1. Define several forms of metadata that can be useful to an investigation. How are valuable to an investigator? (250 words)

2. Using Chapter 10 as a reference, eExplain the concept of information stores. Why is an understanding of how different clients store messaging information critical to the success of an email search? (250 words)

3. Explain how cookies can show that a user has visited a site if that user’s history has been deleted.

Optional: install Windows Historian and see the sites visited by a particular user. (Chapter11) (250 words)

Use your own words. Attach your WORD document here.

Expecting by tomorrow 2/8/2021

Chapter 11

Web Forensics

1

Purpose of Investigation
Theft of intellectual property
Misuse of company resources
Stalking
Possession or distribution of contraband

Internet Addressing
Uniform Resource Locator (URL) points to a specific object with Internet availability
Scheme identifies protocol used to access the resource (http, https, ftp, etc.)
Domain name points to the specific network
Suffix (.com, .edu, etc.) points to top level domain
All together, they make the fully qualified domain name

Browsers
Uses markup language to open web pages
Hyperlinks redirect user to specific resources
Content can be either web pages or files that are the targets of hyperlinks

Function of Browsers
An address bar (manual mapping to URL)
Forward and Back buttons
Bookmarking capabilities
Intrapage search capabilities
Configuration utilities

Artifacts of Browsing
Internet history
Cookies
Temporary Internet files
Registry entries

Deleting Temporary Files
Browser settings can be adjusted to automatically delete files upon closing the browser
Temporary files can be recovered the same as any other deleted file
Cookies may or may not be included, depending on the browser and its configuration
Internet history files and cache files are not the same

Browser History
A database of recently visited sites
Cache files are stored separately
Each operating system/browser combination has a different default location for history and cache files
Some utilities that analyze Internet usage can automatically detect browser settings

Analyzing User Activity
Cookies generally identify the website from whence they came
History records are a database file that shows user activity (may be deleted periodically)
Temporary Internet files can be recovered by file recovery utilities even if automatically deleted

History Files
URL
File Name: as it exists on the local system
Record Type: browsed or redirected
Access Time: time the file was last accessed
Modified Time: time the file was last changed
Directory Name: local directory in which the file is stored
HTTP Headers: as originally received

Finding “Stuff” is Not Enough
The defendant has knowledge of possession of contraband
The defendant took specific actions to obtain the contraband
The defendant had control over the contraband
If deleted, the defendant took active measures to destroy the actual materials
There was sufficient quantity of contraband to justify prosecution

Knowledge of Possession
“Present Possession” concept: The user must know that it is there
Redirected sites will store temporary files and images without notifying the user
Any attempt to manipulate or manually delete the file suggests knowledge of possession
But what user was logged on when these actions took place?

Establishing User Actions
Repeated searches suggest intent
Innocent searches can bring up unexpected content
Popups are not under the control of the user
Meta-refresh will automatically redirect the user against their will
The TypedURL registry entry proves that a website was accessed intentionally

Establishing Control of Material
The Trojan Horse defense (the Devil made me do it)
A malware analysis can prove or disprove this claim
But rootkits can foil the malware analysis
Accessing a file a significant time after the original create date suggests control
Manually deleting or editing a file suggests control

Determining Active Measure
Intentional deletion
Modify dates after the create date
Moving a file from one location to another
Renaming a file

Determining Sufficient Quantity
That’s not your job – leave it to the legal team
Your job is only to ascertain the quantity

Tools for Browser Analysis
Virtually all commercial forensic suites
Pasco
Web Historian
Galleta
NetAnalyst

Investigating Web Servers
Server log files
Access logs
Error logs
Proxy Servers

Chapter 10

Email Forensics

1

Email is Often the Best Evidence
Contents can demonstrate intent
Header data can demonstrate the source
Timestamps can show intent to mislead
Show up as evidence in a vast majority of cases

Email Structure
Plain text emails don’t support graphics
HTML structured emails support graphics and embedded content
Attachments can accompany the message as a separate file

Email Technology
Mail user agent is a software interface that represents the end user
Mail transport agent moves messages from point A to point B
Mail client is the application that provides end user support
Mail server handles addressing and transport

Email Addresses
Each user ID must be unique to a particular domain
The same user ID on a different domain may or may not represent the same user
User IDs are easily spoofed with the right software

Email Protocols
Mailbox protocols
Post Office Protocol, ver. 3 (POP3)
Internet Message Access Protocol (IMAP)
Transport protocols
Simple Mail Transport Protocol (SMTP)

Email Clients
Perform some basic functions
Send messages
Receive messages
Manage content (including attachments)
Are operating system specific
Determine how information is archived on the system
May be a local client or web-based

Information Stores
Acts as a cabinet for the information stored by the client
Sent/Received messages
Address books
Calendars
Each client has a specific format for storing data

Email Servers
Act as relay agents for moving messages across the Internet
SMTP servers handle all outgoing messages
IMAP or POP3 servers handle all incoming messages
Server applications such as Microsoft Exchange combine SMTP with POP/IMAP

Standard Header Information
TO:
FROM:
SUBJECT:
DATE:
All of these are easily spoofed

MIME Header Information
Information stored in the header that includes:
Time/Date stamps for various actions along the way
Server information for relay servers along the way
A message ID unique to this message across the Internet
Versions of software used along the way
IDs of blind carbon copy recipients
A return path

Tracing the Origin of a Message
Each server that relays the message adds its IP address
Each relay server maintains logs for a certain period of time that indicates the IP address of the sender as well as the intended recipient
While the time stamp can be manipulated at the origin, the ones added along the way are likely real

Some Email Search Tools
Clearwell
Paraben
GREP

Search Results
False positives – looks right but isn’t
False negatives – doesn’t look right, but is
A measure of accuracy is “precision”
Ratio of false positives to false negatives
A measure of effectiveness is “recall”
Percentage of relevant emails that were found

Advanced Search Methods
Stationary User Profiles – a method of determining if a user makes use of multiple accounts
Similar Users – a way of determining if what appears to be a single user is actually multiple users
Attachment Statistics – a user’s typical behavior regarding attachments is analyzed
Recipient Frequency – what types of messages a specific user usually receives