Menu
  • Home
  • Brett's Blog
  • My Books
  • Courses
  • About Me
  • Contact
  • Home
  • Brett's Blog
  • My Books
  • Courses
  • About Me
  • Contact

Brett Shavers | Ramblings

Brett's Ramblings

Subscribe to blog
Unsubscribe from blog
Settings
Sign In
If you are new here, Register
  • Forget Username
  • Reset Password

Digital Forensics

JUN
04
0

You do not want to work in DFIR.

Posted by Brett Shavers
in  Digital Forensics

 

The fantasy

So many people ask how they can start a career in the DF/IR field, which is completely understandable. The glamour is there. Hollywood shows vivid and dynamic computer screens depicting the fascinating work of forensics and incident response, from James Bond flicks to any of the CSI tv show series.

And the money! There is so much money to be made! WHAT A GREAT JOB!

The reality

You need to know computers. I mean, you really need to know about computers, from the basic fundamentals of how a computer works physically with hardware through how software works on that hardware. You need to be a generalist and a specialist. The time spent to learn what you need to learn requires more than you can imagine and at that point, you will still be incompetent for working in this field. You’ll just know that you don’t know enough.

Then when you feel like you have learned “enough” to do the job, if you haven’t kept up with technical aspects of the field every day, you will realize that you have fallen behind in competence faster than a boulder plummeting down a high cliff.

After you read a dozen books on the topic, spend thousands of dollars in courses and conferences, practice with all types of software, your climb to the hill of knowledge will feel like the hill is growing and you are not making any headway. 

Every device that you touch will seem like Groundhog Day because not only will it be a different scenario than the prior device, but your objectives will be different, and the software that you once used might not work for what you need this time. That means learning a new tool to handle a new device on a new case, all the while, trying to keep up with the changes that were made in an operating system from last week.

You will quickly learn that CSI on TV has it all wrong. You won’t be solving anything in the timespan of a primetime TV show and will be explaining to your boss or client constantly that Hollywood has forensics all wrong, and that you have to do research on the analysis. Then your confidence will fall because you will feel that you should have already learned how to do analysis on this particular device, but you have to now do research and figure it out like it’s the first day on the job.

Once you get the hang of this career, for as long as you want to be competent, you will be constantly seeking out training, reading, practice, and research. If you didn’t realize it before, you just learned that the process to keep up is never-ending!

Your reality

If you still want to work in DFIR after all of that, then you might be made for it. This may be your path.  I spoke about much of this with Jessica Hyde of Magnet Forensics this week, and I stand by everything I said about trying to talk someone out of a difficult profession because there are some jobs that require more effort than other jobs in terms of preparation and sustainability.

For each of us, there are jobs that we could not be paid enough to do. Those same jobs where we would never work are the same jobs that some people would pay to have. Each person is different as each job to each person is different, and there is a sliding scale for career preferences.

Any and every job is honorable. No job is beneath any of us. And if we are fortunate in this life, we can choose a job that fits both our wants and needs. DF/IR is no different in that aspect with any other profession.

The one aspect where DF/IR is different is the effort required to get started. Compared to a job where minimal skill is required, or where the skill is fairly easy to obtain, DF/IR  is not only not easy, it is laborsome. With that comes making a commitment to carry through just to get a chance of working in the field. If you are not committed, you are not going to make it.

If you ever competed in anything, from music to sports, you know that it takes many hours of perfect practice, many errors, and extreme focus just to be able to be competitive against everyone else. You can tell in seconds those who have prepared from those who have not. There is no competition when there is no preparation.

On the visual below, if DF/IR is not on the far green end of the arrow for you, you might not make it because it is too easy to give up on anything, let alone something that you are not fully committed to do.

Boot camp is not what you think

If DF/IR sounds like a military boot camp to you, then you got the picture that I am trying to get across. It is boot camp for your brain. You need endurance. You need focus. You need to learn to walk all over again and eventually you are running.

Side note: Boot camp is not bad. It is physically challenging. It can be self-demoralizing as you flounder about learning things that you can’t learn anywhere else. But you know the goal, want to work toward that goal, and when you achieve it, have earned the respect of putting forth your efforts. Same with DF/IR. It is the sacrifice of effort and time in exchange for learning skills.

Few things in life are more frustrating and defeating than not getting what you worked for.  We are impatient. We want what we want when we want it and not a second later. If you are lucky, you get what you want when you want it. For the rest of us, it will take time, effort, failure, time, effort, failure, time, effort, failure, and eventually success. Time = days or years, different for everyone and everyone’s personal situation.

Excuses are like…

During my first week in Marine Corps Boot Camp, a drill instructor was yelling at a recruit who had just given an excuse for failing at a task. The DI yelled "Excuses are like assholes. Everyone has one and they all stink!"  I don’t believe DIs can swear anymore by the way..but the point was well made to me and I was really glad to learn it by not being the recruit being yelled at. Don’t worry. I was given my fair share of being yelled at every day.  The point is that everyone has excuses and they get in your way if you let them get in your way.

There are some factors that will eliminate you from a specific job. For example, to be a firefighter, you need to be able to physically carry firehoses upstairs to put out fires. If you cannot physically do that for any reason, you won’t get that job. Same with being a house painter. If you blind, painting houses isn’t going to be possible. If you are able to perform a job, then the odds are good that you can get that job with effort.

Barring circumstances that physically prevent you from doing DF/IR, you can do this job. That might make it sound like anyone can do this job, but that is far from the truth. The only people who can do this job are the ones who dedicate themselves to continual education to keep up and learn. For those who DF/IR is for them, keeping up with the field is more entertaining than watching an action movie because it is exciting and challenging. For those who struggle with spending the time to prepare, learn, and keep up, DF/IR is not for them.

You cried?

If you didn’t get into the school of your choice for the DF/IR degree of your choice or were turned down by the job that you really wanted, or failed to pass a certification that you studied weeks for, or couldn’t figure out something that you believe to be simple for everyone, then you are probably still on the right track. This is normal. 

And if you sat in the middle of your room and cried about your choice of working to get into DF/IR, that is ok too. You are probably still on the right path. If you consider quitting to do something else, you are even still probably on the right path.

The defining point is that after you do that once or twice or a hundred times, you stand up, crack open the book, and get back to it. If you keep doing that, you will be fine. Do not let yourself get in the way of what you are working toward.  Quitting is simply what happens when you find out that what you thought you really wanted, you didn’t want bad enough. No matter how often you fail, it is only failure when you stop trying.

Yes, it does take time.

Timing is everything. If you are lucky (I am not….), by the time you are qualified to do DF/IR, the demand is so great that you have the pick of where you want to and how much you will accept to be paid.  You might not have any downtime between qualified to work and actual work.

For many others, it might take years to get where you want to go. Actually, it probably will take years to end up where you want to be. This is not only ok, but to be expected. Achieving what you want sooner than expected is nice but do not let this be your measure of success.

I get it

Sometimes the timing is not right for what you want. Maybe you are too early or too late for what you are after. Sometimes there are things out of your control that can prevent you from walking one path, but that does not mean you cannot walk another path that might end up being the better path for you.

Life happens to all of us. We hope to avoid life’s tragedies, but the tragedies are waiting on your path just as they are on the path of everyone else. We confront what we confront when it is time to confront them. We don’t choose when they happen, but we choose how to react.

With that, for anyone wanting to sincerely step off the DF/IR path because of any reason, I fully support the decision, because that decision to quit is probably the right decision. By the right decision, I mean that quitting means you weren’t meant for that path, but also means there is another path more fit for you.

But for those who are on the spectrum that they would pay their salary to work in this field, to learn the bits and bytes of data, and to spend whatever energy is required to get there, I am right behind you making sure you keep going.  You can cry along the way or even toss your laptop against the wall in frustration as long as you decide to keep moving forward. Cry. Wipe off the tears. Get back to work. You will be fine.

Hang on…you’re already in DF/IR?

If you do this job already, by now you should have encouraged at least one person who had a spark of DF/IR to move forward (maybe one of those folks was me!). Be an inspiration to the next generation. We now live in a world of the most negative social media, call out and cancel culture, where anyone can be brought down publicly for no reason at all. This is our world, the electronic world, the “cyber” world, and by virtue of our job, we are responsible for safety of all people. Be the force of good and make your name one to be remembered for helping someone, not tearing them down.

The experiences of anyone in this field are awesome! They are even more awesome when you can ignite a small spark of inspiration in someone who may use these skills to change the way we do business, change the way we think about DF/IR, and potentially change the world.

Don’t think this doesn’t apply to you, regardless of where you sit. You have more power to inspire someone to make discoveries in this field that would not be possible except for the spark you lit in someone. That’s pretty cool in my book.

2
  4910 Hits
Tweet
Share on Pinterest
4910 Hits
APR
25
0

COVID-19’s Investigative Impacts on Digital Forensics/Incident Response (DFIR). AKA: All burners are now burned.

Posted by Brett Shavers
in  Digital Forensics

The meat and potatoes

A bit is still a bit and a byte is still a byte. COVID-19 cannot change that, which means that the technical aspects of the work has not changed. But what about the investigative aspect?  Oh yes. That part of DFIR has certainly changed. The key change is geolocation, and it is more important than you may realize at first glance.

The full meal

Every investigation with any aspect of an electronic device has been affected due to COVID-19 and its consequence of stay-at-home/work-at-home. As far as investigations are concerned, device geolocation is perhaps the biggest impact. There are also other subtle aspects of the quarantine to take advantage of in your investigations, whether you are involved in civil or criminal investigations or corporate matters. The benefits are there to be had. Individual privacy is yet another issue but let us start with investigations.

For the most part, the impact of COVID-19 is positive for investigators. Actually, it is practically only positive.  I will be breaking down the pros and cons by way of using the below four broad categories. These are "broad" because overlap exists and it is near impossible to have a clean break from every aspect of DFIR. Every person fits in one or more of those boxes, including the privacy category.

Digital Forensics (DF) & Incident Response (IR)

Criminal & national security investigations

Breaches, ransomware

Electronic Discovery (ED)

Civil litigation

Corporate/internal matters

Open Source Intelligence (OSINT)

Related to any/all investigations and privacy

Not related to any/all of these items

Privacy & Surveillance

A separate, but just as important consideration

Includes, government, corporate, and personal

 

Digital Forensics (DF) & Incident Response (IR)

How does COVID-19 affect DFIR investigations?

For criminal investigations, the geolocation impact is most dramatic. Compare the “before” and the “current” geolocation investigative aspects of COVID-19 (specifically criminals using mobile devices and Internet access points).

 

Before COVID-19

Current COVID-19

#1

Devices traveled 24/7.

Devices are at home.

#2

Multiple devices of one criminal shared the same (multiple) geolocations of other criminals who also carry multiple devices.

The criminal’s devices are sharing one geolocation mostly (only) with family or no others.

#3

“Burner” devices may or might never be turned on or used at “home”.

Burner devices need to be on at home to be used.

#4

Burner devices might not be used at the same geolocation as non-burner devices.

Both burner and personal devices will share the same geolocation (home).

#5

Public wireless access points were used for communication and online criminal activity.

Personal or nearby accessible access points are being used.

#6

Face-to-face meetings to conspire were common.

Electronic communications are now more necessary.

 

In the above comparison, “home” is where a person lays their head. Investigators who pursue criminals focus heavily on the “home” of a criminal, which tends to be the location where the criminal spends most of their time, stores and creates physical evidence, and where they are most vulnerable to arrest. Even one of the most primary and basic goals of law enforcement surveillance is to follow criminals and ‘put them to bed’, which simply means, follow them to their home. COVID-19 makes this much easier since everyone, including criminals, must be home, or at least be at home more than usual.

Side note: An investigative truism for the vast majority of crimes is that criminals must communicate to plan, conspire, and commit crimes. The most convenient and commonly used investigative method to capture communication is focusing on communication devices. Quarantine makes this easier.

COVID-19 Benefits Investigations

--Mobile devices

---Easier to find the home of the owner (suspect) since the device will be home more.

---Easier to identify other devices of the suspect since personal devices are also home with the suspect.

---Cell tower dumps near a crime scene will have fewer devices connected, lowering the list of possible suspects.

---“Burners” are now burned. They now travel less and are quarantined with their owners. Burners can now be easily tied to a ‘home’ and to its owner at that home.

---“Burners” will now always be near their owner’s other devices, tying them together.

---Subsequent forensic analysis post-seizure will have fewer GPS points to investigate. This is good for the purpose of fewer false alibis.

---Higher usage of all devices (burners and personal) results in more data and more evidence. There is also a higher use since face-to-face communications are less due to quarantine/stay-at-home.

--IP Addresses

---Higher use of personal Internet accounts being used.

---Higher use of borrowing neighbor’s Internet access.

---Higher chance of protective measures (VPNs, Tor, etc…) being inadvertently misconfigured or neglected for one or many communications.

With criminals being home more than usual, identifying their devices, tying the devices to them, and identifying the “homes” of criminals has never been easier.  As long as you have either the device information (ex. the phone number) or the home address, tying both together is simpler than pre-COVID 19. Consider that a mobile device, including the ‘burners’, will be living at their owner’s home for longer hours per day than before, because the owner is at home for long hours. Where cautious criminals won't turn on a burner at their home, they don't have much choice now.

  • A home address can be assumed and later confirmed by using mobile device geolocation, such as from GPS coordinates obtained from service providers.
  • Device information can be obtained by having the home address, such as examining cell tower dumps, or other technical means to obtain mobile device signal connections.

Another side benefit of COVID-19 for investigations is that of increased usage of electronic devices to communicate. Criminals must still leave their homes to commit traditional, non-computer crimes, but the use of mobile device communications still increases. More calls to more phones help build a more thorough link analysis of criminals and their co-conspirators. Traditional policing is also made easier with fewer cars on the road and fewer places for criminals to blend in with the public (such as at a crowded restaurant or park).

Cell tower dumps in the area of a crime, where pre-COVID 19 could result in hundreds of devices per one tower might now only have a few devices which greatly narrows the list of potential suspects of a crime.

Successful criminal hackers take great pains to hide their true identity and location. Whether it be using VPNs or Tor, one of the basic premises is to not connect to the wire with anything that ties to your home or work. For the most part, the quarantine forces the use of a home Internet connection or a nearby neighbor’s connections. One error made in complacency or technical failure can expose everything.  Investigators should take advantage of the increased possibility of tracking a criminal hacker to their home as compared to tracking to any one of thousands of public WiFi spots found at libraries, coffee shops, and throughout entire cities with public WiFi.

One negative with COVID-19's quarantine is not being able to physically place the co-conspirators together by way of geolocation, such as having two devices being at the same place at the same time. In cases that I have had, each time that I could identify the date and place that a group of conspirators would meet to talk, such as at dinner or a parking lot, being able to identify every device in the area was a good operation. This was really beneficial as not every person in an organization will call every person in that organization, so tying devices together requires more labor. Conversely, in the quarantined world, everyone in the organization will need to call more of those in the organization to communicate.

As far as when the quarantine is lifted and we reach the new normal, the historical geolocation data available will still benefit future cases, both with device forensic analysis and with third-party service providers holding the geolocation data.

Electronic Discovery (ED)

Compared with criminal and civil investigations, COVID-19 poses more risk to businesses. Companies who are allowing remote work at their employees’ homes without appropriate precautions are now creating a situation of intermingled personal and business data.

Employees who know have open access to their employer’s systems using personal devices might be the biggest risk to employers in the past decade. On one hand, data mingling can cause a substantial legal issue in litigation, where company data might be intentionally or inadvertently saved onto personal computers. Additionally, personal computers that may have outdated anti-virus or unsupported operating systems could increase the chances of a company being compromised through an employee’s personal system.

Companies that had been supporting remote work by way of providing systems that are maintained by internal IT staff and using protected connections (not simply directly connecting to the network…), have no concerns that they did not have before COVID-19. For the rest, I can foresee some problems.

Open Source Intelligence (OSINT)

OSINT is fun for the curious. It is also an effective investigative method as well as an effective victimization tool. With COVID-19’s quarantine, the impact is that for those who want to remain semi-private regarding their homes, yet still remain socially available online, they will be more at risk of exposure.

Being at home more means most photos to be posted on social media will be those taken from the home. More family photos. More photos of a home’s interior and exterior. All of which can build upon safety concerns for some.  

For investigators, applying OSINT to cases where suspects are using social media simply means gathering more relevant and home-based geolocation data.

Privacy & Surveillance

Being anti-crime does not mean that you must be anti-privacy, but most governments will try to convince you otherwise. All of the above-mentioned benefits of COVID-19 as it relates to investigations to solve crimes have a perverted relationship in potential loss of personal privacy. The key questions are who is being watched, for what reason, and for what justification.

Right behind any government are the many tech companies with the ability to collect personal data from its users, privacy be damned. The intention is for the public good as it is primarily, if not solely, used as a revenue source (your data is sold and sold and sold again). Now, we are online more because we are home more (practically 24/7), which creates more data to be collected on the websites we visit, the online shows that we watch, the videos, and online purchases.

A government’s view of “data hoarding” is for the public’s benefit.

A corporate’s view of “data hoarding” is for corporate benefit.

Now comes COVID-19 and there is a merge between the two. Corporate tech giants (small tech too!) are partnering for both the public good of tracking people via mobile devices and certainly the sale of the data. The most effective way to convince anyone to give up a bit of privacy is to promise a chunk of security in exchange.  In times of panic or worry, not only is this easy to accomplish, but it is more of an exchange of a large piece of privacy for a false hope of security.

https://www.apple.com/newsroom/2020/04/apple-and-google-partner-on-covid-19-contact-tracing-technology/

Post COVID-19

I can expect to see the mobile apps being developed today that track infected persons and their interactions with non-infected being more commonly used. The Apple-Google efforts of using Bluetooth technology to track people in the name of public safety can be easily applied to many other things, much like the dating apps and other friendly location sharing apps do as well.

For the investigator, these data sources have always been treasure troves used to place a suspect at a scene but will now jump into hyperdrive in doing more by collecting data with willing user-consent, default configurations of apps, and covert monitoring.

Summary

Forensic analysis is the same. Investigations have (temporarily) changed. Good investigators continually look for breaks in a case, are always open to a break in a case, ready to exploit a break in a case, and are creative in trying to find a break in a case. Don't let COVID-19 be anything else other than a potential way to solve a case. For the business owners and managers, it is not too late to update computer use policies to protect how employees connect to the company's data.

Committing crimes today is not as easy as yesterday. Neither is keeping your privacy.

2
  18397 Hits
Tweet
Share on Pinterest
18397 Hits
APR
05
2

Mini-WinFE 10 and WinFE 10 Updated

Posted by Brett Shavers
in  Digital Forensics

The short story on the newest Mini-WinFE 10 (aka, the download link):

Mini-WinFE has been updated and upgraded.  I update WinFE developments (including the downloads for Mini-WinFE) at https://www.patreon.com/posts/34814255.  The Mini-WinFE builder is a free download.

Mini-WinFE 10 

Are forensic bootable OSs still useful today?

Depending on who you ask, forensic bootable OSs are either extremely valuable or of no practical use. The answer is based on your job, which is why WinFE works great for some and not at all for others. For traditional forensics on deadbox machines, WinFE has a place. In ediscovery matters for data collection, WinFE certainly has a place with custodian machines. For devices that can’t be imaged or accessed other than booting the machine, WinFE has a solid place in the DFIR toolbox. If your job does not involving imaging machines in a forensically sound matter, then WinFE may not be useful to you. The value of WinFE is solely dependent on if you can use it in your job.

What is (Mini) WinFE?

WinFE (Windows forensic Environment) is a forensically sound, bootable Windows operation system, created by Troy Larson and built using a string of command lines. In short, Troy turned WinPe into a WinFe.

Mini-WinFE is easier method of building a WinFE that gives a more ‘fuller’ version of WinPE.  I selected WinBuilder, a project in use for years for customizing WinPEs, to be used as the WinFE building project. A smaller, lighter, quicker build (Mini-WinFE) became the defacto WinFE build because of ease of build and ease of use. Mini-WinFE has now evolved into using PE Bakery with Misty updating the Mini-WinFE project and Colin Ramsden’s updating the Write Protect Tool.

Mini-WinFE 10

WinFE 10 is the most substantial improvement to WinFE since its inception by Troy Larson.  Colin Ramsden did an amazing job of completely updating the WinFE Write Protect tool in his build project and with the WinFE acquisition of ARM devices.  The next phase of WinFE 10 was to implement Colin Ramsden’s upgraded write protect app into the WinBuilder build of Mini-WinFE. In this most recent improvement of Mini-WinFE, PE Bakery was chosen as an improved replacement for WinBuilder.  Both Colin and Misty have now updated the Mini-WinFE with Colin’s latest Write Protect tool.

The primary difference between Mini-WinFE and WinFE 10 is that the Mini-WinFE build, unfortunately, does not acquire ARM devices as does Colin’s WinFE 10 build. However, Mini-WinFE is easier and faster to build which is great for anyone needing a WinFE but not needing an ARM WinFE (WinFE 10).

WinFE 10

Using Colin Ramsden’s build of WinFE 10, you have the new capability to image ARM devices. He also completely updated his write protect tool, and his build method also includes a new forensic imaging tool that works in ARM. That is 100% cool.

For the build download of Colin’s new WinFE, check out Colin’s website, https://www.winfe.net/.

https://www.winfe.net/

 

WinFE Resources

WinFE Documentation

Ultimate Cheats! Windows Forensic Environment (https://www.amazon.com/Ultimate-Cheats-Windows-Forensic-Environment/dp/1790322782). Covers all-things-WinFE and is a good reference to building all versions of WinFE, from the first version to the current WinFE 10 version.

DFIR books:  Multiple books have referenced WinFE, but few (if any) have any details on the how-to-build a WinFE.

Training

If you are in law enforcement (LE), there are a few sources of WinFE training:

  • SEARCH   https://www.search.org/get-help/training/high-tech-crime-investigations/instructor-led-training/windows-forensic-environment/
  • RCFL   https://www.rcfl.gov/orange-county/training-schedule/secure-techniques-for-on-site-preview-stop-nw3c
  • Others As part of FLETC, IACIS, short conference presentations, and others.

For non-LE, the training is even less, but you may be able to find WinFE incorporated in some college-level forensic programs.

An online WinFE course that includes printable proof of completion as part of a Patreon subscription at https://www.patreon.com/DFIRtraining.  The work-at-home/stay-at-home special of 60% off is ongoing and includes other courses too.  The curriculum of the online course can be seen at: http://courses.dfironlinetraining.com/windows-forensic-environment-winfe.

The future of WinFE

Until/unless a day comes when devices cannot be booted forensically, WinFE will continue to be a useful tool in your DFIR toolbox. WinFE has been around for over a decade, used to acquire evidence in both civil and criminal cases worldwide, taught everywhere, noted as a community accepted forensic tool in many DFIR books, and is awesome as an acquisition tool!

 

 

 

0
  16911 Hits
Tags:
winfe
Tweet
Share on Pinterest
Recent Comments
Guest — Jeff E.
Hi Brett, Wondering if there is a way to add dot net framework to a Mini WinFE build?
Friday, 24 April 2020 11:31
Brett Shavers
There is, but it is not easy. I remember seeing a Winbuilder script at one point, but do not know if it worked. Microsoft says i... Read More
Friday, 24 April 2020 12:02
16911 Hits
    Previous     Next
4 5 6 7 8 9 10 11 12 13

DFIR Training

Be sure to check out my DFIR Training website for practically the best resources for all things Digital Forensics/Incident Response related.


Brett's blog

© 2023 Brett Shavers