Chapter 27: Digital Forensics¶

# NEVER analyze original media directly
# Always create a forensic copy (bit-for-bit duplicate)

# Write blocker — hardware or software
# Hardware preferred: Tableau Forensic Bridge, WiebeTech
# Prevent any writes to source disk during acquisition

# dcfldd — enhanced dd with hashing
dcfldd if=/dev/sdb of=/evidence/target_disk.dd \
  hash=sha256 \
  hashlog=/evidence/target_disk.sha256 \
  bs=4096 \
  noerror \
  conv=sync

# Verify acquisition integrity
sha256sum /evidence/target_disk.dd
# Compare to hash generated during acquisition — MUST match

# FTK Imager (Windows) — industry standard GUI tool
# Creates .E01 (EnCase Expert Witness) format with embedded hashes

# Logical acquisition (when physical not possible)
# Active systems — targeted collection of specific artifacts
# Kape (Kroll Artifact Parser and Extractor)
kape.exe --tsource C: --tdest /evidence/triage/ --target !SANS_Triage

# Windows live memory
winpmem_mini_x64_rc2.exe C:\Evidence\memory.raw
# Alternative: DumpIt, Belkasoft RAM Capturer, FTK Imager (memory)

# Linux live memory
# LiME (Linux Memory Extractor) — kernel module
git clone https://github.com/504ensicsLabs/LiME
cd LiME/src && make
sudo insmod lime-$(uname -r).ko "path=/tmp/memory.lime format=lime"

# Virtual machine memory
# VMware: Suspend → examine .vmem file
# Hyper-V: Checkpoint creates AVHD/AVHDX (includes RAM)
# VirtualBox: Take snapshot → includes RAM state

# Verify
sha256sum memory.raw > memory.raw.sha256

# RegRipper — automated registry artifact extraction
rip.pl -r /evidence/NTUSER.DAT -f ntuser
rip.pl -r /evidence/SYSTEM -f system
rip.pl -r /evidence/SOFTWARE -f software

# USB device history (SYSTEM hive)
# HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR
rip.pl -r /evidence/SYSTEM -p usbstor

# Most recently used (MRU) files (NTUSER.DAT)
# HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
rip.pl -r /evidence/NTUSER.DAT -p recentdocs

# UserAssist — GUI program execution count + last run
rip.pl -r /evidence/NTUSER.DAT -p userassist

# Run keys — persistence mechanisms
# HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
# HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
rip.pl -r /evidence/NTUSER.DAT -p run

# Plaso/log2timeline — comprehensive timeline generator
# Parse all artifacts and create super-timeline

log2timeline.py --storage-file /evidence/timeline.plaso \
  --partition all \
  /evidence/target_disk.dd

# Filter timeline (psort)
psort.py -z UTC -o l2tcsv /evidence/timeline.plaso \
  "date > '2026-01-14 00:00:00' AND date < '2026-01-16 00:00:00'" \
  > /evidence/filtered_timeline.csv

# Mactime (from SleuthKit)
fls -r -m / target_disk.dd > bodyfile.txt
mactime -b bodyfile.txt -d 2026-01-14 2026-01-16 > mactime_timeline.csv

# Linux forensic triage commands
# (Run on live system or via chroot on mounted image)

# Find recently modified files
find / -newer /tmp/reference_time -type f 2>/dev/null | grep -v "/proc\|/sys\|/dev"

# Hidden directories/files
find / -name ".*" -type d 2>/dev/null | grep -v ".config\|.local"

# SUID/SGID files (privilege escalation)
find / -perm -u=s -type f 2>/dev/null
find / -perm -g=s -type f 2>/dev/null

# Network connections
ss -tulnap
netstat -anp

# Running processes
ps auxf
ls -la /proc/*/exe 2>/dev/null | grep deleted  # Deleted but running binaries

# Scheduled tasks (all cron locations)
for spool in /var/spool/cron/crontabs/*; do echo "--- $spool ---"; cat "$spool"; done
cat /etc/crontab /etc/cron.d/* /etc/cron.hourly/* /etc/cron.daily/*

# Users and groups
cat /etc/passwd | grep -v nologin | grep -v false  # Interactive users
lastlog  # Last login for all users
last -100  # Recent logins

# Wireshark — GUI packet analysis
# Capture filter (during capture): host 192.168.1.100 and port not 80
# Display filter (post-capture): ip.addr == 192.168.1.100 && http

# TShark — command line Wireshark
# Extract all HTTP POST requests
tshark -r capture.pcap -Y "http.request.method == POST" \
  -T fields -e frame.time -e ip.src -e ip.dst -e http.request.uri -e http.file_data

# Reconstruct files from capture
NetworkMiner -r capture.pcap  # Extracts files, credentials, DNS

# Follow TCP stream for specific connection
tshark -r capture.pcap -Y "ip.addr == 185.220.1.1" -qz follow,tcp,ascii,0

# Extract DNS queries (C2 detection)
tshark -r capture.pcap -Y "dns.flags.response == 0" \
  -T fields -e frame.time -e ip.src -e dns.qry.name

# Zeek — network security monitoring (production-grade)
zeek -r capture.pcap local
# Generates: conn.log, dns.log, http.log, ssl.log, weird.log, files.log, etc.
cat conn.log | zeek-cut ts id.orig_h id.resp_h id.resp_p duration orig_bytes

# nfdump — analyze NetFlow/IPFIX data
# Find top talkers
nfdump -r /netflow/nfcapd.202601150000 -s srcip/bytes -n 20

# Find connections to known bad IPs
nfdump -r /netflow/ -R 2026-01-15/2026-01-16 \
  "dst ip in [185.220.1.0/24]" \
  -o extended

# Detect port scanning
nfdump -r /netflow/nfcapd.202601150000 \
  "flags S and not flags AFRP" \
  -s srcip/flows -n 20

# Preserve evidence — create forensic volume from snapshot
INSTANCE_ID="i-0abc123def456789"

# 1. Create snapshot of each volume
VOLUME_IDS=$(aws ec2 describe-instances --instance-ids $INSTANCE_ID \
  --query "Reservations[].Instances[].BlockDeviceMappings[].Ebs.VolumeId" \
  --output text)

for VOL_ID in $VOLUME_IDS; do
  aws ec2 create-snapshot \
    --volume-id $VOL_ID \
    --description "Forensic snapshot - IR-2026-0142 - $(date -u +%Y%m%d-%H%M%S)" \
    --tag-specifications "ResourceType=snapshot,Tags=[{Key=Purpose,Value=Forensics},{Key=Case,Value=IR-2026-0142}]"
done

# 2. Isolate instance (block all traffic)
aws ec2 revoke-security-group-ingress --group-id sg-xxx --protocol all --port all --cidr 0.0.0.0/0
aws ec2 authorize-security-group-ingress --group-id sg-forensics --protocol tcp --port 22 --cidr ANALYST_IP/32

# 3. Export CloudTrail for investigation period
aws cloudtrail lookup-events \
  --start-time 2026-01-01T00:00:00Z \
  --end-time 2026-01-15T23:59:59Z \
  --max-results 50 \
  > cloudtrail_evidence.json

# 4. Create forensic workstation in same region
# Attach forensic snapshot as additional volume (read-only)
aws ec2 run-instances --image-id ami-forensics --instance-type t3.xlarge \
  --block-device-mappings "[{\"DeviceName\":\"/dev/xvdf\",\"Ebs\":{\"SnapshotId\":\"$SNAP_ID\",\"DeleteOnTermination\":true}}]"