Transcript Computer Forensics

Virtual Forensics Lab
Steve Kim (Client)
Marilyn Silva
Rajeswari Ian
Anu Nagpal
Anthony Glover
1
Overview
 CASE STUDY
An actual NYPD criminal case helped motivate this work.
A person, let's say Sam, was contacted on a Social Network, and decided
to go to meet this other person. The other person's intent was to rob Sam.
In attempt to escape, Sam ran into the street and killed by on-coming
traffic. This then became a homicide case.
 SOLUTION
Developed security software tools, which can be used within Social
Networks, to help in tracking down criminals.
 OBJECTIVES
Retrieve user’s non-personal-identifiable data, during users
Contact via the following Virtual environments:




Social Network Sites
Chat Sessions
E-mail
Website (Developed in Java)
Virtual Forensics
2
Topics

Technology Used Chart

Social Network Site

Data Retrieval using - PHP Scripting

Detecting Device Type

Detecting Mobile Device Model

IM Chat Session

E-mail

MAC Address Retrieval – Using Java Applet

Future Enhancements
Virtual Forensics
3
Technology Chart
Data Retrieval
Virtual
Environment
Virtual
Environment
Examples
Technology/
Techniques
Social Network Site
MySpace
FaceBook
Hidden PHP scripts into
Social Network Page API.
SQL for Database storage
IM Chat Session
MSN chat session
Yahoo chat session
E-mail
Hotmail email
Yahoo email
View emailed messages’
source code, to see IP address
information.
Website
Custom developed Java
Website, used as an early
project phase work-around.
Java
Virtual Forensics
Real-time MS-DOS prompt
NetStat (Network Statistics)
commands.
Java Applets
4
Social Network Site
Data Retrieval
 PHP Scripted Web Site: http://www.virtualforensics.net/track.php
 Tracks the visitors to website
 Can be integrated for use in tracking Social Network Site visitors.
 Captures information of visited users
 Stores retrieved user data to database
 Appends retrieved user data to website for on-screen view
 Social Network Tracking – SETUP PROCESS
 Place the data retrieval PHP web link, into an image
source tag syntax
<img src="http://www.virtualforensics.net/track.php"
border="0" style="visibility:hidden;" />
 Place above source tag into “Headline” section of your
MySpace or FaceBook:
Virtual Forensics
5
Social Network Site (cont.)
Data Retrieval
 The captured user data is stored to a database, and appended to list
of visitors already in database.
 All tracked visitor information is then retrieved from the database logs,
and displayed to following link for on-screen viewing:
http://www.virtualforensics.net/
 Listing of Social Network Site user’s retrieved data:
Visitor entry from database, for viewing on web
Virtual Forensics
6
Social Network Site
Detection of Device Type
 PHP Scripted Web Site:
http://www.virtualforensics.net/mobiledetect/detect.php
 Detects the type of device used to login (PC, Mobile, etc)
Virtual Forensics
7
Social Network Site (cont.)
Detection of Mobile Device Model
 PHP Scripted Web Site:
http://www.virtualforensics.net/mobiledetect/detectmobile.php
 Detects the Mobile Model (Blackberry, I-Phone, etc)
Virtual Forensics
8
Java Applet
MAC Address Retrieval
 MAC address
 If assigned by the manufacturer, a MAC address (Media Access Control
address ) encodes the manufacturer's registered identification number
Display of retrieved user’s MAC address retrieved
Virtual Forensics
9
IM Chat Session
Data Retrieval
 NetStat
 Is a command which retrieves other person’s IP address & MAC address of
person you are chatting with.
 MS-DOS prompt type the following command and press enter: NetStat –n 3
IP address of Local Machine and Foreign Machine
Virtual Forensics
10
IM Chat Session (cont.)
Data Retrieval

IP address on the left hand side, 172.22.45.77 (see Figure 1) represents your IP
address. The IP address on the right hand side, 172.22.47.248 (see Figure 1)
represents the IP address of foreign machine. The 4 digit value following each IP
address represents the port to which it is connected to.

You can connect to the foreign IP address by typing the following command. From
the MS-DOS prompt type the following command: C:\>nbtstat -A 172.22.47.248
the output
Virtual Forensics
11
IM Chat Session (cont.)
Data Retrieval

On figure from previous slide (slide 10), the 172.22.47.248 represents
the foreign machine’s IP address.

This entered command will output the values of:
o Node
o IP address
o NetBIOS
o Remote Machine Table
o MAC address of Foreign Machine
Virtual Forensics
12
E-Mail
Data Retrieval
 Retrieve email sender’s IP address, by following below steps.
Within a yahoo email account do as follows:
 Go to inbox
 Open your email
 Click the drop down for Standard Header (see figure 3)
 Click Full Header from the Standard Header’s drop down
(figure 3 on next slide)
 Dialog box with the IP information appears
RESULTS:
The sender’s IP address will appear in dialogue box.
(Continued on next slide to view)
Virtual Forensics
13
E-Mail (cont.)
Data Retrieval
Virtual Forensics
14
E-Mail (cont.)
Data Retrieval
IP address is
198.105.45.132
Virtual Forensics
15
Future Enhancements
 Assigning the Java applet used to identify the Mac address of the
client to the website
 Retrieving the User Name of other user accessing the monitored
Social Network page
 Expand on fields to be retrieved during email communication.
Virtual Forensics
16
The End
Thank you!
Virtual Forensics
17