Since March I have returned to practicing under my own banner. I have taken this opportunity to change the name of my company to Schatz Forensic, to better reflect the focus of the business and the personal nature of the services that I offer. Schatz Forensic is now operating out of premesis in the Brisbane CBD, and continues to offer the same computer forensics and electronic discovery services that I have provided in the past.

This won’t be news to many, but I came across a colleague today who didn’t realise that the libewf project has moved home to sourceforge.

Libewf is the only open source implementation of the Expert Witness Format (EWF) file format, which is the de facto standard for storage of forensic disk images. This open source implementation contains numerous utilities, including a faster than LinEn, UNIX based, command line EWF acquisition program, ewfacquire, and a command line validation utility called ewfverify. This latter tool I have found extremely useful in automating the evidence preservation process.

Related news is that Joachim Metz, the creator of libewf has recently released libpff, an open source implementation of the Outlook PST, OST and PAB file formats.

In the last couple of days I have taken a few moments to familiarise myself with F-Response. The tool has been getting a lot of buzz lately amongst the forensic community, as it allows read-only raw access to the drives of remote computers, using one’s regular forensic toolset. Think encase enterprise at a lower price tag and open tool access.

For the more technical reader, it does this by setting up an iSCSI target on the remote (target, or suspects) computer.

The field kit and consultant edition of this tool require you to run a GUI agent on the target computer, which is not stealthy. The enterprise version of this tool however allows the agent to be run as a service.

Stealth Deployment
The supplied manual shows you how to install the enterprise agent using a combination of command line and GUI, but dosen’t go so far as to instruct how to do this remotely, via only the command line. This post is to document how I achieved this.

I note here that these instructions apply to a Windows Domain based setup, with firewall rules on workstations set to enable remote administration and file sharing from the investigation computer.

1. Open two windows command prompts. One is to be for work on the target machine and one on the investigation machine.

2. On the target machine command prompt, we first want to get a shell on the target computer, by using psexec, xcmd or other. I am logging in here as a user with Administrator priveleges:

C:\Documents and Settings\bschatz>”c:\Documents and Settings\bschatz\Desktop\tools\psexec.exe” -u VINCENTS\bschatz_admin \\192.168.20.195 cmd

PsExec v1.94 – Execute processes remotely
Copyright (C) 2001-2008 Mark Russinovich
Sysinternals – www.sysinternals.com

Password:

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\WINDOWS\system32>mkdir f-response

3. Then in the same window, we make a directory to put the f-response agent and configuration file in.

C:\WINDOWS\system32>cd f-response

C:\WINDOWS\system32\f-response>

4. On the investigator machine command prompt, we now want to copy the f-response agent and configuration file (f-response-ent.exe and NetUniKey.ini) over to the target machine, and into the directory we just created. Look out for escaping of quotes here:

C:\WINDOWS\system32>runas /user:VINCENTS\bschatz_admin “xcopy \”c:\Program Files (x86)\F-Response\F-Response Enterprise Edition\”\* \\192.168.20.195\c$\windows\system32\f-response\ /e /s /v /y /i”

5. Back in the target machine command prompt, we (in order of commands below) first install the f-response agent as a service, start the service, and finally, assuming that your clients firewall rules prevent connection to the f-response iSCSI target, open the windows firewall on that port:

C:\WINDOWS\system32\f-response>f-response-ent -c

C:\WINDOWS\system32\f-response>net start “F-Response Enterprise Service”
The F-Response Enterprise Service service is starting.
The F-Response Enterprise Service service was started successfully.

C:\WINDOWS\system32\f-response>netsh firewall set portopening protocol=TCP port=3260 name=iSCSI mode=ENABLE profile=DOMAIN
Ok.

6. At this point the regular connection to f-response may be performed.

When you are done
How to undo the above?

C:\WINDOWS\system32\f-response>netsh firewall delete portopening protocol=TCP port=3260
Ok.

C:\WINDOWS\system32\f-response>net stop “F-Response Enterprise Service”
The F-Response Enterprise Service service is stopping.
The F-Response Enterprise Service service was stopped successfully.

C:\WINDOWS\system32\f-response>f-response-ent -d

C:\WINDOWS\system32\f-response>del *.*

C:\WINDOWS\system32\f-response>cd ..

C:\WINDOWS\system32>rmdir f-response

My Ph.D. thesis was accepted by my university a while ago. A result of this is that my thesis is now publically available at the Australian Digital Thesis project. The citation for the thesis is reproduced below.

This thesis addresses problems related to the complexity and volume of evidence drawn from computers and other digital devices (so-called digital evidence) in policing and legal matters. The research identifies methods for increasing the efficiency and reliability of investigations employing digital evidence, by proposing automated methods of processing and documenting such information. The research examined at a fundamental level the role of representation in interpreting and analysing digital evidence, identifying where a formal approach to representing digital investigations and digital evidence reduces the complexity and volume problems. A formal approach was shown to be of benefit in automating the identification of situations of interest from correlated event records sourced from computer security and other disparate event logs. Additionally a formal approach was shown to facilitate granular sharing of evidence and extensible documentation of investigations. Finally, the research identified flaws in the fundamental assumptions in the interpretation of time-stamped evidence, and proposed a novel method of inferring the temporal behaviour of arbitrary computers.

Many thanks to my Ph.D. supervisory team: Ajd. Prof. George Mohay, Dr. Andrew Clark, and Dr. Peter Best. Your support and encouragement have been instrumental in directing my research to this conclusion. Finally, thanks to my thesis examiners for their valued criticism and recommendations.