Digital devices are common place. Digital device examiners are not. How does the digital dutch boy prevent the digital device dam from breaking? By sticking his preview thumb into the leak.
The point of a forensic preview is to determine if the device you are examining has evidentiary value. If it does, the device goes into your normal work flow. If it does not, it gets set aside. The dam remains intact by relieving it of the pressure of non-evidentiary devices.
The point of this post is not to enter a discussion of the benefits and short comings of forensic previewing. I’m merely going to record a method I recently used to differentiate between the files created by the owner of a laptop computer and those generated by the thief who stole the computer. Hopefully, you see something useful here to adapt to your investigation.
The Plot
Police officers recovered a laptop from a home that they believed was stolen. One roommate said the device had arrived in the home a few days earlier, but did not know how it got there. The remaining members of the household claimed to know nothing about the computer at all.
I booted the device with a Linux boot disc designed for forensic examination. The disc allows storage devices to be examined without making changes. I was lucky enough to find a user account that had been established a few years earlier, and files in that account that allowed me to identify and contact the computer’s owner. The owner reported the device had been stolen from him two weeks earlier. The owner had password protected his account, but there was a guest account available for use.
Catching the Thief
I could have stopped there, but the job would have been only half-done. I knew who owned the computer, but I didn’t know who’d stolen it. Fingerprints were not an option, so I decided to look for data in the computer that might identify who had used the computer since it had been stolen. A quick look in the guest account showed me I was not going to be as lucky identifying the suspect as I had the victim: there were no user created documents.
What I need to do was to find the files modified by the suspect and inspect those files for identifying information. The suspect may not have purposely created files, but browsing the Internet, etc, creates cache and history files that point out a person as surely than a witness in a suspect lineup (that is to say, not with 100 percent certainty, but often reliable none-the-less).
File systems are very helpful in examinations of this nature: they keep dates and times that files are created, accessed and modified, just to name a few date attributes. Modern operating systems are very helpful, too, because they usually auto-sync the computer’s clock with NTP (Network Time Protocol) servers. Simply stated, modern operating systems keep accurate time automatically.
With this knowledge in mind, I was looking for guest account files (and, ultimately, all files) that were modified in in the past two weeks. Files modified outside that range were changed by the owner and of no interest. Fortunately, the find command provides a solution:
# This command returns all files modified less than 14 days ago $ find path/to/search -mtime -14 -daystart
|
Note
|
The -daystart option causes find to measure times from the start of the day rather than the last 24 hours. |
The -mtime n option takes integer argument n. This is where a little explanation is in order. Had I passed the integer "14", I would have only returned files modified 14 days ago. Passing "-14" returns all files modified less than 14 days ago. Passing "+14" would cause find to return all files modified more that 14 days ago. It is possible to pass two -mtime options to create a narrow range, such as:
# This command returns all files modified between 7 and 14 days ago $ find path/to/search -mtime -14 -mtime +7
The command in the first example resulted in just over 1600 file names being returned. I saw that most of these were Google Chrome browser application data files. Both the "History" and "Login Data" SQLite databases contained data leading to the identity of the computer user since the date the laptop was stolen (a roommate) and the dates of the activity suggested the computer had been in that person’s possession since shortly after the theft.
Telling Time
The date command can really be your friend in figuring out dates and date ranges. It is easier to demonstrate than explain:
$ date Mon Feb 23 12:41:41 PST 2015 $ date -d 'now' Mon Feb 23 12:41:50 PST 2015
|
Note
|
The two commands above do the same thing. |
$ date -d 'yesterday' Sun Feb 22 12:43:42 PST 2015 $ date -d 'tomorrow' Tue Feb 24 12:43:49 PST 2015
|
Note
|
The date command understands simple english. Used thusly, it calculates based on 24 hour periods, not from the start of the day. |
$ date -d '1 day ago' Sun Feb 22 12:48:57 PST 2015 $ date -d '1 year ago' Sun Feb 23 12:49:14 PST 2014 $ date -d 'next week' Mon Mar 2 12:49:53 PST 2015
Note: The info date command will show you many, many more useful invocations of the date command.
Determining Elapsed Days
You may recall that the find command takes an integer for its date range options, but none of the date commands I illustrated above yielded and integer show the number of days elapsed or until that date. If there is an option for date to yield such information, I have not discovered it. However, a simple shell script can be created to allow us to use the "plain language" of the date command to help us determine the integers required by find.
# This is a simple script that does not test user input for correctness # usage: count_days.sh date1 date2 # collect dates from command line and covert to epoch first_date=$(date -d "$1" +%s) secnd_date=$(date -d "$2" +%s) # calculate the difference between the dates, in seconds difference=$((secnd_date - first_date)) # calculate and print the number of days (86400 seconds per day) echo $((difference / 86400))
|
Note
|
This script can be made executable with chmod +x count_days.sh or simply executed by calling it with bash: bash count_days.sh |
Now, we can figure out the number of days elapsed using the same plain language conventions accepted by the date command. Be sure to enclose each date in parenthesis if the date string is more than one word.
# How many days have elapsed since January 10 $ bash count_days.sh "jan 10" "now" 44 # How many days elapsed between two dates $ bash count_days.sh "nov 27 2013" "Aug 5 2014" 250 # How many days will elapse between yesterday and 3 weeks from now $ bash count_days.sh "yesterday" "3 weeks" 22
You get the idea. And I hope I’ve given you some ideas on how to use the find and date commands to your advantage in a preview or other forensic examination.
No comments:
Post a Comment