2013-10-18 Computer Forensics and Hash Values

Computer Forensics: Images and Integrity

NHACDL Fall 2013 CLEConcord, NH

18 October 2013

Frederick S. Lane

www.FrederickLane.com

www.ComputerForensicsDigest.com

Background and Expertise

• Attorney and Author of 7 Books

• Computer Forensics Expert -- 15 years

• Over 100 criminal cases

• Lecturer on Computer-Related Topics – 20+ years

• Computer user (midframes, desktops, laptops) – 35+ years

Lecture Overview• Not Your Mother’s Hash• The Role of Hash Values in

Computer Forensics• The Growing Use of Hash

Flags• P2P Investigations Using

Hash Values

Not Your Mother’s Hash

• Cryptograhic Hash Values• Relatively Easy to Generate• Extremely Difficult to Determine

Original Data from Hash Value• Extremely Difficult to Change

Data without Changing Hash• Extremely Unlikely that Different

Data Will Produce the Same Hash Value

Types of Hash Alogirithms

• Secure Hash Algorithm• Developed by NIST in 1995• 40 characters long

• Message Digest• Developed by Prof. Rivest in 1990• 32 characters long

• Photo DNA• Developed by Microsoft• Hash value based on histograms of

multiple section of image

Complex Explanation• The word DOG can be represented in

different ways:• Binary: 010001000110111101100111• Hexadecimal: 646f67

• A hash algorithm converts the hexadecimal value to a fixed-length hexadecimal string.• SHA-1:

e49512524f47b4138d850c9d9d85972927281da0• MD5: 06d80eb0c50b49a509b49f2424e8c805

Complex Explanation• Changing a single letter

changes each value.• For instance, the word COG

produces the following values:• Binary: 010000110110111101100111

• Hexadecimal: 436f67

• SHA-1: d3da816674b638d05caa672f60f381ff504e578c

• MD5: 01e33197684afd628ccf82a5ae4fd6ad

Simple Explanation

Oatmeal-Raisin Cookies

Oatmeal-Chocolate Chip Cookies

Evidence Integrity• Acquisition Hashes• Creation of Mirror Images• Verification of Accuracy of Mirror

Images• Use of “Known File Filter”• Hashkeeper• National Software Reference

Library

• NCMEC CVIP Database

Growing Use of Hash Flags

• Child Protection and Sexual Predator Act of 1998

• 2008: ISPs Agree to Block Access to Known Sources of CP and to Scan for NCMEC Hash Values

• SAFE Act: Requires ISPs and OSPs to Turn Over Subscriber Info If Known CP Is Identified

P2P Hash Values• Basic Operation of Peer-to-

Peer Networks• Decentralized Distribution• Gnutella and eDonkey• Client Software• Hash Values Associated with

Each File

Automated P2P Searches

• Peer Spectre or Nordic Mule Scans for IP Addresses of Devices Offering to Share Known CP Files

• IP Addresses Are Stored by TLO in Child Protection System

• Officers Conduct “Undercover” Investigations by Reviewing Spreadsheets of Hits in CPS

Growing Defense Concerns

• No Independent Examination of Proprietary Software

• Very Little Information Regarding TLO or CPS

• Peer Spectre May Generate False Hits Due to Normal Operation of P2P Clients

• Search Warrant Affidavits Fail to Mention Role of TLO or CPS

Computer Forensics: Images and Integrity

NHACDL Fall 2013 CLEConcord, NH

18 October 2013

Frederick S. Lane

www.FrederickLane.com

www.ComputerForensicsDigest.com

2013-10-18 Computer Forensics and Hash Values

Technology

COE589: Digital Forensics - ccse.kfupm.edu.saahmadsm/coe589-122/00_Overview_Logisti… · Digital Forensics computer forensics mobile forensics network forensics ... COE589 - Ahmad

Tehnologije za provjeru integriteta datoteka · Hash funkcije Svaka hash funkcija primjenjuje neki hash algoritam za ra čunanje sažetaka Obilježja hash funkcija: Hash funkcije

Chapter 5 Hash Functions What is a Hash Function? The Birthday Problem Tiger Hash Uses of Hash Functions

Hash-JoinAlgorithmen · Hash-Join Algorithmen | Matthias Richly | 6. Januar 2009 3 Gliederung Hash-JoinAlgorithmen allgemein Einfacher Hash-Join GRACE Hash-Join Hybrid Hash-Join

Hash-Based Indexes - University of Torontocsc443h/fall/posted_lectures/Week2.pdf•For hash-based indexes, a skewed data distribution is one in which the hash values of data entries

PeekaTorrent: Leveraging P2P Hash Values for Digital Forensics

Organizing Data: Hash Tables15110-n15/lectures/unit06-2-HashTables.pdf · Looking Up Values in Hash Tables Convert a key (e.g. string) to an integer and convert this integer to a

iPhone Forensics Methodology and Tools · Forensics methodologies, iPhone forensics, forensics tools, digital forensics evidence handling, INTRODUCTION iPhone mobile phone is becoming

OOo Digital Signatures - OpenOffice.org · Hash Values One Way Hash Functions – Easy to compute, but difficult to reverse – Difficult to find two input values which result in

Chapter 3 Public Key Cryptography · 30 One way datadata hash value hash value. 31 Collision resistant datadata hash function hash value hash value datadata. 32 Message Authentication

Hashing. Concept of Hashing In CS, a hash table, or a hash map, is a data structure that associates keys (names) with values (attributes). Look-Up Table

Forensics & Anti- Forensics

Multi-Hash: A Family of Cryptographic Hash Algorithm ... · Multi-Hash: A Family of Cryptographic Hash Algorithm Extensions 5 Definition of Multi-Hash We define Multi-Hash extensions

CSN08101 Digital Forensics - grussell.org Digital Forensics Lecture 6 ... – hashlog option outputs hash results to a text file that ... – vf (verify file) option compares the image

Comp ter Forensics It’s NotComputer Forensics: It’s … ter Forensics It’s NotComputer Forensics: ... Computer Forensics Can be Useful with ... Solid state drives & deleted file

Forensics · Disk Forensics Mobile Forensics E-mail investigations Questioned document Cryptography, examination Steganography Live Forensics and Network Forensics Audio/video authentication

Cloud Storage Forensics - SANS Computer Forensics

Hashing & Hash TablesHashing & Hash Tablesananth/CptS223/Lectures/hashing.pdf · Hash table: Main components key value Hash index e “john” key h(“john”) TableSiz Hash function

Meta Anti Forensics - Hack In The Box Security Conference - The... · Meta Anti Forensics Presenting the hash Hacking Harness the grugq ... [snip] #

Cryptography in Forensics: Check Sums, Hash Functions, and ... · Cryptography in Forensics: Check Sums, Hash Functions, and the MD5 Algorithm An Undergraduate Teaching Module By: