Na#onal	So)ware		

Reference	Library	

Douglas	White	

nsrl@nist.gov							www.nsrl.nist.gov
NSRL	Core	
NSRL	Core	

All	published	data	is	traceable	to	original	media.	

Collects	metadata	about	files	which	can	be	used	to	uniquely		

iden#fy	files	and	their	provenance.	

Metadata	is	used	during	inves#ga#ons	to	automa#cally		

• Eliminate	known	files	

• Target	files	of	interest	

Supported	by	the	U.S.	Department	of	Homeland	Security,		

federal,	state,	and	local	law	enforcement.	
NSRL	Core	+	Storage	
NSRL	Core	+	Storage	

All	media	are	copied	to	network	storage	

using	forensic	methods.	

Repeatable	processes	can	be	performed.	

Media	degrada#on	can	be	managed.	

Easy	to	incorporate	new	algorithms.	

Easy	to	extend	metadata	collec#on		

and	measurement.	
NSRL	Expansion	
NSRL	Expansion	

Physical	media	have	become	less	popular.	

Downloaded	so)ware	has	a	provenance.	

Expansion	into	acquiring	downloads	enables	

• Greater	coverage	of	popular	so)ware	

• Ability	to	add	mobile	apps	

• Route	for	collabora#on	with	other	collec#ons	
NSRL	Expansion	+	Corpus	
NSRL	Expansion	+	Corpus	

Research	environment	apart	from	core.	

Corpus	built	from	all	dis#nct	files	from	media.	

Algorithms	and	processes	can	be	applied	to	

media	images	and	to	subsets	of	files.	
NSRL	Expansion	+	Corpus	

Alternate	algorithm	examples:		

• SHA-256,	SHA-512,	SHA-3	

• ssdeep,	sdhash

• fiwalk,	bulk_extractor

• Memory	carving	

• Manifest	processing	

• Block	or	sector	processing	
NSRL	Next	Genera#on	
NSRL	Next	Genera#on	

NSRL	uses	virtual	machine	(VM)	technology	to	

inves#gate	the	forensics	of	the	so)ware	life	

cycle.	
NSRL	Next	Genera#on	

Diskprin#ng

Mary	Laamanen

Alex	Nelson	
NSRL	Expanded	Core	

Mo#va#on	

Gather	data	on	the	specific	effects	of	individual	so)ware	

packages	on	a	system	over	the	so)ware's	life#me.		

Provide	digital	forensic	inves#gators	with	new	reference	data.	

Extend	the	NSRL	research	environment	for	use	by	forensic	

researchers	to	develop	new	tools	and	techniques.	
Systems	and	So)ware	

All	so)ware	is	part	of	the	NSRL	library		

-	Provides	Traceability	

Opera#ng	System	

							-	Focus	on	versions	of	Microso)	Windows	

So)ware	applica#ons		

-	Chosen	based	on	recommenda#ons	
Virtual	Machine	Advantages	

VM	state	can	be	captured	at	any	#me	

-	VM	may	be	paused	/	suspended	

VM	is	preserved	as	a	set	of	files	

-	Hard	drive,	RAM	contents,	etc

Can	be	copied	off	for	external	processing	

Saved	for	future	reference	
Baseline	 Ar#facts	

Installa#on	

Running	

Uninstalla#on	

Reboo#ng	
Captured	Data	

Filesystem	(file	hashes,	MAC	#mes,	etc)	

					-	Executables	

	 	-	Libraries	

	 	-	etc.	

	Configura#on	informa#on	

						-	Windows	Registry	

	Memory	mapping	informa#on	

	-	System	RAM	

	Network	communica#on	

		-	pcap	files

 
Snapshot	Metadata	

Snapshot	Id	–	Unique	Id	

Applica#on	Lifecycle	State	–	Record	the	

applica#on	lifecycle	stage	

Snapshot	Notes	–	Record	all	user	ac#ons	taken	

when	genera#ng	the	snapshot	including	

unexpected	behavior	
Processing	Workflow	

What	do	we	do	with	all	this	data?	
NSRL	Next	Genera#on	–	

Diskprin#ng

Mary	T.	Laamanen1,	Alex	J.	Nelson2,3	

1	NIST	

2	Prometheus	Compu#ng	

3	University	of	California,	Santa	Cruz