Updated Windows Registry and Mac resources & Jad's Software....updated

As several sites have rightfully pointed out....Accessdata has made a huge jump ahead with their recent release of FTK Imager v3.0.  (not to mention FTK 3.2 and their most recent "Volatile tab.")   Just finished testing it today by mounting physical images and using VFC to virtually boot XP and Win7 systems.  Flawless!    While wandering around their site (actually looking for updated RSR files to add to their most recent Registry Viewer version), I stumbled across two additional documents that I believe are very worthy of a good read - or at least printing out as a permanent reference.

Registry Quick Find Chart - a very recently updated 34-page reference documenting Registry locations for the standard 5 Registry files.  The document has a few new columns in the document - one which lists what versions of Windows the reference pertains to (ie: XP, Vista or Win7) and a second column that states when the Registry reference is updated (immediately, when document opened, at logon...)    This document would also be great starting reference to initiate further research on Registry locations and extractable artifacts.  D/L it....know it....print it and keep it handy!

Mac System Artifacts - another reference document which provides 7 pages of Mac Artifact locations.  With FTK's amazing ability to parse out the Mac OS (including Plists), this document is another one to print off.  Updated in 2010.

Jad has also updated three of his applications:
Internet Evidence Finder (IEF) - updated to v3.6 to handle recent updates to Facebook Live chat.  Commercial - Cdn $49.00; Free for Law Enforcement.
FChat - updated to v1.20.    Commercial - Cdn $29.99
FJF - Facebook JPG finder - updated to v1.2.1.  Currently free for use.

The iPhone and Corporate Security

I have done my fair share of mobile analyses over the last 4-5 years including logical extractions of Blackberry's and both logical and physical extractions of iPhones.  With a larger number of cellular providers carrying iPhones, I am often asked to compare the Blackberry to the iPhone within a corporate domain.

While I understand that the iPhone is constantly increasing the number of "apps" that they carry, I simply cannot find a logical reason why a corporation (who presumably does not want company information/secrets shared with the world) would opt to incorporate the iPhone into it's corporate enterprise.

As recent as last week, I was reminded that many corporations will almost always opt for "availability" over "confidentiality".  While I believe that both are important, I simply do not see why a company would so severely sacrifice data integrity as to choose the iPhone over the Blackberry. 

Let's look at a few ideas with which to draw a comparison:
- the iPhone allows both a logical and full physical extraction of it's user partition.
- the iPhone password can be bypassed with a known commercial technique.
- Insofar as data, the iPhone retains vasts amount of data in relatively easy to extract/read format.  The use of EnCase and FTK to analyze a physical iPhone partition exposes just how robust the information is.

- there are no commercial techniques to bypass the Blackberry password (yes, I know about BES pwd resets, looking for IPD backups, etc).
- Blackberry does not seem to have jumped on the "app train", pushing out new apps each day. (this is good, no?)

So I ask....beyond being the "new kid with a new toy", why are companies asking about iPhones and security?

Last time I did an iPhone analysis, I mentioned to my colleagues that we ought to be classifying the iPhone analysis the SAME as a full Mac analysis.  File structure, artifacts, geo information, Internet History, Email, ....  it may just be my .02 cents, but any company with any sense of security ought to give this a very long, hard look before seriously considering an iPhone within their corporate domain.

ps...note to Apple....why has it taken you so long to realize this.  (or have you already realized it and simply believe that pushing out "apps" for the home market would be more lucrative?  (huh?))

Mac OSX Forensics becomes "The Apple Examiner"

For the last few years, MacOSXForensics.com has been a continuing reference source for my Mac-based forensic investigations.  The website has now changed names, and moved to The Apple Examiner Website.  The site is very nicely laid out, easy to understand and contains information on the newest of Apple technology.  I see a new area on iPhone/IPad/IPod.


I've been analyzing some iPhones lately, and instead of focusing on the (logical) information parsed out by Cellebrite and XRY, I've been throwing the images into FTK and EnCase.   FTK does a very good job parsing out the PLISTS for examination.  If you're more partial to EnCase, there is a PLIST parser on the Guidance Website (created 03/2010 by Simon Key) which can be downloaded from here  (you'll likely need an account to log into the Support Portal.)  Once these PLISTS have been parsed out, you cannot imagine the information forensically available within an iPhone.  I'm doing up some screenshots of how to bring the Physical Image into FTK and EnCase to preview it (you have to change a byte).  Of course, I maintain the original, and flip the byte on a copy.

Check out Ryan and Dave's website.  If you're interested in Mac Forensics, you HAVE to bookmark this one.

Raptor - another solid tool updated...

The folks over at Forward Discovery, Inc have updated their Intel-based Mac forensic boot-cd Raptor. You will find two versions of the product, one aimed at the Intel-based processor, and the other for the PPC (beta). I personally have used the Intel-based CD and found it to work flawlessly. Although Apple has been kind enough to make the hard drives in the recent MacBook Pro more accessible, the older versions are very difficult to disassemble; particularly if you may be required to image a device in a "time-sensitive" situation (and perhaps without others knowing ....).

Raptor can image in DD, EnCase .E01, DMG or even clone to a destination drive, which can be formatted FAT32, NTFS, EXT3 or HFS+. And for those who prefer to create a pristine, original image and a lab image to analyze, you can create two simultaneous images at the same time.

I haven't had an opportunity to use the PPC version, except for testing it on a few lab models. I recall having to play with the boot options to get the disk to boot properly.

That being said, I'm very anxious to get this image burn and "take 'er for a rip." This IS a tool you should have in your toolkit. From what I've seen in the forensic community, the staff at Forward Discovery are great to deal with as well.

I'll keep you updated.........