Just a quick post regarding forensics.
I’ve gotten some IM’s and feedback asking for some good links/blogs dedicated to computer forensics. If you head over to http://forensics.sans.org you’ll find a wealth of information and many links to forensics blogs/sites. You can thank Rob Lee of SANS for it.
Hey guys,
Darren was nice enough to include the full notes I sent to him in the actual posting on Rev3, but here’s a copy in case you wander over this way.
If you’re ever in a position where you have to perform forensic imaging duties on a machine, this segment may be useful to you! The overall goal is to be able to load a forensic .dd image into an environment where you can interact at the user level with it, and perform some initial analysis that may help to paint the overall picture of what happened later on.
Requirements: A Helix live CD (any of their versions should work, but I recommend 2.0)
Any machine that has an OS which is compatible with VMware
Either a removable drive, or enough free space on a network share in order to push the .dd image out to it.
Live View
Having VMware Workstation is a plus, but if not, Live View will automatically download and install VMware Server and the DiskMount utility for you, if you so choose.
Helix is a forensic Live CD with loads of tools. We’re focused on just the image acquisition part today. For the most part, the default options are fine, just specify where you are outputting the .dd image to and you’re on your way!
Install Live View and make sure you either let it install the necessary components, or already have VMware installed ahead of time. It tends to not like the absolute newest version of VMware Server, so ideally use the older one that it suggests. Open the .dd image with Live View, and either Start it directly or Generate the config files. Should you encounter problems with Starting it directly, use the generate config files option and then manually open the .vmx/.vmdk file from within VMware itself. Don’t forget to check the settings on the new VM and make sure the operating system is set correctly, the program does not always autodetect it.
In layman’s terms, this takes the forensic image and converts it to a virtual machine format, so you can interact with it as if you were the user. It does not write anything to the .dd image at all, but obviously I suggest using this with a COPY of the original .dd image you make of the suspect machine.
Have fun!