Google History Forensics

by Craig Ball

About the Author Craig Ball is a Texas lawyer who limits his practice to service as a court-appointed special master and consultant in computer forensics and electronic discovery.

In my last Forensic Focus column, I touched on migration to handhelds and the cloud, mushrooming drive capacities and encryption-by-default as just some of the factors auguring the eventual extinction of conventional digital forensics. But an end to old school digital forensics is no threat to examiners who evolve. There will be plenty to do for those adapting their skills and tools to new sources and forms of information. We will learn to read new tea leaves.

Happily, for every source of forensically-rich information that fades away, others emerge. For every MacBook configured to wipe deleted data, there’s an iPhone storing screenshots and typed text. When webmail shooed away some of our ability to locate messaging artifacts, social networking and geolocation wandered in with stories to tell.

Now and then, the emergent sources just seem too good to be true.

Case in point: Google History.

Certainly, forensic analysts routinely look at Google searches locally; parsing Internet activity to assess what the user searched and surfed: “Nude children.” “How to make chloroform.” “Wipe a hard drive.” It’s compelling evidence.

But, as users grow savvy about covering their tracks, we see more cache deletion and deployment of antiforensic “privacy” tools designed to deprive us of the low-lying fruit. It’s potentially “spoliation” on the civil side and “obstruction of justice” on the criminal side. On both sides, proving it helps justice be done.

Then again, data can disappear innocently, too. Oliver Wendell Holmes, Jr., observed that, “Even a dog distinguishes between being stumbled over and being kicked." Discerning evil intent—mens rea in the law—is crucial to deciding whether and how much to punish actions that result in lost evidence. One way we demonstrate intent is by showing the planning that preceded an act. We reasonably infer intent to destroy evidence from web searches seeking ways to make evidence disappear.

But what do you do when the data destroyed is the evidence of intent in its destruction?

Read more at http://www.forensicfocus.com/craig-ball

Important Changes to "Articles & Papers" Section

From today, the section where we display user submitted articles and research papers is changing significantly. Users will now be able to upload, edit and publish their own articles.

The URL for the new section is http://articles.forensicfocus.com/

If you would like to submit an article or paper please email admin@forensicfocus.com so that we can start the process of setting you up with an account (separate from your normal Forensic Focus account).

Interview with Scott Burkeman, Warner Scott Recruitment

Scott is a Director at Warner Scott Recruitment in London, specialising in computer forensics recruitment throughout the UK and abroad.

Forensic Focus: Can you tell us something about your background? How did Warner Scott Recruitment come into being?

Scott Burkeman: I have been involved in Forensic Technology and Fraud recruitment for over a decade, working for an international recruitment firm and more recently with Warner Scott. I initially began placing Senior Forensic Accounting professionals prior to the boom in Computer Forensics. Many of my clients were looking to develop Computer Forensic teams from scratch and asked me to get involved in the recruitment of Forensic Technology candidates to assist in their growth plans. Since then, the rest is history!

Warner Scott Recruitment was set up in 2006 as a specialist recruitment consultancy with the vision of developing long-standing, meaningful relationships with both our candidates and clients. We have a strong focus on the Computer Forensic and eDiscovery market and are one of only a handful of specialist consultancies that have a dedicated team focusing in this area.

Many of the candidates we have placed over the years are now our clients and vice versa. We pride ourselves in our market knowledge, deep relationships and a strong understanding of the markets we operate in. We are fortunate enough to work on many roles on an exclusive basis as our clients trust us enough to find the best people in the market.

The Computer Forensic area is an extremely unique market to operate within and has some wonderful characters and personalities that make this area a pleasure to work in.

Forensic Focus: What services do you offer to digital forensics jobseekers?

Scott Burkeman: We are more than just a recruitment firm. As well as placing candidates into roles, we offer career advice and counselling, coaching, CV advice, interview tips and much more. As mentioned above, we are keen to develop long term relationships with our candidates, so if anyone fancies a chat about the state of the market, is looking to benchmark their salary or just wants some career advice, please do not hesitate to call us, or pop in to see us for a coffee and chat.

Forensic Focus: What is the current state of the digital forensics job market? Which sectors are hiring?

Scott Burkeman: The market has been up and down in recent years, which has been characterised by the state of the wider economy. With the government cuts in public spending, there has been much uncertainty within the public sector, which has resulted in some redundancies. Many private sector companies which previously had large government contracts have had to adapt and change to accommodate the loss of work.

However, the eDiscovery & Litigation Support market continues to remains buoyant as well as the Data Analytics arena. The large consultancy firms and international boutiques are still hiring the best candidates and increasingly Banks and Corporates are approaching us to help fill in-house Investigations roles.

With the increase of Anti Money Laundering (AML) projects and the introduction of the Anti Bribery & Corruption Act this year, the demand for Forensic Technology experts with strong corporate investigations experience remains high...

Read more at http://www.forensicfocus.com/scott-burkeman-interview-290611

Scott Moulton’s “5-Day Data Recovery Expert Certification” Course

reviewed by by Karlo Arozqueta

http://www.myharddrivedied.com/data-recovery-training

Just about every individual who is immersed in the Information Technology field has either personally experienced it, or knows someone who has: The hard drive “click of death”. For most, this sound is the start of a downward spiral of doom and depression and eventually a large bill from a data recovery company. For some, however, this is the beginning of a new field of interest in technology. There is only one problem: The field of hard drive data recovery is one that is still shrouded in secrecy and misinformation. How can someone break into an industry where advice is doled out in hushed tones and newcomers are shunned and told to seek professional (read:$$$) help?

Scott Moulton has been trying to change that, and is one of the few individuals teaching a vendor-neutral data recovery class to the public. I attended one of Scott’s 5 day training classes in 2009, and have kept up with him as the course has grown. In an effort to assist other individuals in deciding if this course is worth taking, I opted to write this review. Please note that while my personal attendance of the course was in 2009, I routinely volunteer to assist in these courses (for free) when they come to my geographic area of Washington DC, so this information is current as of May of 2011. Also, while the term “hard drive” has now become the catch-all term, the course material covers recovery of both traditional mechanical hard drives and touches on the latest recovery technologies for flash based devices like USB thumb drives and Solid-State Drives (SSD).

This class is appropriate for any individuals who have a solid understanding of computer forensics and filesystems and want to take their knowledge to the next level in terms of understanding exactly how data is stored on the drive, how the device works, and how it can be recovered when conventional imaging techniques fail. This was my primary reason for attending the course. The class is also appropriate for any individual who wants to approach data recovery as a means to expand their computer-support business and wants to add DR (data recovery) as an additional service...

Read more at http://www.forensicfocus.com/scott-moulton-data-recovery-review-200511

Standard Units in Digital Forensics

by Chris Hargreaves

About the Author Dr Chris Hargreaves is a lecturer at the Centre for Forensic Computing at Cranfield University in Shrivenham, UK.

One of the earliest lectures in the MIT Openware programme in Physics begins with the lecture “Units and Dimensional Analysis”. Units of measurement are critical to science, so much so that there is a standard that defines science’s system of units, for example the precise definition of a kilogram -- the SI (Système International d’Unités or International System of Units). The notion of units of measurement in science is extremely important and it therefore seems sensible to consider how this applies to digital forensics.

As we will see, this does not necessarily suggest that there should be standard units of measurement in digital forensics, to report, for example, the position of the start of a file. As will be discussed later in the article, this is not always appropriate, since it is useful to describe such positions in different ways depending on the context. However, this article will discuss that reporting some unit of measurement is essential.

Perhaps it is best to begin with a simple example:

“the text string ‘this is evidence’ was located at position 34556”

Since this important evidential artefact has been located, it seems sensible to check that the artefact is actually there. So, we should examine position 34556... but 34556 what? Bytes, sectors, blocks? Let us assume just for a second that the position is expressed in bytes, but what about the number base? If the position in which the string was identified was 86FC, it would be reasonable to assume that this is a hexadecimal offset. However, in this example we have 34556. This could be decimal or hexadecimal. So in order to precisely identify the position of this string, not only does the unit of measurement need to be expressed, but so too does the number base in which it is expressed.

Furthermore, consider the organisation of a disk...

Read more at http://www.forensicfocus.com/chris-hargreaves

PitchLake - a tar pit for scanners

by Simon Biles

About the Author Simon Biles is a founder of Thinking Security Ltd., an Information Security and Risk Management consultancy firm based near Oxford in the UK.

We’ve had two bank holidays in a row here in the UK – first off for Easter, then for the Royal Wedding – time off work coupled with very pleasant weather and plenty of “refreshments” has caused my brain to atrophy! So, rather than pulling one of my usual type of topics from the hat for this article, I thought that I’d do a mini-project for the month.

[ I’ll apologise up front though – I can only just program in both Perl and C, and C isn’t exactly column friendly, so it’ll be Perl. I know that many readers here can program in Perl, and most of you probably better than me – I’d be interested to hear corrections, tips and tricks in the comments so as to improve, as no doubt there are better ways of doing this ! ]

One of my first tasks in the office this morning, after a cup of coffee of course, was to review my server logs [1]. As of yet I’ve not got enough staff to have a minion to do this for me, but to be honest I’d miss the connection to the real world of computing if I did [2]. I run a Linux server in a datacentre in Birmingham as my company’s main web-server and my high bandwidth, static IP’d pen-test machine. For the last few months I’ve been meaning to do something about the 404 errors (http://en.wikipedia.org/wiki/HTTP_404) that are being reported by Apache – some are my fault for taking pages away that people clearly still cross reference – the others though are clearly the work of automated web vulnerability scanning tools.

Vulnerability scanners (http://en.wikipedia.org/wiki/Vulnerability_scanner) are the bottom end of the pen-test toolkit – they are to penetration testing what the Windows “find” command is to digital forensics; e.g. superficial and basic. There are various types – but of interest today are those that operate on the application layer over HTTP (http://en.wikipedia.org/wiki/ISO_model#Layer_7:_Application_Layer). In the open source market both Nikto (http://www.cirt.net/nikto2) and Nessus (http://www.tenable.com/products/nessus) [ Nessus isn’t open source per se, but is free for home use … ] are examples of products that perform tests against webservers for potentially insecure CGIs and files – the trouble with this is that in order to determine if an insecure CGI script or file is present, the scanner asks Apache for it, and receives a 404 if it isn’t there, each 404 is written to the log, and when Nikto, for example, tests for over 6400 possible vulnerabilities you can imagine what the logs look like ! Sadly, tools like these, as they are available to everyone, are not only used by the kind of people that get written authorisation before testing your web server...

Read more at http://www.forensicfocus.com/simon-biles