Part 1: Tools and Techniques for the Aspiring Hacker: Digital Forensics

 Greetings from my tenderfoot hackers again!

Knowing what the other side is using and doing is the greatest method to avoid being discovered. Thus, the tools and methods used by security engineers and law enforcement to identify and apprehend hackers worldwide will be the main topics of this series.

What Is Digital Forensics?

The study of digital forensics focuses on identifying the perpetrators of computer crimes such as digital intrusions. It employs a variety of strategies to identify the offender.

It is predicated on the basic idea that whenever a crime or digital intrusion is done, the offender unintentionally leaves a piece of themself behind for the investigator to discover. These "bits" could be malware, hacking software, registry modifications, fragments of erased files, entries in log files, etc. All of these may offer hints and proof that help identify them and help apprehend and apprehend the hacker.

The more knowledge and comprehension a hacker has about digital forensics, the more adept they are at avoiding traditional forensic methods and even using counter-measures to confuse the investigator.

The Digital Forensic Tools

Similar to hacking, digital forensics can be done with a variety of software tools. To avoid them, the hacker must familiarize themselves with these tools and their operation. Three main commercial digital forensic suites are the main tools used by most digital forensic investigators.

1. Guidance Software's EnCase Forensic
2. Access Data's Forensic Tool Kit (FTK)
3. Prodiscover

These three suites can be somewhat pricey and include a variety of tools and reporting functions. Law enforcement uses these suites extensively, but they employ methods that are either identical to or comparable to those of the open-source, free suites, minus the glitzy user interfaces.

Through the use of free and open source suites, we can learn how to use tools like EnCase without having to pay for them. Although it's not always the most advanced or successful instrument, EnCase is the one that law enforcement uses the most frequently. These products are made to be efficient, easy to use, certified, provide quality training, and include reporting capabilities.

The following three are among the many free and open-source forensic suites available.

1. The Sleuthkit Kit (TSK)
2. Helix
3. Knoppix

To have a better understanding of what digital forensic investigators may see and uncover about an intrusion and its perpetrator, we will examine each of these suites.

The Forensic Tools Available in BackTrack

Furthermore, there exists a vast array of specialized tools for digital forensics, a few of which are included in our BackTrack and Kali deployments.

Among many more excellent tools in BackTrack are the following ones.

• sleuthkit
• truecrypt
• hexedit
• autopsy
• iphoneanalyzer
• rifiuti2
• ptk
• exiftool
• evtparse.pl
• fatback
• scalpel
• dc3dd
• driftnet
• timestomp

What Can Digital Forensics Do?

A would-be hacker should be aware of the wide range of things that digital forensics is capable of. A list of only a few of the items is provided below.

• Recovering deleted files, including emails
• Determine what computer, device, and/or software created the malicious file, software, and/or attack
• Trail the source IP and/or MAC address of the attack
• Track the source of malware by its signature and components
• Determine the time, place, and device that took a picture
• Track the location of a cell phone enabled device (with or without GPS enabled)
• Determine the time a file was modified, accessed or created (MAC)
• Crack passwords on encrypted hard drives, files, or communication
• Determine which websites the perpetrator visited and what files he downloaded
• Determine what commands and software the suspect has utilized
• Extract critical information from volatile memory
• Determine who hacked the wireless network and who the unauthorized users are

And that's only a small sampling of what digital forensics can accomplish!

What Is Anti-Forensics?

Techniques known as "anti-forensics" can be used to conceal data and sidestep the forensic investigator's instruments and methods. Several of these methods consist of the following.

• Data Hiding: Techniques like stegonography and encryption can be used to conceal data.
• Wiping artifacts: A signature or artifact is left behind by each attack. In order to avoid leaving any evidence for the investigator, it can occasionally be a good idea to try to remove these artifacts from the victim's computer.
• Trail Obfuscation: Almost any remote attack can be tracked down to an IP address and/or MAC address by a skilled forensic investigator. A tactic called "trail obfuscation" directs their attention away from the attack itself and toward another source.
• Modify, access, and change the file timestamp in order to avoid being discovered by forensic tools.

Stay Tuned for More on Digital Forensics