9/5/2003 

The New Kid on the Blo

NSRL & CFTT

The New Kid on the Bloc

NSRL & CFTT

Doug White 

Information Technology Laboratory

9 September 2003
9/5/2003 

Outline Outline

z Overview of Computer Forensics at Nz Computer Forensic Tool Testing (CFTz National Software Reference Library (z Questions and Answers
9/5/2003 

Computer Forensics Partn

Computer Forensics Partn

NIST NIST

(OLES, ITL) (OLES, ITL) (OLES) (NIJ, FBI)

DoJ DoD

(DCCC

TREASURY

(USCS, 

USSS)

Homela

Securi

National

Agencies

State/Local

z These organizations fund and provide guidance to CFTT & Nz Vendors submit software and provide feedback in peer reviewz NIST is the technical component
9/5/2003 

State & Local LE Representa

State & Local LE Representa

z The National Institute of Justice (NIJ) 

major funding source:

– CFTT to date: $3.5 M– NSRL to date: $2 M

z The Program Manager for Forensic 

Sciences, Susan Ballou, of the Office oLaw Enforcement (OLES) at NIST, diNIJ funding to the appropriate expertiswhether within NIST or beyond.
9/5/2003 

A Shocking Revelation . 

A Shocking Revelation . 

Computers can be involved in crime ...z As a victimz As a weaponz As a witnessz As a recordz As contraband
9/5/2003 

Outline of an Investigatio

Outline of an Investigatio

z Get proper authorizationz Seize evidence (Hard drives, floppies z Create duplicates for analysisz Analyze the duplicates

– Exclude known benign files– Examine obvious files– Search for hidden evidence

z Report results
9/5/2003 

Investigators Need ... Investigators Need ...

Computer forensic investigators need too

that ...

z Work as they should andz Produce results admissible in courtz Reference data to reduce analysis work
9/5/2003 

Goals of CF at NIST Goals of CF at NIST

z Establish methodology for testing com

forensic tools (CFTT)

z Provide international standard referenc

data that tool makers and investigators use in an investigations (NSRL)
9/5/2003 

Why NIST/ITL is involve

• Mission: Assist federal, state & local 

agencies

• NIST is a neutral organization – not la

enforcement or vendor

• NIST provides an open, rigorous proce
9/5/2003 

Computer Forensics Too

Computer Forensics To

Testing (CFTT) Testing (CFTT)
9/5/2003 

A Problem for Investigato

A Problem for Investigato

Do forensic tools work as they should?z Software tools must be ...

– Tested: accurate, reliable & repeatable– Peer reviewed– Generally accepted

z ... by whom?z Results of a forensic analysis must be 

admissible in court
9/5/2003 

CFTT Presentation Overv

CFTT Presentation Overv

z Project Tasksz Current activitiesz Challengesz Testing Hard Drive Imaging Toolsz Benefits of CFTT
9/5/2003 

Project Tasks Project Tasks

z Identify forensics functions e.g., 

– disk imaging, – hard drive write protect, – deleted file recovery

z Develop specification for each categorz Peer review of specificationz Test methodology for each functionz Report results
9/5/2003 

Current Activities Current Activities

z Hard drive imaging toolsz Software hard drive write protectz Hardware hard drive write protectz Deleted file recovery
9/5/2003 

Challenges Challenges

z No standards or specifications for toolz Forensic vocabulary incompletez Arcane knowledge domain (e.g. DOS)z Reliably faulty hardware
9/5/2003 

Hard Drive Imaging Hard Drive Imaging

z SCSI vs IDEz Drive accessz Clone vs imagez Excess sectors on dstz I/O errorsz Corrupt image file
9/5/2003 

Testing Hard Disk Drive Testing Hard Disk Drive 

Imaging Tools Imaging Tools

• Source disk not changed• Copied information is accurate• Behavior if source is smaller than 

destination

• Behavior if source is larger than 

destination

Need to verify...
9/5/2003 

Impact

z Release 18 (Feb 2001) - A US governm

organization was doing some testing auncovered an issue under a specific secircumstances. 

z Linux doesn’t use the last sector if oddz Several vendors have made product or 

documentation changes
9/5/2003 

Benefits of CFTT Benefits of CFTT

Benefits of a forensic tool testing progra

– Users can make informed choices– Neutral test program (not law enforcemen– Reduce challenges to admissibility of dig

evidence

– Tool creators make better tools
9/5/2003 

Lab Facilities Lab Facilities
9/5/2003 

CFTT/NSRL Team CFTT/NSRL Team
9/5/2003 

NSRL Project NSRL Project
9/5/2003 

Outline Outline

z NSRL Descriptionz RDS Descriptionz RDS Usez Research Areasz Project News & Accomplishments
9/5/2003 

What is the NSRL? What is the NSRL?

z National Software Reference Library (NSRL)

– Physical library of software, 2400 products– SQL Server database of known file signatures– Reference Data Set (RDS): 16,200,000 file sign

z Goals

– Automate the process of identifying known files 

computers used in crimes

– Allow investigators to concentrate on files that c

contain evidence (unknown and suspect files)
9/5/2003 

Addressing Law Addressing Law 

Enforcement Needs Enforcement Needs

z LE needed an unbiased organizationz LE needed traceability for the NSRL 

contents

z No repositories of original software 

available for reproducing data

z NSRL needs to work with many CF to
9/5/2003 

Scope of the NSRL Scope of the NSRL

z NIST has collected software for 2 yz Software is recorded as the origina

for known files and stored as a part NSRL

z Versions of OS, DBMS, photo edit

word processors, network browsercompilers...

z Data formats, data dictionary and p

status information is available on thwebsite for RDS users and industry reference
9/5/2003 

What is the RDS? What is the RDS?
9/5/2003 

What is the RDS? What is the RDS?

z Reference set of file profiles

– Each profile includes file name, file size, 

signatures (SHA1, MD5, CRC32), applicname, operating system, etc.

– Extracted from files on original software 

diskettes, and network downloads

– A single application may have thousands 

separate file profiles
9/5/2003 

What is What is in the RDS? the RDS?

z “Known” files – not “known good”z Off-the-shelf, shrinkwrapped program

documented downloads

z Includes hacker tools, port scanners, 

network security tools, encryption

z Permuted index available at 

www.nsrl.nist.gov
9/5/2003 

RDS Use RDS Use

z Commercial tools import the RDS as a 

hash set

z Users may process the RDS data befor

importing it

z Software tools available on www.nsrl.z 4,300 separate hashsets on website
9/5/2003 

How to Use the RDS How to Use the RDS

z Eliminate as many known files as possible from the 

examination process using automated means

z Discover files that do not contain expected content

file containing a bomb schematic, facility map)

z Look for files that should be installed, but are miss

(incomplete deletion of pirated software)

z Look for files that could be suspect (hash matches, 

name does not)

z Provide rigorously verified data for forensic investi
9/5/2003 

RDS Field Use RDS Field Use

KNOWN FILES

RDS

ANALYSIS

PROGRAM

UNKNOWN FILES

FILES

40-95%

Disk Drive
9/5/2003 

RDS Field Use Example RDS Field Use Exampl

Windows NT 4.0 operating system software conta6753 images which are known gifs, icons, jpeg filYou are looking for facility maps on a computer which is running Windows NT 4.0 Workstation.By using the RDS and an analysis program the investigator would not have to look at these files tcomplete his investigation.

e.g., 
9/5/2003 

Hashes

z Compute a unique identifier for each file ba

contents 

z Primary hash value used in the NSRL RDS 

Secure Hash Algorithm (SHA-1) specified iFederal Information Processing Standard (F180-1, a 160-bit hashing algorithm

z SHA-1 values can be cross-referenced by ot

products that depend on different hash value
9/5/2003 

Hashes

z Other standard hash values computed for each file 

Message Digest 4 (MD4), Message Digest 5 (MD532-bit Cyclical Redundancy Checksum (CRC32), ware useful in many CF tools and to users outside LE

z Separate, parallel, and independent process is used 

validate the results of the primary RDS implementa

z Once verified and validated, the RDS is written to a 

CD, duplicated, and distributed through NIST’s StaReference Data Office as Special Database #28 (www.nist.gov/srd/nistsd28.htm).
9/5/2003 

Hash Examples Hash Examples

Filename Bytes SHA-1

NT4\ALPHA\notepad.exe 68368 F1F284D5D757039DEC1C44A05AC1NT4\I386\notepad.exe 45328 3C4E15A29014358C61548A981A4ANT4\MIPS\notepad.exe 66832 33309956E4DBBA665E86962308FENT4\PPC\notepad.exe 68880 47BB7AF0E4DD565ED75DEB492D8CWINNT31.WKS\I386\notepad.exe 57252 2E0849CF327709FC46B705EEAB5EWINNT31.SRV\I386\notepad.exe 57252 2E0849CF327709FC46B705EEAB5E
9/5/2003 

Hashing Installed Files Hashing Installed Files

z Currently testing methods for hashing 

installed files

z Installation of known packages in NSR

onto virtual machines

z Virtual machine state can be preserved 

CD on NSRL shelf for repeatability

z Comparison installation on physical 

machine
9/5/2003 

Installed Hash Findings Installed Hash Findings

z Installed MS W2K Pro on virtual machine a

physical machine; approx. 4,500 files

z RDS identified 79% of files on VM, 60% of 

on PM

z RDS, VM and PM hashsets identified 17% 

4,500 files on two “wild” PCs

z Installed hashes are necessaryz Patch/hotfix/update hashes are most critical
9/5/2003 

Use on Actual Machine

Use on Actual Machine

Clean OSz 4622 files -360, 92% known – w98z 7720 files -864, 89% known – w2kz 5412 files -370, 93% known – wme

Actual NIST PCs

z 39631 files -7902, 80% known – w2kz 18262 files -6395, 65% known – w98z 75834 files -41638, 45% known – w2k,mgm
9/5/2003 

NSRL News NSRL News

z Hashing code (Mar. ‘03) availablez Late Fall ‘03 – LAMP environment, cookboz Peer-to-Peer hashesz Block size hashes – evidence chain, deleted z Multiple language researchz Conversion tools availablez Winter ‘03 – database on public internetz Interesting hashes – 200 steg tools, etc.
9/5/2003 

NSRL Accomplishment

NSRL Accomplishment

z RDS CD Version 1.2 distributed 6/6/2

– 124 subscriptions (Vendors, corporations

universities, and law enforcement agenci

– Free redistribution, NIST traceable

z Incorporated into vendor productsz Used by FBI, DCCC, Secret Service, 

Customs Service (Homeland Security)
9/5/2003 

Contacts Contacts

Jim Lyle Doug Whitewww.cftt.nist.gov www.nsrl.nistcftt@nist.gov nsrl@nist.govSue Ballou, Office of Law Enforcement StandSteering Committee Rep. For State/Local Law 

Enforcement

susan.ballou@nist.gov