-: Timeline generation. 2 2
So at this point we've gone through 3 3
a lot of our process of acquiring things. 4 4
We've collected memory, 5 5
we've collected the disk image and we've hashed it. 6 6
But now we start doing all of our analysis. 7 7
Now a large portion of our investigation 8 8
is going to be trying to find that needle in a haystack, 9 9
and we're going to start figuring out 10 10
who touched what files at what time for what purpose. 11 11
Now as we start gathering all of that information, 12 12
there should be a good way to present that information 13 13
as part of our analysis and our report. 14 14
How do you want to do that? 15 15
Well, one of the best ways is using a timeline. 16 16
Now, a timeline as a tool 17 17
that will show the sequence of file system events 18 18
within a source image in a graphical format. 19 19
So I can give you a lot of different ways to say, 20 20
"here's all the different files I found, 21 21
when they were touched and who touched them." 22 22
I might put that in a spreadsheet, 23 23
I might put it in a Word document, 24 24
But one of the best ways is to graphically depict it 25 25
and that's what a timeline allows you to do. 26 26
Now, some of your tools will help you do this automatically. 27 27
For instance, here's an image from EnCase. 28 28
Notice, on the left side of the screen 29 29
we can see the file system for our target disk 30 30
that we've been doing our analysis on. 31 31
On the right side, you'll see a timeline view 32 32
of all the files that were touched at a particular time. 33 33
For instance, you can see here 34 34
every minute within this hour of this day. 35 35
And so we can see here, highlighted in red, 36 36
that at the 19th minute 37 37
all of those files were being touched. 38 38
Now, if you're on a server, this can be a lot of files 39 39
and so it's really going to be important to say, 40 40
"We know bad thing X happened at this time, 41 41
based on our seam data or our log data. 42 42
And once we go into that, we can then correlate that" 43 43
with the analysis that we're looking at, 44 44
especially if we're trying to track down an intruder. 45 45
Now in the forensic world, this is important as well 46 46
because if I'm trying to put a bad guy away 47 47
for something he did, I need to prove he did it. 48 48
That he had means, motive, intent. 49 49
And one of the things that can help me is, 50 50
if I know he was on this computer at this time 51 51
and this activity happened during that timeframe, 52 52
that's going to be able to help me create that evidence I need 53 53
to punish that bad guy. 54 54
So once you start constructing your timeline 55 55
in this graphical format 56 56
you'll also back it up with a written report. 57 57
Now, a lot of things have to go into this report 58 58
and one of the things you're trying to aim for 59 59
as you're constructing this timeline and your report, 60 60
is to answer a lot of different questions. 61 61
For instance, you might want to answer, 62 62
how was access to the system obtained? 63 63
Was it remotely or was it locally? 64 64
Did they guess somebody's password or did they steal it? 65 65
Were they able to break in using some kind of an exploit? 66 66
All of those are things you want to figure out. 67 67
What kind of tools might have been installed? 68 68
If it was a bad hacker who hacked into your system 69 69
over the internet, did they install a Trojan? 70 70
Did they install some kind of remote access tool? 71 71
All those things are things you want to identify 72 72
as part of the analysis. 73 73
Then you also want to think about 74 74
what changes to the files were made. 75 75
And, again, your analysis and your timeline 76 76
is going to help you here, 77 77
because you'll be able to see which files were touched 78 78
at which particular time. 79 79
You also want to figure out what data has been retrieved. 80 80
Were you the victim of a data exfiltration? 81 81
If so, you should see reading happening of those files, 82 82
and then transmission over the network. 83 83
And, again, all that can be documented 84 84
as part of your timeline. 85 85
And, finally, was the data actually exfiltrated? 86 86
Just because somebody accessed the data 87 87
doesn't mean they took it with them 88 88
when they left the network, 89 89
and so you need to be able to prove that as well. 90 90
All of these are things you're going to do 91 91
as part of your analysis 92 92
as you're going through your timeline generation. 93 93
Now, many forensic tools can generate a timeline 94 94
based on the evidence you've been scanning and analyzing. 95 95
This can be done in lots of different tools, 96 96
for instance, I showed you the one for EnCase earlier. 97 97
You also can do this using the open source tool, 98 98
the Sleuth Kit, and its companion tool, Autopsy. 99 99
Here on the screen, 100 100
you can see the timeline editor within Autopsy. 101 101
Notice, it looks a little different 102 102
than the way we saw it inside of EnCase. 103 103
For this one, we can show what time units we want. 104 104
Do we want to look at it as years, days, or minutes? 105 105
How far out or how far in do we want to zoom? 106 106
We can look at the event type, 107 107
is it a base type or a subtype? 108 108
We can look at the description, 109 109
is it going to be short or long? 110 110
We can apply different filters 111 111
to only show us certain events, 112 112
for instance, "Show me all the files that were PNG files 113 113
that somebody had touched, which are graphic files. 114 114
I can then see a table view or a thumbnail view 115 115
of all the files that were touched there on the bottom left. 116 116
On the right side I can see some data 117 117
associated with the different files 118 118
that are being highlighted. 119 119
And up on the top right, you can also see the counts, 120 120
the details or list view 121 121
of all the things that have been touched. 122 122
Again, you can start playing with this tool on your own 123 123
because it is open source, 124 124
so you can feel free to download it, 125 125
load it up and try it out yourself. 126 126
Now, one of the questions I often get is, 127 127
"What if your tool doesn't support 128 128
creating your own timeline?" 129 129
Well, if that happens, you can create a sequence of events 130 130
within a spreadsheet to serve as your timeline. 131 131
Now, because this is a manual process 132 132
it is more time intensive 133 133
and it takes more work on your part, 134 134
but it is still helpful to have some sort of a timeline 135 135
included in your report 136 136
so people can see exactly what happened, 137 137
when, and who did it.