hemu1438/forensicsgpt-training-data huggingface dataset:
Outlook header format -
Microsoft Office Outlook 2003 ( 11.5608.5606 )
From: "Username" <username@sendinghost.com> To: "'Username'" <username@receivinghost.com> Subject: header test Date: Sat, 28 Jul 2007 22:02:14 +0200 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0003_01C7D162.F589D6C0" X-Mailer: Microsoft Office Outlook, Build 11.0.5510 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1081 Thread-Index: DcfRUi9X1F1oqQo8TgRTgfuoq+BT/A== 
Seems to be like Message-ID was with Thread-Index replaced.
Microsoft Outlook 2000 (9.0.0.2711) IMO ( Internet Mail Only ) Edition.
From: "Username" <username@sendinghost.com> To: "Username" <username@receivinghost.com> Subject: header test Date: Sat, 28 Jul 2007 14:11:13 +0200 Message-ID: <NMBBKEGJPJBBOOBCOCGMKEACCAAA.username@sendinghost.com> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2314.1300 
Microsoft Oulook 97
Received: by localhost with Microsoft Mail id <01C7D126.F90D2860@localhost>; Sat, 28 Jul 2007 14:52:52 +0200 Message-ID: <01C7D126.F90D2860@localhost> From: Username <username@sendinghost.com> To: "'Username'" <username@receivinghost.com> Subject: header test Date: Sat, 28 Jul 2007 14:52:46 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit
Pine header format -
Pine composes headers in the following format:
Date: Tue, 6 Mar 2007 11:10:36 -0500 (EST) From: Sender Name <sender@host.com> To: Getter Name <getter@otherhost.com> cc: Other Person <somebody@somehost.com> Subject: The subject text Message-ID: <Pine.LNX.4.64.0703061056380.29699@host.com> 
Using the function generate_message_id in the file reply.c we can see that the format for the Message-ID line is a series of fields separated by periods, followed by the @ symbol and the hostname of the sending machine. The fields are
The word Pine
A three letter version of the operating system name (e.g. LNX for Linux)
The major version of Pine
The minor version of Pine
A number YYMMDDHHmmssX, Where YY is the last two digits of the year, MM the current month, DD the current day of the month, HH the current hour, mm the current minute, ss the current second, and X is either a zero or one depending on the number of seconds.
The current process ID number
Note that the timestamp in the Message-Id may not necessarily match the Date line.
The hostname can be ROT-13 encrypted on some configurations. If the hostname is not defined, the value huh will be used.
Moto x play (xt1563) chip off -
Tear Down
Remove the back panel, and SIM tray from the top of the phone.
There are 17 Torx-4 screws that are glued in the back. Be careful not to strip them when removing them.
Remove the two battery cables, and carefully peel the battery away from the glue on the motherboard.
| | |
Remove the two ribbon cables from the left side of the motherboard and carefully peel it away from the glue on the underside. Be careful not to bend the board in the middle where all the chips reside.
Heat the middle of the board under a hot air gun until the heat shields pull off. The memory chip should also be ready to pull off at this point. Despite all the glue on the rest of the phone, there was no epoxy on our test phone’s NAND.
Prepare the chip for reading with a little flux, and re-tin the pads if needed. In this case, our chip is a Toshiba THGBMFG7C2LBAIL/16GB which was read in an 11.5x13 Sireda adapter, and can also be read in an UP-828 programmer using the VBGA169E adapter.
Private information in disk images -
Disk images potentially contain a lot of information. Below is a list of information on disk images that we consider private and information that we do not consider private. Please feel free to edit this list as appropriate. Where possible, please provide references for your claims.
Private Information
File names in general should be considered private.
File contents.
User account Names.
Geolocation information
MAC addresses and IP addresses extracted from the disk.
Note: Multi-case MAC addresses and private address space IP addresses are not privacy-sensitive.
Serial number of the drive (currently there are no publicly available databases of serial numbers, but such a database could later be released, making serial numbers private).
Hash of the hard drive.
Wireless networks to which you have associated.
File names and executables that are from applications that are contraband, sensitive, or not widely available.
Files that are encrypted need to be treated as private until they are decrypted, because you don't know what's inside them.
Non-Private Information
City, Country of origin (where it obtained)
Size of Disk
Manufacturer of hard drive and model number.
Time stamps (therefore, timeline information is not private, but the names of the files modified are private).
Operating System Version
Number of accounts on the disk.
Hashes of individual files.
Histogram of file types.
Number of partitions.
Overall storage allocation.
File names of executables and DLLs that are part of widely available software packages (e.g., applications in NSRL).
Mutt header format -
Date: Sat, 28 Jul 2007 18:29:15 +0200 To: Username <username@receivinghost.com> Subject: header test Message-ID: <20070728162915.GA2046@localhost> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.5.13 (2006-08-11) From: Username <username@sendinghost.com> 
The format of the Message id field is:
Four digits for the current year
Two digits for the current month
Two digits for the current day of the month
Two digits for the current hour
Two digits for the current minute
Two digits for the current second
A period followed by the capital letter 'G'
A capital letter. The first message sent will have the letter 'A', the next 'B', and then 'C' until the 26th message will have 'Z'. The 27th message sent starts again with 'A'.
The current process id number
The '@' symbol
The fully qualified domain name of the sending computer.
The above was based on the function mutt_gen_msgid in mutt/sendlib.c.
Live view -
Live View is a Java-based graphical forensics tool that creates a VMware virtual machine out of a raw image file or physical disk. This allows a forensic examiner to "boot up" the image or disk and gain an interactive, user-level perspective of the environment, all without modifying the underlying image or disk. Because all changes made to the disk are written to a separate file, the examiner can instantly revert all of his or her changes back to the original pristine state of the disk. The end result is that one need not create extra "throw away" copies of the disk or image to create the virtual machine.
Live View is capable of booting
Full disk raw images
Bootable partition raw images
Physical Disks (attached via a USB or Firewire bridge)
Containing the following operating systems
Windows 2008, Vista, 2003, XP, 2000, NT, Me, 98
Linux (limited support)
Behind the scenes, Live View automates a wide array of technical tasks. Some of these include: resolving hardware conflicts resulting from booting on hardware other than that on which the OS was originally installed; creating a customized master boot record for partition-only images; and correctly specifying a virtual disk to match the original image or physical disk.
Live View is developed by CERT, Software Engineering Institute
External Links
Official website
CERT, Software Engineering Institute homepage
References -
Making iris recognition more reliable and spoof resistant, by Adam Czajka, Przemek Strzelczyk, and Andrzej Pacut, SPIE 2007.
Biometric Technology Today has many articles on iris identification.
Introduction to Iris Recognition by John Daugman
IRIS06
NIJ-TSA Iris RecognItion Study 2006 (IRIS06). A test to evaluate online, offline, and off-axis performance of three commercially-available iris recognition systems.
Residual data -
Residual Data is data that is unintentionally left behind on computer media. In forensic usage, remnant data is typically left behind after attempts have been made to delete the data, after the data has been forgotten, or after the media on which the data resides has been decomissioned.
Residual data appears at all levels of modern computer systems:
Computer systems that are discarded.
Partitions in hard drives that are deleted.
Files on hard drives that are deleted but not overwritten.
Snippets of text in Microsoft Word files.
Heap variables that are freed with free()
Automatic variables left on the stack of languages like C or garbage collected in languages like Java.
Papers
Scalable Exploitation of, and Responses to Information Leakage Through Hidden Data in Published Documents, by Byers, Simon, AT&T Research, April 2003
Understanding Data Lifetime via Whole System Simulation, by Chow, J., B. Pfaff, T. Garfinkel, K. Christopher, M. Rosenblum, Proceedings of the 13th USENIX Security Symposium, 2004.
Garfinkel, S. and Shelat, A., "Remembrance of Data Passed: A Study of Disk Sanitization Practices," IEEE Security and Privacy, January/February 2003.
See Also
Residual Data on Used Equipment
Residual Data in Document Files
Sanitizing Tools
Remnant Data
Residual data on iPhones
Rfid -
RFID stands for Radio Frequency IDentification. It typically applies to a technology that uses radio waves to automatically identify people or objects. While there are various ways to identify, the most common is to store a serial number that represents a person or object identity and possibly other information, on a microchip that is attached to an antenna. Collectively the microchip and antenna represent a RFID transponder or an RFID tag. The antenna gives the chip ability to transmit identity information to a RFID reader. Then the RFID reader converts the radio waves into digital information that can then be passed to the computer for usage. RFID has been around since the 1970s. Since the radio waves from the low end of the electromagnetic spectrum, waves are safe as radio waves from a car radio.
RFID and Bar codes are different technologies and have different applications. The big difference between the two is bar codes are line-of-sight technology. A scanner requires a bar code be brought towards a scanner in order for it to be read. RFID on the other hand, doesn’t require line of sight. RFID tags can be read as long as they are within range of a RFID reader. If a label is somehow removed or damaged there is no way to scan the item.
Currently many forms and sizes such as personal items, services, and products use RFID worldwide. Currently in the United States, most public transportation such as trains, buses, and restaurants such as Mcdonald's all carry RFID receptacles that allow credit card transactions using MasterCard's PayPass. MasterCard PayPass is the payment feature that can be added to any MasterCard payment account to enable payments with a simple tap. PayPass is flexible enough that it can be built into cards or other devices such as key fobs, and can be used in markets that primarily issue smart cards or those that primarily issue magnetic stripe cards.
InfoSync reported that, Motorola and MasterCard are conducting field tests of new mobile phones that include Radio Frequency Identification (RFID) chips embedded in them as part of a cashless payment system dubbed PayPass. The phones will be equipped with Near Field Communication (NFC) systems, which will allow them to communicate with nearby readers to, for instance, pay for small purchases or tickets for transit or events simply by passing their phone close to a reader.
Once the phone and account has been identified by the RFID tag, the user's MasterCard account will be billed automatically by the network for the appropriate amount. MasterCard also sees potential for the phones as contactless readers, which it claims opens the door for "a variety of marketing a 1000 nd promotional applications", on which the company did not elaborate further.
The PayPass trials will be run by the end of the 2006 at various locations in the United States.
Portable media player -
A Portable Media Player (PMP) is a small device capable of playing audio and video files of different formats. Storage is either an internal hard drive, removable flash storage cards, or both. Most PMP's also have the ability to record audio or video, making them a convienent repository for media information.
Included Devices
Sony PSP
GamePark GP2X
Apple iPod (5th Generation or higher only)
Creative Zen Vision
Ruim -
Removable User Identity Module (R-UIM) is a card developed for CDMA handsets that extends the GSM SIM card to CDMA phones and networks. To work in CDMA networks, the R-UIM contains an early version of the CSIM application. The card also contains SIM (GSM) application, so it can work on both networks. It is physically compatible with GSM SIMs and can fit into existing GSM phones as it is an extension of the GSM 11.11 standard.
The card brings one of the main advantages of GSM to CDMA network phones. By having a removable identity card, CDMA users can change phones while keeping their phone numbers by simply swapping the cards. This simplifies many situations such as phone upgrades, phone replacements due to damage, or using the same phone on a different provider's CDMA network.
This form of card is widely used in China under the CDMA service of China Unicom(The CDMA service of China Unicom was acquired by China Telecom in 2008) . However, it is also used elsewhere such as India, Thailand, and Japan.
Safe block xp -
The System Acquisition Forensic Environment (SAFE) Block XP software is a software-based write blocker designed for the Windows XP 32 and 64 bit operating system. Because it is software based it allows for disk imaging speeds that are significantly faster than imaging in Windows using commercially available hardware-based write blockers. It also allows you to write block as many devices as are connected to the computer. It is application independent and works with all forensic acquisition and analysis software that works on Windows. In order to ensure that you are working forensically sound environment SAFE Block XP provides automatic write blocking of all directly attached media, including IDE (PATA & SATA), SCSI, FC, SAS, USB, and IEEE1394.
SAFE Block XP identifies and provides access to Host Protected Areas (HPAs) and Device Configuration Overlay (DCOs) on IDE (PATA and SATA) disks, connected directly via PATA or SATA controllers. HPAs are temporarily removed and make no permanent modification to the disk configuration, using volatile HPA commands. Since a DCO cannot be removed temporarily, SAFE Block XP preserves all DCO information, allowing safe removal of the DCO or HPA/DCO combination, then upon completion of the acquisition, replacement of the DCO or HPA/DCO combination back to its original state.
Notes
SAFE Block XP has passed all of NIST's Mandatory and Optional Test Assertions, including not allowing a protected drive to be changed, not preventing obtaining any information from or about any drive and not preventing any operations to a drive that is not protected.
Scoped distribution -
Tools libraries and frameworks built by or for goverment agencies often, although essentialy being "open source", can not be freely shared and redistributed.
In the most strict cases an NDA is used, but in some cases instead of this a scoped distribution is defined. With scoped distribution it is allowed to (re)distribute the product, but only under the conditions mentioned by the scope. An often used scope for forensic tools is the Law Enforcement (LEA) only scope.
Scott moulton -
Scott Moulton was the first person arrested for Port Scanning in January of 2000. During the defence, Scott found he had to train his lawyers on the technical aspects of computers in order to defend himself. This began his forensic computer career with a speciality in rebuilding hard drives for investigation purposes.
Many times working on a case, Mr. Moulton will be given hard drives that had already failed in an effort to “blame” the opposition or to slow down the work and cost the opposing forces more money. To combat the “blame” scenario, Mr. Moulton developed a skill at rebuilding hard drives and recovering data. In the five years since its inception, Mr. Moulton has handled many complex cases that include homicide, embezzlement, theft, divorce, child pornography and corporate fraud and continues to combat dead hard drives to this day.
Sealed digital evidence bags -
The concept of a Sealed Digital Evidence Bag describes the idea that digital evidence data and possibly its meta-data should be sealed in order to safeguard the integrity of the digital forensic process. In the narrow sense as defined by Schatz and Clark, the concept describes a way of formatting and signing forensic data, its meta-data and providence information in some kind of a digital forensic data storage file format. This narrow definition is useful mostly for the transport of forensic evidence between different parties, locations or practitioners by means of exchange of signed storage formats.
In a broader interpretation the same idea of sealed forensic data, its meta-data and providence information can be used not between people , organisations and legal entities, but between different forensic and non-forensic evidence data processing tools by means of access control and privilege separation techniques. This second approach to Sealed Digital Evidence Bags is used by MattockFS.
Sender policy framework -
Sender Policy Framework (SPF) is a system to eliminate spam based on the idea that only certain computers should be allowed to send mail for a given domain. SPF allows a domain's owner to specify which hosts may send mail purporting to be from that domain by creating TXT type records in the DNS for the domain. Unlike DomainKeys Identified Mail, only source hosts/addresses may be specified, meaning that should a host/IP address be compromised (such as by Address Resolution Protocol spoofing on an ethernet segment, or system compromise), unauthorized messages may still be sent originating from the given source address and would be accepted based on the SPF record. Any number of hosts may be specified in the TXT record for a given domain, and pointers to SPF records in other DNS zones may be included as well.
External Links
Sender Policy Framework - Project Overview
RFC 4408 - "Sender Policy Framework (SPF) for Authorizing Use of Domains in E-Mail, Version 1"
Wikipedia entry on Sender Policy Framework
Setting up a flash emulator -
Experiments with flash file system forensics can be done usefully using a flash emulator, such as the MTD device. This stores the "contents" of a simulated flash memory in a disk file. You can then use that disk file with JFFS2 or YAFFS. Follow these instructions.
First, you need to have MTD working. Use this:
modprobe mtd jffs2 mtdram mtdchar mtdblock cat /proc/mtd
We will use the RAM MTD device, and then dump it into a file to get the results.
JFFS2
(from http://wiki.openmoko.org/wiki/Userspace_root_image)
mkfs.jffs2 --pad=0x700000 -o rootfs.jffs2 -e 0x4000 -n -d/tmp/jffsroot/ # for GTA01? mkfs.jffs2 --pad=0x700000 -o rootfs.jffs2 -e 0x20000 -n -d/tmp/jffsroot/ # for GTA02 export loop=$(losetup -f) losetup $loop <rootfs.jffs2> modprobe block2mtd block2mtd=$loop,131072 modprobe jffs2 modprobe mtdblock mkdir /mnt/jffs2 mount -t jffs2 -o ro /dev/mtdblock0 /mnt/jffs2 
YAFFS
flash_eraseall mtd_debug write /dev/mtd1 0 16777216 /dev/zero mount /dev/mtdblock1 /mnt/yaffs do smoething umount /mnt/yaffs mtd_debug read /dev/mtd1 0 16777216 mtd-output # writes to the file mtd-output
Sticky notes -
Sticky Notes
Sticky Notes are a feature of Windows 7 that allows a user to create sticky notes on their desktop. The functionality of this feature is somewhat limited, in that the user can change the text, font, color, location and size of the sticky notes, but not much else.
Sticky Notes are maintained in a single file (stickynotes.snt) located in the user's profile ("%UserProfile%\AppData\Roaming\Microsoft\Sticky Notes"). This file is based on the MS OLE/compound file binary format. The .snt file can be opened and viewed using the MiTec Structured Storage Viewer.
When sticky notes files are created, an OLE storage stream using a name similar to "e3a17883-cfd8-11e0-8" is added to the stickynotes.snt file. Each storage stream has three file streams associated with it, and for all sticky notes, they are named 0, 1, and 3. The 0 stream contains the rich text format (RTF) "document" for the sticky note, and the 3 stream contains the actual text of the sticky note, in Unicode format.
The forensic value of Sticky Notes has yet to be determined or demonstrated. The Root Entry of the OLE format file will have a modification time associated with it, and each of the storage streams the contain the sticky notes will have creation and modification times (M and B of the MACB times) associated with them. These times are maintained in the FILETIME format, and can be included in a timeline of system activity in order to demonstrate user activity on the system.
When sticky notes are deleted, the storage streams associated with those notes are removed from the stickynotes.snt file; however, the Version and Metafile streams remain. The Metafile stream format is not documented at this time; however, this stream appears to contain references to the names of the storage streams that contain the sticky notes.
Tools
Tools that can be used to parse and view the contents of Sticky Notes files include (but are not limited to):
MiTeC Structured Storage Viewer
Sticky Notes Parser (found at this Google Code site; Win32 binary command line tool, all times are displayed in UTC format. Output formats include a listing of the available notes, CSV, and TLN format (for inclusion in a timeline). Also displays the modification time of the Root Entry.
Spyware detection tools -
Spyware detection tools can find the presence of spyware (but not always). Some tools will only find spyware on the running system; others can find it on any disk.
It is useful to know if there is spyware on a system you are investigating.
If you are trying to prove guilt of the system's primary user:
You need to understand what the spyware on the system can do and what it can't do
If you are trying to prove innocence:
The presence of spyware can mean that someone else is running system
One way to find spyware is to set up a virtual machine with a disk image of the captured system, install the spyware detector, and then
Tools recommended for finding spyware in a forensic context:
Spyware Doctor (in Google Pack)
System time -
The system time of a computer is typically the time and date of the computer's real time clock. Typically this information is not stored in a disk image but must be recovered separately when a computer is acquired.
It is a good idea to determine the system time so that you can state that the times in the file system are aligned with the times of a correct wall clock.
Determine the System Time
PC
The system time of most PCs can be determined by booting into the BIOS and reading the system clock.
Macintosh
The system time of most Intel-based Macintoshes can be determined by booting a USB device equipped with rEFIt. This gives access to an EFI shell. You can now issue the date and time commands. Note that the time will be in GMT and the date will be in mm/dd/yy format.