1 1 00:00:00,570 --> 00:00:02,820 Timeline generation. 2 2 00:00:02,820 --> 00:00:04,830 So at this point we've gone through 3 3 00:00:04,830 --> 00:00:07,290 a lot of our process of acquiring things. 4 4 00:00:07,290 --> 00:00:08,460 We've collected memory, 5 5 00:00:08,460 --> 00:00:11,310 we've collected the disk image and we've hashed it. 6 6 00:00:11,310 --> 00:00:14,040 But now we start doing all of our analysis. 7 7 00:00:14,040 --> 00:00:16,050 Now a large portion of our investigation 8 8 00:00:16,050 --> 00:00:18,570 is going to be trying to find that needle in a haystack, 9 9 00:00:18,570 --> 00:00:19,740 and we're going to start figuring out 10 10 00:00:19,740 --> 00:00:23,280 who touched what files at what time for what purpose. 11 11 00:00:23,280 --> 00:00:25,470 Now as we start gathering all of that information, 12 12 00:00:25,470 --> 00:00:27,810 there should be a good way to present that information 13 13 00:00:27,810 --> 00:00:30,360 as part of our analysis and our report. 14 14 00:00:30,360 --> 00:00:31,650 How do you want to do that? 15 15 00:00:31,650 --> 00:00:34,470 Well, one of the best ways is using a timeline. 16 16 00:00:34,470 --> 00:00:35,760 Now, a timeline as a tool 17 17 00:00:35,760 --> 00:00:38,160 that will show the sequence of file system events 18 18 00:00:38,160 --> 00:00:40,920 within a source image in a graphical format. 19 19 00:00:40,920 --> 00:00:42,757 So I can give you a lot of different ways to say, 20 20 00:00:42,757 --> 00:00:44,640 "here's all the different files I found, 21 21 00:00:44,640 --> 00:00:46,770 when they were touched and who touched them." 22 22 00:00:46,770 --> 00:00:48,060 I might put that in a spreadsheet, 23 23 00:00:48,060 --> 00:00:49,680 I might put it in a Word document, 24 24 00:00:49,680 --> 00:00:52,470 But one of the best ways is to graphically depict it 25 25 00:00:52,470 --> 00:00:54,420 and that's what a timeline allows you to do. 26 26 00:00:54,420 --> 00:00:56,970 Now, some of your tools will help you do this automatically. 27 27 00:00:56,970 --> 00:00:59,400 For instance, here's an image from EnCase. 28 28 00:00:59,400 --> 00:01:00,930 Notice, on the left side of the screen 29 29 00:01:00,930 --> 00:01:03,630 we can see the file system for our target disk 30 30 00:01:03,630 --> 00:01:05,580 that we've been doing our analysis on. 31 31 00:01:05,580 --> 00:01:07,830 On the right side, you'll see a timeline view 32 32 00:01:07,830 --> 00:01:11,040 of all the files that were touched at a particular time. 33 33 00:01:11,040 --> 00:01:12,750 For instance, you can see here 34 34 00:01:12,750 --> 00:01:15,870 every minute within this hour of this day. 35 35 00:01:15,870 --> 00:01:18,210 And so we can see here, highlighted in red, 36 36 00:01:18,210 --> 00:01:19,740 that at the 19th minute 37 37 00:01:19,740 --> 00:01:21,870 all of those files were being touched. 38 38 00:01:21,870 --> 00:01:24,300 Now, if you're on a server, this can be a lot of files 39 39 00:01:24,300 --> 00:01:25,807 and so it's really going to be important to say, 40 40 00:01:25,807 --> 00:01:28,740 "We know bad thing X happened at this time, 41 41 00:01:28,740 --> 00:01:31,050 based on our seam data or our log data. 42 42 00:01:31,050 --> 00:01:33,240 And once we go into that, we can then correlate that" 43 43 00:01:33,240 --> 00:01:35,010 with the analysis that we're looking at, 44 44 00:01:35,010 --> 00:01:37,530 especially if we're trying to track down an intruder. 45 45 00:01:37,530 --> 00:01:39,750 Now in the forensic world, this is important as well 46 46 00:01:39,750 --> 00:01:41,520 because if I'm trying to put a bad guy away 47 47 00:01:41,520 --> 00:01:44,190 for something he did, I need to prove he did it. 48 48 00:01:44,190 --> 00:01:46,320 That he had means, motive, intent. 49 49 00:01:46,320 --> 00:01:47,880 And one of the things that can help me is, 50 50 00:01:47,880 --> 00:01:50,370 if I know he was on this computer at this time 51 51 00:01:50,370 --> 00:01:53,190 and this activity happened during that timeframe, 52 52 00:01:53,190 --> 00:01:55,830 that's going to be able to help me create that evidence I need 53 53 00:01:55,830 --> 00:01:57,570 to punish that bad guy. 54 54 00:01:57,570 --> 00:01:59,460 So once you start constructing your timeline 55 55 00:01:59,460 --> 00:02:00,540 in this graphical format 56 56 00:02:00,540 --> 00:02:03,330 you'll also back it up with a written report. 57 57 00:02:03,330 --> 00:02:05,280 Now, a lot of things have to go into this report 58 58 00:02:05,280 --> 00:02:06,870 and one of the things you're trying to aim for 59 59 00:02:06,870 --> 00:02:09,390 as you're constructing this timeline and your report, 60 60 00:02:09,390 --> 00:02:11,430 is to answer a lot of different questions. 61 61 00:02:11,430 --> 00:02:13,170 For instance, you might want to answer, 62 62 00:02:13,170 --> 00:02:15,270 how was access to the system obtained? 63 63 00:02:15,270 --> 00:02:17,130 Was it remotely or was it locally? 64 64 00:02:17,130 --> 00:02:19,620 Did they guess somebody's password or did they steal it? 65 65 00:02:19,620 --> 00:02:21,900 Were they able to break in using some kind of an exploit? 66 66 00:02:21,900 --> 00:02:23,940 All of those are things you want to figure out. 67 67 00:02:23,940 --> 00:02:25,830 What kind of tools might have been installed? 68 68 00:02:25,830 --> 00:02:27,930 If it was a bad hacker who hacked into your system 69 69 00:02:27,930 --> 00:02:29,970 over the internet, did they install a Trojan? 70 70 00:02:29,970 --> 00:02:32,280 Did they install some kind of remote access tool? 71 71 00:02:32,280 --> 00:02:33,960 All those things are things you want to identify 72 72 00:02:33,960 --> 00:02:35,760 as part of the analysis. 73 73 00:02:35,760 --> 00:02:36,660 Then you also want to think about 74 74 00:02:36,660 --> 00:02:38,370 what changes to the files were made. 75 75 00:02:38,370 --> 00:02:40,260 And, again, your analysis and your timeline 76 76 00:02:40,260 --> 00:02:41,280 is going to help you here, 77 77 00:02:41,280 --> 00:02:43,380 because you'll be able to see which files were touched 78 78 00:02:43,380 --> 00:02:45,240 at which particular time. 79 79 00:02:45,240 --> 00:02:47,910 You also want to figure out what data has been retrieved. 80 80 00:02:47,910 --> 00:02:50,130 Were you the victim of a data exfiltration? 81 81 00:02:50,130 --> 00:02:53,040 If so, you should see reading happening of those files, 82 82 00:02:53,040 --> 00:02:55,020 and then transmission over the network. 83 83 00:02:55,020 --> 00:02:56,520 And, again, all that can be documented 84 84 00:02:56,520 --> 00:02:58,050 as part of your timeline. 85 85 00:02:58,050 --> 00:03:01,080 And, finally, was the data actually exfiltrated? 86 86 00:03:01,080 --> 00:03:03,240 Just because somebody accessed the data 87 87 00:03:03,240 --> 00:03:04,680 doesn't mean they took it with them 88 88 00:03:04,680 --> 00:03:05,880 when they left the network, 89 89 00:03:05,880 --> 00:03:07,800 and so you need to be able to prove that as well. 90 90 00:03:07,800 --> 00:03:09,240 All of these are things you're going to do 91 91 00:03:09,240 --> 00:03:10,710 as part of your analysis 92 92 00:03:10,710 --> 00:03:13,230 as you're going through your timeline generation. 93 93 00:03:13,230 --> 00:03:15,570 Now, many forensic tools can generate a timeline 94 94 00:03:15,570 --> 00:03:18,540 based on the evidence you've been scanning and analyzing. 95 95 00:03:18,540 --> 00:03:20,250 This can be done in lots of different tools, 96 96 00:03:20,250 --> 00:03:23,040 for instance, I showed you the one for EnCase earlier. 97 97 00:03:23,040 --> 00:03:25,290 You also can do this using the open source tool, 98 98 00:03:25,290 --> 00:03:28,650 the Sleuth Kit, and its companion tool, Autopsy. 99 99 00:03:28,650 --> 00:03:29,483 Here on the screen, 100 100 00:03:29,483 --> 00:03:32,460 you can see the timeline editor within Autopsy. 101 101 00:03:32,460 --> 00:03:33,810 Notice, it looks a little different 102 102 00:03:33,810 --> 00:03:36,690 than the way we saw it inside of EnCase. 103 103 00:03:36,690 --> 00:03:39,240 For this one, we can show what time units we want. 104 104 00:03:39,240 --> 00:03:42,180 Do we want to look at it as years, days, or minutes? 105 105 00:03:42,180 --> 00:03:44,610 How far out or how far in do we want to zoom? 106 106 00:03:44,610 --> 00:03:45,780 We can look at the event type, 107 107 00:03:45,780 --> 00:03:47,730 is it a base type or a subtype? 108 108 00:03:47,730 --> 00:03:48,840 We can look at the description, 109 109 00:03:48,840 --> 00:03:50,820 is it going to be short or long? 110 110 00:03:50,820 --> 00:03:52,080 We can apply different filters 111 111 00:03:52,080 --> 00:03:53,310 to only show us certain events, 112 112 00:03:53,310 --> 00:03:56,220 for instance, "Show me all the files that were PNG files 113 113 00:03:56,220 --> 00:03:58,470 that somebody had touched, which are graphic files. 114 114 00:03:58,470 --> 00:04:00,750 I can then see a table view or a thumbnail view 115 115 00:04:00,750 --> 00:04:03,300 of all the files that were touched there on the bottom left. 116 116 00:04:03,300 --> 00:04:05,040 On the right side I can see some data 117 117 00:04:05,040 --> 00:04:06,150 associated with the different files 118 118 00:04:06,150 --> 00:04:07,440 that are being highlighted. 119 119 00:04:07,440 --> 00:04:09,780 And up on the top right, you can also see the counts, 120 120 00:04:09,780 --> 00:04:11,340 the details or list view 121 121 00:04:11,340 --> 00:04:13,350 of all the things that have been touched. 122 122 00:04:13,350 --> 00:04:15,240 Again, you can start playing with this tool on your own 123 123 00:04:15,240 --> 00:04:16,560 because it is open source, 124 124 00:04:16,560 --> 00:04:18,180 so you can feel free to download it, 125 125 00:04:18,180 --> 00:04:20,430 load it up and try it out yourself. 126 126 00:04:20,430 --> 00:04:22,117 Now, one of the questions I often get is, 127 127 00:04:22,117 --> 00:04:23,610 "What if your tool doesn't support 128 128 00:04:23,610 --> 00:04:25,050 creating your own timeline?" 129 129 00:04:25,050 --> 00:04:28,050 Well, if that happens, you can create a sequence of events 130 130 00:04:28,050 --> 00:04:30,540 within a spreadsheet to serve as your timeline. 131 131 00:04:30,540 --> 00:04:32,310 Now, because this is a manual process 132 132 00:04:32,310 --> 00:04:33,540 it is more time intensive 133 133 00:04:33,540 --> 00:04:35,160 and it takes more work on your part, 134 134 00:04:35,160 --> 00:04:37,560 but it is still helpful to have some sort of a timeline 135 135 00:04:37,560 --> 00:04:38,970 included in your report 136 136 00:04:38,970 --> 00:04:41,220 so people can see exactly what happened, 137 137 00:04:41,220 --> 00:04:42,573 when, and who did it.