Printable View
I'm writing a paper over anti-forensics and i was wondering if anybody had any particular anti-forensic tools that they liked or have read about.
Anti-forensics being tools that try to prevent digital forensics and gaining of digital evidence.
So this is more of a personal opinion post than advice.
I've never even heard of anti-forensics. And just because I haven't heard of that, among other reasons, I'd be interested in seeing the final result of your paper if you're willing to share it. Sorry I can't help you with your paper though.
I'm not sure if this is an antiforensics tool, but I've used various hard drive whiping utilities that go further than a simple format. I've heard of drive washing, but I have this other boot disk at work that I've used exclusively. I can't remember the name. If you really want to know, message me and I'll tell you tomorrow. I usually use it before we return any leased systems or do any type of donations. The only problem with it, it takes a hell of a long time to format.
As far as other tools I use to discourage digital evidence or access to important critical information, I have a media destroyer/paper shredder. Before I throw CDs/DVDs away, I make sure I destroy them. NOt sure if this is considered antiforensics, but I can see how it would be a barrier against people trying to steal any type of data.
hi all,
for antiforensics you have to look into http://metasploit.com/projects/antiforensics/. They hava a very good presentation on this topic http://metasploit.com/confs/toorcon2...innie_2005.ppt
another good read on the topic http://www.informit.com/guides/conte...eqNum=108&rl=1
Talisker anti forensic tools
Hey Hey,
As far as "anti-forensics" go... I think a pretty popular app is Darik's Boot and Nuke disk (DBAN)
Peace,Quote:
Price and Usage Restrictions
Price per computer: yes FREE
Price per user: yes FREE
Number of wipes: yes UNLIMITED
Open source code: yes YES
User Rights: yes GPL PROTECTED
Wipe Methods
Quick Erase yes YES
Canadian RCMP TSSIT OPS-II Standard Wipe yes YES
American DoD 5220-22.M Standard Wipe yes YES
Gutmann Wipe yes YES
PRNG Stream Wipe yes YES
Enhancements
8/33/137 gigabyte disk size BIOS limit fix: yes YES
Fast PRNG (Mersenne Twister) yes YES
Entropy Seeding yes YES
Verification yes YES
Logging yes YES
Hardware Drivers
Controllers: XT, IDE, PATA, SATA, SCSI yes ALL
Consoles: Serial, HGA, VGA yes ALL
Buses: ISA, MCA, PCI yes ALL
Platform Support
* Hardware
o DBAN has all available drivers for SCSI disks.
o DBAN has all available drivers for IDE, PATA, and SATA disks.
o DBAN runs on all 32-bit x86-class computers (Athlon, Pentium, and others) with at least 8 megs of memory. If you find an incompatible machine, then please report it.
* Software
o DBAN supports all Microsoft platforms and securely destroys FAT, VFAT, and NTFS filesytems.
+ MS-DOS, Windows 3.1
+ Windows 95, Windows 98, Windows ME
+ Windows NT 3.0, Windows NT 3.1, Windows NT 3.5, Windows NT 4.0
+ Windows 2000, Windows XP
o DBAN supports all unix platforms and securely destroys ReiserFS, EXT, and UFS filesystems.
+ FreeBSD, NetBSD, OpenBSD
+ Linux
+ BeOS
+ QNX
HT
Hi VAIO can we get the "rules of engagement" sorted out first?
There are two concepts here:
1. I have a working computer which I use, then delete evidence of what I did.
2. I want to wipe everything off a hard drive and that retained in the RAM sticks.
I think that your question is about #1................so you still have a working computer, but it retains no trace that can be discovered by using computer applications, and leaving the device fully functional?
For example, tools like Darik's Boot and Nuke will clean a machine for redistribution, but you will trash everything in the process. You would need to install an operating system etc. to get it to work afterwards.
If you need a more subtle solution, you first need to find where program accessible data are stored?
Your definition of the scope of your paper would be helpful.
;)
http://www.delldjsite.com/forums/att...ntid=336&stc=1
Anything that will disrupt the validity of the data will work as anti forensics.
Encryption, secure deletion, anonamisers.
I think you need to be more specific.
I ask you guys for your opinion on a broad open topic and you still want more specific details. lol. Encryption, secure deletion, anonamisers, these all are great. And i might even throw the sledge hammer into my paper.Quote:
Originally posted here by Aspman
Anything that will disrupt the validity of the data will work as anti forensics.
Encryption, secure deletion, anonamisers.
I think you need to be more specific.
My paper covers specific information about what anti-forensics is, how it can be used, and specific anti-forensics tools. I am working with a partner for this paper who is supposed to cover the first two things, and i am just supposed to write about tools. So you have a broad spectrum of opportunity to explore your favorites list, any books your might have read, and even your common knowledge to provide input to the discussion. No Parameters! As long as it's something anti-forensics.
Disk wiping to the point of no return, encryption, scripts, booby traps such as the Alias command in linux to have "ls" really delete something. Whatever.
Do these have to be demonstrated and/or documented methods of preventing investigation?
I can think of things like, booby trapped USPs that trip a disk wipe when power goes off.
Badly trained police is a wide shot but it definitely affect the quality of forensic evidence.
Virtual machines? What if someone carried out their illegal acts from within a VMWare virtual computer?
Most forensics data is discredited in court not through the data itself but through the handling of the evidence by the investigating organisation.
I have a practical question. Since most people wanting to hide evidence
may not have a lot of time to act, what attention has been paid to the idea of
destroying the evidence while the cops are beating the door down?
You know, like in old gangster movies, bookies working in the back room
of the pool hall using paper that will instantly burn when touched with
a lighted cigarette?
:cool:
Well,
I think that you need to go a bit deeper. If I find a PC with a blank hard drive and nothing works, I know what has happened and I know that you are hiding something. That is when it goes to the "clean room" and the rat hunt begins. The only limitation will be my determination and my budget.
The only true "anti forensics" is to pulverise the thing and dissolve the powder in a vat of acid. Then pour the acid down the drain (sorry, tree huggers :D )
So, the first anti-forensic "move" is to persuade the investigator that there is no need to use forensics...............................the more machines that they have to look at, the easier this is.
So something like "Norton Ghost" or a similar hard drive cloning/mirroring program is actually a potential tool. What you would do is format the drive and then use the cloning/mirroring software to superimpose an apparently innocent system image. That would throw most investigators off, as they wouldn't see anything to excite their interest and attention. Also, you would have overwritten the drive with valid data.
Please realise that once you have overwritten data, it is gone..........no software program will get it back for you............it is the "clean room" scenario and you are going to have to look at B]"track overlay"[/B] and "magnetic remnance"
Another potentially ignored anti-forensics tool is on the dark side of the web. Make sure that your box has a good few Trojans and Back Doors on it.............that will probably invalidate any forensic evidence that may be found, as it cannot be proven who put it there.
Then look at USB Drives, R/W CDs and DVDs..............................You simply load your OS and applications onto these, boot from them, and take them away with you afterwards. The only evidence you will leave behind is in the RAM sticks............and that needs the "clean room". A similar scenario is the removable drive..............so long as there is one in the bay, and it looks plausible, who is to know how many others there are out there?
You are obviously very young and naiive. Wait until you get to deal with lawyers, accountants, doctors and the like...................it is called "being professional"; we don't do general questions........... and we charge like hell ;)Quote:
I ask you guys for your opinion on a broad open topic and you still want more specific details
I wrote this tutorial a while back: http://www.antionline.com/showthread...hreadid=248897
I was looking at a different angle, but the second section (electronic security) might give you some ideas?
:)
Yeah, I tried drive washing once. But the drive wouldn't work again when I took it out of the dishwasher.
I do know that Secret Service agents are very careful about not letting any suspects touch anything once they have entered the house/building/room. They have come across a few people who have set up encryption/destruction programs in case of a bust. Most don't, though. It is possible that the time and effort is too high, and the risk of accidentally setting it off is too great.
Don't ask.
Are you kidding? I asked for everyone's opinion and gave a very broad spectrum. There is a time and place for details and documentation and protocol, yes. But this question is not one of those times.Quote:
Originally posted here by nihil
You are obviously very young and naiive. Wait until you get to deal with lawyers, accountants, doctors and the like...................it is called "being professional"; we don't do general questions........... and we charge like hell ;)
Hmmmm,
Another thought, is the "hidden drive" concept. This software creates a virtual drive or partition that you need passwords to activate (the example I have needs 4 independent ones) and encrypts the data as well. You need to activate the software to get the virtual drive to show up.
Your average law enforcement type wouldn't even know it was there ;)
:)
I'm in favour of giant magnets... for last ditch effort to erase all traces of information... of course sledgehammer would be more spectacular...
Please take this advice as it is intended.............as a general principle it is a good idea to set a few limits and parameters, as they keep people focussed.Quote:
Are you kidding? I asked for everyone's opinion and gave a very broad spectrum. There is a time and place for details and documentation and protocol, yes. But this question is not one of those times.
You are trying to write a paper?................you have chosen the "tools" section?..........well "tools" are specific to jobs, so you have to be more specific in your questions. It is as simple and as complicated as that.............or do you normally eat your burgers with a monkey wrench?
:cool:
May as well ask about "super-sneeky-hacker-f***-you-fed" tactics.
If you want a resonable response...I don't think you can honestly reach state #1 that nihil mentions above. Unles you overwrite a disk with multiple passes of random bits, you can't be certain what informaiton is left on a disk. Even if you use some fancy tool to ferret all the data that you may have left behind, if you're talking about a Windows machine you can't be certain what has been written or left behind in the slack space of sectors or fragments of a pagefile.
State #2 is easy. Full wipe/format multiple times, or Big F***ing Magnets (cancer causing hiroshima magnets). Hydrochloric acid and a hammer work well, too.
Great idea! LoL I've been doing my "research" in vmware for a long time now. *none* of those sessions are recoverable.... ;)Quote:
Originally posted here by Aspman
Do these have to be demonstrated and/or documented methods of preventing investigation?
I can think of things like, booby trapped USPs that trip a disk wipe when power goes off.
Badly trained police is a wide shot but it definitely affect the quality of forensic evidence.
Virtual machines? What if someone carried out their illegal acts from within a VMWare virtual computer?
Most forensics data is discredited in court not through the data itself but through the handling of the evidence by the investigating organisation.
However, it seems as if the vmware player does have a bit of spyware in it. Snort picks it up as spyware as it phones home. Simple ACLs to block that though...
Hey Hey,Quote:
Originally posted here by zencoder
May as well ask about "super-sneeky-hacker-f***-you-fed" tactics.
If you want a resonable response...I don't think you can honestly reach state #1 that nihil mentions above. Unles you overwrite a disk with multiple passes of random bits, you can't be certain what informaiton is left on a disk. Even if you use some fancy tool to ferret all the data that you may have left behind, if you're talking about a Windows machine you can't be certain what has been written or left behind in the slack space of sectors or fragments of a pagefile.
State #2 is easy. Full wipe/format multiple times, or Big F***ing Magnets (cancer causing hiroshima magnets). Hydrochloric acid and a hammer work well, too.
I've never tried recovery on it... but for nihil's #1 what about things like PGP's Free Space Wipe... Randomly Overwrites all your free space X number of times.. What I tend to do is defrag or delete my page file, defrag my drives (C: alphabetically since Windows reads DLLs alphabetically when loading them, and the rest by file access so the most recently accessed files (the ones I most likely use the most) are grouped)... and then run PGP's Free Space Wipe (usually three passes of random data) on them... when you consider that anything important/incriminating has been encrypted while stored and deleted using something like http://www.sys-shield.com/fileshredder.htm... I'd have to say that I feel reasonably comfortable that no one is recoverying anything I've deleted.. but then again I could be wrong and it could be totally recoverable.
Peace,
HT
VAIO both zencoder and HTRegz raise interesting aspects that I feel you may want to include.
Your Windows PC stores data in sectors and blocks and writes to them accordingly. So if your blocks are 16Kb and you write an 18Kb file, it will use two block of 16Kb the second of which will have 14Kb of slack space in it. This will still contain the previous data.
Similarly the nodes will contain clues as to what used to be there, even if the original data is gone.
Those cleaning tools will overwrite the free space, slack space and the nodes (assuming it is a professional quality application).Quote:
for nihil's #1 what about things like PGP's Free Space Wipe.
A good quality erasing tool will overwrite with 0, 1 and random 0s and 1s. It will also do this in a series of random passes . That bit is important, because if the forensic investigator knows the overwriting sequence it is trivial to decompose it.
My methodology would be to use both these tools, format, then ghost/mirror an image of a perfectly innocent system on top, and defragment it.
The investigator will then find what they would expect to find rather than stuff that had obviously been deliberately erased That will make them go away unless they KNOW that there is something of interest on the drive.
This is not as far fetched as you might think. All you would do is boot your machine, create your ghost image on CD/DVD, do your naughty stuff, then go through the cleaning process and ghost the image back again.
This will take a very long time, so using removable media or drives is far more efficient.
I can tell you from my experience in the Defense Sector that we use removable hard drives and that anything that was on the "secure network" is pulverised then incinerated or dissolved. Electronic methods are not trusted, other than for non classified material on the general network.
Incidentally, you will doubtless come across Peter Gutmann and be told that his method overwrites with 32 passes. It doesn't the true number is 17 or 19 depending on the type of hard drive. The 32 is for applications that cannot figure out what sort of hard drive they are dealing with, and I don't think that I would trust one of those.
;)
I think...
Wiping or erasing disk is only the first step of a complete anti-forensics attempt. The next step you would need to write some random but convincing data onto the same disk that looks like the real data before it's tampered. Any other step(s)? Be creative...
Erasing disk alone will only raise the flag and make them believe that you really hide something. Erasing disk alone is useful for cases like when a company/organization wants to sell used PCs or disks that had some (confidential) data in them.
Peace always,
<jdenny>
well, from my point of view, never mention Anti-Forensic unless u understand what is Forensic actually are, and how it works. Where in order to perform forensic investigation, you might require knowledge like Pen Test, Reverse Engineering, programming, behavioral profiling, Honeypot, Convert Channeletc..
If as the topic stated: - 'Anti-Forensic tools' is something you look forward, than the actual skill/knowledge. Then at least you might need to know how all those Forensic tools work in-and-out, in order for you to evade or bypass them. Tools like EnCase Enterprise, ProDiscover IR, OnLineDFS, NetDetector, NetIntercept, CS_MARS, SuperView are the most common tools that professional will use to perform the investigation with. If you can't avoid being trace or penetrate these tools, don't even mention anti-forensic.
Another method, you might need to build your very own rootkit to cover your back, and i really mean YOUR OWN~! Modified/tuned it payload, attitute, sequence & signature, to alter the kernel and return false info to system calls, rendering unless most tools that incident responders have traditionally used to examine a live system for signs of compromise. Programs like Hacker Defender might perform similar stuff, but still detectable!!
Next thing you need to concern is those NG-Digital Forensic technique. Forensic Investigator also will improve & upgrade their skill & method, where they notice that "Anti-Forensic" are trying to beat their ass. They will migate to more higer level way of perform forensic. So in order for you to competitive back, you also need to know how to break stuff like Digital Evidence Bag(DEB) or finding weakness at Advanced Forensic Format (AFF) file(e.g.aimage..).
Perhaps you also can try out Metasploit Anti-Forensic Investigation Arsenal (MAFIA) from Metasploit project, which i think its only some basic tools for Anti-Forensic. MAFIA include tools like 'Timestomp' - allows modify all four NTFS timestamp values: modified, accessed, created, and entry modified. 'Slacker' - allows to hide files within the slack space of the NTFS file system. 'Sam Juicer' - A Meterpreter module that dumps the hashes from the SAM, but does it without ever hitting disk. 'Transmogrify' - First ever tool to defeat EnCase's file signaturing capabilities by allowing you to mask and unmask your files as any file type.
Hope this info can help~ :cool:
Sky_Angus well done!
You have introduced a whole new concept here. We were telling VAIO about retrospective forensics on a PC, and you have raised the subject of live forensic analysis of an ongoing attack.
That is a very valid issue, and I don't think that it was considered in the original question, which is why some of us asked for more details on the scope of the paper.
:)
If you are the target of the forensic investigation there are only three tools you require to ensure your safety from successful prosecution:-
1. A remote access trojan that connects at startup to a host in an unfriendly foreign country.
2. A highly competent forensics expert.
3. A relatively competent lawyer.
The RAT that always makes a connection to a machine that cannot be investigated places significant doubt about the identity of the perpetrator of the crime(s). Your forensics expert can refute or show improper handling of etc. any evidence that the prosecution thinks they can still bring against you and the relatively competent lawyer is the icing on the cake that has the judge dismiss the charges if you even get into the courtroom.
Other than a system such as that then the magnitude of your crime dictates how much effort you put into hiding your activity - But, the magnitude of your crime also dictates the the amount of effort and money the government, (deep pockets), will put into uncovering the evidence of your crime. Even these disk wipers that run multiple passes writing random 1's and 0's are not foolproof. The surface of the disk can be investigated with an electron microscope and the orientation of the media can indicate what was written there some time ago. Even Nihil's "overwrite with a new image", while possibly making an investigator decide that there is no evidence there and move on, can be read and easily reconstructed.
Now, if your crime is that you are a 16 year old who has been downloading MP3's left and right then Nihil's solution is more than enough because the RIAA doesn't have the brains to look under the lid and if they did it would cost them too much. But rest assured if you are a terrorist or the head of a child porn ring you will be able to hide nothing from them....
One final thought.... If you are committing crimes that would bring down the entire weight of a government upon you, you can be sure of one thing if you are committing said crimes by use of the internet.... All your anti-forensics tools are utterly useless... You won't even be arrested until they have built their case against you from the traffic they are sniffing at your ISP... The corroborative evidence would sink you... no matter how clean your box might appear.... period.
Many governments secretly sanction the use of antiforensics and countersurveillance and have been in the state of developing tools, standards and protocols for some time, it's not something you hear much about amidst the hype about securing your users and leave the appropriate hooks to conduct forensic investigations. The Royal Canadian Mounted Police have a PDF that details secure harddrive information removal and destruction (here ).
Antiforensics has been In extreme cases, C4 explosives rigged to a fake power buttons on the computer asset has been cause for concern for law enforcement and military, especially in the case of anti-terrorism. That's why the likes of the RCMP, FBI and British SAS actually take along bomb sniffing dogs when they are going to cease computer equipment from suspected terrorist cells. Damn scary stuff, glad I only deal with call center reps behaving badly :D
A number of techniques such as compaction , multiple deletions, shredding, cryptographic and stegnographic methods (BMP hermetic, MP3 bit stuffing) can be used. Most of these have been discussed here by some folks and is covered by the link that you sent for MetaSploit (more notable is M.A.F.I.A. that was mentioned as well).
Here are some other tools:
Deletion: Tracks Eraser Pro , srm , dban , Necrofile, DiskScrub
Encryption/Hiding: Steganos Security Suite, dm-crypt, Cryptainer, Outguess,
ID Hiding: IP spoofing, anonymizer proxies, VPN with RDP, VNC or SSH tunneling, stolen authentication credentials
Extreme Destruction: Explosives, Incinerator, Acid, Microwave :eek:
I'd like to see you finished paper, post it when you're done...
Cheers
Great comments from everyone. Keep em comin
My paper is due Tuesday so maybe i will post it up here after that. I'm doing this for my digital forensics class BTW. It's pretty exciting. But like i said i am working with a partner on the paper and she hardly ever pulls her weight on projects so i am not guaranteeing the first half of the paper to be informative in any way. lol. But if it is anything like the last paper, i might have to end up doing the whole thing myself again. And then i would be more proud of it. I hate group projects when the partner sucks. If she bails out on me this time i'm gonna have to do something about it. :mad:
Anyways... thanks for all the great input.