FINAL YEAR PROJECT Trevor Brosnan BScHons Computer Forensics

FINAL YEAR PROJECT Trevor Brosnan BSc(Hons) Computer Forensics 20039663@mail. wit. ie

• ORIGINS OF PROJECT • COFEE COMPARISON • HOW IT WORKS • DEMOSTRATION • TECHNOLOGIES • COMPATIBLE / TESTING • PROJECT TIMELINE • FUNCTIONALITY overview • FUTURE /CONCLUSION • QUESTIONS/ISSUES

Computer Fraud has many branches and none is more emerging then that caused by employees. This type of fraud is common place within the workforce, as it does not require an employee to have extensive I. T. knowledge, just the opportunity. Cost is the Biggest concern in considering an investigation -Ernest&Young Report 2011 Fraud can be defined as the intentional deception made for personal gain and to damage another. Make it as simple as possible…. . origins of project

• Microsoft COFEE is a forensics tool, approximately 15 MB in size that fits on a USB drive for law enforcement officials to use in PC An officer with even minimal computer experience can be tutored—in less than 10 minutes—to use a pre-configured COFEE device. Strengths: Created by Microsoft for Microsoft systems. Weakness: Available only to Law Enforcements, Outdated tools. DECAF was invented by hackers to thwart all investigations done by this tool. • En. Case Forensic, the industry-standard computer investigation solution, is forensic practitioners who need to conduct efficient, forensically sounds data collection and investigations using a repeatable and defensible process. [ENCASE] Strengths: The leader on the market for any professional forensic investigation. Weaknesses: Extremely expensive ($4000 -$4500). • Back. Track 5 was designed to be an all in one live cd used on security audits and was specifically crafted to not leave any remnants of itself on the laptop. It has since expanded to being the most widely adopted penetration testing framework in existence and is used by the security community all over the world. ”[Back. Track ] Strengths: Extremely powerful, Has a massive repository of tools Weakness: Extremely complex to use, Separate Operating System current applications

how it works

For the development of fraud. IT one main tool encompassed the entire project, this tool is the programming language known as Python is a programming language that lets you work more quickly and integrate your systems more effectively. You can learn to use Python and see almost immediate gains in productivity and lower maintenance costs. Python runs on Windows, Linux/Unix, Mac OS X, and has been ported to the Java and. NET virtual machines. [Python 2011] Py. Qt 4 Py. Qt is a set of Python bindings for Nokia's Qt application framework and runs on all platforms supported by Qt including Windows, Mac. OS/X and Linux. There are two sets of bindings: Py. Qt v 4 supports Qt v 4; and the older Py. Qt v 3 supports Qt v 3 and earlier. The bindings are implemented as a set of Python modules and contain over 300 classes and over 6, 000 functions and methods. [QT 2012] python

Start 1/11/12 End 12/12/11 project timeline Start 3/2/12 End 1/5/12

• System Audit Information– Logins, System Uptime, System Information, Update History, Recycle Bin History, Windows File System, Power On History, Scheduled Events, Running Services. Unusual Activity- Blue Screen Tracker, Open Files, Event Log’s, Application Crashes, Windows Crash Reports, Whats in Startup Devices – Battery Information, Bluetooth, USB History. • Network Audit Connections – IP Information, Port Information, Check Firewall, Firewall Rules, Nearby Wifi, Networked PCs, Show Groups, Wireless Info. Browser- Chrome/IE/Firefox History, Chrome/IE/Firefox Cache, Chrome/IE/Firefox Cookies Email – Gathering and analysis Additional – Skype History Logs, Live Contacts, Internet Passwords, Opera History, Safari History, Get Bookmarks, Search History tools used #1

• Registry Audit Initial– Gather Hives User Hive- Shellbags, Printers, Recent Files, Recent Application, Typed URLs, Proxy Settings, IE Registry Entries, Recent Documents, Windows Searches, File Associations. Software Hive– Application Paths, Network Cards, Wireless Associations, SQL last connected, Profile List, Internet Applications, Uninstalled Apps, Yahoo Message, Apps Associations, Port Devices System Hive – Network Information, Mounted Devices, Removed Devices, Shutdown History, Event Logs, Safe Boot History, USB Information, Running Services. Security/SAM – Parsing of Hive • File Audit General – Alternate Data Streams, Clipboard History, MSOffice Addons, Video Cache History Text, Image Video and Audio Audits. Pop up drag and drop audits using Alternate Data Streams, Metadata, File Duplication and Integrity checks tools used #2

• Live Audit runs the most important tools with a single click • All in One Audits runs all in 1 audits using the most important tools of the system, network and registry tools • Report Generation Reports are generated for each of the Live Audits and All in 1 tools ran, so that a user can review the information at a later stage • Evidence Uploads All data gathered is with a click of a button uploaded to an Amazon S 3 Bucket • Tutorials These along with a few other features will help guide the user in their use of the application additional functionality

• • • Logging System Evidence Duplication Integrity Checking Timestamps Portability Sub-processing Application Centre Icon Association Re-encoding Outputs background functions • • Global Variables Folder creation Text Browser Use of Windows Functions Progress Bars Error Messages Status Bar OS commands

VS Cofee is Microsoft’s incident response GUI which was made available to the Law Enforcement officers to help aid them in their investigations. Cofee uses around 30 unique tools while fraud. IT uses over 80 • • Design Features/Tools Ease of Use Display cofee comparison • • Integrity Evidence Connectivity All in 1

The Demonstration of the Project will include: • • Accessing application using a USB Loading the application Running various tools Using the File Audit Uploading Evidence Reviewing Reports Due to the length of time it takes to run a Live Audit this will be demonstrated using a video clip as to speed up the time it would normally take. demo

Using ACTIVESTATE Komodo we will take a look at the python code which is use to build the application code overview

Compatibility is of major concern when creating fraud. IT Windows Systems tested for compatibility : XP , 7 and 8 (different architectures) Testing carried out: Use case Testing: Whether the application can be used by a novice. Code Review /Debugging: Asking coders to see what I can do to increase the performance compatible & testing Tool comparison: Different tools used for the same function

• Time Management additional projects • Display Issues icons, centring, sizing • Compatibly Issues XP->7 -> 8 • Tool Acquisition command line only • Programming Issues perl and python knowledge increase • Project Concept idea has changed over time • Presentation Issues issues time management and weigh of markings

• Alert Data Allow for unusual results to be flashed to the user • Apple Compatible Acquire tools for Mac PCs • Timelines Incorporate timelines for the all in one audits • Central Application Run the application from a central server • Python Power Instead of using open source tools include python code to preform the functions future

The skills which I have gained from this project have been immense, they have helped me gain confidence in my ability to learn new programming languages, improve my time management and was one of the main reasons I have been offered a job with Version 1 as a Graduate IT Consultant. The time spent on the creation of the application has also proven quiet useful for other modules as with my understanding in python has been incorporated into projects (Development of an Android APK Analysis Application for a research project in Network Security). It has highlighted weaknesses and strengths which I never knew I had. conclusion

questions

• [Back. Track 2011]Back. Track Linux - Penetration Testing Distribution. Available at: http: //www. backtrack-linux. org/ [Accessed October 26, 2011]. • [Coffe 2011]Computer Online Forensic Evidence Extractor (COFEE). Available at: http: //www. microsoft. com/industry/government/solutions/cofee/default. aspx [Accessed October 22, 2011]. • [Encase]Leading E-Discovery, Forensic Software. Available at: http: //www. guidancesoftware. com [Accessed November 1, 2011] • [Qt 2011]Riverbank | Software | Py. Qt | What is Py. Qt? Available at: http: //www. riverbankcomputing. co. uk/software/pyqt/intro • [Accessed October 17, 2011]. • [Python 2011]Python Programming Language – Official Website. Available at: http: //www. python. org/ [Accessed October 22, 2011]. references