Question

Kali Linux “Live” provides a “forensic mode”, a feature first introduced in BackTrack Linux. You can search the Kali URLs, and discuss how to operate/use the Kali, how to take advantage of bug filing systems to troubleshoot problems. Finally, discuss how to use Autopsy Forensic browser.

Answer 1

Step 1 — Start the Autopsy Forensic Browser

Autopsy is a web based front end to the FSK (Forensic Toolkit). By default, you will connect to the Autopsy service using the URL "http://localhost:9999". The default start page is displayed in Step 2.

Step 2 — Start a New Case

Click New Case. This will add a new case folder to the system and allow you to begin adding evidence. To begin, click New Case.

Step 3 — Enter the Case Details

Begin by entering the details about the case. This will include the name of the Case itself and a description of the case. For this, you should have a means of identifying cases. An example could be something along the lines of "<Company>.<Instance>" if you do external consulting as I do or it could be related to specific designations within a company.You will see the message (displayed in Step 4) when the case file is created.

Step 4 — Note where the Evidence Directory is located

In the example above, we see an example case I created for a CHFI course I created. This displays where the evidence is located on the system.

Step 5 — Add a Host to the Case

Click "Add Host" and you will be presented with a screen (above) that allows you to add the host and a description. As it states, the Timezone and skew can be configured. Also, you can add and use a list of known good or known bad hashes. This can be as complex as the NSRL lists or as simple as a hashed list of your own organizations "known good" files. Lists of known rootkits and other Malware can be added as a known bad list.

Where a time skew is known, you can also add this in advance.

Step 6 — Note where the host is located

Next, add the disk image by pressing the Add Image button (Example /home/CHFI.img. Autopsy allows you to use an image that you have already captured. This can be an image of the disk using the dd command for instance). You can also use Autopsy to capture an image, but this is not covered in this post.

Step 7 — Add an Image to Analyze

The "Add Image" screen allows us to import the image that we are going to analyze in Autopsy.

Step 8 — Select the location of the Image to Analyze

This will allow us to import an image into our evidence locker. Rather than working on the original image, you can select the move option to copy the image to the analysis host and have a separate copy of the image for use in Autopsy.

Step 9 — the Case Gallery

As you add hosts to the case, these will be displayed in the "Case Gallery". When you now go back to the Case Gallery and view your options, you will be presented with the options displayed in Step 10.

Step 10 — Now try the other options

You should work with various features of Autopsy browser and experiment with these in order to become familiar with the options and functionality. Try the other options and analyze an image to gain experience with the tool.

The Evidence Analysis Techniques in Autopsy

The primary modes and functions of the Autopsy Forensic Browser are to act as a graphical front end to the Sleuth Kit and other related tools in order to provide the capabilities of analysis, search and case management in a simple but comprehensive package. This collection of tools creates a simple, yet powerful forensic analysis platform.

Analysis Modes in Autopsy

A dead analysis occurs when a dedicated analysis system is used to examine the data from a suspect system. When this occurs, Autopsy and The Sleuth Kit are run in a trusted environment, typically in a lab. Autopsy and TSK provides support for raw, Expert Witness, and AFF file formats.

A live analysis occurs when the suspect system is being analyzed while it is running. In this case, Autopsy and The Sleuth Kit are run from a CD in an untrusted environment. This is frequently used during incident response while the incident is being confirmed. Following confirmation, the system is acquired and a dead analysis performed.

Evidence Search Techniques

The Autopsy Browser provides the following evidence search functionality:

• File Listing: Analyze the files and directories, including the names of deleted files and files with Unicode-based names.
• File Content: The contents of files can be viewed in raw, hex, or the ASCII strings can be extracted. When data is interpreted, Autopsy sanitizes it to prevent damage to the local analysis system. Autopsy does not use any client-side scripting languages.
• Hash Databases: Lookup unknown files in a hash database to quickly identify it as good or bad. Autopsy uses the NIST National Software Reference Library (NSRL) and user created databases of known good and known bad files.
• File Type Sorting: Sort the files based on their internal signatures to identify files of a known type. Autopsy can also extract only graphic images (including thumbnails). The extension of the file will also be compared to the file type to identify files that may have had their extension changed to hide them.
• Timeline of File Activity: A timeline of file activity can help identify areas of a file system that may contain evidence. Autopsy can create timelines that contain entries for the Modified, Access, and Change (MAC) times of both allocated and unallocated files.
• Keyword Search: Keyword searches of the file system image can be performed using ASCII strings and grep regular expressions. Searches can be performed on either the full file system image or just the unallocated space. An index file can be created for faster searches. Strings that are frequently searched for can be easily configured into Autopsy for automated searching.
• Meta Data Analysis: Meta Data structures contain the details about files and directories. Autopsy allows you to view the details of any meta data structure in the file system. This is useful for recovering deleted content. Autopsy will search the directories to identify the full path of the file that has allocated the structure.
• Data Unit Analysis: Data Units are where the file content is stored. Autopsy allows you to view the contents of any data unit in a variety of formats including ASCII, hexdump, and strings. The file type is also given and Autopsy will search the meta data structures to identify which has allocated the data unit.
• Image Details: File system details can be viewed, including on-disk layout and times of activity. This mode provides information that is useful during data recovery.