Here have a look at this hard drive

This was the statement made to me by my boss. What is interesting is I am a newbie when it comes to forensics, so lets get to this. The chain of evidence has been preserved I have an image of the hard drive and the original is locked in a lawyers safe. So that is not an issue. The system was not properly handled because it was a laptop and the user "turned it in" before he left, so it has been rebooted......Nothing I can do there.
The drive has 2 partitions on it a Win2k and a linux (Red Hat). Now I have gone through the tutorials and I plan on using the tools recommended (awesome info guys thanks) to analyze the Win2k partition, however, I get a sneaking suspicion that if this character was doing anything it was while in Linux. The first step is to get past the password. I am researching that today and hope to have it solved by the time you read this.
My question is are there freeware forensic tools that can give you the same type of information as those tools created for Windows?

you can just boot with knoppix or so and remove the password string in /etc/shadow of the root account, now you would have access to the system as root...

this should work, unless there is some kind of security which prevents the root account from having an empty password...

you can just boot with knoppix or so and remove the password string in /etc/shadow of the root account, now you would have access to the system as root...

this should work, unless there is some kind of security which prevents the root account from having an empty password...

Have a look at this live bootable cd
http://www.knoppix-std.org/
http://www.knoppix-std.org/tools.html

forensics
/usr/bin/forensics/

* sleuthkit 1.66 : extensions to The Coroner's Toolkit forensic toolbox.
* autopsy 1.75 : Web front-end to TASK. Evidence Locker defaults to /mnt/evidence
* biew : binary viewer
* bsed : binary stream editor
* consh : logged shell (from F.I.R.E.)
* coreography : analyze core files
* dcfldd : US DoD Computer Forensics Lab version of dd
* fenris : code debugging, tracing, decompiling, reverse engineering tool
* fatback : Undelete FAT files
* foremost : recover specific file types from disk images (like all JPG files)
* ftimes : system baseline tool (be proactive)
* galleta : recover Internet Explorer cookies
* hashdig : dig through hash databases
* hdb : java decompiler
* mac-robber : TCT's graverobber written in C
* md5deep : run md5 against multiple files/directories
* memfetch : force a memory dump
* pasco : browse IE index.dat
* photorec : grab files from digital cameras
* readdbx : convert Outlook Express .dbx files to mbox format
* readoe : convert entire Outlook Express .directory to mbox format
* rifiuti : browse Windows Recycle Bin INFO2 files
* secure_delete : securely delete files, swap, memory....
* testdisk : test and recover lost partitions
* wipe : wipe a partition securely. good for prep'ing a partition for dd
* and other typical system tools used for forensics (dd, lsof, strings, grep, etc.)

http://www.google.com/linux?hl=en&lr...=Google+Search

There's a thing out on the BugTraq forensics list right now about Knoppix not being sound with regard to forensic investigation.... Unfortunately I can't seem to find it right now..... You might want to look into it......

[Edit]

Search Bugtraq for this thread:-

Re: Re: Write protection devices was: Imaging speed - USB, IDE, laptop

I'm pretty sure this is the one where a CD run Knoppix isn't forensically "sound"

[/Edit]

Quote:

---

you can just boot with knoppix or so and remove the password string in /etc/shadow of the root account, now you would have access to the system as root...

---

This would make any evidence you gleened from the drive in admisable in a court of law. You have just let the bad guy off. Because you have changed the drive contents.

Jinxy, notice he said he had an IMAGE of the drive, so he can mess with it all he wants and find information however he wants then he will know the location of everything on the physical drive when it comes time for him to deal with it.

How was that image aquired. Im not an expert on the subject, but i have read alittle resently. It would seem that it is very difficult to get the courts to exept this type off evidence. That is why software like Encase is so expencive.

http://www.guidancesoftware.com/

Thanks for the heads up Tiger Shark. And here is the url
http://www.securityfocus.com/archive...5/2004-06-11/0

Check this out "KNOPPIX Validation Study"
http://www.linux-forensics.com/publications.html

As with any tool that you use, learn its strengths and weaknesses.

Knoppix is definitely not forensically sound as it attempts to automount available partitions (and for a couple other reasons too). A good forum for linux-related forensics (tools and otherwise) is http://www.linux-forensics.com which coupled with the forensics securityfocus mailling list should get you started off on the right foot.

Quote:

---

I get a sneaking suspicion that if this character was doing anything it was while in Linux. The first step is to get past the password

---

Three questions:

1. If this is a corporate property box, why don't you have the password anyway?.......which password is it?.......like are these lower level user passwords, encryption hashes or what?

2. What do you suspect the character might have been "doing"?

3. Who obtained this "image" and how did they do it?

Cheers

If there is concern there may be something on the hard drive that could result in criminal prosecution, send it to a company that specializes in that type of data recovery. Why further potentially foul the integrety of the evidence by dorking around with it?

If you are just snooping around for a good reason to fire somebody (ie, inappropriate web surfing, violating company email policy, etc.) by all means, play around with the image of the hd all you want.

I think it comes down to a question of "how important is it to prove we didn't alter data after the lap top was turned in"?

As a confessed forensics newbie, a good defense attorney is going to make you and everyone else who touched that thing look either malicious or incompetent and bring the credibility of the data into question. Remember the O.J. Simpson trial? The entire LAPD was a racist institution that was trying to frame Mr. Simpson because he had the gall to marry (and divorce) a pretty white girl. At least, that is what the defense team told the jury, and it worked.

So if there is the possibility of jail time attached to what may be on that disk, I say don't even fool with it. Let someone else get called up on the witness stand to justify his methodology.

Quote:

---

If you are just snooping around for a good reason to fire somebody (ie, inappropriate web surfing, violating company email policy, etc.) by all means, play around with the image of the hd all you want.

---

Hey, were we not told that the machine had been handed in?

Like yourself I get a distinct aroma of rodent here?............how do we know that this is not a stolen box, and someone is trying to get data off it...........

If it is really "in a lawyer's safe" then I would imagine that the employment of a competent forensic analyst would be justified?..........hell, aren't lawyers expensive enough?

Social engineering?

Just my thoughts...........OH and uno digerati means one finger to the non cognoscenti



:D

First let me address Nihil concern........Look for posts from me over the last week and you will discover that I am just a guy trying to do his job. I have been reading information off this board for a while now and know the brain trust that exists here is AWESOME and sometimes paranoid. If you are concerned I am trying to trick you into revealing something that you shouldn't then maybe research some of the other posts the user makes before you make the accusation in their thread.......As a senior member of this site your "opinions " carry weight and you should consider that. Now I feel I have to spend time defending the validity of this thread. Enough said, no hard feelings....Like I said sometimes paranoid.

THE Drive:
The hard drive belonged to the previous security person. The concern is that he was into things that he had no business in and while that will be easy to look at on the NT partition (corporate install) the linux partition will be more of a challenge for me (his install).
The company does not want to pay for a $30k tool or to hire a consultant to do the legwork on the drive. I am it.....It is my job because I am the "network security guy" so I am supposed to know it all........Sound familiar :)
There is a corporate legal team and so they are holding the original drive which was imaged from Ghost.
The point is if I find something then the company will decide how to proceed and if they want to prosecute they will take my findings and send them to a "expert" with the original drive who will go to court.....not me :)

Thanks for the information especially from Devprn, TigerShark, and CHSH......Great resources thanks again!!!!

If anyone has anything else I am all ears...........

Quote:

---

Now I feel I have to spend time defending the validity of this thread.

---

Don't bother..... I'll vouch for you......

I was going to PM you and tell you about Nihil, I got sidetracked.... :( He's a good guy too and has a pretty good nose for "rats"..... Suspicious barely begins to describe him..... ;)