# Presentation: 658508

## Forensic Tool Quirks

**Jim Lyle**
**Information Technology Laboratory**
**Digital Forensics Forum**
**21 Feb 2008**

**Notes:**
It is my pleasure to be here with you today to describe some of the significant work ongoing at NIST involving information technology and the fairly new concept of computer forensics.
NIST is attempting to introduce science into the computer forensics arena by basing our work on first principles of computer science, accepted practice, peer review, and publication of results. <click>

## DISCLAIMER

**Certain trade names and company products are mentioned in the text or identified. In no case does such identification imply recommendation or endorsement by the National Institute of Standards and Technology, nor does it imply that the products are necessarily the best available for the purpose.**

- AAFS 2008

## Outline	

- Overview of computer forensics at NIST
- Quirks uncovered
- Write Blocking
- Acquisition to an image file
- Restoration from an image file
- Other
- Questions and answers

- AAFS 2008

## Where is CFTT?

- US government, executive branch
- Department of Commerce (DOC)
- National Institute of Standards and Technology (NIST)
- Information Technology Lab (ITL)
- Software Diagnostics and Conformance Testing Division (SDCT)
- Computer Forensics: Tool Testing Project (CFTT)
- Also, the Office of Law Enforcement Standards (OLES) at NIST provides project input

- AAFS 2008

## Goals of CF at NIST/ITL

- Establish methodology for testing computer forensic tools (CFTT)
- Provide international standard reference data that tool makers and investigators can use in investigations (NSRL, CFReDS)

- AAFS 2008

## Project Sponsors (aka Steering Committee)

- National Institute of Justice (Major funding)
- FBI (Additional funding)
- Department of Defense, DCCI (Equipment and support)
- Homeland Security (Technical input)
- State & Local agencies (Technical input)
- Internal Revenue, IRS (Technical input)
- NIST/OLES (Program management)

- AAFS 2008

## Other Related Projects at NIST

- NSRL -- Hash (MD5, SHA1) file signature data base, updated 4 times a year (Doug White, John Tebbutt, Ben Long)
- PDAs and Cell Phones, NIST (Rick Ayers)
- SAMATE -- Software Assurance Metrics and Tool Evaluation (Paul E. Black)
- CFReDS -- Computer Forensics Reference Data Sets (Jim Lyle)

- AAFS 2008

## Forensic Tool Features

- ... are like a Swiss army knife
- Blade knife for cutting
- Punch for making holes
- Scissors for cutting paper
- Cork screw for opening Chianti
- Forensic tools can do one or more of ...
- Image a disk (digital data acquisition)
- Search for strings
- Recover deleted files

- AAFS 2008

## Testing a Swiss Army Knife

- How should tools with a variable set of features be tested? All together or by features?
- Test by feature has a set of tests for each feature: acquisition, searching, recovery
- Examples: EnCase acquisition, iLook string search, FTK file recovery

- AAFS 2008

## Good News

- Forensic tools tested work
- Problems found are minor
- Usually something is omitted
- Nothing incriminating is created
- Investigators should be aware of the quirks

- AAFS 2008

## Write Blocking

- Goal: Prevent changes to a protected drive
- Host interacts with a drive by a command set through an interface
- Read
- Write
- Control & info

- AAFS 2008

## Int 13 Extended Write

- DOS Interrupt 13 has three write cmds
- Write (original write cmd)
- Write long
- Extended write (added later for large drives)
- Early write blocker versions only block write & write long

- AAFS 2008

## Blocking read commands

- Hardware write block devices ...
- Capture cmds sent from a host on a bus
- Send cmds to a protected device
- Return data to a host
- Some devices may ...
- Substitute a different cmd
- Cache results and not issue cmd to device. If the protected device is reconfigured to report a different size, a cached size is reported incorrectly
- Block some read cmds

- AAFS 2008

## Allow Reads vs Block Writes

- Block unsafe commands, allow everything else
- +	Always can read, even if new command introduced
- Allows newly introduced write commands
- Allow safe commands, block everything else
- +	Writes always blocked
- - Cannot use newly introduced read commands

- AAFS 2008

## Source Acquisition

- Tool acquires either
-  entire drive (physical drive)
-  partition (logical drive)
- Evaluate the acquisition by either ...
- Hash of data acquired
- Compare source to a restore

- AAFS 2008

## Core Acquisition Requirements

- All visible sectors are acquired
- All hidden sectors are acquired
- All acquired sectors are accurately acquired
- Benign fill of faulty sectors
- Error conditions

- AAFS 2008

## Hard Drive Organization

- sector

- track

- cylinder

- AAFS 2008

## Odd Sectors

- Use dd to acquire either a physical or logical drive with an odd sector count and the last sector is omitted.
- Occurs in the 2.4 kernel and earlier.
- The current 2.6 kernel does not have the problem.

- AAFS 2008

## BIOS Lies

- DOS based acquisition via BIOS interface
- Some BIOSs group several physical cylinders together into a logical cylinder
- There may be a fractional logical cylinder left over.
- In addition, some BIOSs may underreport the number of logical cylinders by 1 cylinder

- AAFS 2008

## More BIOS Lies

- Say a drive has 4003 physical cylinders but the BIOS groups 4 cylinders into one logical cylinder. The BIOS reports 1000 logical cylinders (4000 physical cylinders).
- Some tools acquire 1000 logical cylinders and miss the last 3 physical cylinders.
- If the BIOS underreports the size, some tools fail to adjust and acquire only 999 logical (3996 physical sectors).

- AAFS 2008

## Missing Sectors on Restore

- Restore an image of an IBM-DTLA-307020 with 40188960 sectors to an identical drive the results are ...
- Sectors Compared 40188960 Sectors Differ 10395 Diffs range 40178565-40188959
- Also the partition table gives 255 heads/cylinder and 63 sectors/track.
- That gives 16,065 (63*255) sectors/cylinder
- Note that 40,188,960 mod 16,065 is ... 10,395

- AAFS 2008

## Restoring an Image

- Testing the accuracy of a restore ...
- Compare the original source sector by sector to the restored image

- AAFS 2008

## NTFS Partition Restore

- Setup NTFS partition
- MD5: 92b27b30bee8b0ffba8c660fa1590d49
- 27,744,192 sectors
- Each sector filled with sector LBA & disk ID
- Acquire partition
-  Total Sectors:27,744,191
- 494A6ED8A827AD9B5403E0CC89379956
- Rehash (minus last sector) -- still no match

- AAFS 2008

## More NTFS

- Restore image to NTFS partition
- Compare to original
- Sectors differ:             47
- Restore was in Windows XP ...
- Restore again, unpower drive, no system shutdown. Compare to original
- Sectors differ:              8
- Diffs range:  27,744,184-27,744,191

- AAFS 2008

## NTFS Resolution

- Examine the eight sectors
- Last sector not imaged
- Other seven are a second copy of seven sectors starting at offset 27,744,120 -- Know this because each sector is tagged with LBA
- Verification:
- Acquisition hash: 494a6ed8a827ad9b5403e0cc89379956
- xena:/Users/jimmy root# dd bs=512 if=/dev/disk2s11 of=~jimmy/nt.dd
- xena.local(1009)==> dd if=nt.dd bs=512 skip=27744120 count=7 of=end.dd
- xena.local(1012)==> dd if=nt.dd bs=512 count=27744184 of=chunk.dd
- xena.local(1013)==> cat chunk.dd end.dd | md5
- 494a6ed8a827ad9b5403e0cc89379956
- xena.local(1022)==> md5 nt.dd
- MD5 (nt.dd) = 92b27b30bee8b0ffba8c660fa1590d49

- AAFS 2008

## Faulty Sector Behaviors

- Some sectors adjacent to faulty sector missed
- ATA interface: 8 sector window
- USB interface: variable size window < 64
- FW interface: variable, but different from USB
- Missed sectors filled with unknown data
- Image file gets out of sync

- AAFS 2008

## Other Quirks

- Hash Quirks
- Screen hash differ from log file
- Multiple hashes: SHA ok, MD5 wrong; hardware dependent

- AAFS 2008

## Contacts

- Jim Lyle				Doug White
- _[www.cftt.nist.gov](http://www.swgde.org/)__	__	__	__www.nsrl.nist.gov_
- _[cftt@nist.gov](http://www.swgde.org/)__	__	__	__	__nsrl@nist.gov_
- Sue Ballou, Office of Law Enforcement Standards
- Steering Committee Rep. For State/Local Law Enforcement
- susan.ballou@nist.gov

- AAFS 2008