System7

Spread the word, information is free.

Archive for category forensics

GPS Forensics & Google Earth

Nov 26

Posted by The Gunslinger in forensics | No Comments

I previously wrote about online GPS Forensic references and wanted to put them to use.  I had a suspicion that my girlfriend has been seeing another man.  When she was at work I grabbed her GPS (Garmin Nuvi 205) and connected it via USB (don’t forget a write blocker).  For Garmin models, the file you want to look for is “Current.gpx”

Once I copied Current.gpx, I installed Google Earth.  Earth actually imports several different GPS data/location files. Earth parsed all the recent destinations entered into the GPS and loads them as waypoints.  It makes it very convenient to find out where someone has been, where they might live (home location), etc.  Think about all the applications i.e. rental car GPS units.

***If you don’t want to use Earth you can open the gpx file in a text editor (simple XML).  You’ll be looking at lat/longitude coordinates that you can plot yourself.

Windows Anti Forensics Tip of the Day…

Nov 11

Posted by The Gunslinger in forensics, microsoft | No Comments

I previously wrote about how to have your system automatically clear the pagefile before a reboot or shutdown.  There’s a couple other steps I recommend you make on your system…

Automatically permanently delete (Nuke on Delete)- Normally Delete sends files to the Recycle Bin and a Shift+Delete will permanently delete them.  With the registry tweak below the normal Delete will also behave as a permanent delete. ***Note: Delete does not mean a file is deleted.  It only frees up the file record and clusters so they _could_ be overwritten.

  1. Go to Start -> Run and type Regedit
  2. On the left hand side select the “+” to navigate to the following.
  3. HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer \ BitBucket
  4. On the right look for NukeOnDelete
  5. Right click it and set the key value for NukeOnDelete to 1

Scheduled Task to Zero out unused disk space – As I mentioned above a deleted file only insures that there is a _chance_ the file will be overwritten.  If you run the below command it will zero out all unused disk space which _should_ be good enough to prevent file content recovery. ***Note: The deleted file name will still be lying around until a new file happens to overwrite it.

>cipher /W:[directory_to_wipe]

Here’s my scheduled task: C:\WINDOWS\system32\cmd.exe /c cipher /W:C:\

Scheduled Task to Delete Recent Items – Even if you permanently delete a file and or use Eraser there’s a copy of the filename in your Recent directory.  I have the following scheduled task command which clears my Recent items once a day….

Task for Recent Items:

>C:\WINDOWS\system32\cmd.exe /c del “c:\documents and settings\[username]\recent\*.lnk”

Task for Recent Office Items:

>C:\WINDOWS\system32\cmd.exe /c del /Q “C:\Documents and Settings\[username]\Application Data\Microsoft\Office\Recent\*.*”

Eraser - I highly recommend using this great freeware utility.  One of many things it does is adds a new option in your content menu to permanently delete a file and zero out the contents all at the same time.

GPS Forensics

Oct 5

Posted by The Gunslinger in forensics | 1 Comment

There’s a new GPS forensics community starting up here: http://www.gpsforensics.org/  Some additional information can be found here: http://www.forensicswiki.org/wiki/GPS

I’m going to examine my Garmin 200W this evening.  It looks like a simple text editor will reveal raw trip data including waypoints, date & time stamps, latitude & longitude coordinates and elevations.

Adobe Flash control panel

Sep 8

Posted by The Gunslinger in forensics, privacy | No Comments

I previously wrote about Flash cookies which many folks are not aware of.  Well, I’ve just stumbled across a great article which describes how to manage your Flash cookies and other settings.  The “control panel” is located on Adobe’s website: Flash control panel.

If you navigate to the Global Storage Settings tab you can disable “Allow third-party Flash content…”

You can read the article here.

—

Update: There’s a forensic goldmine in C:\Documents and Settings\[username]\Application Data\Adobe\Flash Player\#SharedObjects\

Penetration Testing & Capture the Flag

Jul 23

Posted by The Gunslinger in forensics, hardware & software, news | 1 Comment

Penetration Testing

Nowadays penetration testing is where it’s at.  Whether trying to learn security, becoming a white hat, or consulting it’s a must have skill.  However, it can be intimidating on where to start.  Besides picking up books the next best way to learn is through capture the flag events.

Important truths about pen testing

Capture the Flag

Computer/hacking capture the flag events are usually team based timed events where you’re pitted against several opponents and trying to earn the highest score.  Points are awarded for both offensive and defensive maneuvers.  Typically each team will have a virtual machine they need to defend while trying to exploit vulnerabilities in other team’s VM.

The best place to find one in your area (besides attending a con) is your local 2600 chapter.  If they don’t hold CTFs then try a local information security club.  If you live in the mountains and can’t find either you can use Hack This Site which runs virtual CTF events 24/7.

Remember, hacker (white hat) and cracker (black hat).

Windows Forensics tip of the day…

Jun 10

Posted by The Gunslinger in forensics | 1 Comment

The Windows page/swap file usually contains very recent information of a user’s activity.  Data is usually overwritten fairly quickly  — depending on how “busy” the system is.  The page file can store potentially sensitive and incriminating evidence.  The legality of admitting evidence found in a page/swap file is still sketchy in the judicial system. However, it’s always a good idea to play it safe.

If you don’t mind a slightly longer shutdown / restart time you can have your system write zero’s to the page file.  This is disabled by default.

Start -> Run -> regedit

Change the following key from a 0 to 1

HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\ClearPageFileAtShutdown

*The Microsoft KB article can be found here: http://support.microsoft.com/kb/314834

eDiscovery and documentation

Apr 6

Posted by The Gunslinger in forensics | No Comments

I attended a recent eDiscovery seminar. I wanted to poll the audience and get your thoughts on this subject. I was advised that you should not document your forensics process (criminal matters) because it then becomes discoverable and could be used against you in a court of law. Example: Let’s assume you have a documented forensics process that spells out you always have a cup of decaf coffee before examining a suspect’s machine. If you begin examining a suspect’s machine and forget to have that cup of decaf coffee you’ve now just made a gaping hole for the defense to use against you. Say goodbye to your credibility, Mr. Expert Witness no more.

On the other hand you must have a documented eDiscovery process (civil litigation). eDiscovery requires that your process is defensible and repeatable. You will need to be able to reproduce your eDiscovery process if called upon. However, there are no stipulations on how granular your process documentation must be. I would not recommend to spell out so many steps in your process that could leave you open for scrutiny. A generally broad eDiscovery process or flow that is published should suffice.

Please share your views below.

TrueCrypt: Avert Employer’s Computer Policy

Feb 21

Posted by The Gunslinger in forensics | 1 Comment

Would you like to store personal data on an employer owned computer?  Does your employer have a policy about what can be stored on their machine?

To protect yourself from employer remote software/inventory scans (as well as a ton of other encrypted related uses) download TrueCrypt:

http://www.truecrypt.org/

It will allow you to create an encrypted container.  So lets say you need 1GB for your mp3’s.   This program will make a 1GB file  and when you put in your password that file becomes another hard drive on your computer.   Then when you’re done or turn off the computer that extra hard drive goes away until you mount it again using your password.

Think of this as a FREE encrypted virtual thumb drive — (as long as you have a tough password)

Read the rest of this entry »