Hey all,
My thesis project for University is on exploitable weaknesses of the forensic examination process looking at ways features like known file filter and keyword searching can be circumvented. After doing all my research I've come up with two different tools
KFFCrack Modifys the DOS stub of executable and DLL's to change their hash value without affecting their functionality so that they remain useable but aren't detected by KFF.
Cyrillix Replaces Latin characters in text files with identical russian counterparts so the file remains identical in appearance but should hopefully avoid detection with keyword searching.
These ideas based largely based off presentations by metasploit and after I've got them working fully I do intend to investigate alternative ways around them, from a forensic point of view such as content triggered piecewise hashing to replace the current KFF.
I would very much appeciate some feedback from the forensic community about the programs GUI e.g. any recommended improvements, Overall any problems or errors encountered using the programs, additional functionality that should be included and finally any thoughts on how if any these programs would affect the forensic examination process. e.g. some example questions would be
As an investigator were you aware of these techniques?
Would they make your task of investigating any more difficult?
Would they pose any threat of you missing data?
Would you be able to easily overcome any problems they caused if any?
Any thoughts or feedback is greatly appeciated thanks again.
Sorry for the wait on the downloads but I dont have any webspace. I've included the source code instead of exe's and it's wrote in VB.net.
Cyrillix
http//
KFFCrack
http//
> As an investigator were you aware of these techniques?
> Would they make your task of investigating any more difficult?
> Would they pose any threat of you missing data?
> Would you be able to easily overcome any problems they caused if any?
As with some other antiforensic techniques/tools, these are point weapons meant to target very specific aspects of forensic analysis.
Both of these tools can be relatively easily overcome, if a thorough analysis process is employed.
Antiforensics techniques don't attack forensic analysis tools…they attack forensic analysts.
HTH,
H