What the FTK?

In the class that I am taking about forensics, we have spent the last few weeks digging into a couple of different tools: Autopsy (mentioned in my last post) and FTK. As a quick disclaimer/post-posting edit, I would like to say that the Windows version of Autopsy is much less antiquated then the Linux version I used and reviewed. In fact, the Windows Autopsy program that I used actually looks very similar to FTK (and it's free ninety-nine!)

FTK

FTK (Forensic ToolKit) is a not-free program that is distributed by AccessData. On the main page for FTK at the AccessData website, it touts FTK as "a court accepted digital investigations platform", and that is definitely the audience that this program is built for. FTK offers a variety of different tools that allow a user to view deleted files, piece together meta-data, view a timeline of events that have taken place on certain images, etc. Pretty much anything can be imported into FTK and used as evidence. 

FTK is built off of a database system (which is included during the initial installation) and uses some pretty beefy algorithms and architecture to index data and make it searchable. FTK also does a lot of the heavy lifting for users, so that going through evidence seems more like browsing through a directory instead of piecing together hex code or bits and bytes. 

One very useful thing that I learned from a classmate of mine was called "carving" the data. Carving is kind of like what it sounds like- working the program a little harder, and having it scrape and clean data to bring out things that may have been hidden, and basically trimming the fat. This is done fairly easily by using the "Evidence" tab, then selecting "Additional Analysis".

Another tool that is built around the same structure as FTK is MPE+ (Mobile Phone Examiner Plus), which is a separate program that feels almost exactly like FTK. MPE+ is basically FTK for mobile phones and devices. I am just getting into using the program, but it seems very intuitive and like I have already mentioned, is structured a lot like FTK in the UI and features. 

While FTK and MPE+ are not free, they can be tried for 30 days courtesy of AccessData. Downloads for FTK and other AccessData products can be found here: http://www.accessdata.com/support/product-downloads.

XKCD. Too good. 

To Catch a Criminal

Of the tools I plan on talking about today, one is more on the archaic-but-useful side, while the other is just plain useful and a bit creepy, and the last is something that I have actually been working on in the open-source community. When it comes to forensics, that is kind of the nature of a number of the tools still in use by professionals... New tools come out, but a lot of the time forensics experts like using open-source(i.e. cheap/free) tools and suites!

Autopsy

One of these open-source and sweet tools (see what I did there? ;) ) is Autopsy. Autopsy is an older program that is available for both Windows and Unix operating systems, and is even included in a few Linux distros (like Kali and SIFT). Autopsy is something that I have been using to reconstruct damaged filenames/filetypes, to look through files to see if they have been tampered with, and frankly to see files and file structures at a more microscopic level. 

That being said, like I have already mentioned, Autopsy is a little bit dated. It is nice that the program at least has a GUI, but it definitely takes a little bit of time to get used to. The screenshot below shows a little bit what it is like to use the tool. You can tell just in the toolbar above the files how many options you have once you have started the case- you can do file analysis, search for keywords in all of the files, get metadata and look through hex code, etc. Truly, Autopsy has an array of tools for cyber forensics that just take a little bit of getting used to in order to fully grasp the benefits of the program. This basic tutorial is great for helping beginners to get started: http://digital-forensics.sans.org/blog/2009/05/11/a-step-by-step-introduction-to-using-the-autopsy-forensic-browser

The Autopsy download can be found at http://www.sleuthkit.org/. 

Data Echo

Data Echo is another tool used by some professionals today (particularly by some consultants on the Brigham Young University (BYU) network) and is the free version of a more powerful tool owned by Solera Networks. Ironically, it was actually released to the public by a member of the Solera team accidentally, and because of that slip-up we can all enjoy this product. 

Data Echo is a tool that can help users recreate a TCP session using capture packet data. You can either do this live, using WireShark or another capturing utility, or you can analyze saved .pcap files as well. Honestly, this program is a bit creepy. If you are a network administrator and are capturing packets on a co-workers computer, you could essentially recreate their browsing sessions and email usage. Yea. Creepy. 

But effective! Especially if you are using it for forensic and/or criminal investigations. This tool doesn't really have a learning curve on it either. You literally load it up, and either start capturing packets with it using the included packet capturing utility, or load in a saved .pcap file for analysis. This program can be found at http://sourceforge.net/projects/data-echo/.

TCPDShark

The last tool I will bring up is actually a project that I am currently working on using Git (source-code sharing software) and CodePlex (a Microsoft creation for fostering open-source tools- I know, kind of counter-intuitive... It's a traaaaaaap). This tool is a plugin for WireShark called TCPDShark. As I have mentioned above, WireShark is a forensic tool used to capture packets over a network. TCPDStat is an older tool that is Unix-based and is used to take packet data and analyze it, giving the user statistics. Since TCPDStat is Unix-based, a BYU student decided to create a version of the program that works on Windows. 

Written in the LUA coding language, TCPDShark fulfills the same function as TCPDStat by giving packet data analytics, specifically what percentage of packets captured are of each different protocol (http, https, ARP, etc). Using this information, the program then goes a step further and gives some suggestions of percentages that may be worrying to a user, and gives an explanation of why. 

This tool is a plugin for WireShark, and therefore you have to have WireShark installed to use it. You can find the WireShark download here: http://www.wireshark.org/download.html and the TCPDShark plugin here: https://tcpdshark.codeplex.com/