Instructor: In this lesson, we will learn about volatile
and non-volatile storage analysis.
Volatile and non-volatile storage analysis
examines both temporary and permanent data storage
to identify evidence of compromise or malicious activity.
Volatile and non-volatile storage analysis concepts
include the order of volatility and forensic imaging.
Volatile storage, such as CPU cache, holds temporary data
that is lost almost immediately in a system.
The order of volatility prioritizes capturing
highly ephemeral data, such as CPU cache, first.
And non-volatile storage, like hard drives,
contains permanent data that persists even after power loss,
and is often analyzed through forensic imaging,
where an exact copy of the data is created for investigation
without altering the original.
Let's learn more about the order of volatility
and forensic imaging.
First, we have the order of volatility.
The order of volatility refers to the sequence
in which digital evidence should be collected
during a forensic investigation.
This sequence is important,
because different types of data vary
in how quickly they are lost or altered.
Volatile data such as CPU cache and RAM, is short-lived,
and disappears as soon as the system is powered off.
While non-volatile data, like that on hard drives, or USBs,
persists even after the shutdown.
So, following the order of volatility
and forensic data collection
ensures that investigators capture
the most transient data first, preserving critical evidence.
RFC, or Request For Comment, 3227, which is titled,
"Guidelines for Evidence Collection and Archiving,"
provides a standardized framework
for handling digital evidence in forensic investigations,
outlining the order of volatility and best practices
for preserving data integrity.
According to RFC 3227,
the order of volatility is, one, registers and CPU cache,
two, routing tables, ARP cache, process tables,
kernel statistics, and RAM,
three, temporary file systems, or swap space,
four, disks,
five, remote logging and monitoring data,
six, physical configurations and network topologies,
and seven, archival media such as backup tapes.
This list ensures that highly volatile data,
like registers and cache,
can be collected before less volatile data,
like archival media.
For example, when a forensic analyst arrives at a scene
where a computer is still powered on,
the first step is to capture the CPU registers
and cache data.
This data might only exist for a short period of time,
and can contain key information,
such as the state of active processes,
or encryption keys in use.
Next in the order of collection is RAM,
which contains active processes, network connections,
and system statistics.
So, in this scenario, the CPU registers and cache,
as well as the RAM data,
was still available for collection
because the computer was powered on.
But if the computer was turned off
before capturing this data,
all the data in memory would have been permanently lost.
So, as we move further down the order of volatility,
the data becomes less transient,
but remains just as important.
Disk drives and logs, for example,
are vital to an investigation
because they store persistent information,
like deleted files or system logs.
And while this data is less likely to disappear immediately,
it can still be modified or overwritten over time,
so capturing these sources after the more volatile data
ensures that critical, short-lived information,
such as active network connections or running processes,
has already been secured,
enabling investigators to build
a comprehensive understanding of the incident.
Second, we have forensic imaging.
Forensic imaging is the process of creating
an exact, bit-by-bit copy, or image, of digital data
from a storage device in a way that preserves its integrity
to a standard that can be used in court.
Creating forensically sound images
is the first and most critical step in an investigation.
This process allows analysts to examine and analyze the data
without altering the original source.
Ensuring the original data remains untouched
is essential to keeping evidence intact
and admissible in court.
So, forensic imaging captures not only visible files,
but also slack space, unallocated space,
and even deleted files,
as these can contain traces of malicious activity
or other key evidence.
Slack space is the unused space in a file system
that exists between the end of the file
and the end of the storage unit,
which may be a cluster, or a block,
where that file is stored.
Slack space exists because storage devices allocate space
in fixed sized clusters or blocks,
and if a file does not completely fill
its allocated cluster,
the leftover space is called slack space.
Back to forensic imaging.
There are three common tools used for forensic imaging,
and they are dd, dcfldd,
and the Forensic Toolkit, or FTK Imager.
The dd, command native to Unix and Linux systems,
can create a bit-by-bit copy of a storage device.
For example, when using the dd command for forensic imaging,
an investigator might issue the following command
to create a bit-by-bit copy of the drive.
In this command, the if specifies the input file,
where the forward /dev/sdx is the source device,
or the drive being imaged.
Next, the of defines the output file,
indicating where the disk image will be stored.
The bs=64K sets a block size of 64 kilobytes
to improve performance
by reading and writing larger chunks of data.
And finally, the conv option ensures
that the process will continue even if it encounters errors,
such as bad sectors,
and will fill any gaps with zeros
to maintain data alignment.
Next, the dcfldd,
a forensic version of the standard dd command,
was developed by the U.S. Department of Defense's
Computer Forensics Lab to enhance the functionality of dd
for use in forensic data acquisition and secure wiping.
dcfldd offers added features,
such as on-the-fly hashing, and progress indicators,
which make it more suitable for forensic work.
A use of dcfldd for forensic imaging
might use the command that is on the screen.
This command not only creates a disk image,
but also generates both MD5 and SHA-256 hashes
of the data on-the-fly,
recording these hash values
in a log file named hashlog.txt.
The inclusion of hashing ensures the integrity of the image,
and provides a way to verify
that the image is an exact copy of the original device.
This is especially important in forensic investigations,
where the integrity and authenticity of the data
are critical for legal proceedings.
Finally, the Forensic Toolkit, or FTK Imager,
is a graphical tool that not only creates bit-by-bit copies,
but also automates hash generation
and provides a chain of custody,
ensuring that the integrity
of both the original and the copy can be verified.
These tools ensure that the image
is an exact bit-by-bit replica of the original,
including hidden and deleted data used for investigations.
A key practice during forensic imaging
is the use of a write blocker,
which prevents any accidental modification
to the original storage device
when an investigator's device
is connected to it for imaging.
This guarantees that the original evidential data
remains in an unaltered state.
Additionally, investigators typically follow
the best practice of creating an image
of the original device for storage,
and then creating another image from that stored image
to be used for analysis.
This way, the original device is accessed only once,
even if there is a problem
with the image being used for analysis,
preserving original data integrity,
and minimizing the risk of data tampering or corruption.
So, remember, volatile and non-volatile storage analysis
examines both temporary and permanent data
to uncover evidence of malicious activity or compromise.
Volatile data, such as what's stored in CPU cache or RAM,
is quickly lost, especially when the system powers down.
So, investigators prioritize capturing it first
by following the order of volatility,
the sequence of which is,
number one, CPU registers in cache,
number two, routing tables, ARP cache, process tables,
kernel statistics, and RAM,
number three, temporary file systems or swap space,
number four, disks,
number five, remote logging and monitoring data,
number six, physical configurations and network topologies,
and number seven, archival media.
This process is crucial to forensic investigations,
ensuring that highly ephemeral information is preserved
before moving on to secure more stable data.
Non-volatile data found on hard drives,
or other permanent storage,
is typically then examined through forensic imaging,
where an exact replica of the original data
is created for analysis,
without altering the original source.
Using forensic tools like dd, dcfldd,
or the Forensic Toolkit Imager,
investigators can ensure the integrity of this data
and maintain its admissibility in court,
while preserving the original evidence.
This is typically achieved by creating a bit-by-bit image
of the storage device, including all files, slack space,
and unallocated space,
while using a write blocker to prevent any modifications
to the original data.
The forensic image is then hashed to verify
that it matches the original,
ensuring that any analysis is conducted on the copy,
and the original remains untouched and secure.
This approach safeguards the chain of custody
and protects the integrity of the evidence
throughout the investigation.