4/24/2003 

Computer Forensics:

Tool Testing 

&

National Software Reference Li

Computer Forensics:

Tool Testing Tool Testing 

&

National Software Reference Lib

National Software Reference Li

Jim Lyle and Doug White

Information Technology Laboratory

24 April 2003
4/24/2003 

Outline Outline

z Overview of computer forensics at NIz Description of CFTT and NSRL projez Questions and answers
4/24/2003 

A Shocking Revelation . 

A Shocking Revelation . 

Computers can be involved in crime ...z As a victimz As a weaponz As a witnessz As a recordz As contraband
4/24/2003 

Outline of an Investigatio

Outline of an Investigatio

z Get proper authorizationz Seize evidence (Hard drives, floppies z Create duplicates for analysisz Analyze the duplicates

– Exclude known benign files– Examine obvious files– Search for hidden evidence

z Report results
4/24/2003 

Investigators Need ... Investigators Need ...

Computer forensic investigators need too

that ...

z Work as they should andz Produce results admissible in courtz Reference data to reduce analysis work
4/24/2003 

Goals of CF at NIST Goals of CF at NIST

z Establish methodology for testing com

forensic tools (CFTT)

z Provide international standard referenc

data that tool makers and investigators use in an investigations (NSRL)
4/24/2003 

Computer Forensics 

Parteners

Computer Forensics 

Parteners

NIST NIST

(OLES, ITL) (OLES, ITL) (OLES) (NIJ, FBI)

DoJ DoD

(DCCC

TREASURY

(USCS, 

USSS)

National

Agencies

Home

Secur

State/Local
4/24/2003 

Why NIST/ITL is involve

• Mission: Assist federal, state & l

agencies

• NIST is a neutral organization – n

law enforcement or vendor

• NIST provides an open, rigorous 

process
4/24/2003 

Computer Forensics in IT

Computer Forensics in IT

Located in Software Diagnostics and 

Conformance Testing (SDCT) Divisi

– Includes development of specifications 

conformance tests for use by agencies aindustry

– Work is funded by Federal agencies and 

NIST internal funds

z Homeland Security support of agenc

investigating terrorist activities
4/24/2003 

Computer Forensics Too

Computer Forensics To

Testing (CFTT) Testing (CFTT)
4/24/2003 

A Problem for Investigato

A Problem for Investigato

Do forensic tools work as they should?z Software tools must be ...

– Tested: accurate, reliable & repeatable– Peer reviewed– Generally accepted

z ... by whom?z Results of a forensic analysis must be 

admissible in court
4/24/2003 

CFTT Presentation Overv

CFTT Presentation Overv

z Project Tasksz Current activitiesz Challengesz Testing Hard Drive Imaging Toolsz Benefits of CFTT
4/24/2003 

Project Tasks Project Tasks

z Identify forensics functions e.g., 

– disk imaging, – hard drive write protect, – deleted file recovery

z Develop specification for each categorz Peer review of specificationz Test methodology for each functionz Report results
4/24/2003 

Current Activities Current Activities

z Hard drive imaging toolsz Software hard drive write protectz Hardware hard drive write protectz Deleted file recovery
4/24/2003 

Challenges Challenges

z No standards or specifications for toolz Forensic vocabulary incompletez Arcane knowledge domain (e.g. DOS)z Reliably faulty hardware
4/24/2003 

Hard Drive Imaging Hard Drive Imaging

z SCSI vs IDEz Drive accessz Clone vs imagez Excess sectors on dstz I/O errorsz Corrupt image file
4/24/2003 

Testing Hard Disk Drive Testing Hard Disk Drive 

Imaging Tools Imaging Tools

• Source disk not changed• Copied information is accurate• Behavior if source is smaller than 

destination

• Behavior if source is larger than 

destination

Need to verify...
4/24/2003 

Testing Hard Disk Drive Testing Hard Disk Drive 

Imaging Tools Imaging Tools

• Detect change SHA-1• Compare Source to Destination• Track relocated information

Testing support Tools

CYL/HD/SEC LBA

ASCII String 25 bytes Fill Bytes 487 Bytes
4/24/2003 

Testing Hard Disk Drive Testing Hard Disk Drive 

Imaging Tools Imaging Tools

Setup SourceWipe

A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1AA1A1A1A1A1A1A1A1A1A1A1A1A1A1A1AA1A1A1A1A1A1A1A1A1A1A1A1A1A1A1AA1A1A1A1A1A1A1A1A1A1A1A1A1A1A1AA1A1A1A1A1A1A1A1A1A1A1A1A1A1A1AA1A1A1A1A1A1A1A1A1A1A1A1A1A1A1AA1A1A1A1A1A1A1A1A1A1A1A1A1A1A1AA1A1A1A1A1A1A1A1A1A1A1A1A1A1A1AA1A1A1A1A1A1A1A1A1A1A1A1A1A1A1AA1A1A1A1A1A1A1A1A1A1A1A1A1A1A1AA1A1A1A1A1A1A1A1A1A1A1A1A1A1A1AA1A1A1A1A1A1A1A1A1A1A1A1A1A1A1AA1A1A1A1A1A1A1A1A1A1A1A1A1A1A1AA1A1A1A1A1A1A1A1A1A1A1A1A1A1A1AA1A1A1A1A1A1A1A1A1A1A1A1A1A1A1AA1A1A1A1A1A1A1A1A1A1A1A1A1A1A1AA1A1A1A1A1A1A1A1A1A1A1A1A1A1A1AA1A1A1A1A1A1A1A1A1A1A1A1A1A1A1AA1A1A1A1A1A1A1A1A1A1A1A1A1A1A1AA1A1A1A1A1A1A1A1A1A1A1A1A1A1A1AA1A1A1A1A1A1A1A1A1A1A1A1A1A1A1AA1A1A1A1A1A1A1A1A1A1A1A1A1A1A1AA1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A

Load OSHash
4/24/2003 

Testing Hard Disk Drive Testing Hard Disk Drive 

Imaging Tools Imaging Tools

Select SourceWipe DestinationRun ToolCompare Src : DstHash Source

A1A1A1A11A1A1A1A1A1A1

A1A1A1A1A1A1A1A1A1A1A

A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1

A1A1A1A1A1A1A1A1A1A1A1

A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1

A1A1A1A1A1A1A1A1A1A1A1

A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1

4C4C4C4C4C4C44C4C4C4C4C4C44C4C4C4C4C4C44C4C4C4C4C4C44C4C4C4C4C4C44C4C4C4C4C4C44C4C4C4C4C4C44C4C4C4C4C4C44C4C4C4C4C4C44C4C4C4C4C4C44C4C4C4C4C4C44C4C4C4C4C4C44C4C4C4C4C4C44C4C4C4C4C4C44C4C4C4C4C4C44C4C4C4C4C4C44C4C4C4C4C4C44C4C4C4C4C4C4

A1A1A1A11A1A

A1A1A1A1A1A1A

A1A1A1A1A1A1AA1A1A1A1A1A1AA1A1A1A1A1A1AA1A1A1A1A1A1AA1A1A1A1A1A1AA1A1A1A1A1A1AA1A1A1A1A1A1AA1A1A1A1A1A1AA1A1A1A1A1A1AA1A1A1A1A1A1A

A1A1A1A1A1A1A

A1A1A1A1A1A1AA1A1A1A1A1A1AA1A1A1A1A1A1A

A1A1A1A1A1A1A

A1A1A1A1A1A1AA1A1A1A1A1A1A
4/24/2003 

Impact

z Release 18 (Feb 2001) - A US governm

organization was doing some testing auncovered an issue under a specific secircumstances. 

z Linux doesn’t use the last sector if oddz Several vendors have made product or 

documentation changes
4/24/2003 

Benefits of CFTT Benefits of CFTT

Benefits of a forensic tool testing progra

– Users can make informed choices– Neutral test program (not law enforcemen– Reduce challenges to admissibility of dig

evidence

– Tool creators make better tools
4/24/2003 

Lab Facilities Lab Facilities
4/24/2003 

NSRL Project NSRL Project
4/24/2003 

Introduction Introduction

The National Software Reference Library is:z A physical collection of over 3,800 software 

packages on secured shelves

z A database of file “fingerprints” and additio

information to uniquely identify each file on shelves

z A Reference Data Set (RDS) extracted from 

database onto CD, used by law enforcementinvestigators and researchers
4/24/2003 

Addressing Industry Nee

Addressing Industry Nee

z No unbiased organizations were involved in 

implementing investigative tools

z Law enforcement had no control over qualit

data provided by available tools – data was market-driven

z Traceability - No repositories of original sof

available for reproducing data

z Each tool provided a limited set of capabilit
4/24/2003 

NSRL Software Collectio

NSRL Software Collectio

z Media in format as available 

to the public

z Consumer products available 

in stores

z Developer products available 

as vendor services

z Malicious softwarez “Cracked” software
4/24/2003 

NSRL Software Collectio

NSRL Software Collectio

z Balance of most popular (encountered 

often) and most desired (pirated often) 

– Currently 32 languages

z Software is purchased commerciallyz Software is donated under non-use polz List of contents available on website

www.nsrl.nist.gov
4/24/2003 

NSRL Software Databas

NSRL Software Databas

z Information to uniquely identify every 

on every piece of media in every appli

z Database schema is available on websz 4,200 Bytes per applicationz 750 Bytes per filez Total database size now 9 GB for 3,80

applications with 13,400,000 files
4/24/2003 
4/24/2003 

NSRL Reference Data S

NSRL Reference Data S

z The Reference Data Set (RDS) is a sel

of information from the NSRL databas

z Allows positive identification of 

manufacturer, product, operating systeversion, file name from file “signature

z Data format available for forensic tool 

developers

z Published quarterly
4/24/2003 

Use of the RDS Use of the RDS

z Eliminate as many known files as possible f

the examination process using automated m

z Discover expected file name with unknown 

contents

z Identify origins of filesz Look for malicious files, e.g., hacker toolsz Provide rigorously verified data for forensic 

investigations
4/24/2003 

RDS Field Use Example RDS Field Use Example

Windows 2000 operating system software contain5933 images which are known gifs, icons, jpeg filYou are looking for facility maps on a computer which is running Windows 2000.By using the RDS and an analysis program the investigator would not have to look at these files tcomplete her investigation.e.g., 
4/24/2003 

RDS Field Use Concep

RDS Field Use Concep

KNOWN FILES

RDS

ANALYSIS

PROGRAM

UNKNOWN FILE

FILES

Disk Drive
4/24/2003 

http://www.cbsnews.com/stories/2003/01/16/tech/main536774.shtml
4/24/2003 

Hashes

z Like a person’s fingerprintz Uniquely identifies the file based on contenz You can’t create the file from the hashz Primary hash value used is Secure Hash 

Algorithm (SHA-1) specified in FIPS 180-1160-bit hashing algorithm

– 1045 combinations of 160-bit values

z “Computationally infeasible” to find two di

files less than 264 bits in size producing the 

SHA-1

– 264 bits is one million terabytes
4/24/2003 

Hashes

z SHA-1 values can be cross-referenced 

other products that depend on differenvalues

z Other standard hash values computed 

each file include Message Digest 5 (Mand a 32-bit Cyclical Redundancy Checksum (CRC32), which are useful tools and to users outside LE
4/24/2003 

Hash Examples Hash Examples

Filename Bytes SHA-1

NT4\ALPHA\notepad.exe 68368 F1F284D5D757039DEC1C44A05AC1NT4\I386\notepad.exe 45328 3C4E15A29014358C61548A981A4ANT4\MIPS\notepad.exe 66832 33309956E4DBBA665E86962308FENT4\PPC\notepad.exe 68880 47BB7AF0E4DD565ED75DEB492D8CWINNT31.WKS\I386\notepad.exe 57252 2E0849CF327709FC46B705EEAB5EWINNT31.SRV\I386\notepad.exe 57252 2E0849CF327709FC46B705EEAB5E
4/24/2003 

Related History Related History

z CRC concept dates from 1960’sz MD5 algorithm published in 1991z Tripwire open source tool 1992z Unix command “md5sum” availablez FIPS 180-1 (SHA-1) published in 199z Unix command “sha1sum” availablez Known File Filter project 1998z FIPS 180-2 (SHA-512) published in 2
4/24/2003 

Hashes in P2P Hashes in P2P

KaZaA Peer-to-Peer (P2P) FastTrack File Formatshttp://kzfti.cjb.net/
4/24/2003 

SHA-1 Mathematics 1 Mathematics

z Bit sequence is padded to a multiple of 512z Messages of 16 32-bit words, n*512, n>0z 80 logic functions are defined that accept 3 

words and produce 1 32-bit word

z 80 constants defined, 5 32-bit buffers initialz 80 step loop: 

– Manipulate message into 80 32-bit words– Use shifts, functions, addition on buffers

z 160-bit SHA is string in the 5 32-bit buffers
4/24/2003 

Application of RDS Application of RDS
4/24/2003 

NIST Research NIST Research

z Hash collisionsz Software distribution metricsz Operating/File system effects z Physical/Virtual machine effectsz “Mining” dynamic filesz Offsite hashing
4/24/2003 

Software Installation Issu

Software Installation Issu

z Dynamic files are “missed” by RDSz Installed on virtual machines which ca

saved in the NSRL on media

z Delineation of static sections of files f

probability of identification

z Independent of installation location
4/24/2003 

NARA Research NARA Research

z Use hashing process on non-classified 

Presidential materials

z Identify application filesz Identify duplicate filesz Access to older installed software
4/24/2003 

NARA Statistics NARA Statistics

z 93 computer systems 

– Pre-filtered to contain only software

z 51,146 individual files z 7,610 file names z 11,118 distinct files (SHA-1)z 8,077 files originating in specific applicatiz 4,326 of 8,077 exactly match application f

names
4/24/2003 

Further NARA Researc

Further NARA Researc

z Building profile of a “master” imagez Statistical weights for application 

identification

z Cross-system relationshipsz Installation locationsz Old compression technologies
4/24/2003 

NSRL Environment NSRL Environment

z Isolated network with domain controller, DHz Database server, File server, Web serverz Batching stations use web browser interfacez Hashing constellationz Virtual machines for installationsz CVS source code repository
4/24/2003 

Input Process Input Process

z Package is acquiredz Web interface used to enter informatio

about manufacturer, product, OS and aan ID

z Media are batchedz Approximately 15 minutes per packag
4/24/2003 
4/24/2003 

Hashing Operations Hashing Operations

z Spring 2003 – accepting softwarez Hashing constellation runs 24/7z Processed over 13.4M files, 9M SHAsz Byte signature file type verificationz CAB, ZIP, TAR, SFX, UU, compress
4/24/2003 

Data Verification Data Verification

z Multiple and independent techniques from d

perspectives

– We use test files with known signatures– Parallel database system: Match results with oth– Human verification– Database rules and constraints– Periodic database queries: Predefined procedure

search for and report anomalies in the database

– User feedback: Error reports and RDS updates
4/24/2003 

Future Operation Tasks Future Operation Tasks

z More hardware platformsz More archive toolsz Redundant hashing in constellationz Scheduled rebatchingz Additional algorithms – AESz Open source LAMP distribution
4/24/2003 

NSRL Accomplishment

NSRL Accomplishment

z RDS CD Version 1.5 distributed 3/3/2

– 102 subscriptions (Vendors, corporations

universities, and law enforcement agenci

– Free redistribution, NIST traceable

z Incorporated into vendor productsz Used by FBI, DCCC, Secret Service, 

Customs Service (Homeland Security)
4/24/2003 

NSRL/CFTT Team NSRL/CFTT Team
4/24/2003 

Contacts Contacts

Jim Lyle Doug Whitewww.cftt.nist.gov www.nsrl.nist.gocftt@nist.gov nsrl@nist.govBarbara Guttmanbarbara.guttman@nist.govSue Ballou, Office of Law Enforcement StandardsSteering Committee Rep. For State/Local Law Enforcsusan.ballou@nist.gov 
4/24/2003