RE: Digital Evidence Question - What is an effective Windows hard -disk search tool?

From: Robinson, Sonja (SRobinson_at_HIPUSA.com)
Date: 06/19/03

Next message: security_at_evensonit.com: "RE: Hard Drive Encrypting"

Previous message: Ben Collins: "RE: Central Win2000 auditing logs"
Maybe in reply to: Robinson, Sonja: "RE: Digital Evidence Question - What is an effective Windows hard -disk search tool?"
Next in thread: Wilcox, Stephen: "RE: Digital Evidence Question - What is an effective Windows hard -disk search tool?"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

To: "'Wilcox, Stephen'" <StephenWilcox@universalcomputersys.com>, security-basics@securityfocus.com
Date: Thu, 19 Jun 2003 09:07:41 -0400

If you haven't overwritten, the master -slave that Chris Berry suggested
would work for copying your files. A new drive prefer W2K or XP should read
any other Win O/S. Linux would also work to read your drive.

Sonja Robinson, CISA
Network Security Analyst
HIP Health Plans
Office: 212-806-4125
Pager: 8884238615

-----Original Message-----
From: Wilcox, Stephen [mailto:StephenWilcox@universalcomputersys.com]
Sent: Wednesday, June 18, 2003 2:54 PM
To: security-basics@securityfocus.com
Subject: RE: Digital Evidence Question - What is an effective Windows hard
-disk search tool?

Hello

It funny that this discussion started in the last few days.. As Murphy
would have it, last night while installing a new nic card. Something
happened to the boot.ini file and corrupted it. I don't know how or why
except the possibility of it writing to the boot.ini file the nic
information. I don't think that this information is stored in the boot.ini
file but maybe. Anyway the problem I ran into is that the win would not
load and I couldn't recover it. (No safe mode, no fixboot, no fixmbr,
nothing) I figured I would just overlay an OS on top of the old one and
then recover the information, no luck the process would not perform unless I
format. Great... If you know what I mean. I have been researching free
tools to recover lost data but no real luck in a software that performs
properly. I was wondering if anyone has/knows of one. Looking to recover
my office files - *.xls, *.pst file and *.doc files.

Stephen

-----Original Message-----
From: Robinson, Sonja [mailto:SRobinson@HIPUSA.com]
Sent: Wednesday, June 18, 2003 10:54 AM
To: Robinson, Sonja; 'marcus peddle'; security-basics@securityfocus.com
Subject: RE: Digital Evidence Question - What is an effective Windows hard
-disk search tool?

I was a bit rushed yesterday, sorry, so here is a bit more detail but still
in a general kind of knowledge base. I'm trying to keep it a simple
explanation so that the general population can understand the basics. If
people want to get really technical please feel free....

In Windows operating Systems (and others) there is the File Allocation Table
(FAT) that is basically an index of where your files are located. Your
files can and are written across numerous clusters and are not written
sequentially. One file is in a number of pieces across your hard drive and
each cluster points to the next in the chain. In addition, MS writes files
more than once (this you'll find in free space and swap space.) If your
file does not fill up the entire cluster, MS dumps other data into it. This
"extra area" is called unallocated space. This data can be anything and is
normally what was in RAM at the time. So for instance you cluster is 24K
(just throwng out a number here) and your file only fills up 18K, well then
the remaining 6K is filled up with "garbage". "What is one O/S's garbage
could be the confidential info I'm looking for...."

When you delete a file, only the pointer in the FAT table is deleted. The
file is still there until it is overwritten. Since MS writes to random
clusters only parts of your file may be overwritten at anytime and the parts
that aren't overwritten are recoverable. It should be noted that MS
normally starts overwriting the beginning clusters of the drive so of the
file is located near the end of the drive it takes longer to overwrite.
Remember though again, that, it does not write in sequential clusters.
Theortically, the end of the drive may never be written to depending on how
much writing and deleting you do.

In order to obtain this "deleted" or "hidden" information you need to
analyze your drives using tools gnerally used for forensics (NTI, Coroners
tool kit, Encase, FTK, Linux tools). In most acses bitstream copies are
done first to preserve evidence but if you're not worried about evidence and
you just want to see what's on your drive any of these tools will work, but
they're not free (Linux tools generally are). If you just want to undelete
files Norton Utilities works great. It's much easier to see it in a
diagram. I think NTI has a good diagram but I'm sure there are others out
there as well.

UltraEdit and other hex editors are great for reading misc data, files and
disks. You just have to be patient.

Did you ever notice how all of your e-mail is 1K even if it is blank, yes MS
dumps info in there too but it is generally invisible unless you do
analysis. It's amazing what you can find....

Sonja Robinson, CISA
Network Security Analyst
HIP Health Plans
Office: 212-806-4125
Pager: 8884238615

-----Original Message-----
From: Robinson, Sonja
Sent: Tuesday, June 17, 2003 3:17 PM
To: 'marcus peddle'; security-basics@securityfocus.com
Subject: RE: Digital Evidence Question - What is an effective Windows hard
-disk search tool?

You're looking for something hat does DoD specs, 31x write, try maresware
decalsfy, bcwipe, etc. There are a number of tools. Make sure that it goes
past the eof flag at the end of the drive. And the LE, most likely used
Encase or FTk. What he did was not magic, it's called forensics. Files are
not deleted when you delete them their pointer is so that the O/S can't
effectively find the file anymore even though the file rsides on the drive
until it is overwritten. Files are written multiple time in an MS o/s and
can reside in multiple locations. You need to look at free, swap and
uallocated space. There is a wealth of info there.

Sonja Robinson, CISA
Network Security Analyst
HIP Health Plans
Office: 212-806-4125
Pager: 8884238615

-----Original Message-----
From: marcus peddle [mailto:marcus_peddle@yahoo.ca]
Sent: Monday, June 16, 2003 8:12 PM
To: security-basics@securityfocus.com
Cc: marcus_peddle@yahoo.ca
Subject: Digital Evidence Question - What is an effective Windows hard-disk
search tool?

Hello,

I have a question/request:

A few weeks back, a friend of mine in law enforcement
demo'ed a tool he had on is computer that searched his
entire hard drive and built an evidence file (he
called it acquiring the drive). He then used a
propritarty tool to search the file the tool built for
things he thought he had deleted. I am very aware of
the footprint that can be left on a users computer but
he had an extensive wipe tool that I was quite
surprised to see did not delete everything. He began
pulling up images/cookies/files that he thought he had
deleted years ago.

Needless to say i was quite surprized.

So I now use a wiping program on my computer that
deletes and overwrites all deleted files. I also have
a few other footprint erasers going but I wonder how
effective they are.

What I seek is the following:

-A tool (peferably freeware) that I can use to acquire
and search my hard drive for
images/history/general/etc information that I have
"deleted".

Any suggestions? It goes without saying that any
ideas you may have would be appreciated. Thanks!

Marcus

______________________________________________________________________
Post your free ad now! http://personals.yahoo.ca

---------------------------------------------------------------------------
Evaluating SSL VPNs' Consider NEOTERIS, chosen as leader by top analysts!
The Gartner Group just put Neoteris in the top of its Magic Quadrant, while
InStat has confirmed Neoteris as the leader in marketshare.

Find out why, and see how you can get plug-n-play secure remote access in
about an hour, with no client, server changes, or ongoing maintenance.

Visit us at: http://www.neoteris.com/promos/sf-6-9.htm
----------------------------------------------------------------------------

**********************************************************************
This message is a PRIVILEGED AND CONFIDENTIAL communication, and is intended
only for the individual(s) named herein or others specifically authorized to
receive the communication. If you are not the intended recipient, you are
hereby notified that any dissemination, distribution or copying of this
communication is strictly prohibited. If you have received this
communication in error, please notify the sender of the error immediately,
do not read or use the communication in any manner, destroy all copies, and
delete it from your system if the communication was sent via email.

**********************************************************************

----------------------------------------
The information transmitted in this message is intended only for the person
or entity to whom it is addressed and may contain confidential and/or
privileged material. Any review, retransmission, dissemination or other use
of, or taking of any action in reliance upon this information by persons or
entities other than the intended recipient is prohibited. If you received
this in error, please contact the sender and destroy any copies of this
document.

---------------------------------------------------------------------------
Evaluating SSL VPNs' Consider NEOTERIS, chosen as leader by top analysts!
The Gartner Group just put Neoteris in the top of its Magic Quadrant,
while InStat has confirmed Neoteris as the leader in marketshare.

Find out why, and see how you can get plug-n-play secure remote access in
about an hour, with no client, server changes, or ongoing maintenance.

Visit us at: http://www.neoteris.com/promos/sf-6-9.htm
----------------------------------------------------------------------------

Next message: security_at_evensonit.com: "RE: Hard Drive Encrypting"

Previous message: Ben Collins: "RE: Central Win2000 auditing logs"
Maybe in reply to: Robinson, Sonja: "RE: Digital Evidence Question - What is an effective Windows hard -disk search tool?"
Next in thread: Wilcox, Stephen: "RE: Digital Evidence Question - What is an effective Windows hard -disk search tool?"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Relevant Pages

RE: Digital Evidence Question - What is an effective Windows hard -disk search tool?
... clusters only parts of your file may be overwritten at anytime and the parts ... normally starts overwriting the beginning clusters of the drive so of the ... analyze your drives using tools gnerally used for forensics (NTI, ... Evaluating SSL VPNs' Consider NEOTERIS, chosen as leader by top analysts! ...
(Security-Basics)
RE: Digital Evidence Question - What is an effective Windows hard -disk search tool?
... > normally starts overwriting the beginning clusters of the drive so of the ... > analyze your drives using tools gnerally used for forensics (NTI, ... > Evaluating SSL VPNs' Consider NEOTERIS, chosen as leader by top analysts! ...
(Security-Basics)
RE: Digital Evidence Question - What is an effective Windows hard -disk search tool?
... hard -disk search tool? ... analyze your drives using tools gnerally used for forensics (NTI, ... Digital Evidence Question - What is an effective Windows hard ... Evaluating SSL VPNs' Consider NEOTERIS, chosen as leader by top analysts! ...
(Security-Basics)
RE: Digital Evidence Question - What is an effective Windows hard -disk search tool?
... Digital Evidence Question - What is an effective Windows hard ... hard -disk search tool? ... analyze your drives using tools gnerally used for forensics (NTI, ... Evaluating SSL VPNs' Consider NEOTERIS, chosen as leader by top analysts! ...
(Security-Basics)