Information Exchange

azrael · 2007-07-11T14:20:03Z

I have had a PM discussion with keydet89 with regard to his thread on Issues/Projects. I've clarified what I understood from the posting, which is that keydet89 is proposing a knowledge base of forensic techniques and experimentation to try to prevent needless repetition of work across the board, and also to allow for independent verification of techniques.I suggested the creation of a separate entity for the storage and indexing of such data, but I concur with keydet89 that we should try to avoid creating a plethora of sites, and that the forensicwiki would be a reasonable place to deposit such information ( … by the way, to get a login, the link is on the bottom of the right hand side … you need to scroll down for it … )The continuing issue, as both of us see it, is actually getting people to submit information. My suggestion is, in order to make the process as painless as possible, that we provide a template with the key data points to fill, obviating the need for free form creativity from submitters )Thus I produced the following as a starting point for discussion, fields are in bold, comments are italic and example data is normal font …—– Submitter Name or Pseudonym, credit where credit is due ) N.B. See comment (1) below … AzraelDate Just for reference really … 11/07/07Operating System ( major version / minor version) Windows XP, SP2 or MacOS X 10.4.2 for example.Specific Software IE 7 or I suggest blank for OS related.Description of Forensic Artifact Insert relevant data here, perhaps it is possible to create a few tick boxes for this item such as … [ ] Metadata [ ] User Preferences [ ] Cached Data [ ] Entered Strings[ ] Recent Files [ ] Passwords [ ] Connection Settings [ ] Other ( please detail below )obviously these need refining … P Perceived or obtained value of evidence I suggest that the value of the evidence should be mentioned and/or what can be inferred from it e.g. suggests knowledge of x or indicates use of yExamination Tool ( major version / minor version ) WinHex 14.2Verification Tool ( major version / minor version ) FTK 1.71 if any …Method to obtain evidence (Lead Tool) This is the bit where some creativity is expected on the part of the person filling the form, however, a step by step should be adequate as other information is already filled out In WinHex select the data, click on … etc. etc.Method to obtain evidence (Secondary Tool) As above, but for verification, if it exists.Experimental Verification I would suggest here a quick check of the test environment so [ ] Same OS Version [ ] Same Software Version [ ] Same HardwarePlease list any significant differences ___________________________Experimental Methodology Again, we are at the mercy of the person filling out the form, but I would suggest that a few model examples carefully created and uploaded would be easy to follow.Experimental Results ( Please note any Failures ) Highlighting the exceptions found is probably more valuable than the normal proof. For the obvious reasons …References Links to technical documents to support findings e.g. http//developer.apple.com/technotes/tn/tn1150.html - Apple TechNote on HFS+———I think that there are perhaps one or two other fields that need to be added at a later stage (1) A reference number - this is good for searching and referencing in future - could be as simple as an incremental count or as complex as being created from the OS Version/Date (WinXP-10-07-07.1) or whatever criteria are agreed by the general population …(2) A field for listing reviewers/verifiers of the data, so that peer review is an added value to the information(3) Fields for additional comments/data/evidence/methods to be added/addressed at such time as is necessary.I think that the key will be in providing sufficient examples and guidance on filling out the more complex open format, ambiguous fields. There is guidance on filling out bug reports available on the web that might well be adapted to our needs, we can write our own, and providing a few, peer/forum reviewed examples of simple tasks should not be a problem.I'd be very interested in feedback on this, as you can probably tell from other posts, I'm a bit of a fanboy for standards, and open ones at that. My background in InfoSec has shown me that they are generally valuable if done right, and part of doing them right is getting the input from the people that they are being designed for, who wants to fill out data that is perceived as irrelevant and not useful ?Incidentally, I see this as the perfect compliment to an Open Methodology, as it would fill in the technical gaps that are not covered by a general purpose methodology.Kind Regards,AzraelNearly forgot ! Comment (1) It has been brought to my attention that people are nervous about contributing information as there may be a fear that some over zealous defence council will get hold of it and use it a...

Page 3 / 3 Prev

General (Technical, Procedural, Software, Hardware etc.)

Last Post by ddow 18 years ago

22 Posts

6 Users

0 Reactions

1,688 Views

RSS

Ivalen

(@ivalen)

Eminent Member

Joined: 18 years ago

Posts: 30

18/07/2007 6:44 pm

How do you sign up for this wiki?

Yeah, sorry should have been clearer. I can't figure out how to signup on the website itself javascriptemoticon('post', 'message', 'oops')
Embarassed

When I click login/create an account, I can't find the create bit. I put a username in the field with no password, and just get an error also.

ReplyQuote

ddow

(@ddow)

Reputable Member

Joined: 21 years ago

Posts: 278

19/07/2007 4:13 am

Send an email to access@forensicwiki.com. It'll help if you use a subject similar to wiki access request. I'd suggest you give a little info about your self so they have some info for vetting.

ReplyQuote

Page 3 / 3 Prev

RE: Android Forensics

Hi, Try decompressing the file using zlib in python. ...

By Dexter4n6 , 15 hours ago
Interview: Neal Ysart, Co-Founder, The Coalition of Cyber Investigators

Neal Ysart shares how The Coalition of Cyber Investigat...

By Zoe , 21 hours ago
Android Forensics

I have conducted a logical and partial extraction of a ...

By SgtAndroid , 4 days ago

8 Forums
15.7 K Topics
92.3 K Posts
266 Online
41.1 K Members

Forum Icons: Forum contains no unread posts Forum contains unread posts

Topic Icons: Not Replied Replied Active Hot Sticky Unapproved Solved Private Closed