6 ms·

> * If the systems are turned on, record the datetime and shut them down. Did this ever lock you out of any machines configured to use Whole Disk Encryption or

by getsat 16y ago

> * If the systems are turned on, record the datetime and shut them down. Did this ever lock you out of any machines configured to use Whole Disk Encryption or out of encrypted, mounted volumes? You could have dumped the keys out of ram, etc. > we used EnCase Did you ever come across any exotic filesystems that EnCase can't read, like XFS?

patrickaljord 16y ago
> Did this ever lock you out of any machines configured to use Whole Disk Encryption or out of encrypted, mounted volumes? That read weird to me too. My file system is totally encrypted and the easiest way to get a copy of it is to not turn the machine off but make a copy of the mounted hard disks first. That's true for any encrypted file system, sounds like a pretty big faux pas in the procedure.
- bradleyland 16y ago
  From a technical perspective, there are definitely better ways to go about acquisition. It can be very hard for technical people to work in computer forensics because many technically attractive strategies are off-limits to you due to constraints that are wholly non-technical. Think of it like this. Police would probably find a lot more evidence if they were able to search your car/property without consent, but they don't because that would violate your civil rights. The acquisition situation is a little bit different, because it's not strictly a matter of civil rights. It's more subtle. We have the right to examine the computer, but the process has to: 1) Hold up in a court as irrefutable and demonstrate a process that is inherently resistant to tampering. 2) Discover the evidence required to execute the legal strategy. All the evidence in the world won't convict someone if the defense can take the position that evidence was tampered with. Using the computer prior to examination is akin to taking a gun used in a murder to the gun range before checking it in as evidence. Simply testifying that you didn't tamper with it doesn't do the trick. It very quickly becomes a chicken and the egg problem.
bradleyland 16y ago
> Did this ever lock you out of any machines configured to use Whole Disk Encryption or out of encrypted, mounted volumes? You could have dumped the keys out of ram, etc. At the firm I worked for, preservation was priority #1 any time we were walking in to a case with high trial-risk. In order to discover that the system was encrypted, I would have to use the computer. Using the computer means changing it. Protocol was really straight forward: If it's running, shut it down and get it to the lab. Because we were working in the US Trustee system, we were dealing with business owners who were either in bankruptcy where a trustee had been appointed, or receiverships, which almost always involves a trustee (or like appointee). This means we weren't chasing kiddie porn, we were looking for the movement of money. Were we to encounter end-to-end encryption, the password is just a "motion to compel" order away. Failure to comply means you sit in a jail cell until you cough up the password. Having said that, I don't recall ever having to go that far. Neither did we encounter any seriously hardened systems. Anyone smart enough to encrypt a system end-to-end at a company was usually on our side by the time we got there. In large businesses where this type of encryption is common, there is an IT person who can get past it. Bad business people have a tendency to make enemies out of their employees, and the trustee knew who to take care of. In instances where we didn't have access to employees with the required knowledge to get in to systems, we relied on industry tools. We were mostly trying to crack in to things like QuickBooks files, Outlook PSTs, and protected documents, so not what you'd normally expect from a geek perspective (john, l0pht, etc). A lot of the stuff was proprietary, and at the end of the day, brute force and dictionary attacks were usually very effective. We rarely encountered disk-level encryption on the systems we examined. App and document level passwords were the norm. I used to run the disk images through STRINGS(1) to extract every bit of text on the drive. Then, I'd break whitespace to newlines and use that as my dictionary. When you have three or four computers worth of strings, coupled with relatively unsophisticated users, you don't often strike out. We had a 100% success rate using standard crackers and the technique outlined above. It seems that users can't resist typing their password in plain text at some point in the life of their computer. > Did you ever come across any exotic filesystems that EnCase can't read, like XFS? I don't think I ever examined a computer that wasn't Windows XP. These were strictly business cases, so anything that wasn't Windows was a server, and that was a very rare case. Most of the time, we got approval to simply run the server systems in question to get the data we needed. The rules of engagement with servers were a little different. Servers involve a lot of multi-user access, so the chain of evidence requirements were a little different. We had to be the most careful with the personal workstations of the owners and accountants. I'd find emails requesting off-shore accounts, shell companies, etc. These had to be bulletproof in order to pin down the business owner. I can't stress enough that I operated in a non-criminal, largely unsophisticated environment. Our rules for preservation were mostly precautionary. There was very little trial risk in our organization. It was mostly a matter of trying to identify assets and dig up any evidence that the owner was acting in a way that would put them in hot water. The trustee would use these items to squeeze the debtor in an effort to repay lenders.
ErrantX 16y ago
I work on criminal cases, so have a slightly different perspective to bradleyland. > Did you ever come across any exotic filesystems that EnCase can't read, like XFS? I've come across something "obscure" only once or twice (in several hundred cases). The bottom line is that most computer crime isn't conducted by technically adept people, but by normal people. i.e. Windows is by far the most common system, with Mac a distant (thought growing) second :) > Did this ever lock you out of any machines configured to use Whole Disk Encryption or out of encrypted, mounted volumes? You could have dumped the keys out of ram, etc. There are all sorts of ways (as bradleyland explained) to get around this issue. The problem is that most material is siezed by a normal police officer - so there is simply no way you can let them do a live acquisition :D (or indeed no way they would know they had to). But there are all manner of ways to figure out, or sometimes crack, the encryption key and away you go :) The times I've come across WDE I've managed to get round it fairly quickly, mostly due to "user error".
- getsat 16y ago
  Thanks for the response! > mostly due to "user error" Can you elaborate on this? I'm aware of taking advantage of idiotic Firewire/USB drivers to inject code into a running system and the "evil maid" attack, but that's where my knowledge of WDE attacks stops.
  - ErrantX 16y ago
    Nothing fancy. Often we get a few computers in such cases, and they reuse passwords. Or write it down somewhere (that's a common one). Or you can "guess" it from likely combinations (names, dates etc.)

by getsat 16y ago

patrickaljord 16y ago

> Did this ever lock you out of any machines configured to use Whole Disk Encryption or out of encrypted, mounted volumes? That read weird to me too. My file system is totally encrypted and the easiest way to get a copy of it is to not turn the machine off but make a copy of the mounted hard disks first. That's true for any encrypted file system, sounds like a pretty big faux pas in the procedure.

bradleyland 16y ago
From a technical perspective, there are definitely better ways to go about acquisition. It can be very hard for technical people to work in computer forensics because many technically attractive strategies are off-limits to you due to constraints that are wholly non-technical. Think of it like this. Police would probably find a lot more evidence if they were able to search your car/property without consent, but they don't because that would violate your civil rights. The acquisition situation is a little bit different, because it's not strictly a matter of civil rights. It's more subtle. We have the right to examine the computer, but the process has to: 1) Hold up in a court as irrefutable and demonstrate a process that is inherently resistant to tampering. 2) Discover the evidence required to execute the legal strategy. All the evidence in the world won't convict someone if the defense can take the position that evidence was tampered with. Using the computer prior to examination is akin to taking a gun used in a murder to the gun range before checking it in as evidence. Simply testifying that you didn't tamper with it doesn't do the trick. It very quickly becomes a chicken and the egg problem.

bradleyland 16y ago

> Did this ever lock you out of any machines configured to use Whole Disk Encryption or out of encrypted, mounted volumes? You could have dumped the keys out of ram, etc. At the firm I worked for, preservation was priority #1 any time we were walking in to a case with high trial-risk. In order to discover that the system was encrypted, I would have to use the computer. Using the computer means changing it. Protocol was really straight forward: If it's running, shut it down and get it to the lab. Because we were working in the US Trustee system, we were dealing with business owners who were either in bankruptcy where a trustee had been appointed, or receiverships, which almost always involves a trustee (or like appointee). This means we weren't chasing kiddie porn, we were looking for the movement of money. Were we to encounter end-to-end encryption, the password is just a "motion to compel" order away. Failure to comply means you sit in a jail cell until you cough up the password. Having said that, I don't recall ever having to go that far. Neither did we encounter any seriously hardened systems. Anyone smart enough to encrypt a system end-to-end at a company was usually on our side by the time we got there. In large businesses where this type of encryption is common, there is an IT person who can get past it. Bad business people have a tendency to make enemies out of their employees, and the trustee knew who to take care of. In instances where we didn't have access to employees with the required knowledge to get in to systems, we relied on industry tools. We were mostly trying to crack in to things like QuickBooks files, Outlook PSTs, and protected documents, so not what you'd normally expect from a geek perspective (john, l0pht, etc). A lot of the stuff was proprietary, and at the end of the day, brute force and dictionary attacks were usually very effective. We rarely encountered disk-level encryption on the systems we examined. App and document level passwords were the norm. I used to run the disk images through STRINGS(1) to extract every bit of text on the drive. Then, I'd break whitespace to newlines and use that as my dictionary. When you have three or four computers worth of strings, coupled with relatively unsophisticated users, you don't often strike out. We had a 100% success rate using standard crackers and the technique outlined above. It seems that users can't resist typing their password in plain text at some point in the life of their computer. > Did you ever come across any exotic filesystems that EnCase can't read, like XFS? I don't think I ever examined a computer that wasn't Windows XP. These were strictly business cases, so anything that wasn't Windows was a server, and that was a very rare case. Most of the time, we got approval to simply run the server systems in question to get the data we needed. The rules of engagement with servers were a little different. Servers involve a lot of multi-user access, so the chain of evidence requirements were a little different. We had to be the most careful with the personal workstations of the owners and accountants. I'd find emails requesting off-shore accounts, shell companies, etc. These had to be bulletproof in order to pin down the business owner. I can't stress enough that I operated in a non-criminal, largely unsophisticated environment. Our rules for preservation were mostly precautionary. There was very little trial risk in our organization. It was mostly a matter of trying to identify assets and dig up any evidence that the owner was acting in a way that would put them in hot water. The trustee would use these items to squeeze the debtor in an effort to repay lenders.

ErrantX 16y ago

I work on criminal cases, so have a slightly different perspective to bradleyland. > Did you ever come across any exotic filesystems that EnCase can't read, like XFS? I've come across something "obscure" only once or twice (in several hundred cases). The bottom line is that most computer crime isn't conducted by technically adept people, but by normal people. i.e. Windows is by far the most common system, with Mac a distant (thought growing) second :) > Did this ever lock you out of any machines configured to use Whole Disk Encryption or out of encrypted, mounted volumes? You could have dumped the keys out of ram, etc. There are all sorts of ways (as bradleyland explained) to get around this issue. The problem is that most material is siezed by a normal police officer - so there is simply no way you can let them do a live acquisition :D (or indeed no way they would know they had to). But there are all manner of ways to figure out, or sometimes crack, the encryption key and away you go :) The times I've come across WDE I've managed to get round it fairly quickly, mostly due to "user error".

getsat 16y ago
Thanks for the response! > mostly due to "user error" Can you elaborate on this? I'm aware of taking advantage of idiotic Firewire/USB drivers to inject code into a running system and the "evil maid" attack, but that's where my knowledge of WDE attacks stops.
- ErrantX 16y ago
  Nothing fancy. Often we get a few computers in such cases, and they reuse passwords. Or write it down somewhere (that's a common one). Or you can "guess" it from likely combinations (names, dates etc.)