recovered from the fragment of knickers and the DNA profile
been found. The scientists decided to renew their attempts recovered from the mucus staining on the handkerchief have
at DNA profiling, testing “the small remaining piece of come from Hanratty.” (Court of Appeal Section 109,2002)
fabric from the knickers (part having been used in the 1995
experiment), a piece of material from one of the slips and the / Key Dates
areas of staining from the handkerchief ” (Court of Appeal Unfortunately that is all the evidence in the public domain
Section 108). According to Horizon “They had failed two years regarding the testing carried out with little detail of the tests
earlier, but were now hopeful because of advances in a DNA performed and no information regarding the results that can
copying technique called PCR.” be subsequently verified by a competent forensic scientist.
This is slightly misleading in that it cannot mean the Nevertheless key dates in the development of DNA testing
introduction of PCR since the Cetus Corporation team had technology and comments published by the FSS in three
developed the first commercial PCR typing kit for forensic use fact sheets indicate the technology that would have been
(DQA1) in 1988. I must assume that it refers to the introduction available. Factsheet 1 entitled ‘What is DNA?’ provides the
of the SGM technique in 1995. timeline of developments:

76 Digital / ForensicS

DF9_75-79_Forensic Uncertainty.indd 76 20/10/2011 17:38

 1990 – Single Locus Profiling (SLP) replaces the less sensitive would expect two profiles, one from James Hanratty due to the
Multi Locus Profiling. contamination and one from the original killer.”
1994 – Short Tandem Repeat (STR) technique introduced So this is the forensic case against Hanratty as far as I have
1995 – Second Generation Multiplex used to generate the been able to ascertain, although how it was presented to the
first profiles for the NDNAD. It looked at (six STR Loci, plus Appeal Court hearing, must remain a matter of speculation.
a sex indicator area) to generate a profile. The average However a close reading of the Court ruling reveals some
discriminating power of a full SGM profile is in the order of one disquieting aspects to this case, as we’ll now see.
in fifty million.
1999 – June SGM Plus® replaced SGM testing. It looks at (ten / Considering the Handkerchief
STR loci plus a sex indicator area). The average discriminating The connection of Hanratty to the murder weapon consisted
power of a full SGM Plus is less than one in a billion. of his DNA found in mucus on the handkerchief enfolding
the gun when police found it under the seat of a London bus.
In Factsheet 2 the FSS states DNA Low Copy Number is Contrary to the conclusion of the court this merely proves
an extension of the SGM Plus profiling technique. It is more that he blew his nose on the handkerchief and does not prove
sensitive and enables scientists to produce DNA profiles from contact with, let alone deployment of, the murder weapon. No
samples containing very few cells even if they are too small to testing took place on the remainder of the handkerchief and
be visible to the naked eye. no test exists to determine the identity of the person wrapping
The FSS also makes the following interesting comments an already used handkerchief around a weapon.
about the LCN technique in Factsheet 6: To my amazement this lacuna seems to have been
overlooked by all participants; the judgement fails to consider
“As with all forensic evidence, the context and interpretation it and it is not mentioned in any other documentation I found or
need to be considered carefully. This is even more important with was permitted sight of. This is even more disturbing since the
DNA LCN, due to its sensitivity and the possibility that the DNA person who led the police to the seat in the bus was Charles
detected is unconnected with the offence under investigation. ‘Dixie’ France, with whom Hanratty often stayed. France, like
DNA LCN has the same discriminating power as the routine Hanratty was a low-level criminal and prior to the trial behaved
technique – about one in a billion. This means that if the DNA erratically, finally committing suicide days before the latter’s
found at a crime scene matched a suspect, then the chance of execution. No reason for France’s suicide is in the public
obtaining the profile if it had originated from someone other than, domain; still it is not infeasible that he ‘planted’ the gun where
and unrelated to that suspect, is approximately one in a billion.” it was found, in the knowledge that it was a hiding place used
by Hanratty to dispose of unwanted items after a robbery.
Note the important caveats regarding LCN highlighted in
the first paragraph of Factsheet 6. I’ll let you draw your own
conclusions regarding their importance to this case. THE WAY THAT EVIDENCE IS
On the basis of the above I assume that the test in March 1995 COLLECTED, ANALYSED AND
used the STR technique, with the 1997-1998 tests, including
those involving Hanratty’s relatives, using the SGM Plus® REPORTED MAY HAVE A SERIOUS
technique. The 2001 test on Hanratty’s remains is assumed IMPACT ON THE LIFE AND LIBERTY
to have involved the use of the DNA LCN technique, in light of
references to the minute size of the sample from his teeth. OF INDIVIDUALS
It is interesting that when testing Hanratty’s DNA against
the other samples the FSS claimed the DNA found on the The investigating officers do not appear to have openly
exhibits was hundreds of millions of times more likely to have considered the possibility of France’s duplicity, and though of
come from him than a random individual, and not definitely key concern to such as Woffinden and Foot it is unmentioned
from him. This implies that the testing of Hanratty’s DNA still in the Appeal Court judgement. Unavailability of full
just looked at the 10 STR loci and sex indicator area of the court transcripts again precludes certainty of the matter’s
SGM Plus/ Low Copy Number profile technique, hence the consideration by the court.
provisional status of the match. This is as opposed to the 13 Two spent cartridge cases from the murder weapon were
STR loci and sex indicator match of the CODIS technique used found at the Vienna Hotel in the Maida Vale area of London
in the USA or the greater discriminatory power of the 16 loci shortly after Hanratty stayed there. Oddly these were not
used in the recently developed Powerplex test. relied upon in the forensic case though there were claims that
they had been planted. Therefore their connection to Hanratty
/ Discounting Contamination may be legitimately considered no more than circumstantial.
Whatever testing was done the evidence convinced the Appeal So, as is clear this evidence is far from the conclusive proof
Court, not least because the FSS categorically dismissed the of Hanratty’s involvement with the murder weapon as claimed
possibility of contamination. As Roger Mann of the FSS put it by the Appeal Court judgement and for the court to conclude
“We only have one profile. That profile matches James Hanratty. as it did, then someone was seriously misrepresenting the
If that was a contaminant, if that was due to contamination we evidence involved.

77

DF9_75-79_Forensic Uncertainty.indd 77 20/10/2011 17:38

 / FEATURE

/ Considering the clothing

Regarding the evidence of semen on Valerie Storie’s slips / Dark times
and knickers, Hanratty’s trousers and the opportunities for The following is taken from the BBC Horizon, 2002:
contamination. In Section 106 and 114 Hanratty’s trousers
were described as semen stained when they were first DR JONATHAN WHITAKER (FSS): “PCR, or the polymerase
received at the Metropolitan Police Laboratory (MPL) on chain reaction, is a process that we use in the laboratory to
copy the bits of DNA that we’re interested in lots of times to
October 9th. On December 28th 1961 pathologist Dr Grant enable us to get enough DNA to generate a DNA profile. When
examined the trousers, the following day he examined the we generated profiles from the handkerchief and the knickers,
slip and knickers. A portion of the crotch area of the knickers the first observation we saw was that these DNA profiles
matched each other and this is what we would expect to find if
was removed and stored “as seems clear”, separately“(Court
they’d originated from the same person.”
of Appeal Section 116, 2002). One might ask whether it is NARRATOR: The same matching DNA profile appearing on
satisfactory to conclude the items were separated on grounds both exhibits meant that for the first time evidence had been
that merely seem clear. The possibility of transference is linked forensically, science suggesting that the person who
had raped Valerie Storie had also handled the murder weapon.
strengthened by there being no awareness of DNA in the
This is a critical over-statement as we shall see shortly,
forensic community in 1961, or of the minute amount of however, whether it has come from the FSS and was then used
cellular material required to produce a DNA sample. in the Appeal Court hearing by them, or whether it was the
At the trial which took place between 22nd January and interpretation of the BBC production team is unfortunately a
matter of conjecture.
17th February 1962 all the exhibits with the exception of a
ROGER MANN (FSS): The profiles in this case were very
portion of the slip and the fragment of the knickers referred rare, something like one in several hundred millions, so the
to previously were produced and taken out by the jury on chances of them coming from two independent people I would
retirement. The Court of Appeal (Section 117, 2002) states say are quite small, beyond reasonable doubt that they came
from the same person, I would say.
that on 9th April 1962 Hanratty’s clothing was returned to
NARRATOR: But for the moment that was all. Although
his father and on 22 May 1962 Valerie Storie’s slips, knickers scientists now had an exact DNA profile for the killer they were
and various samples were all destroyed. This does appear no closer to knowing who that person might be.
to be what happened to Hanratty’s trousers, but contradicts
that stated regarding Miss Storie’s slips at section 108 which
states, “However, in November 1997 after much consultation Although the laboratory records are not dated, the notes
further DNA analyses were commissioned this time using are numbered sequentially and we are confident that the
highly sensitive DNA amplification techniques. The test was knickers were examined almost immediately and in any event
conducted on the small remaining piece of fabric from the no later than 23 September 1961 when the notes show that
knickers (part having been used in the 1995 experiment), certain samples taken from Peter Alphon were examined at
a piece of material from one of the slips and the areas of the laboratory. The handkerchief came to the laboratory on 25
staining from the handkerchief.” August, was screened for blood and semen and, none being
found, seems to have been put to one side.”
(Court of Appeal Section 113, 2002)
ALTHOUGH MANY SCIENTISTS
HAVE SOME FAMILIARITY The judgement makes one further comment regarding the
highlighted point:
WITH STATISTICAL METHODS,
STATISTICS REMAINS A “With regard to the knicker fragment we have what
Dr Whitaker would describe as a typical distribution of
SPECIALISED AREA male and female DNA following an act of sexual intercourse
leading to the obvious inference that the male contribution
What happens thereafter to the slips material is not came from James Hanratty. For that not to be the case we
documented in the judgement. Testing subsequently only would have to suppose that the DNA of the rapist, also
takes place on the handkerchief and the piece of knicker of blood group O, had either degraded so as to become
crotch, which had been stored separately. undetectable or had been masked by James Hanratty’s
With regard to the semen stain on the knickers: DNA during the course of the contaminating event.
Moreover we would also have to suppose that Valerie
“The knickers arrived at the Metropolitan Police Laboratory Storie’s DNA had remained in its original state, or at least
(MPL) on 23 August 1961 where they were examined by Dr detectable, and had escaped being overridden by DNA from
Nickolls, the director and his assistant, Henry Howard. They James Hanratty. The same would have to be true of the DNA
were found to be stained with seminal fluid in the area of the attributed to Michael Gregsten. Finally we must visualise a
crotch and at the back for five inches upwards from the crotch. pattern which is wholly consistent with sexual intercourse
Vaginal fluid from Valerie Storie was also present. There were having taken place in which Valerie Storie and James
smaller quantities of seminal fluid of blood group AB assumed Hanratty were the participants.”
to have come at some earlier stage from Michael Gregsten. (Court of Appeal Section 125, 2002)

78 Digital / ForensicS

DF9_75-79_Forensic Uncertainty.indd 78 20/10/2011 17:38

 But what happened to Gregsten’s seminal fluid during the other form of expert evidence.” (Mahendra, B. The lawyers guide
course of the investigation? Why was no trace of this found to DNA evidence in criminal cases. New Law Journal, 152, p.1110)
during the investigations during the 90s? How had the cutting The relevance of these factors to the case is moot, but the FSS
of a piece from the crotch of Storie’s knickers removed any experts and the Court of Appeal appear to have overstated the
trace of Gregsten’s DNA and left the FSS investigators with certainty, when using a technique that is much more interpretive
their single male DNA profile, with which to discount any and subjective than has been credited in this case. /
chance of contamination?
Unfortunately I cannot answer these questions due to the
absence of court transcripts. THE SOCIETY URGES THE COURTS
TO ENSURE THAT THE STATISTICAL
/ Relevant considerations?
It is also worth bearing in mind the following: EVIDENCE IS PRESENTED
ONLY BY APPROPRIATELY
“Unlike modern forensic DNA analysis that can use
multiple nuclear DNA markers for identification, historic QUALIFIED EXPERTS
DNA cases are usually restricted to analyzing mitochondrial
DNA, which is more likely to survive degradation over time REFERENCES
due to its high copy number per cell (O’Rourke et al. 2000; BBC (2002) The A6 Murder (Horizon – Transcript) [WWW]. Available
Kaestle and Horsburgh 2002). Since mtDNA serves as a from: http://www.bbc.co.uk/science/horizon/2001/a6murder.shtml
single DNA marker, it has limited discrimination power.” – [Accessed 13/1/07]
~ “Extreme care should be taken when collecting and Court of Appeal Criminal Division (2002) Case No: 199902010_S2,
handling reference DNA samples from assumed living London [WWW]. Available from:
relatives. To control contamination, the reference DNA http://www.hmcourts-service.gov.uk/judgmentsfiles/j1166/
should be collected after the bone samples have been HANRATTY.htm – [Accessed 5/2/07].
processed and DNA-profiled.” Yang, DY. and Speller, Dror, IE. and Charlton, D. (2006) Why experts make mistakes. Journal
CF. (2006) Technical Tips for obtaining reliable DNA of Forensic Identification, 56 (4) pp. 600-616
identification of historic human remains. Technical Briefs In Foot, P. (1971) Who Killed Hanratty? London, Jonathan Cape
Historical Archaeology, 1: pp.11–15. Forensic Science Service (2007) Casefiles [WWW]. Available from
http://www.forensic.gov.uk/forensic_t/inside/news/casefiles.php –
This paper is referring to archaeological specimen [Accessed 5/2/07]
DNA, though I have been unable to find any authoritative Forensic Science Service (2007) Fact Sheets [WWW]. Available from
estimates of the expected levels of DNA decay from a human http://www.forensic.gov.uk/forensic_t/inside/news/documents/
body buried for 40 years. I would also remind the reader that DNA_Low_Copy_Number_000.doc – [Accessed 5/2/07]
in this case the reference DNA from the Hanratty family was Forensic Science Service (2007) Fact Sheets [WWW]. Available from
collected and analysed before that of Hanratty himself. http://www.forensic.gov.uk/forensic_t/inside/news/docs/What_is_
The possibility of human error in such interpretive activity DNA.doc – [Accessed 5/2/07]
is also rather more likely than may be acknowledged. “If the Mahendra, B. The lawyers guide to DNA evidence in criminal cases.
nature of the mind and cognitive processing can give rise to New Law Journal, 152, p.1110
error in fingerprint individualization, then these errors are Mason, D. (2002) The last word on Hanratty. New Law Journal, 152, p. 777
inherent to the domain. Nevertheless, they do not reflect a Sunday Mirror (1998) Frail mum is final key to Hanratty mystery.
basic ontological scientific flaw in the domain nor are they Sunday Mirror 26th April [WWW]. Available at:
the fault of a specific practitioner. They are, in essence, http://www.findarticles.com/p/articles/mi_qn4161/is_19980426/
epistemological problems that derive from the mechanisms ai_n14477222 – [Accessed 14/1/07]
of human cognition and the workings of the mind.” (Dror, IE. Woffinden, B. (1997) HANRATTY The Final Verdict. London, Macmillan
and Charlton, D. (2006) Why experts make mistakes. Journal Yang, DY. and Speller, CF. (2006) Technical Tips for obtaining reliable
of Forensic Identification, 56 (4) pp. 600-616) DNA identification of historic human remains. Technical Briefs In
There is one final caveat that is worth considering with this Historical Archaeology, 1: pp.11–15.
case. As has been seen from the limited information above the
FSS have stated the statistical probability of the DNA being
that of Hanratty as ranging from 1 in 2.5 million, through to 1 / Author Bio
in a billion. The Court of Appeal ruling makes no comment on Having spent over 30 years in the business IT world including
the various estimations. nearly 15 years focused on data storage technologies for the
likes of IBM, Perot Systems and Computacenter, Rob decided
However the Royal Statistical Society says, “Although many
to change career direction into the digital forensic arena and
scientists have some familiarity with statistical methods, recently graduated with a 1st Class Honours degree in Forensic
statistics remains a specialised area. The Society urges the Computing. He is currently researching and writing a book
courts to ensure that the statistical evidence is presented only whilst taking on the odd investigation.
by appropriately qualified experts, as would be the case for any

79

DF9_75-79_Forensic Uncertainty.indd 79 20/10/2011 17:38

 / BOOK REVIEWS

BOOK REVIEWS
Extrusion Detection: detailed introduction to network forensics and describes it as
Security Monitoring for being different from digital forensics in that it is focused on
Internal Intrusions packet capture, using tools such as Wireshark/Ethereal. The
emphasis here, however, is the network forensics is a valuable
Author: Richard Bejtlich and crucial part in the defence of a network infrastructure
Publisher: Addison-Wesley both from internal and external threats.
Date of Publication: Followers of Richard Bejtlich’s Tao security blog will
8th November 2005 instantly recognise his unique method of describing and
Price: £39.99 (UK), demonstrating the various tools and techniques required to
$54.99 (USA) put extrusion detection into practice. Throughout the book
ISBN: 978-0321349965 there are valuable diagrams, screenshots and actual packet
Reviewer: Willem Knot captures that help the reader to fully understand each point
Verdict: that is made, a feature that is often overlooked in many
security guides.
This book is a valuable read for anyone interested, or
Despite being over six years old now, this book is certainly not working, in the security and forensics industry. Betjlich provides
outdated in the slightest. While most network security books a refreshing approach to defensive methods and illuminates the
and guides would focus on perimeter defence from outsider potential damage of insider threats. Highly recommended as a
threats, Bejtlich concentrates on attacks launched within the partner guide to ‘The Tao of Network Security’, which together
organisation. At the time of publishing, this book was unique provide an ultimate guide to network security.
in its approach to defensive practices and is aimed to go hand
in hand with Bejtlich’s ‘Tao of Network Security’, picking up
where Tao left off and concentrating solely on defence, where XBOX 360 Forensics:
Tao started from the point of view of the attacker. A Digital Forensic Guide
First thing to notice about this book is the foreword by to Examining Artifacts
Marcus Ranum, which, unusual to most books, consists of
an interview with the author and highlights how different Authors: Steven Bolt
extrusion detection is from other network security guides. Publisher: Syngress/Elsevier
The book is aimed at all those who have an intermediate Date of Publication:
to advance knowledge of network security and so should be 7th February 2011
used by those just starting out in the industry, especially as Price: £36.99 (UK), $59.95
Bejtlich talks about tools and techniques that, at the time of (USA)
writing, were not common practices amongst professionals. ISBN: 978-1597496230
However, it holds great potential value as an addition to Reviewer:
anyone’s security/information assurance library. Willem Knot
Traditionally, the main focus of network security has Verdict:
been about keeping the hackers and malicious users out.
The book is split into three specific sections, Detecting and
Controlling Intrusions, Network Security Operations and XBOX 360 Forensics offers a fairly in-depth introduction
Internal Intrusions, taking the reader on a journey from into the world of games console forensics and the tools and
the reasons to look for extrusions through to the various techniques required to carry out investigations into next-
types of extrusion, such as malicious IRC Bots. Bejtlich generation games consoles.
uses various technologies, such as Proxies and IDS/IPS, as As popular gaming platforms become more and more
demonstrations using commands that can easily be adapted sophisticated, using their own operating systems and accessing
into organizations’ own technologies. the Internet for various types of transactions, the potential for
To those specifically interested in network forensics, Bejtlich illegal and malicious activity is dramatically increasing.
devotes an entire chapter to just this and discusses the links Bolt starts the book with a detailed description of the XBOX
between the security practices discussed throughout the book 360 system, the setup process and how to sign up, and connect
and the forensics practices used within the chapter. Incident to, the social aspects of the XBOX 360 gaming experience:
response is also explained prior to forensics. Bejtlich gives a XBOX Live. It is this social outlet that is the main cause of

80 Digital / ForensicS

DF9_80-81_Book Reviews.indd 80 20/10/2011 17:38

 concern for the population with news reports about paedophilia analyse the hard disk drive. The tool that takes the spotlight
and child abuse stemming from meetings organised using the in the investigation, Xplorer 360, is not strictly a forensic tool
mail and chat functions inbuilt into the online portal. but more of a console management tool used to connect the
Bolt does not provide much information on other crimes that XBOX 360 to a computer via the network and interact with it.
can be committed using the console such as malicious activity It is interesting that this piece of software should provide a
as the result of installing a secondary operating system (for solution to the investigator to find artifacts previously unfound
example, Linux), but the emphasis of the malicious potential is by the standard forensic tools such as Guidance Software’s
made quite clear and the need for a set method of investigating EnCase and AccessData’s Forensic Toolkit Imager. A criticism
consoles is prominent. of the guide is that its main focus is on the hard disk drive,
With very little documentation on the investigation of consoles which, while holding some of the user information and game
available to the investigator, Bolt has provided the perfect starter saves, does not contain information of the operating system
guide for forensic investigation all the way from acquisition or memory stack. Bolt mentions that this information is held
through to analysis. Rather than just provide the tools and within specific hardware inside the console itself and it would
techniques, however, Bolt takes the reader along the journey of seem prudent to provide methods to investigate these artifacts,
investigation and provides a very detailed walkthrough of the especially when the need for live analysis is increasing.
baseline contents of the XBOX 360 hard drive, explaining the The book does seem quite basic throughout, providing
various different file types (such as PIRS, LIVE and CON files) and technical details that most investigators would probably be
sector locations of valuable information. able to figure out for themselves, however, it is an easy read
The guide describes the use of only a few tools but within and one that would prove interesting to most who do not know
this provides an in-depth and efficient investigation method to much about the investigation of games consoles.

81

DF9_80-81_Book Reviews.indd 81 20/10/2011 17:38

 / COLUMN

IRQ
Planes, packets and IP mobiles...

A
few years ago, I was called in to help with an interesting addresses as most of it is voluntary, but over the years it has
little job. It’s one of those where it’s probably best not become a bit more reliable and some sensible assumptions
to go into too much detail, but suffice to say we were about associated FQDNs can help in the interpretation. Given
dealing with a fairly serious conspiracy. the nature of the case, I was willing to at least try.
Intelligence had led to successful observation and arrest Most of them related to a common UK mobile phone
of a few suspects and one in particular was thought to be the network and didn’t really help much as they could have
ringleader. The problem was that all the relevant activity was been anyone, but there was a batch of around 150 that
conducted on an online forum, and the suspect had no computer looked useful. They covered a one-month period and were all
with which to access it. However, he did have a mobile phone, associated with a mobile phone network in another country.
which never left his side. Of course, it was a smartphone, running Curiously, the same country that the main suspect had been
Windows Mobile (not that the O/S has any particular relevance). visiting at exactly the same time! Now, of course, that’s not
enough to be conclusive, after all, many people visit other
countries and buy local SIMs to keep costs down while they’re
I’VE ALWAYS BEEN A LITTLE there. Still, it was a nice coincidence.
SUSPICIOUS OF GEO-DATA Then we hit paydirt. A single IP address registered to a civil
aviation authority and clearly labelled in DNS as being for
ASSOCIATED WITH IP ADDRESSES one of their airport “pay as you go” Internet terminals. It had
AS MOST OF IT IS VOLUNTARY, BUT been used right in the middle of the suspect’s time in transit
through that airport on his way back from the other country,
OVER THE YEARS IT HAS BECOME and it never appeared in the forum again. Neither, for that
A BIT MORE RELIABLE AND SOME matter, did any of the other country IP addresses.
Either our man was very unlucky to have travelled at exactly
SENSIBLE ASSUMPTIONS ABOUT at the same time as the real ringleader, or he had a stalker
ASSOCIATED FQDNS CAN HELP IN who was setting him up. Funnily enough, he didn’t suggest
either of those explanations in court and is now spending
THE INTERPRETATION a considerable amount of time in one of Her Majesty’s
establishments for the criminally unlucky.
At the time in question, the agency conducting the investigation What’s the moral of this story? Location in 3D space is nice,
had two separate units – one for mobile phones and one for but it works even better if you can add the 4th dimension. /
computers. The mobile phone unit only dealt with phone activity
(call logs, SMS, cellsite analysis) and the computer unit didn’t do Twitter: marshalla99, Blog: marshalla99.wordpress.com,
mobile phones. Of course, because this was a phone, it had been e-mail: [email protected]
examined as a phone and no one had tried to extract any other
data from it. After a few minutes of incredulity, I asked the obvious
question: “Can anyone get the web cache off this thing? “ / Author Bio
If time had allowed, I was pretty sure that we would have Angus Marshall is an independent digital
found fragments of pages from the forum somewhere in the forensics practitioner, author and researcher,
currently working on the ‘fitness for purpose’
cache. Unfortunately, time didn’t permit. However, we did have challenge. In a past life he was an academic
a copy of the forum, including times, dates and IP addresses course leader in Digital Forensics and Forensic
for all the messages posted by the ringleader under his online Computing and still retains strong links with
academia, professional bodies and regulators.
identity. (Approximately 600 in total) He can be contacted through his company,
So, could I perhaps tell where they came from? Well, I’ve n-gate ltd. (http://www.n-gate.net).
always been a little suspicious of geo-data associated with IP

82 Digital / ForensicS

DF9_82_IRQ.indd 82 20/10/2011 17:38

DF9_IBC_Ad.indd 63 11/10/2011 10:24
DF9_OBC_Ad.indd 84 12/10/2011 17:29