Docstoc

Computer Forensics

Document Sample
Computer Forensics Powered By Docstoc
					Virtual Forensics Lab
       Steve Kim (Client)
         Marilyn Silva
         Rajeswari Ian
          Anu Nagpal
        Anthony Glover




                            1
  Overview
   CASE STUDY
    An actual NYPD criminal case helped motivate this work.
    A person, let's say Sam, was contacted on a Social Network, and decided
    to go to meet this other person. The other person's intent was to rob Sam.
    In attempt to escape, Sam ran into the street and killed by on-coming
    traffic. This then became a homicide case.

   SOLUTION
    Developed security software tools, which can be used within Social
    Networks, to help in tracking down criminals.

   OBJECTIVES
    Retrieve user’s non-personal-identifiable data, during users
    Contact via the following Virtual environments:
        Social Network Sites
        Chat Sessions
        E-mail
        Website (Developed in Java)



                                                                                 2
Virtual Forensics
  Topics
      Technology Used Chart
      Social Network Site
      Data Retrieval using - PHP Scripting
      Detecting Device Type
      Detecting Mobile Device Model
      IM Chat Session
      E-mail
      MAC Address Retrieval – Using Java Applet
      Future Enhancements




                                                   3
Virtual Forensics
  Technology Chart
  Data Retrieval
   Virtual                   Virtual
 Environment               Environment                     Technology/
                            Examples                       Techniques
Social Network Site           MySpace                  Hidden PHP scripts into
                              FaceBook                Social Network Page API.

                                                     SQL for Database storage
 IM Chat Session          MSN chat session         Real-time MS-DOS prompt
                         Yahoo chat session        NetStat (Network Statistics)
                                                   commands.
      E-mail                Hotmail email          View emailed messages’
                            Yahoo email            source code, to see IP address
                                                   information.
     Website           Custom developed Java                    Java
                       Website, used as an early
                      project phase work-around.            Java Applets


                                                                                    4
Virtual Forensics
 Social Network Site
 Data Retrieval
  PHP Scripted Web Site: http://www.virtualforensics.net/track.php
        Tracks the visitors to website
        Can be integrated for use in tracking Social Network Site visitors.
        Captures information of visited users
        Stores retrieved user data to database
        Appends retrieved user data to website for on-screen view

  Social Network Tracking – SETUP PROCESS
    Place the data retrieval PHP web link, into an image
     source tag syntax

      <img src="http://www.virtualforensics.net/track.php"
      border="0" style="visibility:hidden;" />

    Place above source tag into “Headline” section of your
     MySpace or FaceBook:




                                                                               5
Virtual Forensics
 Social Network Site (cont.)
 Data Retrieval
  The captured user data is stored to a database, and appended to list
   of visitors already in database.
  All tracked visitor information is then retrieved from the database logs,
   and displayed to following link for on-screen viewing:
   http://www.virtualforensics.net/
  Listing of Social Network Site user’s retrieved data:




         Visitor entry from database, for viewing on web
                                                                               6
Virtual Forensics
 Social Network Site
 Detection of Device Type
  PHP Scripted Web Site:

   http://www.virtualforensics.net/mobiledetect/detect.php
    Detects the type of device used to login (PC, Mobile, etc)




                                                                  7
Virtual Forensics
 Social Network Site (cont.)
 Detection of Mobile Device Model
  PHP Scripted Web Site:

   http://www.virtualforensics.net/mobiledetect/detectmobile.php
     Detects the Mobile Model (Blackberry, I-Phone, etc)




                                                                   8
Virtual Forensics
  Java Applet
  MAC Address Retrieval
   MAC address
      If assigned by the manufacturer, a MAC address (Media Access Control
       address ) encodes the manufacturer's registered identification number




        Display of retrieved user’s MAC address retrieved




                                                                               9
Virtual Forensics
  IM Chat Session
  Data Retrieval
  NetStat
   Is a command which retrieves other person’s IP address & MAC address of
    person you are chatting with.
   MS-DOS prompt type the following command and press enter: NetStat –n 3




             IP address of Local Machine and Foreign Machine
                                                                              10
Virtual Forensics
    IM Chat Session (cont.)
    Data Retrieval
   IP address on the left hand side, 172.22.45.77 (see Figure 1) represents your IP
    address. The IP address on the right hand side, 172.22.47.248 (see Figure 1)
    represents the IP address of foreign machine. The 4 digit value following each IP
    address represents the port to which it is connected to.

   You can connect to the foreign IP address by typing the following command. From
    the MS-DOS prompt type the following command: C:\>nbtstat -A 172.22.47.248

                                    the output




                                                                                        11
Virtual Forensics
    IM Chat Session (cont.)
    Data Retrieval
   On figure from previous slide (slide 10), the 172.22.47.248 represents
    the foreign machine’s IP address.

   This entered command will output the values of:
     o Node
     o IP address
     o NetBIOS
     o Remote Machine Table
     o MAC address of Foreign Machine




                                                                             12
Virtual Forensics
  E-Mail
  Data Retrieval
   Retrieve email sender’s IP address, by following below steps.
    Within a yahoo email account do as follows:
      Go to inbox

      Open your email

      Click the drop down for Standard Header (see figure 3)

      Click Full Header from the Standard Header’s drop down
       (figure 3 on next slide)

      Dialog box with the IP information appears

     RESULTS:
    The sender’s IP address will appear in dialogue box.
    (Continued on next slide to view)

                                                                    13
Virtual Forensics
 E-Mail (cont.)
 Data Retrieval




                    14
Virtual Forensics
 E-Mail (cont.)
 Data Retrieval




 IP address is
198.105.45.132




                    15
Virtual Forensics
  Future Enhancements
   Assigning the Java applet used to identify the Mac address of the
    client to the website

   Retrieving the User Name of other user accessing the monitored
    Social Network page

   Expand on fields to be retrieved during email communication.




                                                                        16
Virtual Forensics
                     The End


                    Thank you!




                                 17
Virtual Forensics

				
DOCUMENT INFO
Shared By:
Categories:
Tags:
Stats:
views:4
posted:1/7/2012
language:English
pages:17
jianghongl jianghongl http://
About