Digital Forensics of the Internet, E-mail and Social Media

Digital Forensics of the Internet, E-mail and Social Media ➢ Internet Overview - When a web page URL (Universal Resource Locator) is typed in, the different parts of the name each have their own meaning: o ‘http’ (HyperText Transfer Protocol) provides the means for devices to communicate with each other o ‘robajackson’ is the domain name o .com is the TLD (Top Level Domain) ➢ Domain Names, IP Addresses and Web Page Types - Domain names have no meaning on the internet and are converted to IP addresses by the web browser - Conversion is done by a DNS (Domain Name Server) - Web Pages are either static or dynamic o A static page is pre-built o A dynamic page is built at the time it is called and, in the case of a commercial website like Amazon, can deliver targeted content to a particular user ➢ Web Browsers and DF Investigations - If a computer is under investigation, the web usage is likely to be of interest - For PCs, the three browsers that are most commonly used are Internet Explorer (IE), Mozilla Firefox and Google Chrome - Microsoft Edge has also appeared recently - For Apple computers, Safari is most common - DF investigators are still most likely to encounter IE ➢ INDEX.DAT Files - INDEX.DAT files are used by IE to keep track of information such as web sites visited → they are therefore of potential use to DF investigators - These files are hidden from users and need to be viewed using a DF tool - In IE there are three directories: History, Cookies and Temporary Internet Files and the contents of these are tracked by INDEX.DAT files ➢ Aspects of IE of DF Relevance - Cookies are text files left on a computer by a web server - Often used to track sessions or remember user preferences - They are tracked by an INDEX.DAT file and can contain information like URLs visited, usernames, etc → need to be decoded by special tools o Due to privacy concerns, it is much easier to delete cookies now ➢ Temporary Internet Files/Web Cache - These are used to make the use of web browsers quicker, by storing components of web pages → useful information in a DF investigation - However they can be deleted using tools like CCleaner (will also remove cookies/trackers) ➢ Internet History - IE, as well as other browsers, keeps records of web sites visited to save users from having to keep retyping URLs o Other information is stored in the INDEX.DAT files, including the number of times a site is visited - With IE, internet history is cleared evert 20 days by the system but it can be done manually - Other browsers have similar options – with Mozilla Firefox it is done as follows: o Tools > Options > Privacy & Security and scroll down ➢ Summary – Web Browsers - All web browsers have features that make them more convenient to use, like web cache → potentially very useful in DF investigations (unless they have been cleared by the user, e.g. by using CCleaner) ➢ The Digital Forensics of E-mail - E-mail is a very useful potential source of digital evidence - Sammons notes that ‘these often-candid exchanges can (and have) come back to haunt the parties involved’; he also notes that copies of e-mails can reside in multiple locations o Even if the original copy sent/received may have been deleted, a copy might be retained on a server ➢ How e-mail is accessed - E-mail is accessed and managed in two ways: o Webmail (like Google’s Gmail or MS Hotmail) is accessed through an internet browser when using a computer, although if accessed from a mobile device (phone/tablet) a local copy is normally kept ▪ Another reason why mobile phones can provide useful information o E-mail clients, like MS Outlook and Windows Live Mail, store e-mail messages locally on the user’s PC ▪ Outlook uses .pst or .ost files and it used to be difficult to access these, but less so now ➢ E-mail Protocols - Simple Mail Transfer Protocol (SMTP): used by e-mail clients to send e-mail - Post Office Protocol (POP): used by e-mail clients to receive e-mail, but e-mails are downloaded and there is no interaction with the server (which may keep copies) - Internet Message Access Protocol (IMAP): two way communication between email clients and serves – used by most modern e-mail systems ➢ E-mail as Evidence - Evidence might include: o Communication relevant to case o Other e-mail addresses o IP addresses o Dates and times o Attachments (photos, documents, etc.) - E-mails can also be found in more than one place (copies kept on servers, etc.) ➢ Components of an E-mail message - The main components of an e-mail are the header, the body (the message itself), and any attachments - The header provides a record of information as the e-mail travels from sender to recipient - The message ID is a unique ID assigned to the message and can provide solid evidence of the message’s authenticity ➢ Covering up E-mail – spoof e-mails and shared accounts - It is possible to use software to make an e-mail appear to come from somewhere else/a different location → e-mails sent in this way are hard to trace - Shared accounts can be used to communicate without anything actually being sent → an account is set up with a provider requiring minimal information - The login details for the account are shared and users put messages in the ‘drafts’ folder → once message(s) has/have been read it is deleted and so is the account - It might be possible to trace the setting up of the account in the Windows registry or internet browser records, however ➢ Social Media and DF - Evidence from social media is of great potential use to DF investigators, but there are issues: o Much information from Facebook, Twitter, LinkedIn, is stored online, so accessing information from a service provider may be needed o Some information may be locally stored, e.g. on a smartphone, but then access is needed o Data providing evidence may only be retained for a certain time, so swift intervention may be needed - Evidence that can be obtained includes business discussions (potentially illegal) and discussions about criminal activities - Such evidence may include: o Evidence of cyber bullying and witness tampering o A company’s position on an issue o Whether intellectual property rights have been violated o Who posted information and when - It is noted that the number of DF cases involving social media is increasing, but it is complicated by the fact that evidence is spread over many servers, service providers and users ➢ Social Media Information obtained from a Suspect Computer - If a smartphone can be investigated, copies of Facebook messages and Twitter DMs will be available on the phone, unless they have been deleted (although then they may still be recoverable) - On a computer it may be possible to find the e-mail sent when the account was created and also Facebook profiles may be stored locally - See Sammons, chapter 8, page 130 for more information ➢ Case Studies – Web Browsers - US trial of Casey Anthony, charged with murdering her young daughter - Amongst the prosecution evidence was that she had repeatedly searched for the word ‘chloroform’ on her computer - The case was turned round when it was found that she had actually only searched for the word once, and there was a big in the software used to analyse the browser searches ➢ Case Studies – Social Media - LinkedIn o Evidence gathered from a LinkedIn profile showing theft of information by an employee of a company while still working for them who then started working for a rival company o ‘For example, in a recent intellectual property theft suit, I used X1 to collect the publicly available LinkedIn profile of a disgruntled employee, who left her company for a competitor. The woman’s LinkedIn profile disclosed that she began her tenure with the competitor nearly three months before she officially quit. Using the date provided, I was able to determine that same week she copied thousands of confidential electronic records to a USB thumb drive from her work-issued laptop. The evidence collected by X1 Social Discovery proved to be extremely valuable, and when used in conjunction with other evidence, a settlement was reached in a matter of hours after the analysis results were produced. In this way, social media provides important context to other aspects of discovery’ o X1 Social Discovery can be used to ‘Collect and search data from social networks and the internet - Facebook o Evidence from Facebook posts which proved someone innocent of a crime because they showed he was somewhere else when the crime occurred o ‘New York (CNN) – for 19-year-old Rodney Bradford, a simple Facebook status update turned into much more: a rock-solid alibi after he was accused of a crime’ o ‘Confirmation of the time stamp on the update and the location from which it was entered showed he could not have been at the scene of a robbery in another part of NYC. After he had spent almost two weeks in jail, the case against him was dismissed’