As a part of the AFF4 work I have been involved in, I recently created a set of java bindings for libewf. If you want read access to the block content or metadataof EnCase compatible forensic images from the java programming language then this is for you.

They are currently tested on the windows platform (x86). UNIX and x64 support should be trivial.

They are now included in the libewf repository as libewf-java.

Thanks to Joachim Metz for libewf and David Collett for his python bindings (on which I based my code).

It is not straightforward to get working so I have copied the instructions originally provided by David Loveall and further expanded on them below.

1. Extract the Windows mount_ewf files into a directory.  I used the current mount_ewf_windows-20091123.zip file found in the downloads area of libewf. Download from the same place the proxy_ewf.py file and place it in the same directory (I used c:\opt\proxy_ewf\).

2. Download and install the Visual Studio runtime files, if you don’t already have them. Don’t bother as they are now included in the mount_ewf windows distribution.

3. Download and install ImDisk. Be careful about driver loading if you are on Vista and above.

4: Install python for windows. I used python 2.5 (x86) but 2.6 should work as well.

5. If you are on an x64 system, move imdisk.exe from the c:\Windows\system32 directory into the same directory as the mount_ewf and proxy_ewf.py files. The proxy_ewf script wont be able to run imdisk.exe due to the WOW64 file virtualisation features otherwise.

6. Run proxy_ewf:

c:\python25\python c:\opt\proxy_ewf\proxy_ewf-20091123.py c:\evidence\foo.e01

If you get a "Version number mismatch" error, it is likely that the _ctypes.pyd file in the mount_ewf distribution is incompatible with the one in your just installed python distribution. I deleted the one in the mount_ewf directory and things worked fine.

At this point, you should see a new drive letter (or letters) appear in windows explorer.

The subject of the interview is fallibility of digital evidence.

If you are in any way involved in searching for information in a legal context, it is fascinating stuff. 

[via Ralph Losey's e-Discovery Team blog]

Michael and I have recently extended and refined the container format to support describing the provenance of information and data, and more accurate description of evidence characteristics. A paper describing this work, titled “Refining the AFF4 evidence container for provenance and accurate data representation”, has been accepted for presentation at the 6th Annual IFIP WG 11.9 conference on Digital Forensics.

The abstract follows:

It is well acknowledged that there is a pressing need for a general solution to the problem of storage of digital evidence, both in terms of copied bit-stream images and general information which describes the images  and  surrounding  context  of  the  case.  In  a  prior  paper,  the  authors  introduced  the  AFF4 evidence container format, focusing in particular on the description of the efficient and layered bitstream storage  architecture,  a  general  approach  to  representing  arbitrary  information,  and  a  compositional approach  to  managing  and  sharing  evidence.  In  this  paper  we  describe  our  work  refining  the representation  schemes  embodied  in  the  new  format,  addressing  the  accurate  representation  of discontiguous data and description of the provenance of both data and information. 

The video below shows an interactive exploration of the memory space of the emulated C64 while it runs the game “Cataball”, pointing out correspondences between the raw memory and the on-screen action.

Hex editor authors and forensic tool manufacturers should take note of the zoomable memory map.

[via Root Labs Rdist]

Today, The Australian is reporting that Mr. Grech last night admitted to having faked the email.  Mr. Grech claims that he recollected receiving an original email similar to the one in question. Unable to find the original, he concocted the fake one in order to substantiate verbal claims he had made about the matter.

• The Australian Information Security Association (AISA)
• The Chartered Practicing Accountants (CPA) IT Discussion Group
• The Information Systems Audit and Control Association (ISACA)

Thanks to the attendees for their high degree of participation – it always makes for a lively and engaging time when the audience share their experiences and questions.

An excellent visual summary of computer hardware connectors. The original is sonic840’s Computer Hardware Poster.

[via Hack a Day]

Background

Australian media reporting has been dominated over the last week by the OzCar scandal. The scandal centres around claims that the Prime Minister (Kevin Rudd) has given preferential treatment to a friend and political donor, car dealer John Grant. Mr. Grant had previously given the Prime Minister a car for use in his campaign and contributed financially to his legal and political endeavours.

An apparent smoking gun in the form of an email was referred to in the senate testimony of Treasury official, Godwin Grech. Mr Grech recalled an email from the PM’s office in relation Mr. Grant and the OzCar financial bailout scheme, which Mr. Grech administered. The email was supposed to have been written by the PM’s economic adviser, Dr Andrew Charlton. The opposition leader seized on the email, calling for the PM to resign.

The PM responded by bringing in the Australian Federal Police (AFP) to investigate the email. On the Monday following Mr. Grech’s testimony, they executed a search warrant on Mr. Grech’s home, and very quickly released their preliminary investigation results. They had found the email in question sitting deleted on his computer. They concluded it was a hoax. Further reports have indicated that the email originated within Treasury.

Mr. Turnbull spent the rest of the week defending both his reliance on the fake email, and  claims that the scandal had been orchestrated. He has since suffered a large fall in public satisfaction, as revealed by today’s poll results.

On email authenticity

This matter highlights the need for a greater degree of scepticism when it comes to reliance on email evidence, as compared with its paper counterpart. Modification of text on paper leaves a trace, whereas the substance of email is modifiable without an obvious trace. Hand written signatures go a long way towards authenticating the author of mail; the email equivalent of a signature is technically possible, however its use remains a niche practice.

Email authentication requires additional corroborating evidence and technical expertise. Metadata hidden within an email can indicate, among other things, the path that the email has taken from the sender to the recipient. This data is typically stored with the email, and can be used to detect tampering or outright forgery of emails.

Each server that an email passes through usually makes a note of the receipt and handoff of the email to the next carrier along the way. Multiple copies of the email may additionally be stored in the senders “Sent Items” folder and in archival or disaster recovery backups. Such information can be used to identify which computer an email originally came from.

Gaining access to these evidence sources is time consuming and often involves the cooperation of multiple parties. Determining authenticity based on such evidence then requires a high degree of expertise.

Commentary

It is unlikely that either Mr. Grech or Mr. Turnbull would have had access to the corroborating evidence or possess the expertise required to judge the authenticity of the email. Nor for that matter would the average email user.

Day to day though, email authenticity isn’t a problem. Our society largely manages to muddle along with email as one of our primary communications mediums. The reason it works is that each of us make decisions of trust around every email we receive.

Assuming neither Mr. Grech nor Mr. Turnbull fabricated the email, whoever inside Treasury created and sent the email to Mr. Grech relied on exploiting his trust of emails appearing to come from that source. It appears that Mr. Turnbull trusted Mr. Grech in turn.

This affair may mark the end of this kind of trust in emails as concrete evidence and the general acceptance of their authenticity. Certainly you would think so in the case of politicians attempting to score points against their opponents.

More generally though, the wider implications of the increased awareness of the vulnerability of email to fraud will be felt in our courts, where emails are often cited as evidence in both criminal and civil matters.

As for the fake email which has brought all of this to the public’s attention, presumably the AFP are still investigating who the original concocter of the email was. This investigation should lead to an examination of the computer systems of Treasury, where traces of the email, and hence clues to the original concoctor of the email may well remain. In which case, we wait with bated breath to see the next twist in this political drama.