Saturday, November 29, 2008

Recovering web browser passwords

All popular web browsers offer a password manager option to store usernames and passwords of the visited websites. It is possible to recover these usernames & passwords and in some cases view dates and times when a person registered/logged in with these credentials the first time.

1. Internet Explorer - IE PassView

2. Mozilla Firefox - PasswordFox v1.10

3. Safari – Method applicable to several web browsers

4. Opera – Unwand

5. Google Chrome - ChromePass v1.05

There are some other utilities incl. commercial versions, which I have not tested. The above mentioned tools are free and tested to be working.

Sunday, November 23, 2008

A bit of technology in a world of geeks

Tesla Personal Supercomputer under $10,000 with Nvidia graphics processing unit (GPU) inside and utilising parallel computing architecture. Claims are that Computers with the Tesla C1060 GPU processor have 250 times the processing power of a PC workstation. It should be good for password cracking :-).

Microsoft is going to offer a free anti-malware solution codenamed "Morro" to provide 'comprehensive protection from malware including viruses, spyware, rootkits and trojans'. Windows Live OneCare will no longer be sold from June 30, 2009. Hopefully it would have a positive impact on stopping malware from spreading without killing the sales figures of other anti-virus vendors.

Faster FireWire and USB speeds

Next year we may see a new version of FireWire known as S3200. This new version is to deliver a peak of 3.2 gigabits per second (400 MB/s) compared to the current 800 megabits (100MB/s).

The new USB 3.0 also called 'USB Superspeed' is set to multiply USB 2.0 (480Mmb/s) bandwidth tenfold and will transfer data at speeds up to 4.8Gbit/s. That would allow transferring a 27GB of date in only 70 seconds. USB 3.0 is designed to be backwards-compatible with USB 2.0 and USB 1.1.

Here is an interesting link re: USB 3.0

Wednesday, November 19, 2008

CISCO Routers forensics

Some interesting links to resources about forensics on CISCO routers.

  • Book "Cisco Router and Switch Forensics" by Jesse Varsalone
  • Powerpoint presentation "Cisco Router Forensics" by Thomas Akin, Black Hat Briefings, 2002
  • Powerpoint presentation "Router forensics DDoS/worms update" by Nicolas Fischbach, Senior Manager, IP Engineering/Security - COLT Telecom
  • Another interesting document "Auditing CISCO Routers" by the Technology Pathways
  • A document called "CISCO Routers as Targets" by Joshua Wright
  • Ms.S. Thesis "Forensic examination of log files" by Joan Petur Petersen

Saturday, November 15, 2008

My forensic 'dream' machine

Here are the specs for a forensic machine I would like to get one day.
Intel Dual-Core Xeon Processor X5272
There is no point to use quad core because current forensic applications are not designed to take advantage of multi-core CPU's
8GB ECC Registered DDR2 Memory

ECC uses an advanced error correction system that can correct data transmission errors on the fly. Because ECC memory involves more processing, it may be a bit slower that non ECC memory, however ECC provides reliability and greater system stability. ECC RAM is more expensive however.

SATA RAID hardware controller with 4 x 10,000 RPM SATA II drives

RAID controller configured as RAID 0+1 which is a mirrored array whose segments are RAID 0 arrays. It provides the same fault tolerance as RAID level 5 and the same overhead for fault-tolerance as mirroring alone. It supports a very high I/O rates due to multiple stripe segments.

Other must-have components

Drive Bay Controller with multi-bay read/write status, a couple of SATA /IDE write-blocked bays, write-blocked universal memory card reader, built-in USB write-blocker, USB 2.0 ports, FIREWIRE 400/800 and eSATA ports.

Operating System

To get maximum compatibility with drivers and software, I would go for Windows 32-bit operating system. Microsoft Windows Server 2003 Enterprise Edition allows using memory beyond the 4-gigabyte range that is inherent to 32-bit operating systems. The 32-bit version of Microsoft Windows Server 2003 Enterprise Edition allows 8GB RAM and Windows Server 2003 with Service Pack 2 (SP2), Enterprise Edition supports 64 GB. Most of Windows XP drivers are compatible with Windows Server 2003. FTK, EnCASE, X-Ways Forensics and many other forensic applications run very well under Windows Server 2003. FTK however requires admin privileges to work correctly. The operating system needs some tweaking to enable prefetch etc. All adjustments take about 10 min to complete. Instructions can be found here. Additionally, there is a free tool for automated server to workstation transformation.

Saturday, November 8, 2008

USB Flash drives acquisition!

Wear Levelling

Most flash drives are NAND EEPROM devices capable of 100,000 to 1 million erase and write cycles. The lifetime of the flash drive depends on endurance of the flash chip. To extend the life of flash drives, manufacturers often implement wear-levelling (also referred as wear-leveling).

Wear-levelling mechanism spreads write cycles across a flash chip, thus reducing continual usage of the same areas of the flash chip, and as a result promotes even usage of all memory cells.

What this means for forensic examiners? The content of a file that is no longer exists from the point of view of the file system may have been fully or partially changed by the wear-levelling algorithm. On many NAND flash memory devices this occurs upon writing the new data.

NAND flash drives are not very efficient at random writes due to the requirement of an application to locate a free block, before it can write to it. If such block is not available, the block must be fully erased which takes additional time, thus reducing the efficiency of the device. Different manufacturers are taking different approaches to tackle this problem. Some implement additional controllers or/and memory into their flash drives. Some change the software (firmware) and wear-levelling algorithms that shuffles "unallocated" free space every time the device is read, so when the application is about to write the new data, free blocks are already available to the application for writing.

Acquiring these devices require an additional step that from my experience is rarely taken. The standard procedure is to simply connect such USB device to a forensic machine via hardware or software write blocking device and let the forensic software to do the acquisition and verification. There are two problems with this approach.
  1. Most forensic tools verify (calculate MD5 or SHA1 hash) of the device, then acquire the data followed by MD5 or SHA1 verification of the image. There is no verification of the physical device after that. So, we essentially rely on the write blocker to prevent any changes.
  2. Some USB devices (approximately one in every ten from my experience) will produce different cryptographic hash every time you calculate it, despite the fact that no write is allowed. So, by simply reading such devices, we are changing something inside these drives.
The significance of this is obvious. If an independent party checks the integrity of such device, (s)he will end up with a completely different MD5 or SHA1 value. Unless you know about the problem before hands, it may be too late to explain this difference in Court.

So, what is actually changed on the drive and how to deal with this issue? The good news is that existing files are not changed and this can be easily confirmed by comparing hash values of files from two images of the same device taken at a different time. X-Way forensics is probably the best tool for this task.

By utilising the above mentioned tool and its terminology we can see that changes occurred in 'Free space' and 'previously existed files'. It is up to the forensic examiner to deal with admissibility of the data/evidence extracted from 'Free space'. Taking an additional image of the device, extracting (carving) files and comparing these files with the files from the first image is one of these techniques. There will be many files that are changed by the sector shuffling, thanks to the wear-levelling algorithm.


Additionally, because of the wear-levelling mechanism and dynamic mapping of logical to physical sectors, some file artefacts may be left behind even after "secure wiping" of the USB flash drive.

Ordinary hard disks in general do not have wear-levelling implemented; however this may soon change due to becoming increasingly popular in notebooks solid-state drives.

27 February 2009


The issue does exist despite some people finding it hard to believe, and it is here to stay for some time. The only way to deal with this is through the correctly devised procedures that in general can be described as:

1. Identifying the device with the specific wear-levelling behaviour (via hashing before and after the procedure for example).

2. Isolate the existing (not marked as deleted) from the deleted files. Verify the integrity of the existing files.

3. Deal with the deleted files in a way that the accurate and verifiable data can be presented in court.

"Knowledge is dynamic in nature, today's knowledge may well become tomorrow's ignorance if an individual or organisation fails to update knowledge as environmental conditions change."

Turban, E., Leidner, D., Mclean, E., Wetherbe, J., Information Technology for Management: Transforming Organizations in the Digital Economy. Wiley; 6 edition (March 5, 2007)
March 2009

Here is the link to a series of youtube videos of 'DEFCON 16' presentation by Scott Moulton who does a good job of explaining how the concept works.

5 November 2009
Another good article about SSD and NAND flash technology.

Friday, November 7, 2008

VMware Workstation 6.5 released

Finally I have found some time to install the recently released VMware Workstation 6.5 and regretted that I haven't done this earlier. This version offers several new features such as improved performance of Copy/Paste operations between the Host and Guest. USB devices are handled quite well by this version, so no more pain getting a device recognised by the guest and not the host OS. Some sources claim that USB device performance is improved by as much as 50%. Unity feature is interesting but too me it is a little toy at this stage.

Saturday, November 1, 2008

Case Notes Software

A proper forensic analysis is rarely accomplished with just one forensic tool such as EnCase or FTK. So, jumping from one tool to another, from one operating system to another makes it a necessity to keep contemporaneous notes in one place, so they can be quickly searched and referenced. I was looking for a tool that would be lightweight and easy to use. I have found a nice application called CaseNotes from QCC. It is a free application that runs on MS Windows machines and is designed for Computer Forensic records keeping. I have found it quite useful. Tabbed interface and MS Word like interface are very useful; however a simple spell checking and easier way to import photographs would make this application more user friendly. I like to have the formatting and spell-check of Office at my disposal, so after using CaseNotes for a few days, I have started playing with MS Office OneNote 2007. It has tabbed interface, insert day and time (ALT+SHIFT+F), password protect option, search option, easy formatting, adding photographs and can be shared with others in my office. OneNote has a nice option to export all the records to PDF. For me, this could be the way of moving away from paper based records keeping.