Latest / Parsing the Truth: One Byte at a Time / Who Solves Cases? Digital Forensics Tools or People?

Transcript

Who Solves Cases? Digital Forensics Tools or People? · Parsing the Truth: One Byte at a Time

0:01
Join former FBI Senior Forensic Examiner's Becky Passmore and
0:05
Stacey Eldridge as they dig into the world of digital forensics
0:08
one bite at a time. Now leading their own consulting
0:11
firms and educating the next generation of cyber sleuths,
0:14
these badass babes of digital forensics bring sharp insight,
0:18
real world case experience, and a dose of humor to the bits and
0:21
bites that build today's investigations.
0:23
From deep dives into business e-mail compromise and ransomware
0:26
attacks, Becky's specialty to cracking the complexities of
0:29
iPhone forensics, Stacy's obsession, this podcast delivers
0:33
insider knowledge for professionals, students, and
0:36
true crime techies alike. If you've ever wondered what
0:39
really happens when the digital trail is all that's left, TuneIn
0:42
and start parsing the truth. Welcome to Parsing the Truth one
0:53
bite at a time. We are the true crime ish
0:57
podcast where we're talking about digital forensics and how
1:00
they solve today's modern crimes.
1:03
And we also talk about a little bit everything digital
1:06
forensics. I am Stacey Eldridge, your Co
1:09
host, and as always, I am joined by my Co host, Becky Passmore.
1:14
Becky, what are we going to talk about today?
1:16
Today we're going to talk about how tools don't solve cases.
1:19
People do, which I know there's a lot of examiners out there
1:24
that preach this all the time. We're going to say Briggs is
1:28
probably that preacher of tools don't solve cases, people do.
1:32
And it's pretty much because that digital forensic tool is an
1:38
amplifiers of expertise, not substitutes for it.
1:42
They're not trying. A tool only works as well as an
1:45
examiner's understanding of data structures, the scope and the
1:51
legal authority, the condition of the evidence.
1:54
There's so many factors that can play into and my favorite
2:00
comment is how much is this going to cost me?
2:04
Yes, yes, Once you get out of like the law enforcement
2:08
prosecution side of the house, people want to know what's it
2:12
going to cost. And sometimes when they're
2:15
asking that question and often times you haven't even seen the
2:19
evidence. So you're making a guess in the
2:22
blind and depending on who you're dealing with, how well
2:27
they can explain what they have, what they need and what's going
2:31
on, there can be a great divide there.
2:34
And I always find myself starting with like, you know, I
2:38
start, I start low if they kind of be kind of a low thing.
2:41
And it's like, but I don't know, we can start here and then we'll
2:45
have to talk about it and we'll prioritize things as you get
2:49
deeper and deeper, I think the target moves.
2:52
Yeah, absolutely. We always say what is the end
2:55
goal? What are you trying to
2:56
accomplish? Because we want to focus and
2:59
prioritize because people say by the tool it solves the case.
3:04
And you and I have had that discussion about how expensive
3:06
these tools are and what is the benefit to having them.
3:12
And the benefit to having them is it parses the data for us.
3:16
It gives us the data structure. It gives us what is in the data.
3:21
We don't need the tool to figure that out, but having a tool to
3:25
help us do that? Does speed up time?
3:28
No, Yeah, we're paying for the speed, right?
3:30
We're paying. If I can't get, if I can do it
3:33
faster manually, I don't want to pay for a tool then like if I
3:37
can open it up in SQLite Viewer, something for the database, if I
3:43
can open it up in Excel, because even with the expensive tools,
3:46
you're still working in Excel a lot to solve your cases.
3:50
But yeah, they're, they've got to give me value as I'm doing it
3:54
so I can work it faster and better and more accurate so I
3:57
can pass that value in terms of cost savings on to my client.
4:02
That's correct, right? Because the faster that tool
4:05
processes the data, the scope may be very narrow and that tool
4:10
can produce those results pretty quickly.
4:13
And then you've. Covered that, not that we get a
4:16
charge for when the tool is running.
4:18
We don't get a charge. Just to be clear for everybody,
4:20
we're not charging when the tool is sitting there running and
4:22
we're not sitting there. We we charge for when we're
4:25
working. When we're when we're doing the
4:28
analysis of it, right, we get the data, download the data,
4:32
process the data, and then we start to analyze the data and
4:35
that's what we're doing is. So like as soon as that tool, I
4:38
mean, that's the thing. And, and many of these scopes is
4:41
they're time sensitive. Some of that information is
4:44
needed pretty quickly. So a tool that parses something
4:47
pretty fast that we can go straight to the artifact that
4:52
answers the question of the scope of what is, what is the
4:56
need of the end goal? Then that helps us help our
5:01
clients, our customers. So forensic success depends on
5:06
those methodologies and not brand name tools.
5:11
So why forensics tools work when they work?
5:16
Why don't you, why don't you talk about that, Stacy?
5:18
Why do forensic tools work when they work?
5:23
The better question is why don't they work when they don't work
5:27
right? It's two.
5:27
It's two sides of the same coin. But the biggest?
5:30
Thing has to come down to the programming of the tool.
5:35
There are people employed by the program, whatever program you're
5:40
using that are developing the things that are working in the
5:43
background and digging through the tool or through the data.
5:48
And then they also have to make the decision of how will that
5:53
information be presented in the tool?
5:56
What will it be categorized as? What will it look like?
6:01
You know, what are the different interactions?
6:03
And and then how can they make it work with their existing
6:07
structure? Because, you know, new
6:09
technology comes along all the time.
6:11
So how can they make this new widget fit into their software
6:16
program? And so when we say the tool
6:18
isn't working, we're saying we're not seeing some data in
6:23
the tool presented to us either as we expect to see it, or maybe
6:28
we're not seeing it at all, or maybe the way it's presented is
6:33
confusing, convoluted, takes a lot of clicks to get there, you
6:38
know, that sort of stuff. So that's kind of, you know, how
6:41
we get to the tools working versus not working.
6:45
If something's been around for a long time, we expect it to be
6:49
clearly presented easily to figure out.
6:51
Great example is Word doc documents of things that
6:55
consistently work emails, which I'll talk about more later.
6:59
As long as these mails has been around, it's it's a moving
7:03
target because new software comes out and e-mail is always
7:08
kind of a problem to a certain extent.
7:11
Yeah, yeah. And and tools are highly
7:13
effective when file systems such as your NTFS, your FAT, your
7:17
APF, all of those are well documented, right?
7:20
And because like what you were saying, you have these
7:24
developers in the background. As long as the artifacts are
7:27
living in the same spots all the time, every time the update
7:31
comes out, not a whole lot there to change.
7:34
I'm sure a software developer would say no, there's probably a
7:37
lot more to change. And I would agree they are an
7:40
expert in their field. But what we're talking about is,
7:43
is that if you're same general and artifacts that you are
7:49
studying and analyzing for specific case don't aren't being
7:57
populated in different areas of the evidence, then why change
8:04
the product? Why move it into a different
8:07
bucket? Why put it into a different
8:10
parsing tab on the dashboard? And so as long as file systems
8:15
are well documented and stay the same, those tools are going to
8:19
be highly really affected, even effective, even your, you know,
8:23
open source tools. That's why there are so many
8:26
open source community tools that are well tested and used and
8:31
actually more feedback given on those tools in the in the
8:36
community. And you know, it helps when
8:39
those artifacts are stable and predictable within that
8:43
standardized data structure where tools are highly
8:46
effective. And that goes into MFT parsing
8:49
those browser SQLite databases or your favorite, the iOS
8:54
Knowledge C databases. Yep.
8:56
Yep. So when the data behaves, the
8:59
tool shines. Yep.
9:03
But it's when that data is manipulated right by the user,
9:10
by the system, by configurations, by a program, by
9:15
an application. That's where it becomes
9:19
unpredictable and. You know when you're getting
9:22
those unpredictable results in the tool, whether it looks wonky
9:27
or you can't find it parsed out. Then you go to some other method
9:32
to figure it out. Like if it's in a database, can
9:35
you open it up externally in a database viewer and look at it
9:38
that way? Or if you switch to another
9:41
forensic, what it does when it parses it on, what does it look
9:46
like? And then some other tools when
9:48
you are manually trying to search for something, say it
9:52
didn't parse out. You've been told it exists, but
9:55
it didn't parse out. So now you're trying to look for
9:58
it and you're doing some searching your, you know,
10:00
keyword searching, but now you need to search against, you
10:03
know, the index of the case. Or maybe you need to do what's
10:08
referred to as a live search and, and different things and,
10:10
and you've got to know your tool for what terminology they use
10:13
and how it will actually search for you too.
10:16
But if you need to do that search where you're literally
10:18
looking over every bit of the drive, you know, are you looking
10:22
for a hex pattern or what are you looking for?
10:25
Some tools do that sort of manual hex searching better than
10:29
other tools. And sometimes it's maybe the
10:33
examiner knows this one tool better for doing this type of
10:38
work versus this other tool for this other type of work.
10:42
And that's fine too, because everybody has their strengths
10:45
of, you know, what they're great at examining and what tools they
10:50
use. And naturally, the tools you use
10:52
most often should become the tools that you become stronger
10:57
in. But sometimes something doesn't
10:59
work, so you've got to be able to flex and try to use a new
11:02
tool. So you've got to be able to be a
11:05
little bit well-rounded and have some backups in your toolbox.
11:11
And it's also important to phone a friend and be like, hey, have
11:15
you seen this? I'm trying to do this.
11:17
It didn't work in this tool, but now I'm trying to do it in this
11:19
tool. I'm running into Roadblock.
11:22
Can you walk me through how to do this one thing and this other
11:26
tool that I don't use a whole lot?
11:29
I always say Mark Johnson is my hero in that one case where I
11:34
knew nothing about N case and he was the one that opened my eyes
11:38
to, you know, a different level of understanding of a tool by
11:43
helping me navigate that case. And and you're absolutely right,
11:48
phoning a friend. Have I some people are very
11:52
reserved about calling someone else up to ask him a question
11:56
because they think that it might make them look like they don't
12:00
know what they're doing. It might cause them to have some
12:02
type of imposter syndrome, right.
12:04
But again, how often do you look at iOS devices and the different
12:12
models and versions? And how often do I look at them?
12:16
And if I look at them once every six months, why wouldn't I call
12:21
you to say, hey, I'm seeing something here that I don't know
12:24
what this means. Has something changed or that is
12:27
data being populated in a different dashboard?
12:30
Or where did this? Where does this data live now?
12:33
Because I'm very interested in finding something very specific.
12:36
And again, it goes back to phone.
12:39
Own a friend, use your resources, network with people,
12:43
networking with people. I was working a case.
12:46
I called Briggs, said hey Briggs, I need some help on
12:49
something. And he answered the call and we
12:53
had a great discussion and he sent me off in the right
12:55
direction and I was right. Yeah, and sometimes it's just
12:59
like saying the problem out loud to someone else and then all of
13:04
a sudden the light just goes off.
13:05
Or you just talk through it and they ask you some questions
13:09
about some stuff that you haven't thought of before.
13:11
Right, right. You're, you know, say you're
13:15
working an insider threat case and all of a sudden you're
13:18
really focused on looking for jump lists or shell bags and
13:26
someone says, hey, have you thought about looking in the
13:29
registry hive for USB? Connections.
13:32
It can get you out of that tunnel vision, correct?
13:35
And then you're like, and like you said, a light bulb goes on.
13:37
And then you're like, I can, I could go here and here and here
13:40
and here, and I could do this and this and this and this And
13:43
again, it's that strategy and networking that helps keep the
13:48
flow moving for these cases. Yep.
13:51
Absolutely. Yeah.
13:51
So then another part of why forensic tools work when they
13:55
work is you can get it to some type of automation to a scale,
14:02
right? A lot of logs you got a lot, you
14:05
got a large volume of logs that need to be processed.
14:08
Automation log, Ecker log using tools to grab those logs,
14:13
looking for something very specific.
14:15
That's that's a great way to get through that process using
14:20
automation to scale, being able to timeline that out and
14:23
correlate your timelines and also cross artifact indexing.
14:28
You know, you use tools like Zimmerman's tools.
14:31
Yep. And you parse out all of your
14:35
individual artifacts, your MFT, your jump list, your shell bags,
14:38
your link files, all those. You use those tools to parse out
14:42
all that data and then you start to correlate those times.
14:46
I mean, it looks beautiful when it's done and now you're able to
14:50
cross artifact indexing that information and then you didn't
14:55
necessarily have to use a tool to process it.
14:59
Yeah, you didn't need a big forensic suite that did like all
15:03
the things. Right, right.
15:05
And you got to what you needed to get to.
15:07
You met the scope, you move through the process, you could
15:11
go back and like you said, verify through some other tools.
15:15
But yeah, in contrast, manual analysis equals precision and
15:20
tool assisted analysis equals feasibility.
15:23
Yep. And you still just got to know
15:25
where all these artifacts come from because like you're
15:27
mentioning jump lists and stuff like that.
15:29
And so that reminds me of a case I worked just last month.
15:34
I think I had to go down to Harciville in Kansas City and
15:38
review a suspected C Sam case. So C Sam, obviously I can't have
15:43
that in my lab, so I got to go down there and review that
15:46
stuff. So when I'm there, what I want
15:49
to focus on is just the items that may be C Sam, but then I
15:55
want to be able to take the non C Sam stuff back to my lab that
16:01
can help me determine, you know, interaction with the files.
16:06
How recent? Where did these things, you
16:09
know, go to and from? Was there multiple devices?
16:12
What is the connection between that frequency stuff like that
16:16
attribution? Yeah.
16:17
So, you know, I wanted to be able to get, I just, I exported
16:21
those artifacts out of the forensic image of the ones that
16:24
I needed and then I put it in a folder on the Hartsville system.
16:29
And then when I was ready to go, they, you know, checked it to
16:32
make sure that I wasn't taking anything that I wasn't supposed
16:35
to be taking. And then I took that stuff back
16:37
to my lab and just process those individual artifacts through a
16:42
tool rather than sitting there and doing it for days and days.
16:48
I mean, everybody's super nice to work with when you go there
16:51
and do that in that situation. But you know, you're not in your
16:54
lab and you've got to get all your tools loaded onto their
16:57
stuff. And so, you know, my philosophy
17:00
is get in, get done what you have to get.
17:02
Done there and then go back home and finish it there.
17:05
Focus of within your tool, your lab, your structure.
17:09
You know the good thing about tools when they work because
17:13
they help us to known artifacts, known outputs, right?
17:18
We know what those artifacts are, where they're going to
17:21
live, what they're, you know, what they're expected to look
17:24
like and at the same sense what that known output put is going
17:28
to look like. Whenever I'm teaching my
17:30
students, I say we're going to use a couple of tools and you
17:34
see, you'll see all these buckets on the side, whether
17:38
we're using celebrate you Fed reader, or we're using autopsy,
17:42
we're using Axiom. Those buckets are where that
17:46
data lives, but that data is parsed by this tool.
17:49
So we have to understand artifacts outputs.
17:53
Also, the I would say the most compelling statement for tools
18:00
when they work is if they're tested, they're validated,
18:04
they're they're recognized in the community as a good resource
18:10
or identifying artifacts and information that it's
18:15
repeatability matters for court defensibility.
18:18
Yes, repeatability, super important.
18:21
But Speaking of court, what I've heard a lot, but not a lot, I've
18:25
just heard it. And you know, we've been
18:26
reviewing trials, learning from them and getting ready to do
18:30
podcasts on them. And one thing I've heard in some
18:34
testimony that I've been listening to is the tool said
18:38
this, the tool said that. The tool also said this other
18:41
thing. And then there's been some
18:43
discussion about that LinkedIn, that's mostly where I hang, hang
18:47
out. And they're saying like, well,
18:49
they said the tool said this. And I was like, didn't know that
18:53
tool knew how to talk. That's amazing.
18:56
But we've got to be careful because we're, you know, you're
18:58
pinning it all on the, the tool. So we've got to be careful when
19:03
we're testifying on how we're explaining things because I
19:07
think there were then some questions later on, probably on
19:11
the cross. They're like, what do you mean
19:12
that the tool said, you know, so be prepared to explain it
19:18
without saying the tool told me this.
19:20
The tool said this. You've got to explain it as you
19:24
were discovering and examining and reviewing that information.
19:28
Because you are the tool, as Briggs says, right?
19:33
You are the tool. And, and this is what I told my
19:35
students when you are communicating and articulating
19:39
your findings, I don't care what that tool said.
19:41
I care what you say. Like don't.
19:45
You're not allowed to write in your report what the tool said
19:49
because you are telling me what you you identified.
19:53
You're putting the case together based on the scenario, the
19:57
investigation, what you've been asked to produce.
20:01
And so the tool findings help you get to that answer.
20:06
Yep, and you just got to explain it all out in your report and
20:09
then explain it all when you're in the hot seat in the
20:12
courtroom. That's exactly right.
20:14
That's exactly. And then there's forensic tools
20:18
fail and sometimes mislead. Yes, yes, that's where I've been
20:22
living this week. Let's talk about that.
20:26
OK, yeah. So let's talk about when they
20:29
fail and when they mislead. So the first thing that I want
20:34
to talk about is e-mail. As I mentioned earlier, and I'm
20:38
going to go down the path of let's talk about some specific
20:43
about e-mail attachments and the way I was seeing them in Axiom.
20:51
So if you're not familiar with Axiom, it has some different
20:55
buckets, but the you're mainly working in, well at least I am,
20:59
especially when you're starting the case you're working in the
21:01
artifacts Explorer. And as it indicates, it has all
21:05
of the different things that it's parsed out, divided out
21:08
into different artifact categories.
21:11
And then you can go go through the Navigation Pane on the left.
21:15
So it's quite easy to understand.
21:17
Like emails would be in the e-mail container in the
21:20
Navigation Pane documents like text and word documents would be
21:25
in the documents container. So e-mail has its own container
21:29
and then it has sub things underneath there for the
21:32
different types of emails like inbox and e-mail X and just all
21:37
the different types. They also, Yep, and they also
21:42
have artifact category of e-mail attachments.
21:49
So if it's an e-mail attachment, it only lives in the e-mail
21:55
attachment artifact category. That's right.
21:59
It does not live anywhere else, even if it is a picture, even if
22:05
it is a Word document. So if you were looking for a
22:10
document and it came in as an attachment and you didn't know
22:14
it came in as an attachment, you're not going to see it in
22:17
documents. You're only going to see it as
22:20
e-mail attachment right when you go there and look.
22:24
Right. And if they didn't create it on,
22:26
they didn't create it on the computer.
22:28
It got sent to them. Yeah.
22:32
Now, you can do a little bit better when it comes to pictures
22:37
that are received and sent via e-mail as attachments, because
22:42
then you can switch to the Media Explorer to find the pictures.
22:45
And it doesn't matter if they came in as an e-mail attachment
22:48
or they were stored on the computer hard drive or the
22:53
device that you're examining. And it's not limited to just
22:57
that e-mail or just the hard drive.
23:00
It will whatever artifacts and images and extractions, whatever
23:05
you have, anything that is a image, a picture will show up in
23:10
the Media Explorer. So even if you have like a
23:14
Google take out all that stuff, it will show up there in
23:18
addition to the e-mail attachments.
23:21
So that's a good way to kind of find the pictures there.
23:23
One stop shopping to look through all the pictures
23:25
together there. But if you need to find a
23:28
document, you're going to look through and you don't know what
23:31
it's called because obviously if you knew what it was called, you
23:34
could just keyword search it. And then hopefully when you got
23:37
the results of the keyword search, you would see like, oh,
23:39
there's four things in e-mail and one thing in documents.
23:44
And that would be a quick look through with your eyeballs.
23:46
Once it's you know, I've been filtered down with that keyword
23:49
search. But if you don't know what it's
23:51
called, you know, obviously you could again, try to keyword
23:55
search with some words that might be in there.
23:58
But again, how many things are going to come, come back?
24:01
Now you're looking in two places for the unknown.
24:04
So this is sort of my, my pet peeve.
24:06
And the other thing is you might be thinking, Oh, well, I'll just
24:10
go to the file system Explorer and look for the e-mail
24:14
attachments there because I'll just keyword search over there
24:18
or do a little more filtering by like the file extension and
24:21
stuff like that over there. That doesn't work over there
24:24
either because most of the time the e-mail is not living on the
24:28
file system as an individual file.
24:32
If they've exported out or saved it as like a dot eml or dot MSG
24:37
by themselves, then you would see it on the file system.
24:39
But you've got to remember all of these emails are being parsed
24:43
out of whatever container it's living in and then shown to you
24:46
as an artifact in the artifact explorer.
24:49
And so that's the problem because apparently something
24:52
can't be two types of artifacts at the same time because then it
24:57
would live in two containers simultaneously.
24:59
So I guess this is how the tool was developed.
25:02
It can only be 1 artifact and they because it's an e-mail
25:05
attachment, it lives in the e-mail attachment container.
25:08
But then the problem is, well, what if you have a search
25:12
warrant that says you can only view or search for Excel files?
25:17
And so, you know, you can see all the Excel things if you go
25:21
into that, that category. But what if you can't?
25:26
What if you're not allowed to like look under e-mail
25:29
attachments because they're like, well, you're, you're
25:32
looking through emails. You're not supposed to be
25:34
looking through emails. You're only supposed to be
25:36
looking at Excel files. So I mean, you could certainly
25:39
filter for the Excel file, but would you be going out of the
25:42
scope of your search warrant by by going into the e-mail
25:46
artifacts category and looking there?
25:49
You know, so I just like, I think I think that's a hard
25:51
thing to to work through to try to find it determining what your
25:55
legal authority is, how far can you can you go and what can you
25:59
look in? I would agree.
26:03
So I did, I don't know how many people know that paid attention
26:08
to that. And maybe you found it like
26:10
figured it out when you were looking for something that was
26:13
supposed to be there, but you couldn't find it, right.
26:16
And then you've got to figure out why.
26:18
Why isn't it showing up here? It's not in here anywhere.
26:21
OK, now it's in it. I'm looking through attachments.
26:24
But why do I have to look through attachments?
26:25
I just want to look through documents and find all of the
26:29
documents there. And then so say you're, you're
26:32
only allowed to look at the Excel file.
26:35
So now you're going to go into attachments.
26:38
How can you filter down to only look at the Excel files when
26:43
you're in the attachments category to be effective?
26:48
So you can certainly filter by extension that that would be an
26:51
option, sure, but it's not 100% right because it could have
26:56
changed the wrong extension. No extension.
26:59
That's right. Again, you could try to keyword
27:03
search and use like Excel because the metadata tag of
27:07
Microsoft Excel should be present.
27:10
But again, it's just one of those weird things you got to
27:13
think differently about how am I going to find this stuff and it,
27:17
and it's harder to find stuff when you don't know exactly what
27:20
it is. And it's even harder to find it
27:22
if it's not there because it's not there and so you can't find
27:25
it. But you know, we've gone through
27:26
this, down this path a million times.
27:28
Somebody swears it's there. Yes.
27:31
On the drive, yes. And so you start going through
27:34
the problem. Yeah.
27:36
Is it me? Right.
27:37
Is it the tool? What is the problem here?
27:40
Right, right, right, right. Right.
27:42
Yeah. And, and that's another thing is
27:44
sometimes it's easy to blame it on the tool.
27:46
Well, the tool didn't parse it. Well, if you're an examiner,
27:50
shouldn't you be able to parse it if it's there?
27:52
Like, I know it's not always easy because as we know, data is
27:58
messy. It's not always clean.
28:01
And going back to intact metadata, is the metadata intact
28:07
and is it parsing it out properly?
28:11
These tools assume that your metadata is intact, right?
28:16
But the tools also assume every computer is clean when it shuts
28:20
down, like it shuts down in a clean environment all the time.
28:24
We know that doesn't happen. We also know that tools assume
28:29
that there's non corrupted structures and we also know
28:34
that's not the case either, right?
28:36
People that are trying to hide their tracks, they are
28:41
manipulating the data, whether that's the file system, the
28:45
formatting, the data structure, whatever the case may be.
28:48
We also think about real world evidence being power loss,
28:54
partial overrides, malware tampering, time stamp stomping,
29:00
right? All of these different things
29:02
those could resolve within the data, which means that it's
29:07
messy, it's not clean. And then in the in the results,
29:10
we get those false negatives that we're like, it should be
29:14
here and this is where it should be.
29:17
And why is it not here? We get the false negatives, we
29:20
get the incomplete timelines, and we get misleading
29:23
confidence. It breaks down our confidence.
29:26
And you know, when you spend hours and hours and hours
29:30
looking at the data and thinking that it is, it's exactly
29:34
supposed to be in this area, why am I not finding it?
29:39
You know, it breaks us down and puts us through that imposter
29:42
syndrome. Yeah.
29:43
And part of it comes from things are just not clearly articulated
29:48
to us to give us enough technical information about what
29:52
it is, where it is. And then so we've got to make
29:55
some assumptions that we operate under as well.
30:00
And I think my assumption always is if I'm not finding it, the
30:03
problem is me, I'm the problem. What am I doing wrong?
30:08
What am I not finding? And so I will go through like 3
30:14
different tools trying to parse something.
30:17
And you know when that doesn't work, now I'm looking at stuff
30:21
manually. And so this leads me into
30:24
another thing about the the wonders that is e-mail.
30:28
Windows 10 is is basically dead. You can still get some limited
30:32
support, but basically since Windows 10 is dead, there are
30:36
free e-mail app that came with it.
30:38
Windows Mail it's dead also. So it made everybody move over
30:42
to Outlook New. Not to be confused with.
30:46
Outlook classic. OK, Yeah, I was going to say
30:49
old. No, it's classic like we're
30:53
classic. So we're not right.
30:55
That's right. But.
30:56
Basically Outlook New is like some half baked version of
31:01
Outlook Classic because Outlook Classic is what you get when you
31:05
use Microsoft 365 and you have a subscription for that.
31:09
So the pain of Outlook New is that it's default storage time
31:14
for offline emails is 30 days. The Max number of days you can
31:20
get is 180 days. Now The funny thing is like when
31:25
you're online in the Outlook New app, you can basically like see
31:31
them all and search because it's querying your online storage for
31:35
the stuff that you're searching for.
31:37
But then after you're disconnected when you're
31:39
offline, there's a only 180 days worth of stuff stored in there
31:44
and it's not stored in like an OST or a PST or anything like
31:50
that. This stuff is all stored in
31:53
Outlook new in the level DBS. The other thing that comes with
31:57
that choice of like if you switched it up to 180 days, you
32:00
can also choose whether or not to include the attachments in
32:05
your offline storage. Luckily, attachments are on by
32:09
default from what I've seen. But the other thing that's
32:12
problematic with this is this setting about, you know, is it
32:16
30 days or 180 days? And what about the attachments
32:20
is it does not live in the registry.
32:23
It's stored in the cloud. So you can't just go into the
32:27
registry and be like, oh, what do they have it set for?
32:30
So you could try to do some deductive reasoning, right?
32:33
Like when was this imaged? Oh, I'm only seeing the emails
32:37
going back 30 days. I suspect they have the default
32:41
setting of 30 days. Or if it's going back 180 days
32:45
ish, you'd be like, I suspect it's at 180 days.
32:50
And then, you know, so your default assumption is, you know,
32:55
if they have an e-mail app on their computer, they've got
32:58
everything downloaded and everything is there, but that's
33:02
not the case. So, you know, what can you do
33:06
when you're in this situation? If you have to produce something
33:10
and, and this could work whether you know you're in a civil case
33:13
or you're law enforcement trying to prosecute somebody, you're
33:16
going to have to think about what to do to work through this
33:18
to get these emails that you need.
33:22
The other thing with Outlook new is you can't even open it
33:26
without an Internet connection. So, you know, as a forensic
33:30
examiner, sometimes we do, you know, we make a copy of the
33:33
image, we make a live boot and boot into the VM to look around.
33:37
Well, that's not going to work because Outlook new won't open
33:39
without the Internet connection, which really irritates me to no
33:44
end because some of us still live in the boonies and we don't
33:47
always have Internet. And then what if your, you
33:51
should be able, in my opinion, to open your e-mail and and see
33:55
what's in there. I don't think you should have to
33:57
have an Internet connection to just look at your emails.
34:01
But again, so much of this stuff is in the cloud and it's really
34:04
not like an app anymore like the traditional app that we're used
34:09
to. Everything's more just, it's
34:11
really based in the browser. It just looks like an app.
34:14
It's a different overlay. And this is kind of where we're
34:16
getting into with Outlook new and especially with that level
34:20
DB. So that totally explains why
34:22
there's not the PST and why there's not so much living on
34:26
your computer anymore. But you know, so this is where
34:29
Microsoft is going, I guess they have this belief that everybody
34:33
is on the Internet all the time. Easy connection, no problem.
34:36
But I also had a case probably 3 months ago where I couldn't log
34:41
into the laptop of my client unless it was connected to the
34:46
Internet. How stupid is that?
34:48
You can't even log on again. What if you're in the booties
34:51
and you don't have an Internet connection?
34:54
Now this was the fault of Windows welcome and that
34:57
nonsense. But The funny thing was, you
35:00
could connect and change the Wi-Fi without being logged on.
35:04
That's no problem. But let's just stupid on
35:08
Microsoft's part. Yeah, in my opinion, yeah.
35:10
And it goes back to version drift and update risk, right?
35:16
OS updates change artifacts constantly, right?
35:20
Tools lag behind always. So now I promise you, those tool
35:25
vendors are doing some magic changes and trying to figure out
35:33
the best way to populate and parse what you're referring to.
35:37
Yep. Yep.
35:38
Because they lag behind. There's new schemas that come
35:41
out, there's new app behaviors like you were talking about, and
35:44
then on top of that, there's new encryption methods.
35:47
Yep. Always, but I digress.
35:49
So let's kind of go and work through like what do we do with
35:53
this e-mail and kind of the path I went through.
35:55
So you know, in law enforcement it would be a different
35:59
situation because like me, I could just contact my client and
36:02
be like, what's your password? Let me in.
36:05
And then so like I could do the Internet connection on the VM,
36:08
open Outlook, enter their password, and then I can make
36:10
that decision to. You do still have the option to
36:14
export to a PST from Outlook new, so you could do that or you
36:19
could just save down the dot eml files that you specifically need
36:25
if it's only a few. Another thing you could do would
36:28
be to migrate their account to like Outlook Classic where it's
36:33
going to download everything 100%.
36:36
Another option is you could use a cloud collection tool, for
36:40
instance, where you could get all of their emails down from
36:43
that cloud account. But again, you need the password
36:46
and you'd probably have to work around getting in with the MFA
36:49
and so you'd have to work with a client.
36:51
So like that sort of stuff that I'm talking about.
36:54
Great for me working with clients either in offense or
36:59
more of the civil law suits, but law enforcement probably not
37:04
going to have the legal authority to like be logging in
37:06
live to people's accounts and pulling down stuff.
37:09
And they certainly can't compel or force someone to provide
37:13
their password. So the alternative for the law
37:16
enforcement is to go out and get a search warrant and they could
37:20
serve that search warrant to whatever the e-mail provider is
37:23
to get everything back. So then you're going to have to
37:25
wait for that return as well. But so then the other problem is
37:29
with Outlook new some tools couldn't process it and and this
37:35
was the other part of like, am I crazy?
37:38
Is it me or is it the tool? Is it a combination of both
37:42
things happening simultaneously? Because both things can be true
37:45
at the same time, right? So and the reason I didn't think
37:49
Axiom was working at all with Outlook new is I saw some emails
37:55
and they look like what is a very technical term.
37:58
It is called gobbledygook. They looked like gobbledygook
38:02
and I thought. My favorite term.
38:04
Yes, I thought it's not parsing it out right.
38:07
It's kind of here, but it's all like smashed together and it's
38:12
just not right. And so I'm like, OK, all throw
38:15
it in another tool. I've been having really great
38:17
luck with Fex Forensic Explorer lately.
38:20
So I threw those emails in there and is this the one that ran?
38:25
It ran for like 3 days on the e-mail that was. 53,000,000
38:31
emails and I'm like I don't I don't.
38:34
Yeah, because there was this ticker going through and it
38:36
looked like it was going through 53,000,000 emails and I'm like
38:40
no wonder it's taking so long. That's right.
38:43
And at the end of the day, all I got from FEX was a 300 gig log
38:47
file with all the time stamps that have when it was doing
38:51
stuff. That's all that was in there and
38:53
no emails. So next I threw it into autopsy.
38:58
I just did the default install, so I don't know if there's
39:01
another e-mail module, but that default install didn't get it
39:04
either. Also went to OS forensics didn't
39:07
get it either. There are a couple of other
39:10
things I had in mind, but part of the problem I was like, the
39:14
problem is, is that it's a level DB.
39:17
So what's a level DB? It's it's, you know, DB
39:22
database, but it's more of like a library that gets built into
39:27
the applications rather than like running as a whole separate
39:32
database. That's kind of, it's a, so it's
39:35
a little bit different. That's the best like, and it's
39:38
not even an analogy, but it's the best explanation I got at
39:41
this moment. But the most important thing you
39:43
need to know about the level DB is that everything works in key
39:48
value pairs on the disk. So if you're familiar with
39:53
working in a registry, it's kind of not that hard of Elite to
39:58
kind of get your head wrapped around the level DBS.
40:01
And when I was in training last year at I Asus, we did do some
40:05
manually parsing of these key value pairs to work through it.
40:09
So after I saw this gobbling gook, I thought, OK, it's just
40:12
not parsing it right. I'm going to go use.
40:16
Rabbit hole. Great program.
40:18
You can literally go down the rabbit hole with rabbit hole.
40:22
Well, I've not used rabbit hole, I got to check that out.
40:25
I love it. It's, it's great.
40:26
You can get a 30 day free trial. OK.
40:29
It's not a they're not paying us to say any of this stuff.
40:32
No, but then after the 30 days you got to pay for it.
40:36
But it does a whole bunch of stuff.
40:37
It's really great to kind of go dig down deeper and deeper.
40:41
And so I was like, okay, I'm just going to go look through
40:45
this and level DB in rabbit hole to see if what's supposed to be
40:50
there is in there somewhere. Like I needed to know was it
40:54
really there or not? And because it's in the key
40:57
pairs and you have to piece all this stuff together, you can't
41:01
just like search against the drive for the contents because
41:06
it's not together in one spot. And so I was was searching
41:10
through rabbit hole and of course I've still got to put
41:13
stuff together, but I could at least see a chunk of data at a
41:16
time time like, you know, to from subject header stuff to
41:19
give me enough insight to lead me to believe that no, in fact,
41:24
this e-mail is not existing on here at all.
41:28
Yeah. So I was like, okay, I've done
41:30
all the things. It's not me, it's not the tool,
41:34
it's just not there. So Rabbit Hole was kind of my
41:38
more manual work and the last thing I did to be like, it's
41:41
just not there. The other thing about Rabbit
41:44
Hole is they have a great blog post of kind of how to work
41:47
through getting out some of these emails manually.
41:50
I didn't have to go that far, but they have like how you could
41:52
rebuild it. So if you needed to understand
41:54
how it worked at a deep level, you could go out there and get
41:58
it. So at the end of the day, in
42:00
this case, it wasn't a me problem, it wasn't a tool
42:03
problem, it was an Outlook new problem.
42:05
That's what the problem was. The Outlook new problem, I like
42:10
it again, going back to the tools lag behind the new schemas
42:16
and how data is parsed and populated into these buckets and
42:21
dashboards and findings, right? And but the tool tools help us
42:26
to validate and verify information for real courtroom
42:30
reality, right? And going back to what you were
42:33
saying is like you've used multiple tools, tools to try and
42:38
understand how the data structure is designed so that
42:42
you could go down that rabbit hole, so that you could go find
42:45
that information. Because in the end we have to
42:48
remember the tools are not self authenticating.
42:52
The courts care about methodology, validation,
42:56
examiner competence, and that's what we have to.
43:00
So when the tool said so, that's not testimony going back to what
43:04
you said earlier, right? And that is, you know, going to
43:08
get challenged in court. The reproducibility is the gold
43:13
standard. Can I take what you did and
43:16
repeat what you did and get the same result?
43:21
Can I explain the artifact with screenshots?
43:25
This is that gold standard they're looking for.
43:28
The defense will attack the tool first.
43:31
They. They'll attack you personally
43:33
first probably. What do you think?
43:35
Right. And then and then the tool.
43:36
Absolutely. So it's the tool said they're
43:39
going to attack the tool and then they're going to attack you
43:41
as to why you're talking about the tool saying it did it.
43:44
So the right thing, the right way to think about tools is they
43:48
are necessary, they're feasible, they're fallible, they're
43:51
powerful when they're understood.
43:53
Expertise lives between hex metadata and context, and it's.
43:58
Does it say expertise lives in the chair?
44:00
Becky, it lives in the chair and it is not what the tool said.
44:04
It's what the interpreter interprets, which is you and me
44:08
and every other examiner out there.
44:10
So. I was to say the other thing,
44:12
you know, maybe some people already knew all this stuff.
44:16
They do a ton of e-mail cases and they've seen it evolved.
44:18
I don't do a lot of Windows e-mail cases, but I went down
44:22
the steps to figure out why am I not seeing what I'm seeing?
44:26
I knew what I was looking for. I knew where it should be,
44:28
checked all the places, tried all the tools, manually looked
44:32
and then eventually determined it wasn't there.
44:33
And then when it are out about another way to get that e-mail
44:36
because it it did exist. It was just somewhere else.
44:39
It was in the cloud it. Was in the cloud, cloud and you
44:42
don't always have access to the cloud.
44:44
And it matters when you are trying to parse the truth.
44:50
That's why we are parsing the truth one bite at a time.
44:53
Because when you are trying to parse out the truth, you have to
44:56
understand. And so you have to go around and
44:59
figure out what you were seeing and then what was being
45:03
displayed and how it was being read by the tool through your
45:09
knowledge. So absolutely 100% one skill.
45:13
What is 1 skill every examiner should learn outside of tools?
45:17
Outside of, I don't know what's your answer?
45:19
Do you have a plan 1? How to communicate, right?
45:22
Yeah, like they should learn how to communicate.
45:25
You being able to explain to our listeners about how you went
45:30
about understanding what Windows Mail was and how you went about
45:34
to go and figure out where the data lived, how the data was
45:39
designed, what the data structure was, and now you've
45:43
explained it to them. Someone out there has probably
45:45
worked a case very similar and they don't know the answer to
45:49
this, but you have provided some steps now that will lead them
45:53
down the road to go. Let me let me go check that out
45:56
and see if I can figure it out. So and there's probably somebody
45:59
else there out there that said I knew this days after Outlook new
46:03
came out, sure. But lucky for them, you know.
46:07
And some people probably don't even know that.
46:09
Some people probably don't even know that Outlook New is out
46:12
there. Yeah, it just depends when it
46:13
works. Yeah, and you don't know until
46:15
you get it. That's the the luck of the draw.
46:19
So I guess, you know, I think communication is a great skill.
46:23
I think like being able to look at some of this stuff and like
46:27
hex and being able to do some of that manual decoding and parsing
46:32
and being able to trace down through things.
46:35
So it's going to help you troubleshoot.
46:38
Oh yeah, I don't think. That's like a, there's not like
46:41
a class you can go to and and get that skill.
46:43
You've just got to build it up over time and you build it from
46:47
doing a bunch of different things.
46:49
So like learning the basics of FAT and NTFS and how all that
46:54
stuff works together and you know what stuff looks like in
46:58
hex because eventually you'll be able to start to see patterns.
47:01
You might not know what this pattern means, but you're going
47:05
to see it and you're going to be like, that's a pattern.
47:07
So there's something about this pattern that's special.
47:10
It's not getting parsed out. Maybe it's a new pattern.
47:12
Let's let's dig into this and and look at at it.
47:15
Yeah, again, that's why I Asus BCFE course is instrumental to
47:22
those people to understand how to read the hex, how to read the
47:27
data structure, how to read the file systems, how to read the
47:30
MFT, how to carve it out manually and then have an
47:34
understanding of this is how the tool does it.
47:37
This is what the tool is parsing when it pulls it out of that
47:40
location and puts it in to the dashboard and makes it pretty
47:44
debris 100%. Well, great.
47:47
Well, as always, stay safe, stay sharp, and keep parsing the
47:51
truth one bite at a time. If you enjoyed this episode,
47:55
make sure to follow us to get notified the next time a new
47:59
episode drops. If you can do more, head on over
48:02
to parsingthetruth.com and donate by clicking on the donate
48:07
button. Parsing the Truth is a nonprofit
48:09
organization and we are raising money to send a new digital
48:12
Forensic Examiner to IASYS training next year in Orlando.
48:16
Thanks. Yeah.
48:23
Yeah, yeah. Yeah.
48:24
Yeah, yeah, yeah, yeah, yeah.