Is Linux a superior forensics platform?

So I just recently went out and purchased two terabytes of disks and spent around $2000 in software and hardware and I got to thinking...what the hell am I doing?

For a few years now, I've been doing forensics work on the linux platform exclusively. I've been using Helix and my own workstation running redhat that I put together to handle multiple disk types.

Linux supports virtually every file system type, can mount a disk read only without modifying mactimes, and it has virtually every tool neccessary built in to it.

Hexeditor
debugger
Free virus scanning that's generally speaking..better than commercial software.
Binary/hex/dec converters
compilers
perl
dd
hashing
time retrieval
network monitoring
and the list goes on...

and any other tool you need to look at a disk is provided by Brian Carriers hard work creating TSK.

I spent $2k on FTK and Winhex(forensics version), a few disk mounting programs and a couple of hardware write blockers.
My question is, who the hell in their right mind would choose to do forensics on a single minded operating system that has to have all these extras just to be able to do something simple like mount a DD image that's stored on an EXT3 disk let alone analyze that image.

I think my next purchase will be ASR Data's SMART..because to be honest, windows is a piece of **** when it comes to forensics work.

Hmmm,

Quote:

---

because to be honest, windows is a piece of **** when it comes to forensics work.

---

Isn't that a bit like comparing COBOL to ALGOL :D

Remember, Windows is purely commercial and $$$$$ driven. It is the OS of the masses, many of whom would not even understand forensics, let alone be prepared to pay ?

Just a thought :)

Personally, I think FreeBSD might also be a very good option. It's Unix but not Linux. I think the FreeBSD kernel is a bit more reliable than the Linux kernel, although with Linux it strongly depends on which version you like to use. (SuSE, RedHat, etc.)

I'm going to an introduction to forensics day on the 20th he asked for any additional topics and I asked him to do some comparisons between Helix and the commercial software EnCase etc. I't'll be interesting to see what he says.

I don't know if you can add to the polling options but it would be interesting to see how many people out-source forensics rather than do it in house.

I know we out-source foresnsics in everything that is likely to come to court just because we lack the skills and equipment within the organisation. We would only carry out simple investigations internally.

Quote:

---

Originally posted here by nihil
Hmmm,



Isn't that a bit like comparing COBOL to ALGOL :D

Remember, Windows is purely commercial and $$$$$ driven. It is the OS of the masses, many of whom would not even understand forensics, let alone be prepared to pay ?

Just a thought :)

---

Something like that..

Yes windows is purely commercial, but for places like government and law enforcement that claim they lack funding..how can they justify all these windows programs to perform such a simple task like mounting a disk partition?
I understand that windows is commercial, and encase is commercial etc..but just because it's commercial doesn't mean it's the best or even good(in the case of windows).

POLL modified..

And at this point in time, I can see that the windows utilities are polished and clean and make everything pretty, but that doesn't excuse the operating system from sucking for this purpose.

Quote:

---

Originally posted here by Katja
Personally, I think FreeBSD might also be a very good option. It's Unix but not Linux. I think the FreeBSD kernel is a bit more reliable than the Linux kernel, although with Linux it strongly depends on which version you like to use. (SuSE, RedHat, etc.)

---

What is different about the kernel from SuSE, RedHat, Debian, etc.? They are all still Linux...because it's Linux solely BECAUSE of the kernel; if you use the Hurd kernel, it's no longer Linux (however, I'm not a zealot that demands we use "GNU/Linux").

If you mean all the extras that get compiled into each distro's default kernel, then yes, there is a difference. How that impacts forensic work, I don't know. I don't know many people who would (seriously) use a defatult kernel (generic distro) on a forensic capture and examination platform. The requirements for making a platform and processing data on it with documented integrity that will stand up to cross-examination are not to be balked at.

That's part of why platforms like Helix and Auditor (yes MsM, I've been won over...Auditor is a valuable tool! :grin:) are tailored towards specific uses.

hogfly what about Encase from the guys at Guidance Software? It's been a long time since I touched their stuff (I was using Encase in the mid 90's)...is it *still* windows based? I know it's the darling child of the commercial mag's and such. Unfortunately, I don't do enough forensic work anymore to be up-to-date on this stuff. Mostly, I play around with finding a few things on a quicky search (nothing for criminal or administrative purposes...just lost files, where has the subject been surfing, etc.)

ZenCoder: Yeah funny thing about Encase and Guidance Software..it was stolen from ASR data..the makers of SMART :) They have a link to one of the court orders on their website.

BSD contains the only version of DD that will read an odd number of sectors on a disk(atleast the last time I looked in to it). That's a one-up in my book.

Encase is a good tool, but it is only windows based.

I feel linux is better, while working on HPA/DCO I realized that. Just that linux has some built in features that will detect HPA. Also, there is an intersting case: if you create HPA on the disk such that the size is in KB , then some versions of windows won't detect, even if it does the size will 0MB and the tools that can run on windows might not detect that there is a HDD. While on Linux platform, although the size will shown as 0, but TSK can easily detect and reset the HPA, Also once the investigator finds out that there is HPA on the disk then he can easily reset it back.

So the idea here is to find out whether there is any HPA or not.

MRG.

Maybe I'm old, but I still use F.I.R.E. - Forensic Incident Response Engine. It's basically a custom implementation of Linux with all the forensic tools you could need that run from a CD or DVD and a RAM Drive. Works well, and is sanitary.

Just to keep everyone thinking about this...I've done some calculations...

Take the following for example:
A first responder walks in to an incident scene, and, using Helix grabs a DD image of the system disk off of a windows 2003 server. A SHA1sum is taken of the source and final disk image. The disk storing the image is formatted as EXT3.

The disk is then delivered to the investigator.

In order for an investigator to conduct a sound investigation on this image the following is required:
Windows XP Professional: $199
WinHex $459
Mount-Everything Professional - $150
Access Data FTK -$1000
Mount image Pro -$279
Digital Intel Write blocker - let's call it $250 for the sake of simplicity.

In order to mount a dd image for FTK to get a file listing, this is what it takes.
Mount-everything -sees the EXT3
Mount image pro - Mounts the dd image

Total cost of tools to investigate this disk: $2337

Now let's look at an alternative...

RedHat Linux Enterprise Workstation - $179
PYFlag - FREE
Sleuthkit - FREE
Autopsy - FREE
khexedit - FREE
Regviewer - FREE
Mounting a disk image?
mount -o loop,ro,nodev,noatime,noexec /path/to/image /mount/point

Total cost of tools to investigate this disk: $179 (this is not even accurate because no one said you had to use RH enterprise)


Granted, the windows tools have been heavily refined to automate the tasks involved in investigations, but the principal issue I struggle with, is why use a single minded, inferior operating system to do forensics? Why are programs like encase and FTK made only for windows, when the core operating system does nothing but hamper an investigation?

Aren't you required to use reviewed software? You can't just run around using any old software you want for a sensitive task like forensics.

I'm assuming the biz behind $$ software took the route to have their software approved/reviewed for work in the industry, where as the open source solutions don't have that sort of intiative?

I guess what I'm asking is that unless the costs of learning/operating/documenting the free solutions are more that their $$ counterparts, what's stopping you? Do regulations exist that keep investigators from switching?

In my very limited experience and training, linux is the better and cheaper choice. Even more, alot of the basic tools I've had recommended to me for doing things on windows are just ports of linux tools anyways (tho these are all the non-commercial tool recommendations).

Soda, I honestly think the problem is the CFTT (computer forensics tool testing) group at NIST just hasn't gotten around to looking in to open source tools. I don't know if it costs money to have your tools reviewed or not, but that would certainly limit whether or not something is "approved".

What's stopping me personally? Absolutely nothing. I can document all of my procedures in linux just as well as I could using an automated windows tool.

Just out of curiosity, what would happen to a closed case if it was discovered that one of your tools was severely flawed?

Would you have a chance to re-investigate using proper procedures, or would someone go free until the case was proven again?

That's actually a really good question. Unfortunately I don't know the law well enough to tell you what would happen. I would imagine that just like any other case though, if there was enough compelling evidence (take a murder case for example where DNA evidence proved 10 yrs later that someone was innocent) the courts would re-examine the case and perhaps let the person go. And in a trial..just like any other trial, you can't be tried for the same crime twice.

It'd be interesting when someone leverages a bugfix in forensic software to delay an investigation or trial.

/me flees

hmm interesting idea. We should hide your post lest a criminal defense attorney get any ideas :)

It's my understanding that you are generally pushed to gather evidence from multiple sources and to use multiple tools to verify the data integrity. So you don't just MD5 something you MD5 and SHA-1 it.

You don't just gather evidence off the drives, you grab it off your router logs, ips/ids, firewall logs, backup log server, etc.

The multiple tools/sources combined with the documented and consistent techniques for gathering/handling evidence 'should' build a fairly decent case. That and if you keep a copy of the drive in question you can always go over it with better tools later if you really needed to.

Most of the training I've had has basically said that you should basically keep whatever data you need for as long as it's financially viable to keep and use it (so barring it no longer being usable with current technology or it simply costs waay too much money for someone to keep it going) for legality purposes.

I can't see it being different than any other case if the better tools proves the person didn't do it or casts enough doubt to do damage to your case against them.

In the work I'm doing now we've got evidence from Routers, event logs, Disk Forensics, and a network analysis tool. It's roughly equated to:
2TB of disk data
well over 100,000 flow records with 64bytes of content/flow
router flow totals
and whatever the eventlogs have.

I typically md5 and sha1 my files, but there isn't anything that says you have to. MD5 is still accepted but on the way out.

The major problem, like you point out is documentation..of EVERYTHING. Reporting is major, as is placing a copy of the software used in with the evidence collected. Everything and anything will get called in to question.

It's funny you mentioned keeping the data around.. Initially the lawyers said keep it forever. The secret service said keep it only as long as you need to to practice due diligence. Storing 2TB per case gets a bit costly.

Here's what prompted my concern, a post I made a long time ago. I love the response (lack thereof) considering it's an active forum, I lost some trust in open source.

You'd think they'd jump on me to defend it, but it was passed up.

http://www.knoppix.net/forum/viewtop...201&highlight=

Yeah, the lawyer who was doing our training just left it at 'keep it as long as you can'. Doesn't have to be forever per se, just as long as it's financially and technically viable for your company, and if you got rid of it you had better have good reason (preferably documented). Of course he was talking about more than just forensics, he was talking about any data that could be used in any kind of legal proceedings ever. Basically so you don't pull an Arthur Anderson (think enron accounting) and start shredding docs or ditching data in some suspicious manner.

As for the md5 +sha-1 thing, the advice I got was to use both. This is to remove doubt about the file integrity and the possibility of hash-collisions. Just getting rid of more lawyer doubt about your evidence.

I'm curious about that test on EXT3 and ReiserFS. Was the change made due to the mount count increasing(as it does with EXT3/Reiser)? Did he mount the disk noexec,nodev,noatime? Mounting a disk/partition just read only is not suggested.

the md5/sha1 thing..yep I agree, that's why tripwire uses 4 hashes by default.

Well I don't know what kind of legal system you guys run, but:

Quote:

---

the md5/sha1 thing..yep I agree, that's why tripwire uses 4 hashes by default.

---

The trouble with that is that there will be twelve people on the jury who do not, and NEVER will

They will be curious as to why you use "free" rather than pay for....................can't you afford it?...........if "free" is better, how come commercial organisations have not taken it up and done better?

Also taxpayers like myself are going to ask who is accepting collateral responsibility for any defects in the tool. Lawyerscum can only write so much B/S into the EULA..............and dealing with serious, people they can write virtually nothing..................."the State of XYZ rejected that forensics tool because its vendors would not accept responsibility for its fitness for purpose?"............the stock would be suspended immediately?

If you want people to accept responsibility, you have to pay, if only so they can buy insurance?

And to cover your own a$$ you are better off paying.

Ask yourself: "what is the point of forensics if no-one will pay you for it?"

See you in court


:D :eek:

It's not only accountability but percieved value also. Something that is free, is by and large considered to be of little value compared to something that costs. The greater the cost the greater the value.

Why do people spend X amount for goods services, when it is possible to to purchase those goods services else where at half X. We all see this every day, with every day items. I don't think software is any different in this respect than any other consumer goods and service.

For every forensics specialist who considers OSS as an alternative to Microsoft, I bet there is one that thinks, OSS must be crap, or else they would not give it away.

of course. Both of you are correct. My main issue is with NIST I suppose for not pushing open source testing. If LE & Gov is so damn broke, isn't it in their best interest to use something with little to no cost?

Quote:

---

Granted, the windows tools have been heavily refined to automate the tasks involved in investigations, but the principal issue I struggle with, is why use a single minded, inferior operating system to do forensics? Why are programs like encase and FTK made only for windows, when the core operating system does nothing but hamper an investigation?

---

Because Windows is still in widespread use in the corperate network (and the government which is huge cash as well). When people switch over they'll have to switch right? Basic economics ^_^.

i pick linux and Windows Nt. because. one the Nt. is hardest to use. because its the main one being hacked. and linux because its old and its still way usefull.. heh. thats my reason.

A step aside.

I was on a forensics intro course yesterday. The chap speaking was a seasoned investigator with a lot of high profile cases under his belt.

I asked him about Helix and his reply was that basically it didn't matter if it was better then Encase or not. Encase was court proven and accepted and the Encase developers were prepaired to be put on the stand to defend the integrity of results produced by their product.

There was too much of a risk associated with switching to any other product.