Forensic Software: Exchange Audit with EnCase?

Sat, 04 Feb 2012 11:31:27 GMT

Hello, Most of the time those crooks use Outlook Web Acces (OWA) to look into different mailboxes. Check if OWA logging is enabled. Also check if 'message tracking' is enabled. (see properties of the exchange store) If not enabled, try to get access to the Exchange server and enable those loggings. If you have those logs, you will be able to see who is reading mail in employee mailboxes. You can use Encase to see if any log files are present. Check: winnt\system32\logfiles Also look for 'W3SVC' in file and directory names. Kind regards, Hans Heins

General Discussion: Email Xtender - Opening *.EMX files

Sat, 04 Feb 2012 04:07:09 GMT

Use Email Xtender to export to NSF.

General Discussion: Linking Win7 Thumbnail Cache to Windows.edb

Fri, 03 Feb 2012 21:59:28 GMT

YogeshKhatri wrote: I too wrote a utility and an enscript to carve out and process the wss db a couple of years back. But like another user pointed out, very little deleted data would actually be found as it is very efficient at clean up, hence limiting its use. Did you post your utility and EnScript? Sure, NOW Microsoft decides to be efficient and clean...

Mobile Phone Forensics: Blackberry Texts

Fri, 03 Feb 2012 19:58:23 GMT

Thanks Ron. I downloaded and ran PA 2.4.2.1. All of the processing scripts ran (which wa snot the case with the previous version) but the data they interpreted from the .bin file was junk. I went with a File System Dump instead and got a decent amount of data. Thanks for the quick response. Hopefully, the next release will better address this issue.

General Discussion: Home folder encryption Linux

Fri, 03 Feb 2012 17:06:18 GMT

That looks like a failed install originating from a live CD/DVD. Both files appear to be used by anaconda to install to hard disk from a live CD. I found part of a bug report that references the two files in this scenario: Code:: live@localhost ~]$ /usr/bin/draklive-install-lock-storage На диске /dev/mapper/live-rw На диске /dev/mapper/live-osimg-min The full bug report can be read here!That just leaves the question of what was on the device before the live CD install was attempted <img src="images/smiles/icon_biggrin.gif" alt="Very Happy" title="Very Happy" border="0" /> Stu

General Discussion: help with $usnjrnl structure

Fri, 03 Feb 2012 11:40:57 GMT

Thanks HodboH, good work. I'll give it a whirl when I get a chance.

Classifieds: iPhone and iOS Forensics: Investigation

Thu, 02 Feb 2012 17:46:27 GMT

Looking for a used copy of iPhone and iOS Forensics: Investigation, Analysis and Mobile Security for Apple iPhone, iPad, and iOS Devices for research. Shoot me a PM if anyone has one they'd like to unload!

Digital Forensics Job Vacancies: Data Analytics Assistant Director, Dubai

Thu, 02 Feb 2012 17:14:03 GMT

Our client, a leading consulting firm, is seeking to recruit a Data Analytics Assistant Director to be based in Dubai. Attractive remuneration package offered as well as the opportunity to work in a dynamic and exciting environment where the client base is varied and the case load extremely interesting. Full relocation package offered where relevant. Candidates will: - Have strong Data Analytics skills - Ideally come from a Big 4 professional services or global consultancy firm background Kind regards, Sarah Burden Warner Scott Recruitment Direct Tel: +44 (0)20 7297 9690 Fax: +44 (0)20 7681 1174 Email: seb@warnerscott.com Web: http://www.warnerscott.com 620 Linen Hall,162-168 Regent Street, London W1B 5TG Warner Scott is acting as a recruitment consultancy in relation to this vacancy.

General Discussion: ISO 17025

Thu, 02 Feb 2012 14:21:19 GMT

thanks

Legal Issues: Issue of 'Overseizure' relating to imaging of computer media

Thu, 02 Feb 2012 14:20:04 GMT

There is no simple answer to the issue of seizure of electronic data and each case must be treated on its own set of circumstances. So if you "routinely" image everything then that is unlikely to be appropriate in all circumstances and a decision has to be made to carfeully consider what should be seized/imaged. Generally the police err on the side of caution and this approach is based upon past experience of failing to capture enough data and then not being able to retrieve it later. In UK law there is case law regarding the failure by the prosecution to gather enough information at an early stage of an investigation and by doing so failing to give the defence an opportunity at reviewing potentially exculpatory evidence. This arose in a homicide case where the police failed to secure CCTV evidence in the environs of a crime scene which might have assisted the defence. This could equally apply in computer related evidence where if a logical image or partial logical image is taken this may fail to give the defence an opportunity to consider the evidence in context. There is some UK case law surrounding seizure of evidence which relates to documentary evidence but can be extrapolated into digital evidence. One which is quite old now but led to changes in the law was R v Chesterfield Justices and another, ex parte Bramley [1999] All ER (D) 1237 Another one which did relate to computer evidence was H v IRC. This was concerning Inland Revenue law but is about the seizure of too much electronic data, I include a rather long but interesting part of this here - [19] Mr Knowles’ .. next complaint is that the search was rendered unlawful by the seizure of a large quantity of material which fell outside the terms of the warrant. . it is said, ‘thousands of clients’ files were seized’. ..For the purposes of this judgment I accept that the images incorporated a vast number of documents relating to the firm’s clients, and held by it subject to a duty of confidence, .. [20] Mr Coppel, ..Thus a hard disk may be seized and removed pursuant to the power to seize and remove documents to be found in paragraph 10(3)(b) of Sch 11 provided that it contains material which the searching officer at the time of the search has reasonable cause to believe might be required as evidence in relation to the suspected offence or offences, .. The officer is not required to extract from the hard disk just the information he believes may be required, nor is it practicable for him to do so. ... .. 30. Mr Newman criticised Kennedy LJ’s comparison of the computers with a leather bound ledger. He said that unlike such a ledger, a computer contains distinct files, each of which may be separately accessed, copied or printed. He submitted that the more accurate comparison is with a filing cabinet. Provisions such as section 20C of the TMA do not justify the seizure and removal of an entire filing cabinet that includes irrelevant and non-incriminating material: the officers conducting the search are restricted to seizing incriminating material only. ..... 31. .. 32. Consideration of these submissions involves consideration of the nature of a computer and of the data and documents stored on it. .. 33. The data on the hard disk is stored in magnetic form. Although the data may be regarded for some purposes as contained in separate files, they are all stored on the same physical object, namely the hard disk. Files may be copied to a floppy disk or other storage medium. They may be removed from the hard disk by a “cut and paste” onto another storage device, but this process alters accessibility to the data on the hard disk; which, if not obliterated becomes non-referenced data as described in the next paragraph. Files cannot be removed from the hard disk physically. 34. Furthermore, the data on the hard disk includes data, referred to as non-referenced data, that is not accessible or indeed visible with ordinary software. For present purposes, non-referenced data may be regarded as data originally in a file, or part of a file, that has been deleted. Deletion of a file normally does not remove from the hard disk all of the data of the file: the effect of deletion is that the file ceases to exist for the purposes of (i.e. is not visible to or accessible by) the operating system of the computer. The data on the deleted file may remain on the hard disk, and may be recovered with the use of suitable software. 35. There may also be embedded data on the hard disk. Embedded data is described ..as follows: “(3) Embedded Data ... 36. There may also be distributed data .. ... Lastly, there may be encrypted data on the disk. .. . .. 37. These facts show that the comparison of a hard disk with a filing cabinet is inexact and may be misleading. For some purposes no doubt the files on a hard disk may be regarded as separate documents. But a hard disk cannot be regarded as simply a container of the files visible to the computer’s operating system. It is a single object: a single thing. I see no basis, therefore, for a computer not being considered a “thing” within the meaning of section 20C(3)(b) of the TMA. If there is incriminating (in the normal sense of the word) material on the hard disk, and if it is assumed that the hard disk is not copied, the computer itself may be used, and may be required, as evidence in order to prove the existence of the incriminating material on the defendant’s computer. The fact that there is also on the hard disk material that is irrelevant, and not evidence of anything, does not make the computer any less of a thing that may be required as evidence for the purposes of criminal proceedings. 38. ... 39. For these reasons, even if I were free to do so, I would not differ from the conclusion reached by the Divisional Court in Da Costa. In any event, I do not think that Da Costa is distinguishable. While it is true that for the purposes of VATA a hard disk is a “document”, it is equally a “thing”, and in my judgment would be subject to the power of seizure in paragraph 10(3) of Schedule 11 to that Act even without the extended definition of “document”. Bramley is distinguishable: to the extent that it concerned computers, it concerned the problem that arises when the information on a computer includes material that is subject to legal professional privilege. That circumstance raises different issues that I do not have to address. I think it unlikely that when he gave judgment in Da Costa Kennedy LJ had forgotten his own judgment in Bramley. It is far more likely that he did not refer to it because he considered it to be irrelevant to the different issues in the later case. 40. It follows that I disagree with the view taken, following Bramley, that that part of the judgment relating to paper documents was applicable to material stored on a computer. In my judgment, if an Inland Revenue officer who enters into premises under the authority of a warrant under section 20C finds a computer, and he has reasonable cause to believe that the data on the computer’s hard disk may be required as evidence for the purpose of relevant proceedings, he may seize and remove that computer even though it also contains irrelevant material. The officer should then make a copy of the hard disk (i.e. cause the hard disk to be imaged); when that has been done, the computer must be returned pursuant to section 20CC(3). In coming to this conclusion, I take into account the need to interpret powers of search and seizure restrictively, for the reasons set out by Kennedy LJ in his judgment in Bramley. In my judgment, the provisions of section 20C are clear and in cases in which no question of legal professional privilege arises are capable of being operated in a practical manner in relation to computers. Following the Bramley case mentioned earlier S 50 & 51 of the Criminal Justice and Police Act 2001 introduced the concept of search and sift which some police forces have applied to differing degrees in respect of digital evidence. H

Forensic Focus