(fios#03) 5. 죽은 서비스도 살려내는 포렌식 기술
TRANSCRIPT
The 3rd FIOS(F-INSIGHT OPEN SEMINAR)
Resurrect the System and Services: 죽은 서비스도 살리는 포렌식 기술
ykei
@ykx100
forensicinsight.org Page 2
목차
1. Cold or Hot Evidence
2. Resurrection
3. Chain of Custody
forensicinsight.org Page 3
Cold or Hot?
forensicinsight.org Page 4
Cold or Hot Evidence
Top Class Forensic Scientist
forensicinsight.org Page 5
Cold or Hot Evidence
One of Top Class Forensic Scientist
forensicinsight.org Page 6
Cold or Hot Evidence
Meet
The bruised body
One of Top Class Forensic Scientist
with breath
forensicinsight.org Page 7
Cold or Hot Evidence
U Remember?
Specialized at dead body
forensicinsight.org Page 8
Cold or Hot Evidence
forensicinsight.org Page 9
Cold or Hot Evidence
Now He got the cold body
as his wish
Is it fair?
forensicinsight.org Page 10
Cold or Hot Evidence
Digital Evidence?
forensicinsight.org Page 11
Cold or Hot Evidence
Have you ever like this?
forensicinsight.org Page 12
Cold or Hot Evidence
Same Cold EV.
forensicinsight.org Page 13
Cold or Hot Evidence
But,Benefit of live forensics
Short way to extract
Quick response
Seize the live data
forensicinsight.org Page 14
Cold or Hot Evidence
Increased size, complexity of Data
Hard to find evidence
forensicinsight.org Page 15
Cold or Hot Evidence
Still, u
wanna kill
the hot &
take the
cold body
for analysis?
forensicinsight.org Page 16
Cold or Hot Evidence
Stop pulling the plug
forensicinsight.org Page 17
Cold or Hot Evidence
Boooooring… I know that, already
forensicinsight.org Page 18
Cold or Hot Evidence
Someone killing the hot body
Mistake
Wrong decision
Bad Situation
forensicinsight.org Page 19
Cold or Hot Evidence
If someone give you the shit,
forensicinsight.org Page 20
Resurrection
forensicinsight.org Page 21
Resurrection
Unified Log Monitor System
Pulled the plug and Imaging the Disks
Can you export the all log from DB?
Where is the start point?
Here is shit…
forensicinsight.org Page 22
Resurrection
Resurrect System
forensicinsight.org Page 23
Resurrection
Virtual mount disk image files
forensicinsight.org Page 24
Resurrection
Check the Kernel version information
forensicinsight.org Page 25
Resurrection
Check Filesystem information
forensicinsight.org Page 26
Resurrection
Make the VM with mounted disk
forensicinsight.org Page 27
Resurrection
Now boot,
Meet the kernel panic
So I present this now :)
forensicinsight.org Page 28
Resurrection
Try to rescue boot [ linux rescue, chroot /mnt/sysimage ]
forensicinsight.org Page 29
Resurrection
Try to rescue boot [ linux rescue, chroot /mnt/sysimage ]
forensicinsight.org Page 30
Resurrection
Physical Driver to Virtual [ /etc/modprobe.conf ]
forensicinsight.org Page 31
Resurrection
Check disk order [ fdisk –l ]
forensicinsight.org Page 32
Resurrection
Check original mount point [ /etc/fstab ]
forensicinsight.org Page 33
Resurrection
Fix the raid bug [ /etc/grub.conf ]
forensicinsight.org Page 34
Resurrection
Grub information update [ grub-install ]
forensicinsight.org Page 35
Resurrection
Update Kernel information [ mkinitrd ]
forensicinsight.org Page 36
Resurrection
Still No Heartbeat of Service
forensicinsight.org Page 37
Resurrection
Resurrect Service
forensicinsight.org Page 38
Resurrection
Adjust network environment [ ifconfig ]
forensicinsight.org Page 39
Resurrection
Recovery DB files
forensicinsight.org Page 40
Resurrection
Recovery DB files
forensicinsight.org Page 41
Resurrection
May be It is not good idea…
forensicinsight.org Page 42
Resurrection
But, u can cheating the history :) [ history ]
forensicinsight.org Page 43
Resurrection
Now service is warmed
forensicinsight.org Page 44
Resurrection
Maybe, u need to PW recovery from DB
forensicinsight.org Page 45
Resurrection
But, Is resurrection break the chain?
forensicinsight.org Page 46
Chain of Custody
forensicinsight.org Page 47
Chain of Custody
No, Chain is fine
forensicinsight.org Page 48
Chain of Custody
When is preservation done,
CoC is Start.
forensicinsight.org Page 49
Chain of Custody
Don’t scared, Do hash
For Compatibility : MD5
For Security : SHA256(higher)
forensicinsight.org Page 50
Chain of Custody
But be prepared, always
Guide
Tools for your Environment
Storage for backup
And Hiring the Real Expert
Don’t deceived by crook
forensicinsight.org Page 51
Now, Cold or Hot?
forensicinsight.org Page 52
Conclusion
Virtual Technology is awesome
I can resurrect the cold media
Sometimes, It is very efficient method
forensicinsight.org Page 53
Conclusion
Please reconsidering the pull the plug
Do not send the shit to me
If you give me the shit,I can over that, too.
forensicinsight.org Page 54
Conclusion
Hello, digital media necromancer!
Have u a question?