Teaching Digital Forensics to Undergraduate Students

  • Published on

  • View

  • Download


<ul><li><p>EducationEditors: Matt Bishop, bishop@cs.ucdavis.eduDeborah A. Frincke, deborah.frincke@pnl.gov</p><p>54 PublishedbytheieeeComPutersoCiety1540-7993/08/$25.002008ieeeieeeseCurity&amp;PrivaCy</p><p>teachingdigitalForensicstoundergraduatestudents</p><p>Lynn Batten and Lei PanDeakin University</p><p>Digital forensics isnt commonly part of an un-</p><p>dergraduate university degree, but Deakin </p><p>University in Australia recently introduced </p><p>the subject as part of an IT security course. </p><p>As instructors, weve found that digital forensics complements </p><p>our other security offerings be-cause it affords insights into why and how security fails. </p><p>A basic part of this course is an ethics agreement signed by stu-dents and submitted to the unit instructor. This agreement, ap-proved by Deakin Universitys legal office and consistent with Barbara Endicott-Popovskys ap-proach,1 requires students to maintain a professional and ethical attitude to the subject matter and its applications. </p><p>Assignments regularly cast stu-dents in the role of forensic pro-fessional. Our teaching team emphasizes throughout the course that professional conduct establish-es credibility with employers and customers as well as colleagues, and is required to perform the job effectively. This article describes our experiences with this course.</p><p>The forensic units contentsThe unit takes a standard approach to investigating a single computer or laptop involved in an incident: students learn how to boot the machine into forensic mode and avoid making changes to data or timestamps while the investiga-tion is in progress. Instructors cover data-hiding techniques and </p><p>methods for recovering deleted files, the use of hash functions to identify files, and how to capture network packets and analyze traf-fic. We also cover practical issues such as working in a hazardous materials setting, using a vari-ety of forensic tools for different purposes, making and copying bitstream versions of files or discs, and working on copies while pre-serving original evidence.</p><p>The unit requires students to work individually on two assign-ments to develop their skills in identifying, preserving, analyz-ing, and presenting digital evi-dence. Each of these assignments simulates a digital forensic case in which the student plays the role of forensic investigator. After students acquire the basic investi-gative skills, we offer a more ad-vanced assignment that includes data carving, steganography, and encryption. The rest of this sec-tion reviews the advanced compo-nent in more detail.</p><p>The investigative scenarioThe scenario starts with a haz-ardous materials team called to a warehouse behind the Roma Street train station in Brisbane at 3 a.m. on 25 April. Team mem-ber Moti identifies the scene </p><p>as a drug manufacturing loca-tionthe people working there have hurriedly packaged up loose powders but have left traces on the floor and across many desk surfaces. Moti decides not to call in the forensic squad because he suspects the drug is at the top of the current most dangerous list, and he needs to analyze samples in his lab for confirmation.</p><p>However, Moti notes that a computer is in the crime-scene area, so he calls his colleague San-dra, the forensic teams director, and asks her to walk him through a capture of computer data for fo-rensic analysis. He shuts down the laptop and removes it from the scene along with several CDs he finds in a desk drawer. Later that day, Sandra analyzes the laptop in the police forensics lab, but it doesnt appear to store any docu-ments of interest: three of the CDs hold recent movies, and the fourth has pictures of cars. Sandra makes three forensic copies of all the data and stores two of them safely in the lab. She then gives the laptop and CDs to various staff members for analysis, distributing the third copies to them. Because most of the staff is involved in a large on-going investigation, she decides to ask for the help of an additional team member (the student) whos vacationing overseas.</p><p>Sandra sends a secure email with an attachment containing a compressed version of the car photos from the car CD along with a request to analyze them as quickly as possible for any pertinent information. She also attaches a list of possible pass-</p></li><li><p>Education</p><p> www.computer.org/security/ieeeseCurity&amp;PrivaCy 55</p><p>words that investigators found in a locked drawer of the suspects desk. These passwords are antho-ny, artemidorus, brutus, caesar, calphurnia, and cassius.</p><p>Getting to the solutionThe provided binary file appears to consist of a single picture, regard-less of the image viewer program used, but its actually a concatena-tion of 12 individual pictures, each of which can be identified through a binary examination (specifically, a hex reader displays 12 obvious .gif headers). To extract each in-dividual file, most students use a hex editor program such as Hex Workshop to manually cut-and-paste the binary segments to 12 new .gif files; other students use file-carving tools such as Scalpel and Foremost. We expect the stu-dents to calculate two hash values, MD5 and SHA-1, for each ex-tracted file.</p><p>Supplied with a list of pass-words, students recover three text files by applying each given pass-word to every .gif file by using a steganographic tool (S-Tools in our lab). The three text files are located in three different picture files: we hid Who.txt in a file la-beled Bugatti EB110 1995 pro-tected by DES encryption and password caesar; Where.txt in the Aston Martin 2002 file pro-tected by DES encryption and password anthony; and How.txt in the Maserati Coupe 2004 file protected by DES encryption and password brutus. Figure 1 shows the three text files.</p><p>The How.txt and Where.txt files are readable, but the Who.txt file appears to be encrypted. The infor-mation in the How.txt file suggests a possible encryption method is the caesar cipher, which permutes the alphabet. Many of the students used an automated script they found on the Web (www.secretcodebreaker.com/caesar.html), entered the en-crypted text, and requested a shift of four positions (from four caesars) </p><p>back to decrypt, which gave a list of names (Wong, Davidson, and so on).</p><p>We then ask the students to write a two-page report to San-dra, listing their findings and rec-ommendations. They must also construct and complete an appro-priate evidence form as part of this report, and their detailed proce-dures should include the search for hidden files in the 12 .gif files, re-covery of the three text files, and the decrypted cipher text in the Who.txt file. The 15 numbers in the Where.txt file are Australian mobile numbers.</p><p>Weve found that students en-joy doing this assignment and chat about it a great deal in the online unit chat space. Verbal feedback to staff is also positive, as indicated by the teaching evaluation results from the last course. We didnt see any significant differences be-tween the results of on- and off-campus students. </p><p>Technical issuesThe text book2 we use comes with an individual license for software called DriveSpy. This tool works in DOS command mode and lets </p><p>students analyze and retrieve files from several storage media de-vices; the text focuses on floppy drives. As a traditional and cheap storage device, weve found that the floppy drive is a good starting point for beginners in digital fo-rensics because students can grasp the detailed structure of an entire filesystem by manually examin-ing a floppy disc sector by sector within a few hours. </p><p>However, the fact that we must use floppy discs with this software has led to some prob-lemsprimarily, because almost nobody has a floppy drive on their machines at home. The on-cam-pus labs do have floppy drives, so weve ordered a few hundred discs for our two campuses in Burwood and Geelong. Students dont seem to mind using these in the labs, but off-campus students or students working on their home computers wish for some additional options. Some get around this problem by using virtual floppy drives; oth-ers are Linux users who avoid the problem entirely by mounting floppy images as a loop device.</p><p>Besides the tools listed in the textbook, weve introduced ad-</p><p>________________________________________________</p><p>How.txt </p><p>four caesars </p><p>_________________________________________________</p><p>Who.txt </p><p> 1. ASRK 2. HEZMHWSR 3. WLMZEOYQEV</p><p> 4. AMPPMEQW 5. OMQ 6. IXMRSOI</p><p> 7. VMGLEVHW 8. LYERK 9. IZERW</p><p> 10. GVSA 11. JMWLIV 12. PMQ</p><p> 13. WMRKL 14. GSLIR 15. FVYRIPPM</p><p>__________________________________________________</p><p>Where.txt </p><p> 1. 0409267531 2. 0412563993 3. 0500287456</p><p> 4. 0416327897 5. 040028648 6. 0486375296</p><p> 7. 0500374092 8. 0483956280 9. 0484974488</p><p> 10. 0429846759 11. 0500329674 12. 0492695873</p><p> 13. 0402389756 14. 0423940785 15. 0478822256</p><p>Figure 1. Three recovered text files. We hid each of these files in a photograph of a car </p><p>and instructed students to recover them with a variety of techniques.</p></li><li><p>Education</p><p>56 ieeeseCurity&amp;PrivaCymay/June2008</p><p>ditional ones that are distributed under free licenses on the Inter-net. Some of these, such as HxD (http://mh-nexus.de/hxd/) and S-Tools (www.stegoarchive.com), have become very popular with our students, but they also use the universitys chat space to broad-cast information and ideas about new tools and facilities. Weve also found software licenses in gen-eral to be a challengesome of our key software is only free for a short trial period and expires half-way through the semester.</p><p>C learly, weve shown that uni-versities and colleges can im-plement introductory computer forensics and achieve good teach-ing results given a tight budget, limited staff, and a requirement to provide the same experience to both on- and off-campus stu-dents. The students in our course receive hands-on, realistic experi-ence with tools and gain insight into forensic tasks performed in </p><p>the real world; they also develop an understanding of broad theo-ries about operating systems, file structures, and the behavior of high-level applications. Introduc-ing investigative scenarios in our assignments not only strongly motivates students but also im-proves their analytic, problem-solving, and communicative skills. </p><p>By teaching this unit at the second-year undergraduate level, weve found that</p><p>little background is needed; one year of university experience is necessary and sufficient; andstudents get to see ideas not pre-sented in any other unit. </p><p>Dealing with the ethics issues is an interesting challenge, but our approach seems to work by intro-ducing an agreement between the university and the student. Be-cause we chose a standard interna-tional agreement, the legal office is happy to sign off on it. Digital fo-rensics is now a regular annual of-</p><p>fering at Deakin and has become very popular among students. </p><p>ReferencesB. Endicott-Popovsky, Ethics and Teaching Information As-surance, IEEE Security &amp; Privacy, vol. 1, no. 4, 2003, pp. 6567. B. Nelson et al., Guide to Computer Forensics and Investigations, 2nd ed., Thomson Course Technology, 2006. </p><p> Lynn Batten is director of the Informa-tion Security Group at Deakin University. </p><p>Her research covers a spectrum of securi-</p><p>ty areas including cryptography, wireless </p><p>network security, security and privacy is-</p><p>sues, and computer forensics. Battan is </p><p>a member of the IEEE and a fellow of the </p><p>Australian Computer Society. Contact </p><p>her at lmbatten@deakin.edu.au.</p><p>Lei Pan is a lecturer at Deakin Universi-ty. His research interests include digital </p><p>forensics, software testing, and general </p><p>security issues. Contact him at l.pan@</p><p>deakin.edu.au.</p><p>1.</p><p>2.</p><p>Advertising Sales Representatives</p><p>Mid Atlantic (product/recruitment)Dawn BeckerPhone: +1 732 772 0160Fax: +1 732 772 0164Email: db.ieeemedia@ieee.org</p><p>New England (product)Jody EstabrookPhone: +1 978 244 0192Fax: +1 978 244 0103Email: je.ieeemedia@ieee.org</p><p>New England (recruitment)John RestchackPhone: +1 212 419 7578Fax: +1 212 419 7589Email: j.restchack@ieee.org</p><p>Connecticut (product)Stan GreenfieldPhone: +1 203 938 2418Fax: +1 203 938 3211Email: greenco@optonline.net</p><p>Midwest (product)Dave JonesPhone: +1 708 442 5633Fax: +1 708 442 7620Email: dj.ieeemedia@ieee.org</p><p>Will HamiltonPhone: +1 269 381 2156Fax: +1 269 381 2556Email: wh.ieeemedia@ieee.org</p><p>Joe DiNardoPhone: +1 440 248 2456Fax: +1 440 248 2594Email: jd.ieeemedia@ieee.org</p><p>Southeast (recruitment)Thomas M. FlynnPhone: +1 770 645 2944Fax: +1 770 993 4423Email: flynntom@mindspring.com</p><p>Southeast (product)Bill HollandPhone: +1 770 435 6549Fax: +1 770 435 0243Email: hollandwfh@yahoo.com</p><p>Midwest/Southwest (recruitment)Darcy GiovingoPhone: +1 847 498-4520Fax: +1 847 498-5911Email: dg.ieeemedia@ieee.org</p><p>Southwest (product)Steve LoerchPhone: +1 847 498 4520Fax: +1 847 498 5911</p><p>Email: steve@didierandbroderick.com</p><p>Northwest (product)Lori KehoePhone: +1 650 458 3051Fax: +1 650 458 3052Email: l.kehoe@ieee.org</p><p>Southern CA (product)Marshall RubinPhone: +1 818 888 2407Fax: +1 818 888 4907Email: mr.ieeemedia@ieee.org</p><p>Northwest/Southern CA (recruitment)Tim MattesonPhone: +1 310 836 4064Fax: +1 310 836 4067Email: tm.ieeemedia@ieee.org</p><p>JapanTim MattesonPhone: +1 310 836 4064Fax: +1 310 836 4067Email: tm.ieeemedia@ieee.org</p><p>Europe (product)Hilary TurnbullPhone: +44 1875 825700Fax: +44 1875 825701Email: impress@impressmedia.com</p><p>Advertiser IndexMay/June 2008</p><p>advertiser Pagenumber</p><p>blackhatusa2008 Cover4linuxWorld2008 Cover2usenixevt2008 Cover3</p><p>Advertising Personnel</p><p>Marion DelaneyIEEE Media, Advertising Dir.Phone: +1 415 863 4717Email: md.ieeemedia@ieee.org</p><p>Marian Anderson Advertising CoordinatorPhone: +1 714 821 8380Fax: +1 714 821 4010Email: manderson@computer.org</p><p>Sandy Brown | IEEE Computer SocietyBusiness Development Mgr.Phone: +1 714 821 8380Fax: +1 714 821 4010Email: sb.ieeemedia@ieee.org</p></li></ul>


View more >