Refine
Document Type
- Report (6)
- Article (1)
- Doctoral Thesis (1)
Has Fulltext
- yes (8)
Keywords
- Computerforensik (3)
- Analyse (1)
- Analysis (1)
- Backdoor (1)
- Computer Forensics (1)
- Covert channel (1)
- Data recovery (1)
- Digital Forensics (1)
- Digital Forensics, Privacy (1)
- Digital forensics (1)
Institute
ReFS is a modern file system that is developed by Microsoft and its internal structures and behavior is not officially documented. Even so there exist some analysis efforts in deciphering its data structures, some of these findings have yet become deprecated and cannot be applied to current ReFS versions anymore. In this work, general concepts and internal structures found in ReFS are examined and documented. Based on the structures and the processes by which they are modified, approaches to recover (deleted) files from ReFS formatted file systems are shown. We also evaluated our implementation and the allocation strategy of ReFS with respect to accuracy, runtime and the ability to recover older file states. In addition, we extended The Sleuth Kit allowing it to parse ReFS partitions and build a carver based on that extend The Sleuth Kit.
We present a new class of covert channels which
can be created by utilizing common hardware but that cannot
be detected by such. Our idea is to abuse anti-EMI features
of a processor to create a covert channel on the physical layer.
Thus, the sender uses the invariants in how digital signals are
encoded over analog channels to covertly transport information.
This leaked data is present on the wire bound connections of
the compromised device, but is also by definition present in the
vicinity of the device and can be picked up by radio equipment.
As the covert channel is present only on the physical layer, the
data on all layers above, as well as the timing behavior on
those layers is indistinguishable from uncompromised devices.
We present two example implementations of such channels using
RS-232 as the carrier and use a common oscilloscope to decode
the resulting covert channel. Using this setup, we observed symbol
rates of around 5 baud. We derive the theoretical upper bound of
the covert channels bandwidth and discuss the factors by which
it is influenced.
In many digital forensic investigations, email data needs to be analyzed. However, this poses a threat to the privacy of the individual whose emails are being examined and in particular becomes a problem if the investigation clashes with privacy laws. This is commonly addressed by allowing the investigator to run keyword searches and to reveal only those emails that contain at least some of the keywords. While this could be realized with standard cryptographic techniques, further requirements are present that call for novel solutions: (i) for investigation-tactical reasons the investigator should be able to keep the search terms secret and (ii) for efficiency reasons no regular interaction should be required between the investigator and the data owner.
We close this gap by introducing a novel cryptographic scheme that allows to encrypt entire email boxes before handing them over for investigation. The key feature is that the investigator can non-interactively run keyword searches on the encrypted data and decrypt those emails (and only those) for which a configurable number of matches occurred.
Our implementation as a plug-in for a standard forensic framework confirms the practical applicability of the approach.
From Computer Forensics to Forensic Computing: Investigators Investigate, Scientists Associate
(2014)
This paper draws a comparison of fundamental theories in traditional forensic science and the state of the art in current computer forensics, thereby identifying a certain disproportion between the perception of central aspects in common theory and the digital forensics reality. We propose a separation of what is currently demanded of practitioners in digital forensics into a rigorous scientific part on the one hand, and a more general methodology of searching and seizing digital evidence and conducting digital investigations on the other. We thereby mark out the route for computer forensics to turn into a true forensic science. To illustrate the feasibility of the proposed path, we supply a couple of practical examples, as well as a list of exemplary questions that should be answered by digital forensic scientists.
The analysis of memory during a forensic investigation is often an important step to reconstruct events. While prior work in this field has mostly concentrated on information residing in the kernel space (process lists, network connections, and so on) and in particular on the Microsoft Windows operating system, this work focuses on Linux user space processes as they might also contain valuable information for an investigation.
Because a lot of process data is located in the heap, this work in the first place concentrates on the analysis of Glibc's heap implementation and on how and where heap related information is stored in the virtual memory of Linux processes that use the Glibc heap implementation.
Up to now, the heap was mostly considered a large cohesive memory region from a memory forensics perspective, making it rather hard manual work to identify relevant information inside.
We introduce a Python class for the memory analysis framework Rekall that is based on our analysis results and allows access to all chunks contained in the heap and their meta information.
Further, based on this class, six plugins have been developed that support an investigator in analyzing user space processes:
Four of these plugins provide generic analysis capabilities such as finding information/references within chunks and dumping chunks into separate files for further investigation.
These plugins have been used to reverse engineer data structures within the heap for user space processes, while illustrating how such plugins ease the whole analysis process.
The remaining two plugins are a result of these user space process analyses and are extracting the command history for the zsh shell and password entry information for the password manager KeePassX.
Im Oktober 2011 erregte die Ver"offentlichung von Details über die inzwischen meist als BckR2D2 bezeichnete Schadsoftware öffentliches Aufsehen. Mitglieder des Chaos Computer Club e.V. veröffentlichten einen ersten Bericht über die Funktionsweise des Trojaners, dem weitere Analysen folgten. In dieser Arbeit geben wir einen Überblick über die bislang veröffentlichen Einzelberichte und über die verschiedenen Komponenten der Schadsoftware sowie deren Funktionsweise. Hierzu präsentiert diese Arbeit die wesentlichen Ergebnisse einer ausführlichen Analyse aller Komponenten des Trojaners und geht insbesondere auf Unterschiede zwischen den beiden bislang bekannten Varianten BckR2D2-I und II ein. Ziel dieser Arbeit ist auch die kritische Überprüfung der von anderen Autoren getroffenen Aussagen über die Schadsoftware.
Die forensische Informatik, die häufig auch als digitale Forensik oder Computerforensik bezeichnet wird, zählt heute zum Standardrepertoire forensischer Ermittlungsinstrumente und wird durch die regelmäßige Präsenz in den Medien auch in der Öffentlichkeit immer stärker wahrgenommen. Allerdings sind heutige Vorgehensweisen und Methoden der digitalen Forensik eher pragmatisch geprägt und ein Vergleich zu anderen forensischen Wissenschaften zeigt deutliche Defizite, welche sich in zwei Bereiche zusammenfassen lassen: 1. Eine mangelnde Orientierung an anderen forensischen Wissenschaften. 2. Einen Mangel an grundlegender Theorie. Die vorliegende Arbeit versucht beide Problembereiche zu adressieren und damit zur wissenschaftlichen Fundierung des Gebietes der forensischen Informatik beizutragen. Hierzu betrachtet diese Arbeit die Ursprünge und Grundlagen forensischer Wissenschaften und zieht Parallelen zur digitalen Forensik. Es wird der Bezug der etablierten Praxis der digitalen Forensik zur Theorie der klassischen Forensik untersucht. Insbesondere überträgt diese Arbeit eines der grundlegenden Prinzipien der Forensik - die Theorie vom Ursprung der Spuren von Inman und Rudin (2000) - von der physischen auf die digitale Welt. Dieser Theorie zufolge, bildet die Assoziation den Kern einer jeden forensischen Untersuchung. Daher führt diese Arbeit den Begriff der forensischen Informatik als denjenigen wissenschaftlichen Kernbereich der digitalen Forensik ein, deren Fokus auf der reinen Feststellung von Assoziationen durch Anwendung wissenschaftlicher Methoden der Informatik liegt. Um der Forderung nach theoretischer Fundierung nachzukommen, formalisiert diese Arbeit den Begriff der Spuren auf Basis eines abstrakten Modells. Diese Formalisierung gibt erstmals die Möglichkeit, genaue (formale) Aussagen darüber zu treffen, was digitale Spuren sind und wie sie entstehen. Außerdem wird formal untersucht, welcher Gestalt die in der forensischen Informatik gelösten Rekonstruktionsprobleme sind und welche Einflussfaktoren auf die Lösbarkeit von dieser Probleme - und damit der Feststellung von Assoziationen in der digitalen Welt - existieren. Diese Ergebnisse werden anhand praktischer Beispiele nachvollzogen und erläutert.
Background
Due to rapid medical and technological progress, more and more pediatric patients with terminal cardiac insufficiency are being implanted with a ventricular assist device as a bridge to transplant without legal approval for hospital discharge. EXCOR® Active is a recently developed mobile driving unit for the EXCOR® ventricular assist device (EXCOR® VAD) with a long-lasting battery life that can manage small blood pumps, offering improved mobility for pediatric patients. This study strives to elaborate the requirements necessary for a safe home healthcare environment (HHE) for pediatric patients on EXCOR® VAD powered by the EXCOR® Active driving unit.
Materials and methods
Patient- and device-related preconditions (medical, ethical, psychological, technical, structural, organizational) were analyzed with regard to feasibility and safety in three individual patient cases. Included were pediatric patients with terminal cardiac insufficiency in a stable medical condition receiving in-hospital treatment with a univentricular or biventricular EXCOR® VAD powered by EXCOR® Active. Analysis was single-center, data was obtained 05/2020–02/2022.
Results
A total of three patients on EXCOR® VAD were identified for HHE treatment with the EXCOR® Active driving unit. Switch was performed safely and increased mobility led to improved psychomotor development and improved quality of life. No complications directly related to HHE-treatment occurred. One patient recently underwent an orthotopic heart transplant, one patient remains in HHE, and one patient died due to a complication not related to the HHE. Ethical approval for off-label use was obtained and patients and parents were given the required technical training and psychological support. Caregivers and medical professionals involved in the patients’ care at home were briefed intensely. Remote consultations were implemented and interdisciplinary in-hospital checks reduced to a long-term 4-week-scheme.
Conclusion
While it is challenging to discharge pediatric patients being treated with a paracorporeal ventricular assist device (EXCOR® VAD) from hospital, it is feasible and can be managed safely with the novel driving unit EXCOR® Active. A HHE may help to improve patients’ psychomotor development, offer normalized social contacts and strengthen both patients’ and parents’ physical and mental resources. Legal approval and another study with a larger sample size are warranted.