Performing Forensic Analyses, Part 1

In "Building and Using an Incident Response Toolkit, Part 1," April 2004, InstantDoc ID 41900, and "Building and Using an Incident Response Toolkit, Part 2," May 2004, InstantDoc ID 42173, I discuss how to quickly and appropriately respond to a computer security incident. In this two-part article, I delve into the field of computer forensics and show you how to conduct an in-depth analysis of the compromised machine. The preparation for this analysis involves creating a bootable CD-ROM and duplicating the compromised machine's hard disk. You can then use several utilities to analyze the contents of that duplicate disk. Before I begin, however, let's quickly cover three basic forensic-analysis principles:

• You must avoid changing any data on the corrupt machine. To preserve the data, you need to perform a forensic duplication of the compromised hard disk, verify that the duplicate disk is exactly the same as the original, then perform all the analyses on the duplicate disk. Most forensic tools are designed to work on duplicate disks to avoid changing any pertinent information (e.g., access times) on the compromised computer.
• You shouldn't trust any programs or data on the compromised computer because the attack might have compromised them. By performing the forensic duplication, then using forensic tools on the duplicate disk, you avoid the use of potentially compromised programs and data.
• You need to document the forensic duplication and analysis. One good documentation method is to create digital hashes of the compromised hard disk and the forensic image. If the hashes match, you've mathematically proven that the data hasn't been altered. You should also document the programs you run and their output. If you anticipate that the computer security case will go to court, you might consider having two parties document the forensic duplication and analysis.

Keeping these three principles in mind, let's look at how to create a bootable CD-ROM and how to make a copy of the compromised disk. Note that although these tasks involve running a few Linux commands, you don't need any prior knowledge of Linux to use the methods I describe. . . .