Artefacts of Windows, Linux and Macintosh Systems

Artefacts of Windows, Linux and Macintosh systems ➢ The Wide Ranging Use of Windows - Although recent statistics suggests this is falling, Windows still accounts for about 90% of desktop computers and is the system most likely to be encountered by FS examiners - For that reason it is worth looking at the system in detail and identifying those aspects (artefacts) that can help in a FS examination ➢ Finding Deleted Files - When files are deleted the data is not lost - The act of deleting a file just tells a computer that the space it occupies is available if needed → if it is not overwritten, or only partially overwritten, recovery may be possible! - File can be recovered from the recycle bin but examiners don’t normally have it so easy - Removing a file to the recycle bin doesn’t delete it but makes it more easily recoverable ➢ Recycle Bin Operation - Once the recycle bin is emptied, file recovery is a challenge for most users, but FS examiners can usually manage this - It should also be noted that files can be deleted bypassing the recycle bin completely (Shift + Delete) - Windows can also be configured to bypass the recycle bin and if this has been done it will show up in the registry ➢ Hibernation Modes - Windows computers have three different “sleep” modes, some of which can help FS examiners recover data: o ‘Sleep’ mode (desktops), where the current data in RAM is kept intact by a small amount of power. However RAM data is lost when the power supply is switched off o ‘Hibernation’ mode (laptops), involves writing the RAM data to a hard disk, which is more permanent storage o ‘Hybrid Sleep’ (desktops) is a blend of the two systems but does write data to the hard disk - A computer that has hibernated will write current data to the hard drive as a hibernation file - If a suspect is working on a document that is found to be incriminating, they may delete it to avoid it being found → but the hibernation file will still be there and most people don’t know about it - For data written to RAM in Sleep mode, power must be maintained to avoid it being lost ➢ The Windows Registry - Although ignored by most computer users, the Registry can provide much useful information in a Forensics Examination - The Registry is important to FS examiners because it keeps track of the activities of users and the computer itself (e.g. internet searches, programs run/installed…) - A Registry Editor (e.g. Regedit) can be used to look at the Registry - There are 5 keys (HKEY_) in the diagram and each of these is concerned with a particular aspect of the computer’s operation HKEY_CLASSES_ROOT – links file types with programs HKEY_CURRENT_USER – sets individual users computer environment HKEY_LOCAL_MACHINE – is concerned with the computer operation HKEY_USERS – is concerned with all users of the computer HKEY_CURRENT_CONFIG – is concerned with current hardware - The Windows Registry can provide important information about the use of a computer: o e.g. was a particular external hard drive ever connected to a computer? o So when people copy data onto USB drives, the Registry records the connection - FS examiners can use software tools (e.g. EnCase and FTK) to obtain detailed information ➢ Print Spooling - When a document is printed, two files are created, one of which is an image of the file being printed (an EMF, Enhanced Meta File) and one containing information about the print job itself (a spool file) o There are normally automatically deleted after printing is completed, but if there is a problem with the printing the files might remain - These files can provide useful evidence if they can be found (e.g. copies of forged contracts, letters, etc.) ➢ Metadata - Sammons defines Metadata as ‘data about data’. It is most easily illustrated by looking at file properties, e.g. of a lecture file - The Created, Modified and Accessed dates can be useful ➢ More File Properties ➢ The Details Tag - For music or photo files, the Details tag can contain useful information, as in the JPG file, giving camera maker, etc. - Note the line at the bottom which gives a way to erase the metadata ➢ Removing Metadata - Metadata is now a major privacy concern and it is routinely removed from documents before they are shared - It is now less useful for that reason, with programs like MS Word 2010 providing menus for its removal → However it can still be useful for FS investigators ➢ Thumbnail Cache - A feature of Windows is that it produces thumbnail versions of photos stored on a computer (easier to browse them) o However, these are not deleted when the photos are and most users are unaware of their existence - The files are stored in thumbcache.db (Windows 7) - They can serve as important evidence if the original photos have been deleted ➢ Most Recently Used Lists - An MRU list is a list of most recently used documents/applications. It can be found via the Registry, or in Windows 10, for example, can be accessed through Windows Explorer ➢ Restore Points - Windows creates restore points (RP) when new software is installed - They enable the system to return to an earlier point if a problem occurs in an installation o The RP feature works in the background and is normally invisible to users o RPs enable an FS examiner to explore a suspect computer at a point before incriminating files were deleted → also contain metadata ➢ Shadow Copies - A description of Shadow Copies is provided by Larson (2010): o Shadow copies are bit level differential backups of a volume o They are the source data for Restore Points and restore previous version features o Typically, they are created when a system boots up, but can be created at other times ➢ Prefetch Files - Windows creates a Prefetch File when an application is run on a particular computer for the very first time. This is used to help speed up the loading of applications: o They can show that a particular program was installed at a particular time, including a program designed to wipe files from the hard disk ➢ Link Files and Installed Programs - Link Files are links (or shortcuts) to programs or files. They can be created by the user or by the computer o Link Files have time and date stamps so they can be used to establish whether a file existed, even if it has been deleted or if a program was used at some point - Installed Programs leave evidence even if they have been deleted from a suspect computer o This evidence can be found in several locations ➢ Linux and Macintosh Systems - While it is possible to relate DF of Windows systems to non-specialist ideas, Linux and iOS systems are more challenging in this respect - This part of topic 5 will focus on the particular challenges associated with these operating systems in DF examinations ➢ Linux and Windows compared - Linux is an open source OS that evolved from UNIX which was invented in the 1970s - UNIX was widely used in computer workstations and has largely been replaced by Linux o There are several ‘flavours’, including Ubuntu, Red Hat and OpenSuse - One of the main differences between Windows and Linux is the file structure Address/Location of file: Rob Jackson > Dropbox > @teaching 2016-17 > che20042 > topics > che-20042 Digital Forensics topic 5b.pptx ➢ Corresponding Linux Address - Linux file addresses follow a similar logic but are not quite so user-friendly o For example → /home/rob/teaching/che-20042 - To change directory you need to type the command ‘cd’, which moves you up or down a level - So although it is logical, it is not as easy to use ➢ Deleted Files in Linux - As with Windows, deleting a file doesn’t actually delete it, but allocates the space it has used to be written over - So, as long as additional files haven’t been written to the disk, deleted files can be recovered ➢ macOS File Structure - As of Feb 2019, the current Mac OS was Mojave 10.14.3 - The latest version of iOS is iOS 12.1.4 - There are some similarities with the appearance of file structures in Linux but it is harder to access other user’s files - Below is shown what a file looks like in a Mac, divided into two Forks, one containing data and one any additional file information. This presents additional challenges as both forks need to be recovered ➢ Issues with DF Investigations of Mac Systems - Encryption is an issue, with FileVault and later FileVault2 being used to encrypt/decrypt user files - On the positive side, deleted files retain their filenames when deleted o Drive imaging is carried out as with Windows systems, but there may be issues in physically removing the hard disk without damaging the computer, particularly with the Mac Mini and the MacBook Air