Informaon)Assurance) in)a Distributed)Forensic) Cluster)old.dfrws.org/.../presentations/DFRWS2014-pres3.pdf · 2014-08-09 · Informaon)Assurance) in)a Distributed)Forensic) Cluster))

Informa(on Assurance in a

Distributed Forensic Cluster

•  Nick Pringlea*, Mikhaila Burgessa

•  a University of South Wales (formerly University of Glamorgan), Treforest, CF37 1DL, UK

•  This is a short presenta(on of the work presented at DFRWS Europe 2014

•  www.fcluster.org.uk •  PhD published at the end of the year

ComplexHighly SkilledSmall Quantity

SimpleBasic Skills

Large Quantity

Opera(on Big Wing, 24th April 2014 3,300 Metropolitan Police Officers Targe(ng Co-‐ordinated arrests of 630 persons across London as burglary and theS crackdown Na(onal Crime Agency Opera(on Notorise resulted in 660 persons arrested in regards child abuse. Specifically 9,172 devices seized.

Source media Write

Protected Copy

Image on Local

harddisk

Artefact extrac(on Processing

Analysis Repor(ng

8GB USB 2 S(ck

SATA III but HD 85MB/s

i7 12 cores

Analysis Repor(ng

2 MBytes/sec per core 20 minutes

3TB hard Disk 75 Mbyte/s


i7 12 cores

Analysis Repor(ng


SATA III SSD at 450 MB/s

i7 12 cores

Analysis Repor(ng

$$$$ Expensive

Results Database

Results Database

Results Database

Results Database

Our Media

Our Media

Write Protected Copy

Direct Write Protected Copy


Copy

Copy

11 hours

2 minutes



i7 12 cores

Analysis Repor(ng

Results Database

Our Media

Copy Write Protected Copy

11 hours 2 MBytes/sec per core 70 hours

S7ll 2 MBytes/sec per core S7ll 70 hours

2 minutes

11 hours

S7ll 2 MBytes/sec per core S7ll 70 hours

Processor Bound

11 hours

No Control over Source device speed All Cores at 100%

Chain of Evidence Wait

Wait Wait Wait



i7 12 cores

11 hours 2 MBytes/sec per core 25 x i7 = 300 cores 2 hours

Gigabit Network 100 MB/s = 10 hours



Xeon 64 cores

11 hours 2 MBytes/sec per core 13 hours

$$$$ Expensive! $150,000? Unacceptable SGI Al(x 4700?

i7 12 cores i7

12 cores i7 12 cores i7

12 cores 10 Gigabit Network 1000 MB/s $$$ Expensive For 25 W/S $25,000

Analysis Repor(ng

Analysis Repor(ng

Results Database

Results Database



i7 12 cores i7 12 cores i7

12 cores i7 12 cores i7

12 cores

This problem is not going away. It’s going to get worse! RCFL Figures

2004 2012 % 2020?

Examinations 1304 8566 657 56270 Total Volume Examined

229TB 5886 TB 2570 151 EB Average Case 175GB 680 GB 300 2.6 TB

Linear Processing

Mul(-‐Threading/ Parallel/ Distributed Processing

Task setup Processing Task closure

Latency, Mul(-‐threading and Parallel Processing

I7 -‐ 12 cores Hard Disk

Source media

Write Protect


Analysis Repor(ng













Source media

Write Protect

Source media

Write Protect

Source media

Write Protect

Results Database


Source media

Write Protect


Analysis Repor(ng













Source media

Write Protect

Source media

Write Protect

Source media

Write Protect

Results Database

DEB DEB DEB DEB DEB DEB DEB DEB

DEB

DEB DEB DEB DEB DEB

DEB

DEB

DEB

DEB

DEB

DEB

DEB

DEB

DEB DEB

DEB DEB

DEB DEB

DEB DEB

DEB DEB

DEB DEB DEB

DEB

DEB DEB DEB DEB DEB

DEB DEB DEB DEB DEB

We lose “Chain of Evidence” •  We’re not longer using a simple system

with one file store and a few PCs

•  In this world of distributed storage and processing we need to revisit and re-‐establish “Chain of Evidence” within the computer system

•  We’re back a decade and can’t move on un(l we do


Source media

Write Protect


Analysis Repor(ng













Source media

Write Protect

Source media

Write Protect

Source media

Write Protect

Results Database (Hadoop?)


DEB

DEB DEB DEB DEB DEB

DEB

DEB

DEB

DEB

DEB

DEB

DEB

DEB

DEB DEB

DEB DEB

DEB DEB

DEB DEB

DEB DEB

DEB DEB DEB

DEB

DEB DEB DEB DEB DEB

DEB DEB DEB DEB DEB “Jigsaw” Im

aging

Data Acquisi7o

n Triage

FClusterfs


Source media


Analysis Repor(ng













Source media

Source media

Source media

Results Database (Hadoop?)

DEB DEB

DEB

DEB DEB

DEB DEB

DEB DEB

“Jigsaw” Imaging Data Acquisi7on Triage

FClusterfs

Processing Server Results Meta Data table

Replicator Data Storage Server

FClusterfs metadata storage Metadata Import/Load Balancer

Acquisi(on Authority Jigsaw Imager and Data Triage

FCluster Architecture Roles and Zones

Jigsaw Imaging •  Reads the Source media and follows the file system (not sector by sector)

•  Creates Digital Evidence Bags for each file while simultaneously crea(ng the conven(onal image

Source media

Write Protect

Source media

Write Protect

Source media

Write Protect

Source media

Write Protect


DEB

DEB DEB DEB DEB DEB

DEB

DEB

DEB

DEB

DEB

DEB

DEB

DEB

DEB DEB

DEB DEB

DEB DEB

DEB DEB

DEB DEB

DEB DEB DEB

DEB

DEB DEB DEB DEB DEB

DEB DEB DEB DEB DEB

Data Acquisi(on Triage

•  Uses a Bayesian approach that directs the Jigsaw Imaging process to priori(se files considered to be of higher likelihood of yielding evidence

Source media

Write Protect

Source media

Write Protect

Source media

Write Protect

Source media

Write Protect


DEB

DEB DEB DEB DEB DEB

DEB

DEB

DEB

DEB

DEB

DEB

DEB

DEB

DEB DEB

DEB DEB

DEB DEB

DEB DEB

DEB DEB

DEB DEB DEB

DEB

DEB DEB DEB DEB DEB

DEB DEB DEB DEB DEB

Fclusterfs A file system for Digital Evidence Bags

A FUSE file system that: •  Stores the original file meta-‐data in the file system •  Gives access to files stored as whole, encrypted DEBs •  Has access control by user and file system and file •  Is Read Only •  Logs movement of, and access to, data •  Allows (most) unaltered legacy soSware •  Allows non-‐parallel-‐aware soSware to run across mul(ple nodes

Why is this the right approach? •  This could be achieved within an applica(on program but

each package would to have to implement it and gain approval.

•  Working at file system level the efficacy is global •  Interac(on with FClusterfs is unavoidable •  Fclusterfs controls data access and maintains Assurance

Funded by…

Informa(on Assurance in a

Distributed Forensic Cluster Ques(ons?

Documents

Informaon)Assurance) in)a Distributed)Forensic) Cluster)old.dfrws.org/.../presentations/DFRWS2014-pres3.pdf · 2014-08-09 · Informaon)Assurance) in)a Distributed)Forensic) Cluster))