analysis_of_winhex_167.pdf

(3215 KB) Pobierz
Analysis of WinHex
Fight crime.
Unravel incidents... one byte at a time.
This paper is from the SANS Computer Forensics and e-Discovery site. Reposting is not permited without express written permission.
Copyright SANS Institute
Interested in learning more?
Check out the list of upcoming events offering
"SANS Computer Forensics, Investigation, and Response (Security 508)"
at http://forensics.sans.org/events/
271450741.003.png 271450741.004.png
Analysis of WinHex
GIAC Certified Forensic
Analyst (GCFA)
Practical Assignment
Version 1.5
Option Two
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46
Jessica Dillinger
SansFire ‘04 Monterey, CA
© SANS Institute 2005
Author retains full rights.
271450741.005.png
Jessica Dillinger
Table of Contents
Table of Contents
Table of Contents
i
List of Figures and Tables
i
Abstract
1
Introduction
2
Preparation Steps for Analysis
2
Autopsy Setup Process
4
Image Details
6
Analysis of Files
9
Examining Camouflage
12
Deciphering Camouflage
15
Recovering Camouflaged Files
20
Conclusion
22
Legal Implications
22
Additional Information
25
Part Two: Forensic Tool Validation: WinHex
26
Scope
26
Tool Description
26
Test Apparatus
29
Environmental Conditions
30
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46
Description of the Procedures
30
Criteria for Approval
31
Data and Results
31
Analysis
36
Presentation
36
Conclusion
37
- 2 -
© SANS Institute 2005
Author retains full rights.
Examination Details
6
271450741.006.png
Jessica Dillinger
Table of Contents
List of Figures and Tables
Figure 1 - Evidence Custody Form and Chain of Custody Form 5
Figure 2 - MD5sum verification of floppy 5
Figure 4 - File details viewed in Autopsy 7
Figure 5 - Image details of confiscated floppy disk viewed in Autopsy 8
Figure 6 - file owners 8
Figure 7 - Password_Policy.doc viewed in hex editor 9
Figure 9 – Camshell.dll file viewed in hex 11
Figure 10 - Comparison of Camshell.dll MD5 hashes 12
Figure 11 – Comparison of images 13
Figure 12 - Beginning of encrypted data in the test Word document 15
Figure 13 - Location of encrypted password in Password_Policy.doc 17
Figure 14 - Location of encrypted password in Remote_Access_Policy.doc 17
Figure 15 - Zipped file viewed in W inHex
31
Figure 16 - MAC times file prior to WinHex
33
Figure 17 - MAC times of file after WinHex
34
Table 1 - Conversion table from hexadecimal to binary
3
Table 2 - Files and their corresponding sectors
11
Table 3 - Finding the key to camouflage
16
Table 4 - Recovered camouflage passwords
20
Table 5 - Cat.mdb, Access database storing customer information
21
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46
- 3 -
© SANS Institute 2005
Author retains full rights.
271450741.001.png
Jessica Dillinger- 4
-
Abstract
<your name>
Abstract
This practical assignment was created to meet the criteria for the GIAC Certified
Forensic Analyst certification, which consists of two parts. The first part of the
certification requirement is to analyze a floppy disk that contains several files.
This will be done using several forensic utilities including Autopsy, shred and
WinHex. This portion of the paper will include how the computer that was used
for the investigation was prepared. It will also explain the steps taken to examine
the media and what was found during each step of the investigation. The tool
that was used in this case will be studied in order to give a accurate description
of how it works and what it was used for. A brief conclusion will give an overview
of the evidence found and conclude what the suspect was trying to accomplish.
Finally, the legal implications will be discussed along with the punishments the
suspect could face based first on business policies and then on state and
federal laws.
For the second portion of the paper the second option was chosen. Analyzing a
tool that could be used for forensics will be investigated to determine how well it
works and what typed of forensic capabilities it has. The tool that will be
reviewed is W inHex. W inHex is best known for its disk editing capability.
However, it has many other capabilities, including RAM editor, erasing entire
hard drives, drive cloning and random number generator.
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46
- 4 -
© SANS Institute 2005
Author retains full rights.
271450741.002.png

Plik z chomika:

Inne pliki z tego folderu:

Inne foldery tego chomika:

Zgłoś jeśli naruszono regulamin