Notes on Vista forensics

In part one of this series we looked at the different editions of Vista available and discussed the various encryption and backup features which might be of interest to forensic examiners.

In this article we will look at the user and system features of Vista which may (or may not) present new challenges for investigators and discuss the use of Vista itself as a platform for forensic analysis.

User files and applications

One of the first things to note about users' data files is that they're not where they used to be! Instead of the familiar "Documents and Settings" folder we must instead look to a new folder called "Users". Other folders which typically fall under the scope of an examination have also moved so examiners running scripts which expect certain files or folders to be in specific locations may need to do some editing. Another interesting change is that Vista is configured by default to not update the last access time on files, a decision made to increase file system performance.

At the application level, much forensic work consists of reconstructing web browsing and email activity, so let's take a look at the relevant programs provided by Vista.

Vista ships with Windows Internet Explorer 7 for web browsing and, although forensic examiners will certainly encounter other browsers during Vista's lifetime, it seems reasonable to assume that IE7 and its Microsoft successors will represent the vast majority of browsers whose use comes under investigation. Familiarity with IE's usage of files and directories, together with experience using appropriate tools for recreating browsing activity (using the browser history, cache, cookies, favorites, etc), will continue to be essential components of every investigator's arsenal and most people currently working in the field will already be familiar with IE7 since its release last year. The version of IE7 included with Vista does include a number of additional features, however, which examiners should at least be aware of (such as Protected Mode, Parental Controls, and enhanced Network Diagnostics).

Windows Mail is the standard, standalone email client included with Vista. Functionally, if not aesthetically, similar to Outlook Express, Windows Mail is likely to be the focus of many investigations.

In terms of architecture, however, it should be noted that Windows Mail uses a JET database and messages, including newsgroup posts, are now stored in individual files (mail files have a .eml extension and newsgroup posts .nws).

These files have two "streams" - for mail messages the first stream consists of RFC compliant MIME data and the second stream holds XML metadata. Another change is that account information which used to be stored in the Registry is now also held in XML format within the Windows Mail folder of a user's profile.

However, Windows Mail is not the only email option likely to be available to Vista users at some stage in the future. Windows Live Mail Desktop, somewhat unfortunately abbreviated to "WLMd", is an email solution currently in beta which Microsoft describes as "an email client that can be downloaded onto Windows XP or Windows Vista...a rough super-set of Windows Mail in Windows Vista".

While the exact set of features is still being worked out, in broad terms this is an email client which will integrate with Windows Live Hotmail (previously known as Windows Live Mail), Microsoft's Web 2.0 mail client, and include a number of other features above and beyond those available in Windows Mail. Investigators already familiar with cases involving Hotmail usage will probably be well prepared for the challenges arising from WLMd but it will be interesting to see exactly what those challenges are once this client is released - those wishing to get a head start may wish to check out the beta.

In fact, situations where a user's data may no longer be stored on the local machine should come as no surprise to forensic examiners. Over the past few years most practitioners have come to realize that the hard disk is not the only source of potential evidence and have been forced to take a more holistic view of a suspect's computing environment whether that means a focus on the nearby, such as RAM or backup storage, or further afield, such as network devices or remote servers.

One last point which involves RAM, application usage and a new feature in Vista. As most computer users will know, there often comes a time when our machines slow to a crawl due to too many applications making demands on available memory. The most straightforward solution to this problem (other than running fewer programs at the same time, of course) is to add extra RAM but this can still be a daunting task for those with little technical knowledge.

Vista offers a solution to this problem in the shape of ReadyBoost, a new feature which allows attached flash memory devices to be used as extra memory. However, examiners should be aware of two important points.

irst, although strictly speaking ReadyBoost does provide extra memory the data held on the flash device is actually also present in the host machine's RAM - the intended benefit of the feature is that it provides faster access to this data for certain types of operations.

Second, the data on the device is AES-128 encrypted. It's too early to say how often examiners are likely to encounter ReadyBoost in practice (reports on its effectiveness appear mixed so its popularity may be limited) but with our attention being more and more focused on evidence sources beyond the hard drive it is at least something to be aware of.
System files and metadata

Log files are often a useful source of information and changes to the Event Viewer in Vista mean that log files are now created in an XML compliant .elf format (rather than as .evt files seen previously). Any scripts which are used to locate and parse log files may need to be updated.

The hidden file "thumbs.db" introduced in previous Windows versions which has been of such interest to investigators over the past few years has also undergone a significant change. In fact this file has been replaced by a number of "thumbcache_xxx.db" files which are now located within a user's profile at

\Users\\AppData\Local\Microsoft\Windows\Explorer

Another change to be aware of is that the Disk Cleanup Wizard included with Vista may be used to delete these thumbnails. (Note: in some cases Microsoft now refers to thumbnails as "icons" or "live icons".)

Metadata can be described as data about data. In the world of computer forensics, metadata is usually discussed in terms of information held about a file, a well known example of which is the information associated with a Word document which can include various details such as the author's name, comments and revision history (in fact, this particular example is so well known that Microsoft was forced to create a tool to help users remove the data in question!) Metadata on Windows systems becomes even more interesting when you examine multiple file streams, a concept first introduced in NT 3.51, which allow you to associate extra information with a file on an NTFS filesystem.

Although the information held in these streams may appear invisible to the typical user, it can be a rich source of information to the examiner. This potential repository for data could also be used to hide information and so it has become an essential area to cover during an investigation.

Although NTFS is the recommended file system for Vista Microsoft no longer believes that alternate data streams (ADS) are the best method for associating metadata with a file, primarily due to the fact that this extra information is not included when the file is transferred under certain circumstances (e.g. to a non-NTFS volume or when sent as an attachment).

Instead, Vista developers are being encouraged to include metadata within files themselves and this is another area where useful information may be uncovered by the examiner. It should be noted, however, that ADS functionality is still present within Vista so it should not be ignored during an investigation.

Returning to the user experience once again, another important develoment as far as metadata is concerned is that Microsoft is now encouraging users to add such data to their own files though the use of "tags" or "metatags". Primarily seen as a way to help users rate, organize and search through their content, user-generated tags may prove to be a useful source of information during certain types of investigation. However, the flip side of this potential benefit is that Vista also makes it relatively easy (through a file's Properties tab) for users to remove metadata.

Vista as an examination platform

Vista's much touted Aero interface may give the impression that "Minority Report" style crime-busting is just around the corner but, sadly, we're not quite there yet.

Perhaps unsurprisingly given the changes to some aspects of Vista of interest to forensic examiners (e.g. file structure, the Registry, the Recycle Bin, etc.) a number of issues with existing forensic software packages have already been identified and vendors continue to work on new releases in response.

Although many of the issues identified are directly related to the analysis of Vista on a suspect drive a number of other problems have been reported by those running Vista as the platform upon which the forensic package itself is running (it should be noted that in some cases Vista is not yet officially supported by the developer in these cases).

The problems are not only related to forensic software, however, and while some may be addressed with a simple driver update others may be considered even more fundamental as Scott A Moulton of Forensic Strategy Services, LLC. explains: "I still have major problems mounting large drives under Vista. I use many 1 terabyte or 2 terabyte drives and Vista is absolutely worthless on these drives - I'm lucky if Vista does not actually mess the drive up. Deleting files is a nightmare and sometimes takes days. Just simply copying files is so slow it is unbearable.

"I received quite a few responses from people who have had similar issues and it seems that DRM [Digital Rights Management] may be the most probable cause. They've found that Vista tries to check each file to see if there is a protection flag on it or not before even deleting the file."

Despite these issues, Vista retains much of previous versions of Windows and some third party tools are expected to function largely as before. Where changes do need to be made in some tools they may be minor. For example, most of the Sysinternals tools commonly used in many Windows live response scenarios are expected to work under Vista without modification. One exception is Process Explorer, a minor modification to which in order to enable full functionality is expected within the next few months.
Conclusions

Computer forensic examination does not only involve searching an individual's computer for evidence of their own wrongdoing but also includes situations where the system itself has been attacked, commonly resulting in data loss, alteration or a denial of service. In addition to the deliberate targeting of individual systems over a network the threats posed by malware downloaded through web browsing or email use are well documented.

One of Microsoft's goals with Vista is to significantly improve the security of the operating system and although the act of investigation is necessarily one which takes place after an incident has occurred, the effect of hardening the system against common attacks in the first place is one which may impact the number of incidents of this type which require investigation.

So, where does this leave us? I think the first thing to keep in mind is that the playing field hasn't changed overnight just because Vista has been released to the public.

In fact, there are a number of reasons to believe that the uptake of Vista amongst existing users might be relatively slow so whatever impact it does have may be fairly gradual (even Steve Ballmer, Microsoft's chief executive, has admitted that earlier sales forecasts may have been "overly aggressive").

Secondly, the changes in Vista most likely to affect forensic examiners are probably most accurately described as evolutionary rather than revolutionary. There really isn't much which we haven't seen before in some shape or other and already developed strategies to deal with. Undoubtedly there will be cases where new features do present difficulties but investigators will adapt their approach accordingly, perhaps moving towards a greater emphasis on live analysis or network-based evidence collection where appropriate.

And finally, taking a broader view, if Microsoft delivers on its promise to improve the security of our increasingly connected world then we all benefit. For the time being though, the fight between those with something to hide and those tasked with uncovering electronic evidence continues.

This article originally appeared in Security Focus.

Eight Faces of a Hacker

You fight against them every day: hackers, attackers, insiders. You know what they do, but not who they are. They are often nameless, usually faceless. You'd like to be able to guess their next move, but that can be pretty difficult when you don't even know what motivates them or why they're attacking you.

Is there a way to "profile" a hacker, the way the police might profile an arsonist or a serial killer? Not exactly. But quietly, a collection of university researchers and law enforcement agencies has been developing a taxonomy of the hacker community, much as an entomologist studies and classifies insects. And police and security experts hope that taxonomy will eventually help them identify and root out the vermin.

"To address the problems created by hackers, it is apparent that we need more than just technical controls," says Marc Rogers, a professor at Purdue University and author of the industry's most widely-used taxonomy of the hacker community. "We also need to start understanding the individuals behind the attacks."

The effort to understand the psychology of hackers and attackers is nothing new. Psychological studies of "phone phreaks" can be found as far back as the early 1980s, and MessageLabs is publishing a study on internal "company devils" today. The idea behind most of the studies is the same: to break the stereotype of the hacker as a socially-inept male teenager sitting behind a PC in his parents' basement.

There is no single profile of a hacker, inside or outside the company, Rogers says in the most recent update of his taxonomy paper. In fact, the idea of lumping all hackers into a single group is "analagous to attempting to understand criminal activity by lumping the entire spectrum of traditional criminals (i.e., shoplifters to homicidal psychopaths) into one generic group," he says. "The idea seems ludicrous, yet this is what we are currently doing with the criminal domain of computer crimes."

There has been a "huge shift" in hacker profiles in the last few years, as motives shift from curiosity to financial gain, says Rogers, who has worked with law enforcement agencies on hacker profiling and computer forensics. But security managers should also be wary of oversimplifying the new threats as well, he advised.

"For years, vendors treated the 'cyber-punk' as the boogeyman, and they built at least some of their business on the fear that some brilliant teen would launch a virus," Rogers says. "Now some of them are painting organized crime as the boogeyman, spreading this notion that the Russian mafia is out to get every business."

In reality, there are lots of different types of attackers, Rogers states. His taxonomy breaks them up into eight different categories, each with different characteristics and motivations. The taxonomy is frequently used by law enforcement agencies and other researchers as a starting point for profiling computing attackers. "It's a long way from perfect, but I wanted to give people something to shoot at."

1. The Novice
Sometimes called "script kiddies," this group is typically young, with limited skills, whose primary motivation is thrill seeking and ego stroking. In order to prove their worth, they attempt to "rack up" trophies, often using pre-written software.

2. The Cyber Punk
This group comes closest to fitting the traditional view of the hacker -- young males with some skills and programming capabilities with a desire for attention and, sometimes, monetary gain. They typically choose high-profile targets, and they often choose vandalism over outright data theft.

3. The Internal
These are the insiders -- those who use their internal system privileges to gain access to unauthorized data. They generally fall into two subcategories: disgruntled employees seeking revenge and those who are looking to use the data for financial gain.

4. The Petty Thief
Traditional criminals who learn how to hack in order to expand their field of targets. They usually are not skilled at first, but they sometimes become skilled over time. Their sole motivation is money.

5. The Old Guard
Motivated by curiosity and the need for an intellectual challenge, these highly skilled individuals are capable of writing code and scripts. Espousing the ideology of the first-generation hackers, they usually have no criminal intent but will readily post the scripts and code they develop.

6. The Virus Writer
This group is still being defined, Rogers says. It is made up mostly of young males, who tend to age out of the group once they hit their mid to late twenties. This group differs from the Cyber Punks in that its motivation is more along the lines of revenge or curiosity than notoriety.

7. The Professional Criminal
Highly-trained IT experts who use their skills for financial gain. They tend never to be caught or even come to the attention of the authorities, Rogers says. These are the "hired guns" employed by organized criminal groups.

8. The Information Warrior
Motivated by patriotism, these individuals use their skills to disrupt the command and control of a rival nation. They are typically highly trained and highly skilled.

These categories have remained fairly stable since Rogers developed the taxonomy in 1999, but many subcategories are evolving all the time, Rogers says. "I expect this to develop like an ornithology, where people take the basic structure and develop taxonomies for the subgroups."

One category that has gotten a good deal of attention from researchers is the Internal group, which has been difficult to study because of companies' reluctance to share information about insider threats and break-ins. Several researchers have published studies on the topic in the last two years.

The Secret Service and Carnegie Mellon University in 2005 released a paper that says there are no common demographics among insiders who damage or steal customer data, but there are indicators of risk.

Thirty-three percent of subjects were perceived by management as 'difficult,' and 19 percent were viewed as disgruntled by other employees. Twenty-seven percent had come to the attention of a supervisor or a co-worker for behavior concerns, and another 27 percent had prior arrests, the study says. While 42 percent of those motivated by greed were female, only 4 percent of those motivated by disgruntlement were female.

In a study published last year, Eric Shaw, a professor at George Washington University, reported that most of the insiders they studied displayed four basic traits: a history of negative social and personal experience; a lack of social skills; a sense of entitlement; and ethical flexibility. These traits, combined with a right stress factors and opportunities, can lead to a higher incidence of insider attacks, he said.

But such studies may overlook the more frequent instance of accidental security exposure from inside the company. In a study being published today, MessageLabs found that the "devils" in most companies are not those that intentionally steal or damage company data, but who expose it to outsiders by breaking company security protocols.

According to MessageLabs, the danger comes from young, tech-savvy junior-level sales types who are under pressure to meet their quotas.

"The problem is that the more you lock down your systems, the less usable they become," notes Paul Wood, senior analyst at MessageLabs. "These people are under pressure to meet their objectives -- they are moving quickly and they don't have time for systems that aren't usable. So they'll use their technical skills to find a way around the policy."

These company "devils" are natural multi-taskers who will use any means necessary to get their jobs done -- including IM, wireless, VOIP, and email -- from any access point, and without regard for security policy, Wood explained. Their intent is not malicious, but they may create avenues for security breach without knowing it, he says.

— Tim Wilson, Site Editor, Dark Reading