NSRL	Next	Genera-on	–	

Diskprin-ng

Mary	T.	Laamanen1,	Alex	J.	Nelson2,3	

1	NIST	

2	Prometheus	Compu-ng	

3	University	of	California,	Santa	Cruz	

December	3,	2014	
Disclaimer	

• This	talk	men-ons	several	soMware	products.	

• No	men-ons	are	or	should	be	construed	as	

endorsements	of	that	soMware.	

• In	this	research,	they	are	test	subjects.	
Diskprints	show	when	ar-facts	appear.	

• Baseline	

• Installa-on	

• Running	

• Uninstalla-on	

• Reboo-ng	
Diskprints	show	when	ar-facts	appear.	

• Baseline	

• Installa-on	

• Running	

• Uninstalla-on	

• Reboo-ng	
Diskprints	show	when	ar-facts	appear.	

• Baseline	

• Installa-on	

• Running	

• Uninstalla-on	

• Reboo-ng	

Registry	entries:	460,000	
Diskprints	show	when	ar-facts	appear.	

• Baseline	

• Installa-on	

• Running	

• Uninstalla-on	

• Reboo-ng	

Registry	entries:	460,000	

+	10	–	10,000	
Diskprints	show	when	ar-facts	appear.	

• Baseline	

• Installa-on	

• Running	

• Uninstalla-on	

• Reboo-ng	

Registry	entries:	460,000	

+	10	–	10,000	

+	more	
Diskprints	show	when	ar-facts	appear.	

• Baseline	

• Installa-on	

• Running	

• Uninstalla-on	

• Reboo-ng	

Registry	entries:	460,000	

+	10	–	10,000	

+	more	

+	less	&	more	
We	need	to	understand	

ar-fact	origins.	

• Files,	Registry	cells	–	mostly	unknown	origins.	

– Most	created	by	soMware.	

– Some	recognized	from	malware	signatures.	

– Most	just	in	the	way	of	finding	relevant	data.	
Diskprints	help	recognize	

ar8facts	and	behaviors.	

• Whole	virtual	machine	states	are	available.	

• We	compute	changes	between	states,	making:	

– Catalogues	of	system	behavior	

– Known-file	lists	

– SoMware	signatures	
Diskprint	data	are	being	made	from	

forensic	differencing.	

• New	NSRL	data	sets	based	on	

diskprint	sequences.	

– Using	forensic	differen-al	analysis	

[Garfinkel et	al.,	DFRWS	2012]	

– Extension:	Forensic	sequence	analysis	
Outline:	Data	set	produc-on	

• File	system	analysis	language	

• Diskprint	lineage	analysis	workflow	

• Results	(with	URL)	

• Research	on	soMware	signatures	

• Conclusions	
File	system	analysis	language	

Digital	Forensics	XML	
File	system	analysis	with	DFXML	

• Digital	Forensics	XML	describes	storage	

system	metadata.	

– Currently	hosted	by	NIST.	

• Originally	by	Garfinkel	[SADFE,	2009;	DI,	2012].	

– Document	language	(with	XML	schema).	

– Python	bindings	available.	

– In	use	by	forensic	researchers,	digital	archivists.	
DFXML	describes	storage,	

and	changes.	

• Simple	annota-ons	for	files.	

– New,	removed,	modified.	

• New	analy-cs	on	reduced	data.	

– E.g.	-meline	of	changes,	instead	of	whole	system.	
The	structure	of	diskprint	data	

Lineage	graph	
The	diskprint	lineage	graph	

A	machine’s	state	is	related	to	its	ancestors.	
The	diskprint	lineage	graph	

A	machine’s	state	is	related	to	its	ancestors.	

																				The	history	can	fork.	

																				The	tree	is	rooted	at	

																				the	baseline	OS.	
The	diskprint	lineage	graph	

A	machine’s	state	is	related	to	its	ancestors.	

																				The	history	can	fork.	

																				The	tree	is	rooted	at	

																				the	baseline	OS.	
The	diskprint	lineage	graph	

A	machine’s	state	is	related	to	its	ancestors.	

																				The	history	can	fork.	

																				The	tree	is	rooted	at	

																				the	baseline	OS.	

																				The	lineage	graph

																				is	all	of	the	trees.	
The	diskprint	analysis	workflow	

Lineage-based	differencing	
The	diskprint	analysis	workflow	

Some	results	can	be	derived	from	a	single	snapshot.	
The	diskprint	analysis	workflow	

Some	results	can	be	derived	from	a	single	snapshot.	
The	diskprint	analysis	workflow	

Some	results	come	from	two	snapshots.	
Results	

New-content	data	sets	
Now	available:	

File	system	difference	data	

• File	system	changes	available	in:	

– Differen-al	DFXML	

– NSRL	RDS	format	(CSV)	

– CybOX

• Sector	hashes	of	new	and	modified	files	

• hgp://www.nsrl.nist.gov/dskprt/sequence.html
Research	

Registry-based	soHware	signatures	
Developing	soMware	signatures	

• What	ar-facts	are	dis-nct	to	an	applica-on?	

– Or,	have	sufficient	affinity?	

• Can	the	Windows	Registry	show	the	soMware	

history	of	a	computer?	

– A	boon	to	triage.	
Methodology:	“Document”	search	

1. Observe	the	sets	of	Registry	ar-facts	created	

by	a	snapshot.	

2. Assemble	those	sets	into	“Fingerprint	

documents”	

3. Query	with	a	Registry.	
Signature	challenges	

• Some	indis-nct	ar-facts	confuse	signatures.	

– Need	“Background	noise”	iden-fica-on.	

• (See	me	at	poster	session	for	more.)	
Summary	

Data	in	use,	

research	on	horizon.	
Community	

• Forensic	standards	

– MITRE	

• Archival	applica-ons	of	Digital	Forensics	

– BitCurator

• Academia	

– George	Mason	University	

– San	Jose	State	University	

– University	of	California,	Santa	Cruz	
Conclusion	

• Diskprints	are	a	record	of	system	states.	

• The	workflow	extracts	ar-facts	and	behaviors.	

• Ar-fact	agribu-on	tells	a	computer’s	

soMware	story.