8/20/2003 

Computer Forensics:

Tool Testing 

&

National Software Reference Li

Computer Forensics:

Tool Testing Tool Testing 

&

National Software Reference Lib

National Software Reference Li

Jim Lyle & Doug White 

Information Technology Laboratory

20 August 2003
8/20/2003 

Outline Outline

z Overview of computer forensics at NIz Description of CFTT and NSRL projez Questions and answers
8/20/2003 

Computer Forensics Partn

Computer Forensics Partn

NIST NIST

(OLES, ITL) (OLES, ITL) (OLES) (NIJ, FBI)

DoJ DoD

(DCCC

TREASURY

(USCS, 

USSS)

Homela

Securi

National

Agencies

State/Local
8/20/2003 

State & Local LE Representa

State & Local LE Representa

z The National Institute of Justice (NIJ) 

major funding source:

– CFTT to date: $3.5 M– NSRL to date: $2 M

z The Program Manager for Forensic 

Sciences, Susan Ballou, of the Office oLaw Enforcement (OLES) at NIST, diNIJ funding to the appropriate expertiswhether within NIST or beyond.
8/20/2003 

A Shocking Revelation . 

A Shocking Revelation . 

Computers can be involved in crime ...z As a victimz As a weaponz As a witnessz As a recordz As contraband
8/20/2003 

Outline of an Investigatio

Outline of an Investigatio

z Get proper authorizationz Seize evidence (Hard drives, floppies z Create duplicates for analysisz Analyze the duplicates

– Exclude known benign files– Examine obvious files– Search for hidden evidence

z Report results
8/20/2003 

Investigators Need ... Investigators Need ...

Computer forensic investigators need too

that ...

z Work as they should andz Produce results admissible in courtz Reference data to reduce analysis work
8/20/2003 

Goals of CF at NIST Goals of CF at NIST

z Establish methodology for testing com

forensic tools (CFTT)

z Provide international standard referenc

data that tool makers and investigators use in an investigations (NSRL)
8/20/2003 

Why NIST/ITL is involve

• Mission: Assist federal, state & l

agencies

• NIST is a neutral organization – n

law enforcement or vendor

• NIST provides an open, rigorous 

process
8/20/2003 

Computer Forensics in IT

Computer Forensics in IT

Located in Software Diagnostics and 

Conformance Testing (SDCT) Divisi

– Includes development of specifications 

conformance tests for use by agencies aindustry

– Work is funded by Federal agencies and 

NIST internal funds

z Homeland Security support of agenc

investigating terrorist activities
8/20/2003 

Computer Forensics Too

Computer Forensics To

Testing (CFTT) Testing (CFTT)
8/20/2003 

A Problem for Investigato

A Problem for Investigato

Do forensic tools work as they should?z Software tools must be ...

– Tested: accurate, reliable & repeatable– Peer reviewed– Generally accepted

z ... by whom?z Results of a forensic analysis must be 

admissible in court
8/20/2003 

CFTT Presentation Overv

CFTT Presentation Overv

z Project Tasksz Current activitiesz Challengesz Testing Hard Drive Imaging Toolsz Benefits of CFTT
8/20/2003 

Project Tasks Project Tasks

z Identify forensics functions e.g., 

– disk imaging, – hard drive write protect, – deleted file recovery

z Develop specification for each categorz Peer review of specificationz Test methodology for each functionz Report results
8/20/2003 

Current Activities Current Activities

z Hard drive imaging toolsz Software hard drive write protectz Hardware hard drive write protectz Deleted file recovery
8/20/2003 

Challenges Challenges

z No standards or specifications for toolz Forensic vocabulary incompletez Arcane knowledge domain (e.g. DOS)z Reliably faulty hardware
8/20/2003 

Hard Drive Imaging Hard Drive Imaging

z SCSI vs IDEz Drive accessz Clone vs imagez Excess sectors on dstz I/O errorsz Corrupt image file
8/20/2003 

Testing Hard Disk Drive Testing Hard Disk Drive 

Imaging Tools Imaging Tools

• Source disk not changed• Copied information is accurate• Behavior if source is smaller than 

destination

• Behavior if source is larger than 

destination

Need to verify...
8/20/2003 

Testing Hard Disk Drive Testing Hard Disk Drive 

Imaging Tools Imaging Tools

• Detect change SHA-1• Compare Source to Destination• Track relocated information

Testing support Tools

CYL/HD/SEC LBA

ASCII String 25 bytes Fill Bytes 487 Bytes
8/20/2003 

Testing Hard Disk Drive Testing Hard Disk Drive 

Imaging Tools Imaging Tools

Setup SourceWipe

A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1AA1A1A1A1A1A1A1A1A1A1A1A1A1A1A1AA1A1A1A1A1A1A1A1A1A1A1A1A1A1A1AA1A1A1A1A1A1A1A1A1A1A1A1A1A1A1AA1A1A1A1A1A1A1A1A1A1A1A1A1A1A1AA1A1A1A1A1A1A1A1A1A1A1A1A1A1A1AA1A1A1A1A1A1A1A1A1A1A1A1A1A1A1AA1A1A1A1A1A1A1A1A1A1A1A1A1A1A1AA1A1A1A1A1A1A1A1A1A1A1A1A1A1A1AA1A1A1A1A1A1A1A1A1A1A1A1A1A1A1AA1A1A1A1A1A1A1A1A1A1A1A1A1A1A1AA1A1A1A1A1A1A1A1A1A1A1A1A1A1A1AA1A1A1A1A1A1A1A1A1A1A1A1A1A1A1AA1A1A1A1A1A1A1A1A1A1A1A1A1A1A1AA1A1A1A1A1A1A1A1A1A1A1A1A1A1A1AA1A1A1A1A1A1A1A1A1A1A1A1A1A1A1AA1A1A1A1A1A1A1A1A1A1A1A1A1A1A1AA1A1A1A1A1A1A1A1A1A1A1A1A1A1A1AA1A1A1A1A1A1A1A1A1A1A1A1A1A1A1AA1A1A1A1A1A1A1A1A1A1A1A1A1A1A1AA1A1A1A1A1A1A1A1A1A1A1A1A1A1A1AA1A1A1A1A1A1A1A1A1A1A1A1A1A1A1AA1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A

Load OSHash
8/20/2003 

Testing Hard Disk Drive Testing Hard Disk Drive 

Imaging Tools Imaging Tools

Select SourceWipe DestinationRun ToolCompare Src : DstHash Source

A1A1A1A11A1A1A1A1A1A1

A1A1A1A1A1A1A1A1A1A1A

A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1

A1A1A1A1A1A1A1A1A1A1A1

A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1

A1A1A1A1A1A1A1A1A1A1A1

A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1

4C4C4C4C4C4C44C4C4C4C4C4C44C4C4C4C4C4C44C4C4C4C4C4C44C4C4C4C4C4C44C4C4C4C4C4C44C4C4C4C4C4C44C4C4C4C4C4C44C4C4C4C4C4C44C4C4C4C4C4C44C4C4C4C4C4C44C4C4C4C4C4C44C4C4C4C4C4C44C4C4C4C4C4C44C4C4C4C4C4C44C4C4C4C4C4C44C4C4C4C4C4C44C4C4C4C4C4C4

A1A1A1A11A1A

A1A1A1A1A1A1A

A1A1A1A1A1A1AA1A1A1A1A1A1AA1A1A1A1A1A1AA1A1A1A1A1A1AA1A1A1A1A1A1AA1A1A1A1A1A1AA1A1A1A1A1A1AA1A1A1A1A1A1AA1A1A1A1A1A1AA1A1A1A1A1A1A

A1A1A1A1A1A1A

A1A1A1A1A1A1AA1A1A1A1A1A1AA1A1A1A1A1A1A

A1A1A1A1A1A1A

A1A1A1A1A1A1AA1A1A1A1A1A1A
8/20/2003 

Impact

z Release 18 (Feb 2001) - A US governm

organization was doing some testing auncovered an issue under a specific secircumstances. 

z Linux doesn’t use the last sector if oddz Several vendors have made product or 

documentation changes
8/20/2003 

Benefits of CFTT Benefits of CFTT

Benefits of a forensic tool testing progra

– Users can make informed choices– Neutral test program (not law enforcemen– Reduce challenges to admissibility of dig

evidence

– Tool creators make better tools
8/20/2003 

Lab Facilities Lab Facilities
8/20/2003 

CFTT/NSRL Team CFTT/NSRL Team
8/20/2003 

NSRL Project NSRL Project
8/20/2003 

Outline Outline

z NSRL Descriptionz RDS Descriptionz RDS Usez Project Newsz Your Needs
8/20/2003 

What is the NSRL? What is the NSRL?

z National Software Reference Library (NSRL)

– Physical library of software, 2400 products– SQL Server database of known file signatures– Reference Data Set (RDS): 16,200,000 file sign

z Goals

– Automate the process of identifying known files 

computers used in crimes

– Allow investigators to concentrate on files that c

contain evidence (unknown and suspect files)
8/20/2003 

Addressing Law Addressing Law 

Enforcement Needs Enforcement Needs

z LE needed an unbiased organizationz LE needed traceability for the NSRL 

contents

z No repositories of original software 

available for reproducing data

z NSRL needs to work with many CF to
8/20/2003 

Scope of the NSRL Scope of the NSRL

z NIST has collected software for 2 yz Software is recorded as the origina

for known files and stored as a part NSRL

z Versions of OS, DBMS, photo edit

word processors, network browsercompilers...

z Data formats, data dictionary and p

status information is available on thwebsite for RDS users and industry reference
8/20/2003 

What is the RDS? What is the RDS?
8/20/2003 

What is the RDS? What is the RDS?

z Reference set of file profiles

– Each profile includes file name, file size, 

signatures (SHA1, MD5, CRC32), applicname, operating system, etc.

– Extracted from files on original software 

diskettes, and network downloads

– A single application may have thousands 

separate file profiles
8/20/2003 

What is What is in the RDS? the RDS?

z “Known” files – not “known good”z Off-the-shelf, shrinkwrapped program

documented downloads

z Includes hacker tools, port scanners, 

network security tools, encryption

z Permuted index available at 

www.nsrl.nist.gov/index
8/20/2003 

RDS Use RDS Use

z Commercial tools import the RDS as a 

single hash set

z You may need to process the RDS dat

before importing it

z Perl scripts and unix shell scripts avail

on www.nsrl.nist.gov

z 4,300 separate hashsets on website
8/20/2003 

Hashes

z Compute a unique identifier for each file ba

contents 

z Primary hash value used in the NSRL RDS 

Secure Hash Algorithm (SHA-1) specified iFederal Information Processing Standard (F180-1, a 160-bit hashing algorithm

z SHA-1 values can be cross-referenced by ot

products that depend on different hash value
8/20/2003 

Hashes

z Other standard hash values computed for each file 

Message Digest 4 (MD4), Message Digest 5 (MD532-bit Cyclical Redundancy Checksum (CRC32), ware useful in many CF tools and to users outside LE

z Separate, parallel, and independent process is used 

validate the results of the primary RDS implementa

z Once verified and validated, the RDS is written to a 

CD, duplicated, and distributed through NIST’s StaReference Data Office as Special Database #28 (www.nist.gov/srd/nistsd28.htm).
8/20/2003 

Hash Examples Hash Examples

Filename Bytes SHA-1

NT4\ALPHA\notepad.exe 68368 F1F284D5D757039DEC1C44A05AC1NT4\I386\notepad.exe 45328 3C4E15A29014358C61548A981A4ANT4\MIPS\notepad.exe 66832 33309956E4DBBA665E86962308FENT4\PPC\notepad.exe 68880 47BB7AF0E4DD565ED75DEB492D8CWINNT31.WKS\I386\notepad.exe 57252 2E0849CF327709FC46B705EEAB5EWINNT31.SRV\I386\notepad.exe 57252 2E0849CF327709FC46B705EEAB5E
8/20/2003 

Hashing Installed Files Hashing Installed Files

z Currently testing methods for hashing 

installed files

z Installation of known packages in NSR

onto virtual machines

z Virtual machine state can be preserved 

CD on NSRL shelf for repeatability

z Comparison installation on physical 

machine
8/20/2003 

Installed Hash Findings Installed Hash Findings

z Installed MS W2K Pro on virtual mach

and physical machine; approx. 4,500 f

z RDS identified 79% of files on VM, 6

files on PM

z Hashed installed files on VM and PMz VM hashes identified another 5% on Pz PM hashes identified another 3% on V
8/20/2003 

Installed Hash Findings Installed Hash Findings

z Hashed 2 W2K Pro PCs “in the wild”z RDS, VM and PM hashsets identified 

of the 4,500 W2K files on the “wild” P

z The “wild” PC hashsets identified 80% 

the files on each other

z Installed hashes are necessaryz Patch/hotfix/update hashes are most cr
8/20/2003 

Data Verification Data Verification

z Multiple and independent techniques from d

perspectives

– We use test files with known signatures– Parallel database system: Match results with oth– Human verification– Database rules and constraints– Periodic database queries: Predefined procedure

search for and report anomalies in the database

– User feedback: Error reports and RDS updates
8/20/2003 

Project News Project News

z Hashing code (Mar. ’03) availablez Late Sept. – LAMP environment, cookbookz Peer-to-Peer hashesz Block size hashes – evidence chain, deleted z Multiple language researchz File format NOT changing ever againz Conversion tools availablez Dec. (?) – database on public internetz Interesting hashes – 200 steg tools, etc.
8/20/2003 

Your Needs Your Needs

z Opinions on “known” vs. “known gooz What can we do to make your work

– Faster?– Simpler?– Easier to explain in court?

z What software do you recommend to 

hashed?

z ???
8/20/2003 

Contacts Contacts

Jim Lyle Doug Whitewww.cftt.nist.gov www.nsrl.nist.gocftt@nist.gov nsrl@nist.govMark SkallChief, Software Diagnostics & Conformance Testing www.itl.nist.gov/div897 skall@nist.govSue Ballou, Office of Law Enforcement StandardsSteering Committee Rep. For State/Local Law Enforcsusan.ballou@nist.gov