MD5 Limited Announces the Launch of VFC Version 6

MD5 are excited to announce the launching of  VFC version 6, and as an ongoing commitment to our loyal customer base and the hardship caused by the ongoing pandemic VFC Version 6 is at no extra cost.

In this release the product has undergone major surgery that once again puts our product ahead of the competition:

  • VFC has now added support for Unicode path names to better support non-English deployments.
  • VFC has been reworked to take advantage of the Windows operating system’s multilingual capabilities. It will include Chinese, Japanese, Spanish, German, French, Italian, and Dutch.
  • Windows 11 virtualisation capabilities.
  • ​Works on Windows 11.

For Further information contact the sales team on +44 1924 220999 or sales@md5.uk.com

Amazing Opportunity – USA And Canada Channel Partners – Work With UK Leading Digital Forensics Company

Channel Partners Required  – USA & Canada

Law Enforcement Digital Forensics

MD5’s VFC virtualisation software is already assisting digital forensic Investigations in 98% of the Police Forces in the UK.

We are seeking North America Channel Partners for the exciting opportunity to sell and distribute VFC to over 17,500 Police and other Law Enforcement agencies in the USA and Canada.

 

“The product is one of our main tools – a picture paints a thousand words as they say – very powerful in court…” Mark Boast, Forensic Analyst, Suffolk Constabulary, UK

If you are already established in this sector, and are excited to add another successful product to your portfolio, contact tom.cross@md5.uk.com or Geoff@md5.uk.com

Amazing Opportunity – USA And Canada Channel Partners – Work With UK Leading Digital Forensics Company

Channel Partners Required  – USA & Canada

Law Enforcement Digital Forensics

MD5’s VFC virtualisation software is already assisting digital forensic Investigations in 98% of the Police Forces in the UK.

We are seeking North America Channel Partners for the exciting opportunity to sell and distribute VFC to over 17,500 Police and other Law Enforcement agencies in the USA and Canada.

 

“The product is one of our main tools – a picture paints a thousand words as they say – very powerful in court…” Mark Boast, Forensic Analyst, Suffolk Constabulary, UK

If you are already established in this sector, and are excited to add another successful product to your portfolio, contact tom.cross@md5.uk.com or Geoff@md5.uk.com

Virtual Forensic Computing (VFC) From MD5

In the pantheon of computer forensic analysis, practitioners are often faced with many problems that require innovative solutions. Every case or incident presents us with new challenges, new approaches, new work-arounds and new exploits. For many years, the practice of utilizing virtual computing machines in forensic analysis has been an accepted practice to help re-create and document the user environment as the suspect or target of an investigation would have used it. As many in the field will no doubt agree, the tools for effectively creating, using and documenting a virtual computer machine from a forensic image file have met with varied success. Due to the *virtual* instability in the forensic computing market, UK-based MD5 has developed a robust and user-friendly tool: Virtual Forensic Computing (VFC) by MD5.

System Requirements

As with any tool, VFC comes with specific system requirements that are recommended as a minimum. So, what do you need to run VFC on your system? The system requirements are listed below, but as we’ll detail later in this review, the flexibility of your system will also help a great deal in how effective your use of VFC will be.

These system requirements were taken directly from the VFC quick-start guide. Please note that use of VFC requires installation and licensing for VMWare on your system as well as highlighted above.

For our testing of VFC by MD5, we utilized two raw (DD) images – one Windows XP system and one Windows 10 system.

Step 1: Image Mounting

In order to use most (or all) virtual systems, you will first need to locate and mount the image(s) you wish to analyze. VFC comes equipped with a disk or image mounting utility called VFC Mount that makes this process easy. Simply find the disk attached to your forensic analysis system that contains the image(s) you’d like to mount and tell VFC Mount which image it is. VFC does the rest for you, quickly and automatically, including detection of the operating system of your write-blocked image.

Naturally, once the image is mounted, you’ll also be presented with the disk in Windows Explorer, which you can browse on your local machine as the case parameters dictate.

Starting Up Your Virtual Forensic Machine

After mounting your image, one of the nice initial features in VFC is the immediate display of your virtual system’s properties, mainly derived from the Windows registry. This quick snapshot of your system is really useful, not only for general knowledge, but for also for basic documentation. Here are our Windows 10 test system properties as presented in VFC:

Note that the user accounts and their password status are included in this quick snapshot, but this should always be validated. VFC also allows you to set the virtual machine date and time, which is a nice feature when documenting your analysis and making screen captures of your findings.

At this point, to start up our virtual machine, we simply tell VFC to launch and it fires up simply and effectively.

Generic Password Reset

Most users secure their systems with a password. As such, VFC comes with a built-in password bypass utility that is user friendly, fast and (amazingly) actually works! When the virtual machine starts up, we are presented with a command line-like window asking if we’d like to use this utility or simply minimize the window. Naturally, if the account is not password-protected, we have no need for this. But in our Windows 10 test, even though the system properties reported our main user account as not being password protected, upon startup of the VM, it was. Fortunately, we have a tool within VFC to deal with this issue. 

The Generic Password Reset Tool menu requires us to tell VFC which user account password we’d like to reset, then choose what password we’d like to use. If we have forgotten or didn’t note the list of user accounts, we can get a listing of that prior to selection as well. 

When we selected option 2, we referred to our list of users. The only unique user was “srg”, so we told VFC that was the account password we wanted to reset and entered “1234” as the new account password when prompted. Then… voilà!

As soon as that was completed, we were able to log into the password-protected account using our new password with ease. This entire process was intuitive, easy-to-use and fast!

VFC User Options And Experience

As stated earlier, VFC requires use of VMWare to function, so many of the user options that are available to us are associated with VMWare, not VFC. These include native screen captures; the ability to disregard or include external devices; and network settings. However, VFC offers some case-specific customization for use as well. One of these areas is the settings on our virtual machine. VFC allows us the ability to customize options such as processor and RAM use, as well as other areas to help optimize the use of our new virtual computer during analysis.

Other customizable options include the ability to auto-detect the operating system of your image, screen resolution for your VM, and default RAM usage. If you use VFC regularly in your analysis, you can also save these settings and configurations so you can use them across the board in all forensic analysis using VFC.

All of these options are built into VFC to ensure you can run your VM in the most optimal fashion possible for your particular case. With the inclusion of experimental features, we can conclude that the application development team for VFC at MD5 is hard at work adding additional functionality to the tool as well.

When you’re finished, shutting down VFC is as easy as shutting off your computer. The files associated with your virtual machine are saved in case you need to access them later and your image is un-mounted. 

Conclusion

As digital forensic examiners, we’re always searching for the next best way to get the analysis done faster and more effectively. Much of the time, the concentration in our industry in this particular arena is focused on mobile devices. But Virtual Forensic Computing by MD5 has taken what has previously been a computer forensic practice that was met with moderate difficulty by some and made it simple to use, robust in functionality and effective in analysis. If your current virtual machine setup has you fiddling with coding and command line prompts that are cumbersome or don’t allow you the ability to customize your machine for maximum effectiveness, try out VFC by MD5. You may find it the solution to a problem you didn’t know you had! 

Tom Cross, VFC Sales Manager, MD5

Tom, you’re VFC Sales Manager at MD5. Tell us about your role: what does a day in your life look like?

A day in my life as VFC sales manager in a nutshell consists of me developing new and existing customer relationships, and promoting and pushing VFC as far as I possibly can. I spend a lot of my time researching potential customers. I feel that is very important to know who you will be dealing with. At the end of the day I am not only selling a product, I am also providing a service to our customers. This to me is the different between making sales and making customers. 

Not every day is the same and I absolutely love it. Some days I will be preparing for demonstrations and webinars. Some days I will be researching new markets. Other days I will be sorting through my emails and compiling quotations, along with other administrative type tasks. I am still new to this. I have only been in the field and job since February 2020 – and most of this has been interrupted by the pandemic! Hopefully, when all this is over, I can start going out on the road, visiting new and existing customers to showcase VFC in all of its glory! 

Can you tell us about your background? Why did you decide to work in this field?

In answer to the first part of the question – I have quite a varied background! The roles I have occupied have been sales oriented, but the industries have been very different.

Once completing university with a degree in business management, I just wanted to start working. When I did finish I managed to find work pretty much straight away, working for a small, family run business in the motorhome, towing, and trailer accessory industry. As it was a small business, I pretty much did bits of everything. I dealt with 99% of customer enquiries – from quotations (for standard and bespoke enquiries) to full demos of the products that we offered. 

I then managed to find myself in a quotation advisor role for an organisation in the data and power management industry. I think the job title pretty much tells you what I did there. I then left this role to become a sales and service coordinator for an industrial and waste water pump company. And finally, here I am today, VFC sales manager of MD5, in the digital forensic world. 

I will be honest; the position caught my eye first. Don’t ask me why, but I have always wanted to work in sales. Once I heard of the position, I looked into the industry and was instantly excited. I love learning. I love finding out new things. I have never done anything remotely like this before and I couldn’t wait to get stuck in. Of course, with my background, I was taking a huge leap of faith having no knowledge of what you are going into – but that’s the most exciting part! 

Please talk us through VFC and some of its main features; what’s exciting to your customers about it?

How long have you got? I will try to keep this brief! 

  • VFC’s ability to create the VM in literally minutes. 
  • Password reset and bypass tools. 
  • The ‘experience’ VFC has gained over the years. 
  • Conversion of live accounts to local accounts. 
  • The ease of access.
  • Restore point. 
  • Versatility.
  • Caters for pretty much every operating system. 
  • Ability to create a standalone copy. 

I could go on and on and on.  It is easy to list the features. What is exciting is the benefits that VFC offers. 

What advantages do users realize when they can create a virtual machine of a target system? What about this capability gives VFC an edge over other forensic tools?

The advantages are what excite our customers. The speed, the understandability, the versatility, the no nonsense, the experience. The time saved itself makes VFC an incredibly powerful tool. Human error is avoided, the evidence gathered using VFC is black and white. As previously discussed, I have walked into the industry with 0 experience and I can use VFC with ease. Literally anyone can use it. You can access proprietary software just as the suspect would have been able to. I could go on and on. You know the saying ‘save the best ‘til last‘ – VFC enables the Investigator to see the digital data through your suspect’s eyes. 

VFC is in no way designed to replace existing tools already in the field. There are tools out there that are fantastic at what they do – VFC is 100% included in this. It’s different – it is designed to work alongside these other tools. At the end of the day, the whole point in an investigation is to find, collect and present evidence in the best possible format. VFC is the perfect tool to help maximise the credibility of the report. A picture paints 1000 words! 

What are some of the biggest challenges your customers are reflecting that face digital forensic investigators today, and how does VFC help to address these?

Being able to save time obviously helps the investigator. The time saved using VFC can be used elsewhere. Being new to the industry and learning about all the tools, VFC is one of the best out there, and I am not just saying that. I’d more than happily prove that with a demo! Keeping a Judge and jurors engaged can be difficult. Being presented with something they have no background knowledge on can be confusing. VFC bridges the gap. Everyone knows what a computer screen looks like. 

Is there a typical VFC user — or any you’d like to see become typical, regularly solving problems by using VFC?

The typical user is obviously law enforcement. This speaks for itself. Once people know about VFC and its capabilities, they will realise they can use it for much more than what they already do. I want to be able to push VFC into the financial investigator/ forensic accountancy world. Discussed in the previous question, VFC bridges that gap and any can use it.

I also want to get it into universities. The majority of our customers in the UK are law enforcement and they do use VFC regularly.  I think it is only logical that students are exposed to this during their course. 

Finally, when you’re not working, what do you enjoy doing in your spare time?

At the moment, I don’t do a great deal haha! #pandemicproblems. However, I am a very passionate football (soccer) supporter. Outside of work, it governs my life haha! Aside from that, I play a few instruments – mainly piano and guitar. I have no shame in saying this – I also love Pokémon and have for the last 20+ years. I also seem to get tattooed quite a lot, before the pandemic, I was in the studio at least once a month haha!

Virtual Forensic Computing (VFC)

Host: All right. Hello everyone. Welcome. Welcome to our first webinar, I believe, we’ve had with VFC. It’s a Teel Technologies VFC project. Just to be able to bring people to be aware of Virtual Forensic Computing and how it is able to assist you with your investigations and being able to recreate the environment of the suspect’s computer on your own desktop in that way.

So here we have Tom, who’s going to be telling you guys more about it, and I’d like to welcome him to unmute himself and begin speaking.

Tom: Hello everyone. I hope everyone can hear me, and I hope everyone’s doing well. Yeah. Just to briefly introduce myself, I’m Tom and I work for a company called MD5 here in the UK. I’m still relatively new to the industry. I only started in February. But I’m hopefully going to get across some of the benefits of Virtual Forensic Computing, which is VFC, the software that we offer here, and just how it can help and benefit you in supporting a successful investigation.

I don’t know if there’ll be time for questions at the end or anything like that, but I have got my contact details at the end of the presentation. So if you do have any questions, just drop me an email or give me a call, I’m happy to help. So we will crack on with the presentation now.

So firstly, just a quick introduction. The main tagline of VFC, for me and for everyone, is that VFC enables the investigator to see the digital data through the suspect’s eyes. And basically you can see what they see. You can see what they saw at the time. On the right hand side, you can see some of the customers that we’ve we’ve got already not just in the UK. We are in Europe, we are already in the US, and we are in Canada, Australia and some quite big names there as well. You can see the FBI, Interpol, and the Canadian police as well. And on the left-hand side, you’ve got the sectors as well. So we do law enforcement, we do government and we do the corporate side of things as well.

So onto the next slide. So VFC produces a forensically sound replicate of the target’s computer in a matter of seconds. So there are two ways to be able to virtualize that virtual machine. So one way is that we would need the hard drive. We do know that we can’t switch a laptop or a computer back on, but what we can do is we can remove that hard drive. So once that hard drive is removed, we can then connect it to a write blocker. And then what VFC will do is, it will create that virtual machine using the data from a variety of sources on the hard drive, and then we would use VMware to emulate that.

Another way to create a forensic image is to use in a standard forensic imaging tool. And once that image has been created, we would use a mounting tool to mount it into VFC. Since version five, VFC Mount has been built into the software, so we have our own mounting tool. And since the release of VFC 5.2, we also have a mounting tool available as a standalone bit of software. So you won’t need VFC to use that. So if you want to go check our website out, which is at the end of the presentation, you can download that mounting tool for free, and you can use that without any license or anything like that.

Once the virtual machine is created, using VFC you can create a standalone copy of a virtual machine. This can then be used without VFC, as long as the computer has VMware. And this essentially gives you a portable copy of that suspect’s computer. So you can have a play around with it, if there isn’t a better term for it, to have a look in all the files, to have a look at all the settings, et cetera, without any consequences to that original forensic image.

VFC doesn’t do anything you can’t do yourself manually. However, what VFC does do is, it saves you a lot of time, and it does present that evidence in the easiest format and the easiest way possible. VFC does all the hot fixes in the background. I like to say that VFC has a lot of experience in building the virtual machines and overcoming problems, such as the blue screen of death or driver errors, and all this is done with the click of a button. So it saves you a lot of time as well.

Anyone can use VFC. I like to use myself as an example, like I said at the beginning, I haven’t even been in the industry for a year yet. But all you need is basic computer skills to use VFC. Everybody knows what a computer looks like, if you’re in this industry at whatever level, you’ve worked with a computer before. And if you’ve got those skills, you’ll be able to use VFC.

It’s also important to point out that VFC is also ACPO compliant. And it does adhere to the ACPO principle one as well. So it is up to standard. And I’ll be touching on this later as well, that it does only take minutes from start to finish once you received that hard drive. So then having a play around with that suspect’s environment, you’re looking at minutes instead of hours, potentially days.

So on to the next slide. So you, as in a virtual machine, can help explain the technical evidence. This is where I think VFC is absolutely fantastic. So you can put the screenshots and screen capture videos into reports, into your technical evidence. What VFC does do is that it helps maximize the credibility and the impact of that evidence by demonstrating and illustrateng the confusing narrative that can be present in court.

Basically, in court a technical report can confuse the judge and jury with the jargon included in that report. If pictures are embedded in the report, then this will help illustrate and explain in a more general sense. 99.99% of the time on the jury, you’re not going to get people that are clued up on the industry in terms of phrases used, in terms of the jargon used. And you might get people that are going to get bored and not take anything on board.

Text reports are subject to interpretation as well. Not just from the jury and judge, but from the analyst creating the report. So the point of the judge and the jury reading the report are screenshots of the actual desktop is black and white. There’s no interpretation and it’s right there in front of you. And as the saying goes, everyone knows the saying, a picture paints a thousand words. Anyone who’s seen a computer screen before understands and can identify a desktop.

VFC is also useful in identifying a timeline of events. And you can see clearly when a computer was last booted up, to things such as when files were last edited.

So all this brings us to saving time. So like I previously touched on, embedded screenshots into the report will help reinforce the credibility. Also it helps saving time on writing up a report as well, because you have actually got that evidence in data format. You can actually use VFC live in court to play screen capture videos as well, to help explain unfamiliar concepts. There have been cases in the past where this has actually been done. So I’m not just saying that as if, like, you could try this; it has actually been done so you can definitely do it.

You can also show a suspect their own computer, especially in interviews. Everyone knows that you’ll get difficult suspects that might not want to provide any information and might deny everything, but if something there is black and white in front of them, that is their own, it’s very difficult to do that.

Also, I’ll touch on this a bit later as well, but you can remove and bypass the passwords with the in-built password tools that we’ve got in VFC. Again, this leads back to, if you have a difficult suspect unwilling to give correct passwords, VFC will be able to get around that, again with just a click of a button. And we all know that time equals money. And so where you are saving that time, saving those hours, saving those days, creating minutes instead, you are saving money in the timeline as well.

So onto the next slide: gathering the evidence. There’s loads of different ways you can gather evidence. Before I go into it as well, I can imagine that you’re all thinking of different ways that you can search a computer, or search a desktop, of all the different places you can see that evidence.

So you can check the jump lists to see what has recently been added and accessed. You can see all the file properties, you can see where the files were created when they were last modified, if they were modified, and when they were last accessed. Again, this can be done manually with different types of software. There’s no getting away from that, but VFC lets you view this in the easiest way possible, without any interpretation, without missing anything, which is what everyone wants, at the end of the day. People want to be able to do things in the best, easiest way possible without any interpretation getting in the way.

You can also check things such as the wallpaper, I know this may seem a bit silly. But there have been cases in the past where there has been indecent images as the actual screensaver of the suspect’s computer, which obviously again, that is obtainable using different software, but it is so easily obtainable and presented using VFC. Again, there’s no way you can get around that is black and white. You can see it at face value. You can see it for what it is.

You have peer to peer software. You can have a search on that, to see if anything’s mid download, mid upload, or if anyone’s sharing any sensitive data. You can also go into the settings in the software and see if they’ve been changed. Obviously if they have been changed, this would show intent, which can go towards providing the evidence in court.

Again, cleaning software, someone may track to cover their tracks. Again, this would show intent. You can have a look at all the settings. You can have a look at when it was last set to clean the computer, the hard drive. Again, that would obviously go towards the evidence that you present.

You’ve got hidden files. Someone may have created those hidden files. Again, this can be easily obtainable using VFC. I’ve already said it, you can do it using other bits of software, but VFC puts it in such a simple format to gain that information from, and you can actually see what the suspect will have done for themselves in the way that they would have done it.

Again, these settings show intent. So whether there’s something in there or not at the time you are searching for it, if those settings have been changed, quite clearly, something has gone on in the past, whether that is legal, illegal, or something of that nature.

We have antivirus software. This can be checked to see if any recent scans were done, to see if anything’s in quarantine. You may get someone saying that “I didn’t put this image on this computer. Someone else put this image on this computer, that virus put this on the computer.” We can see if a recent scan has been done, actually no, no malware or any viruses on your computer. So you’re shooting them down straight away, and basically verifying what they’re saying is incorrect.

Onto the next slide, again, this is gathering evidence.

Host: Tom, Can I interrupt you really quickly? We just have two questions and I wonder if you can address them.

Tom: I can certainly try my best.

Host: One is: Can VFC remove or discover a BitLocker password?

Tom: There is a way we can get bit round BitLocker passwords. I’m not 100% sure personally how it’s done, but if those people want to take my details at the end, I will get back to them and give them a bit more information on it.

Host: Yeah, I can take their name too, so we can get an answer to them later on.

Tom: Perfect. It’s definitely achievable. It definitely can be done. How it’s done, I don’t know personally, but I will definitely get that information and feed that back to them.

Host: And then, second question, can VFC virtualize a Linux machine?

Tom: It can indeed. The reason… as far as I’m aware, it can do pretty much everything. So you’ve got Linux, Solaris, Windows, it can do pretty much all. I do know if it can’t, we fix it pretty much straight away, so it can. So again, we are constantly developing VFC. It’s not just something that we’ve created and left alone, it’s something that we are constantly developing, constantly trying to improve to meet everyone’s needs. So, yeah. Linux, as far as I’m aware, we’ve never had a problem with that. It does build that virtual machine and have no issues.

Host: Okay, cool. Sorry for interrupting.

Tom: No, it’s all right. No problem.

So yeah, onto the next side. So using existing software on the machine. Again, I’ve mentioned that this is just another way of gathering that evidence in a more corporate sort of environment rather than maybe a law enforcement environment, and this may be more applicable to that side of things.

So this applies to any sort of software that requires a license. With VFC, the software can be used as long as it had an active license when the machine was last used. So an example is accounting software, for example, Sage and Quickbooks. Should the computer be seized within an active license, VFC will create the virtual machine from the point it was last started. This is where VFC comes into its own. Some cases may be 12 months old and beyond before the hard drive can be examined with VFC. The virtual machine is booted up at the point of the computer and laptop was last used. So that won’t be an issue.

In order to aid within the investigation, VFC also allows you to set the virtual machine to a specific time and date as well, to keep you within that license. So there’s no panic or anything like that, of that license running out. You can use it. Again, you can use that version of the software rather than having to download the latest version and it not transfer over properly. You’re using the specific software that the target’s computer used. So again, to that tagline, you’re viewing it as what that suspect would have viewed it, how that suspect would have used it, sorry.

VFC is also useful when it comes to proprietary databases and software. VFC can utilize a software and databases that are created and are developed in house. For example, a company I used to work for before this one had a specific bit of software for the service that they offered, which there’s none like it anywhere else. Now, using other software to try and use that would be near impossible. With VFC, using the software that they created in-house, you are viewing it as they would have last viewed it and played around with it as they would have been able to. So you don’t need that software installed on your machine because it’s built into that virtual machine.

A feature as well as of VFC is that you can drag and drop any file from the virtual machine. So for example, if you want to export any databases from Sage or QuickBooks into an Excel format, you can simply just drag that from the virtual machine onto your own desktop. And then you can use that in evidence or pass that on to a solicitor or something like that, for them to have a look at, which obviously then counts towards reports and investigations.

As well, I’ve touched on this, a suspect could say that malware has altered the hard drive, malware put the files on there for them. You can actually use VFC to clean install malware and use that virtual machine as a sandbox environment. So you can install that malware onto it, see what it does, without impacting the host machine or the original hard drive. And so you can get down to the nitty gritty to see if the suspect is telling the truth, at the end of the day. You can also see website history, bookmarks, favorites, what’s been last accessed, just to add to that investigation as well.

So onto the next slide, restore point forensics. So you can rewrite rewind the virtual machine using restore point. The best way I can describe restore point, which quite a lot of people listening will already know, is that it’s like a checkpoint in a game. For example, if you have cleaning software installed and you suspect this may have deleted crucial evidence, then you can use restore point forensics to restart a virtual machine to a risk previous point before the software was downloaded. However, this is dependent on the settings. Again, if the settings have been changed, this would obviously show intent, which goes towards the report and the investigation.

There is a case that that MD5 actually conducted and had a hand in before I started, around terrorism. There was a case where a hard drive was checked and it seemed clear, but MD5 did use VFC to boot up the virtual machine to a previous restore point, and this showed applications and links to known terrorist sites, which obviously again, is put in an easy format for you to be able to gather that evidence and present that evidence in court.

And onto the next slide. So in-built password bypass tools and password reset exploits give rapid access to the user’s desktop. So there are two password tools built into VFC. So we have the generic password reset tool and the password bypass tool. So what GPR is, which is the generic password reset tool, what that does is it permanently removes a password from multiple accounts. It also converts Live ID accounts to local accounts, and then it also can activate admin accounts as well. So it gives you access to those admin capabilities, et cetera.

The password bypass tool can remove the password for one session using an exploit to make Windows believe it has the password. So they are similar in what they let you achieve, but there’s two different ways of doing it. You can remove that password, or you can just bypass that password. A new feature of VFC 5.2, which has only been out just short of a couple of months, I believe, and it means that you can also select an option to convert Live ID accounts to local accounts and to reset all the passwords while the virtual machine is being built.

Again, VFC saves you time in the first place. We’ve managed to develop VFC where it saves you even more time. So it gets rid of those passwords without you having to do anything. Again, this is an automatic, you have to take a couple of boxes, but it is as simple as that. Yeah, it’s just such a big time save. And this is what VFC is all about.

So just to summarize, before I go into a couple of case studies where VFC has been used and come into its own. So benefits of having VFC: you’ve got triage, you can quickly see if a hard drive is required or not. This can be done in the field as well. There’s no disguising the fact that there are triage tools out there that are specific for this task, but VFC gives you enough information to see whether you need a hard drive or not to take it back, to see if it’s worth taking, which I’m more than happy to provide a demo to people afterwards, if they want to get in touch with me, we can start a demo out so I can show you how that can be done.

Avoiding errors. Like I said near the beginning of the presentation, VFC has a lot of experience in overcoming errors in building a virtual machine. VFC knows what it’s doing. Human error is removed from the process. And then obviously that leads to maximizing that credibility of that that evidence as well, which is obviously the next item.

Screens are black and white. You know what you’re looking at. You know what a screen looks like. You can see the screenshots in the report. You can see videos.

Again, this is the first I’ve touched on that, but versatility and capability. VFC is designed to work alongside other forensic software. It’s not designed to replace. I’m not here to try and pull wool over anyone’s eyes. Other software out there is fantastic, but putting VFC alongside that obviously goes towards maximizing that impact and credibility of the evidence. And at the end of the day, that is why we are in this industry. We are here to put our point across, to make sure what we are present in is 100% fortified.

Again, a safety net. I haven’t touched on this, but I’ll quickly touch on this now. VFC creates a log of everything you do, and this can assist with the contemporaneous notes. Again, it also lets you create a standalone virtual machine that can be used to have a play around with, to explore that virtual machine without risk of harming the original VM as well. Which you can create multiple copies of that. So you, again, if you want to put two different types of virus on there, you can put that into there and see what both do without impacting that virtual original virtual machine or hard drive.

And the big one, which I’ve mentioned a few times, is time and money. We’ve talked about saving hours, days, throughout the timeline. Those hours and days that you spend doing it, VFC will be able to do it within minutes. We all know, again, that if you save time, you will save the money.

I’m quite passionate about this tool. I know I’ve got to be because I’m the one that oversees it. But when I say it is a must have tool, I really believe that. And like I say, I’m more than happy to give you that demo of how it all works and everything like that for you to see it firsthand, rather than me just try and force it upon you. I’d rather you see it for what it does so it can sell itself.

And then that’s pretty much the end of it. So I will go into a couple of case studies really quickly now. And it just gives you an example of a few things I’ve touched on and the benefits that I’ve touched on.

So this first case study is surrounded by QuickBooks. This is an example of how proprietary software is used in the real world. And this shows that VFC is art is always being developed. So bullet point 4, you can see there that when we launched each VM and bypassed the password, using the bypass tool feature with VFC, we were unable to bypass one of the machines. So we quickly fed that back to our software developer, and that was pretty much rectified straight away. So that problem will never be encountered again.

Again, exporting files and copying them from the virtual machine on your own desktop, onto your own data storage device. And that can be seen in the last paragraph when they then contacted the client and asked what information was going to be of relevance to their case, we generated custom reports within the virtual machine, and then we were able to, to feed them back to the client.

More details on this case study is available on our website; again, if you can’t navigate that, which I’d like to think people will be able to do, if you just want to drop me an email, I’m more than happy to go into more detail into it.

And then there’s this final case study, which is an extreme example, but I think it’s such a perfect example and I hope everyone else can see that as well, of where this can be used elsewhere. There was a case study done in Oklahoma City, and it was a cold case. It went pretty much dead. You can read it for yourself. No body was ever found, all evidence was entirely circumstantial. Based on evidence taken from the computer, cell phone, friend’s statement.

VFC was introduced within this investigation and it was quite obvious what happened here. They convinced the DA in this case to allow them to actually bring a laptop and project it into the court and let them build on the suspect’s computer, using VFC and VMware, and it made all the difference. The jurors were able to get past that technical report, get past the jargon, and see it for what it was. So booting up an image of the hard drive, you could see what it was. You can see highlighted that we were able to see how the icons were organized on the desktop. All of the internet history was clear, internet chat programs, emails; so easy for everyone to just digest that information.

As you can see from the non highlighted parts, you could see text files that taught them how to dismember bodies; roast full size pig carcasses; which obviously are all led to this case being solved in the end. And just a quick quote from our customer at the time: “Never before has Oklahoma County being able to successfully prosecute a no body case, and VFC was actually the software that drove this home.”

Again, I don’t want to force VFC upon you without showing you how it works. So please get in touch with me. I’m more than happy to get a demo. I’m happy to work around you. You just tell me when you want a demo and I’m happy to give you it.

And that’s it from me. So if you guys have got any questions, fire away, if not, thank you for listening.

Host: Yeah. We have a couple of questions and people seem to be writing them into the chat. I don’t know if you can figure out how to get there. It’s on the bottom bar.

Tom: Let me have a look…

Host: Or I can tell you them right now.

Tom: You may have to read them out to me. Yeah. Technology!

Host: One is, can I import a VDI into VFC?

Tom: I’m not 100% sure to be honest. I’d love to be able to answer that. I will have to ask our technical team on that one. Again, if you just want to drop me a quick email with that question. I’ll go back to our department and get all the information that I can.

Host: Yeah. Tom, why don’t we just send a follow-up email?

Tom: That’s perfect. Yeah, that’s perfect. That sounds great for me.

Host: Cool. Just going to make a note of that. And then the next question is: when using the password bypass or resetting option, are all files accessible without ownership restrictions?

Tom: Yeah. So you’ve got those admin rights that you can access. So you will be able to essentially view, like I say, view it as they would’ve been able to view it, so you can change the settings and everything like that. So there’s no restrictions in there. You can view essentially what you want.

Host: Okay. And there’s no more questions. I’m just going to leave it open for another minute, just in case. Yeah. But cool. Yeah. I really appreciate it, Tom. Yeah.

Tom: Again, like I say, I am passionate about VFC. I’m not just saying that because I’m the salesman for VFC, I’ve done so much research into it before I even started. I use it every day, even though I’m not a technical member of the team, I do use it every day to try and find new ways of how it can be used. Like I say, I know I only touched on it a little bit, it’s such a versatile tool. It’s just being able to experience it for yourselves which hopefully I’ve touched on today.

Host: Cool. And that shows. We’ve got one other question that came in. Would password bypass work with application protected apps?

Tom: No, I don’t think it does. I don’t think it can go that far into the system to get rid of those. So it’s the Windows Live ID that it can do, but apart from that, I don’t think it can access anything else, unfortunately.

Host: One question that the person is asking, when can we expect follow-up on the initial first two questions?

Tom: Go on, sorry.

Host: Can we just promise them sometime tomorrow?

Tom: Obviously there’s a bit of a time difference. So you should receive an email from me before you guys wake up. I don’t know what the time is here. It’s currently half past five in the afternoon here, so yeah. I’ll look at those questions straight away and feed back to you in our a.m. So you should receive them as soon as you arrive at your emails in the morning.

Tom: Perfect. And then more questions. So, hang on, folks, you’re welcome to stay everyone, or you can leave, do whatever you’ve got to do. But one is, will VFC work on cell phones?

Tom: No, it doesn’t work on cell phones, unfortunately. I don’t see why we can’t look into it in future. If there’s a demand there, then obviously we can look into it, but there’s nothing in the pipeline at the moment for that sort of thing. It’s strictly just laptops, computers, et cetera, at the moment. But I will feed that back to our software development team. Obviously, like I say, if there is a requirement for it, we’ll certainly look into it.

Host: Okay. And then here’s another one asking if it will–

Tom: Apologies. Apologies. Just to go back on that. I just had a quick thought: if the phone has actually been backed up on the computer, those files are accessible. And again, like I keep saying, you are viewing it as how they would have viewed it. So yeah, if the phone has been backed up on there, you can view the files that way. If it hasn’t, there isn’t something in place for that at the moment. But again, if you really think there is a market for that, then we’re looking to it and see what we can do.

Host: Cool. And then there’s someone asking if it will exploit shadow copies?

Tom: Not at the moment. But we are putting… I think there is something in the pipeline for that. So we are looking into it, and hopefully that won’t be too far away. So keep an eye out.

Host: Okay. And that seems like all the questions. Thank you, Tom.

Tom: No problem. Thank you everyone. I hope everyone couldn’t understand my accent because I know it’s not a typical British accent. So I hope I got all my words up properly for you guys.

Host: I got it clear. My mom is from England, so it’s no problem.

Tom: And if that’s it, I hope you all have a fantastic rest of the day.

Host: Cool. You too. Bye-Bye.

Register For Webinar: How To Recreate A Suspect’s Computer Environment With Virtual Forensic Computing (VFC)

VFC removes the guesswork from virtualization and allows investigators to concentrate on the investigation. Join MD5’s Tom Cross as he shows you how to make a virtual copy of the computer environment of the original user. This puts you “in the room” with the suspect, providing invaluable access to software and data that cannot be easily found with a typical “dead box” examination.

Date: December 9, 2020
Time: 12pm ET
Presenter: Tom Cross

Register here.

VFC 5.2 And VFC Mount

Virtual Forensic Computing (VFC) was first launched to the digital forensic community in 2007. It is the original and still the go to virtualisation solution for the digital forensic investigator.

VFC makes it easy to create a Virtual Machine (VM) replica of a target system. This enables an investigator to recreate and interact with the “digital crime scene” without altering data on the original drive.

Built to follow accepted forensic practices VFC interrogates the target drive to gather relevant system information. From there it very quickly builds the specific VMware framework needed to create a forensically sound replica of the target system (the exhibit) as a VM. This process is automated by the VFC software to avoid Blue Screen of Death (BSOD) and driver errors, saving the user hours of manual diagnosis and repair.

VFC can virtualise Windows, Linux, Solaris, DOS & other OS platforms.

The VFC VM enables the user to navigate around the suspect’s desktop as if they had literally turned on their machine. This can be completed by working from forensic images (using mounting software such as VFC Mount) or can work directly from a write-blocked hard-drive.

VFC MOUNT IS FREE!

The forensic disk image must be “mounted” to make it visible to both VFC and later VMware. Our latest release, VFC 5.2, includes VFC Mount (introduced in VFC 5). However, VFC Mount is now also available as a standalone tool that can be downloaded free from our website. VFC Mount has been designed for use with VFC and optimised to avoid common compatibility problems with VMware. Although VFC Mount is designed to work with VFC, it can also be used as your everyday mounting tool.

Find out more at vfc.uk.com/shopuk/vfcmount.php

BYPASSING PASSWORDS

Generic Password Reset (GPR) was introduced in VFC 5 and this allows the user to change or remove the password completely. A new feature of VFC 5.2 allows you to choose to remove passwords during the VM generation process. This means less steps are required to access the VM.

LIVE → LOCAL

Since VFC 5, users have been able to bypass passwords on live ID accounts. This was accomplished by creating an exploit using the generic password reset tool. This was performed once the VM was virtualised in VMware.

A brand-new feature introduced in VFC 5.2 is the ability to convert live ID accounts to local accounts during the VM generation process. WHY. This conversion takes place at the same time as the password removal. Again, saving you time during the investigation.

MOUNT AND EXPLORE

Mount and explore was a feature added to VFC 5.1. this allows you to mount and view a VM as a file system tree. This allows you to insert files in and copying files out of the VM without booting the VM. This is useful for injecting antivirus software to do an antivirus scan, and other specialist software. This is can also be performed using a command-line interface (CLI) for integration with other systems.

For Further information on both VFC 5.2 or VFC Mount contact Tom Cross at Tom.Cross@md5.uk.com our New VFC Sales Manager, or Telephone on 01924 22099, or visit our website VFC.UK.COM

Walkthrough: VFC From MD5

VFC was first launched to the forensic community in 2007. It makes it easy to create a virtual machine (VM) replica of a target system, enabling an investigator to recreate and interact with the “digital crime scene”. 

Using accepted forensic practices, VFC interrogates the target drive to gather relevant system information, so that it can very quickly build the VMware framework to create a forensically sound replica of the target system (the exhibit) as a Virtual Machine (VM). This process is automated by the VFC software to avoid BSOD and driver errors, saving the user hours of manual diagnosis and repair. 

VFC allows virtualisation of Windows, Linux, Solaris & other OS platforms.

The VFC VM enables the user to navigate around the suspect’s desktop as if they had literally turned on their machine. This can be completed by working from forensic images, using the inbuilt mounting tool VFC Mount™, or can work directly from a write-blocked hard-drive. Due to its simplicity VFC allows forensic and non-forensic practitioners to triage computers in a forensic manner.  

VFC automatically fixes known errors associated with virtualisation, and speeds up the process of manually virtualising devices. This allows exhibits to be quickly triaged, allowing investigators to look at more cases in shorter time-frames, reducing backlogs.

Investigations Using VFC

The VFC VM can be used to quickly identify obvious “accessible” files and folders. Recent file history can be accessed, internet history can be viewed in its native format, P2P/torrent downloads and shares can viewed in the native tools, and “Hidden Files” can be accessed.

A real-life example of VFC being used in this manner included in detail in the Testimonials (see link below) is from Oklahoma City PD:

“Never before has Oklahoma County been able to successfully prosecute a “No Body” case based only on circumstantial evidence – and it was VFC that drove it home to the jury.”

“VFC is a must-have tool for all forensic investigators and offers a different angle of investigation to the standard analysis software.”

VFC will also recover/bypass user locks hindering virtual machines. The software has the ability to reset online-authenticated “LiveID” Windows user passwords, or permanently reset passwords on local Windows accounts. These inbuilt features remove the need for other tools.

VFC can also be used to help an investigator get their bearings in relation to incriminating data. It enables an investigator to visually show a suspect’s desktop, in a format that any audience will understand. This can either be performed live at court, using a portable standalone clone VM, or captured as stills for reporting. This can have a huge benefit in cases that a non-technical person such as a judge, a member of the jury or a solicitor can understand and recognize the data (see testimonials). 

VFC can be used to access bespoke data in their native applications using software already installed on the host system, whether this be P2P/torrent downloads, Sage databases or QuickBooks accounting records, among others (see link to Case Studies at the end of this article).

The VFC-generated VM means that all installed programs that were working at the time of last use are still in license and accessible to investigators (even those with time-bound licenses).

VFC has enabled investigators to access encrypted phones or USB devices where the decryption password is auto-saved on the suspect’s computer/laptop that the device had been connected to. This procedure will also enable the device to be forensically imaged by an investigator.

VFC has been used on investigations to run scripts or install software on the system with no fear of breaking it; you can always “rewind” it back to the initial state. This has proved invaluable for cyber inquiries where investigators have been able to run trojans or viruses, or investigate exploits.

 

A final feature for investigators to consider is the Restore Point Forensics / Patch VM, which allows you to rewind a machine to an earlier state to see Shortcuts that had been saved on the desktop in an earlier version of the machine – such as links to websites of ill-repute or terrorism activity which have since been removed.  It can also help you to ‘fix’ a broken VM by automatically applying the collective knowledge of VFC.

This VFC walkthrough is not exhaustive, but covers what we believe are methods and identifies uses of a virtual machine in a digital enquiry that we hope investigators may not have previously considered or explored and may now benefit from going forward. VFC has become an integral and must-have tool in the digital forensic investigator’s armoury of tools when investigating and fighting digital crimes. 

MD5 Limited are organising webinars in January/February 2020 to demonstrate the benefits of VFC to all users, along with many other items not able to be covered in this article. Please register your interest by emailing info@md5.uk.com.

Case Studies: https://vfc.uk.com/resources/files/Case_Studies.pdf 

Case Testimonials: https://vfc.uk.com/resources/files/Case_Testimonials.pdf 

Walkthrough: How VFC 5 Can Exploit Windows Live ID (Inc PIN)

What is Virtual Forensic Computing?

Virtual computing transforms investigation of the digital crime scene.

Having access to the ‘digital scene of crime’ can offer huge benefits to an investigator. Whether investigating fraud, murder, child abuse or something else, seeing the computer through the eyes of the suspect can be invaluable. Building a virtual machine (VM) of the suspect’s computer is one easy way to get forensically sound access to the user’s environment. 

A VM allows an investigator to:

  • See the desktop and operating environment just as the user saw it
  • Navigate financial records within the native software (Sage, QuickBooks, Great Plains etc.)
  • Access emails and internet search histories, demonstrate interaction with installed software
  • Determine accessibility of illegal files

“I originally ordered VFC for **PD and have been using it since.… VFC has proven to be invaluable. I first searched for forensic virtualization software in 2008 after assisting with a financial crimes investigation.  

A computer with business records had been seized.  Data files with an obscure file extension were located during forensic examination.  I did not have a compatible viewer and couldn’t verify manually-parsed data. I did locate proprietary accounting software within the suspect image.  

In an effort to view the correctly-formatted data, I contacted the accounting software company and requested a copy of the software.  They generously sent a copy of the accounting program for use in this investigation. I installed the software on my forensic workstation and, after some tweaking, was able to view the formatted data.  While I was eventually able to review the data, the manual process of extracting the data, acquiring the correct version of the proprietary software, and finally hoping it would all work on my forensic workstation was cumbersome, at best.  

I… used VFC to show attorneys and investigators digital evidence as the user would have viewed it. ”  

– Digital Forensic Examiner, Charles County Sheriff’s Office

VFC simplifies the virtualisation process

As virtualisation platforms have improved, building a replica of a suspect’s system has become much easier. What once could take a few days now takes just a few hours if you are lucky. Most of this time is spent fixing driver errors (e.g. human input device drivers such as the mouse and keyboard) and overcoming driver problems and the infamous blue screen of death (BSOD). 

However, with the right tools, investigators can now do all this reliably in just a couple of minutes. 

‘Virtual Forensic Computing’ or ‘VFC’ allows the user to create a VM from a forensic image (or a write-blocked physical hard disk drive), automatically fixing common problems and  typically booting the VM in under a minute. VFC makes the virtualisation process smooth and hassle free. 

Among VFC’s valued customers, to “VFC a forensic image” has become synonymous with virtualisation since it was first released by MD5 in 2007.

“VFC has become an essential tool in our forensic investigator’s toolkit. It provides investigators an insight into the suspect’s perspective by actually seeing the user’s desktop, settings and user environment. Screen captures from the suspect’s ‎environment add significant weight to the forensic report when describing how the suspect utilized the computer to facilitate the crime. 

VFC is truly a tool that I rely upon and use in all my computer investigations!”

– D/Sgt Vern Crowley, Ontario Provincial Police eCrime Section

A picture speaks a thousand words

Using a VM to replicate the user’s computer, the desktop environment can easily be captured for presentation to a judge or a jury. This helps juries understand the more technical aspects of their reports, or enable powerful emotive images to be put before the judging panel. Using VFC, investigators can:

  • take screenshots and embed these in their reports.
  • record video screen-capture of an examination to playback in the courtroom
  • Create portable versions of VM to demonstrate live in court 

VFC is now used on every continent, in almost every aspect of digital forensic investigations, by law enforcement, military investigations teams, forensic and cyber investigation teams in both the private and public sector.

“VFC is a very useful tool for us as the screenshots we can show a jury far outweigh simply writing about a topic.”

– Graham Green – Suffolk Police

“The product is getting better by the day and is one of our main tools – a picture paints a
thousand words as they say – very powerful in court…”

– Mark Boast, Forensic Analyst, Suffolk Constabulary, UK

“I imaged a drive which had some positive keywords … and thought I would have a look at it using VFC. The results were extremely impressive.  It showed the suspect using shareazza to download illegal content and also showed the actual folders on his desktop. Makes proving this case really easy.”

– Computer Forensic Investigator, Durham Constabulary, UK

VFC 5.0 launched July 2019

VFC 5.0 integrates the VFC workflow directly into existing forensic analysis tools, making the creation of a VM even easier with its integration components for common forensic analysis tools:

  • EnCase Enscripts 
  • XWF X-Tension files

The integration components are provided with the standard VFC package and can be setup and used within minutes. Similarly, VFC now supports a command line interface to   support automated workflows. 

These exciting new features  now allow the analyst to launch a VM of their target image directly from within their standard forensic examination suite.

VFC Mount helps reduce common errors

VFC 5.0 now comes with its own mount utility, VFC Mount, to simplify the virtualisation process and remove reliance upon third party tools. VFC Mount currently supports .E01, .EX01, AFF4, .VMDK, .BIN, .IMG, .RAW, and .DD images.

VFC Mount helps reduce instances of common Windows errors when dealing with mounted images such as the very common “The physical disk is already in use” error in VMware.

VFC 5.0 contains numerous other tweaks and upgrades to make the VM-generation more stable and effective. Early feedback has been very positive:

“I have downloaded version 5 and have used it on a couple of occasions recently, I find it
more successful in running the VM than version 4, I get less error messages than before especially the one relating to the drive being already in use. So far very happy with the upgrade

– Kevin Mount, Queensland Police, Australia

Password bypass (PWB) gives quick access to suspect accounts

VFC also gives the ability to clearly demonstrate that something doesn’t work – for instance, if a suspect insists the password they have provided is correct, VFC provides a quick way to prove them wrong without affecting the original data.

“VFC allows me to try passwords first, show they don’t work, and then bypass …”

– Special Agent, DHS ICE, US

Historically VFC PWB only worked on local Windows user accounts, however, now VFC 5.0 adds support for Windows 8/10 ‘live’ accounts with the Generic Password Reset (GPR) feature.

New from September 2019 – Windows Live ID Exploit (including PIN accounts)

Generic Password Reset (GPR) tool

New to VFC 5.0, the GPR tool can be used to help make powerful system-level changes. With GPR, the investigator can:

  • List User Accounts (including password status)
  • Bypass security on Windows online (Live ID)
  • Reset account passwords to known values (including PIN accounts)
  • Open a SYSTEM level command prompt (at the logon screen)
  • Easily reboot the guest VM

Early feedback from a select group of active police investigators, that have been given pre-release access to the Live-ID feature has been very positive.

“[VFC5] Was a dream to use. Easy to follow the prompts in the GPR. I converted the live account …, used the GPR password reset, and voila, I got in.

I will be adding some very convincing evidence to my investigation by being able to show the Judge/Jury what the User was seeing instead of just my forensic analysis.”

– Cst. Chad Seidel, Saskatoon Police Service, Canada

Continual investment ensures continued development

With additional support for Linux and other Operating Systems, VFC has continued to deliver new features since it was introduced. The newest features (for ease of reference) include:

  • Windows ‘Live ID’ (online) password reset feature – gives the user a simple method to get around even the latest in Windows user security
  • VFC Mount  – simplifies the user experience and minimize common VMware problems 
  • Generic Password Reset – gives users a simple and fast way to access a specific account or make system-level changes. It is portable, powerful and user friendly.
  • Command Line functionality and inclusive components – seamlessly integrate with EnCase Forensic and X-Ways Forensics allowing VFC to be used alongside existing, trusted forensic software.
  • 64-bit host system support – brings VFC fully up to date, giving it a rightful place in today’s forensic laboratory

Other significant features include:

  • Standalone Clone VFC VM gives the user the option to export a copy of their VM that can be reviewed by an investigator away from the forensic analyst’s workstation, without the need for a VFC dongle (license). 

“I really like the standalone VM option that VFC has now.  Giving a VM to a case agent to use on a review station has always been an issue.  The standalone VM solves that problem.”

– Special Agent, DHS ICE, US

  • Modify Hardware allows VM hardware to be amended including adding extra drives or network support 

“The addition to be able to stitch in a second drive is … brilliant … as we are … able to fully replicate the users environment rather than just their Windows installation drive.”

– Paul Ripley – Cleveland Police

  • Password Bypass (PWB) feature for Windows user accounts –  VFC 5.0 has increased the number of discrete PWB routines to over 2000, up considerably from 500 with VFC 4.0.
  • Patch VM / Restore Points  feature  – allows the investigator to patch problematic virtual machines or repair a VM after using the Windows system restore feature to ‘rewind’ a VM to an earlier historic state.
  • The VFC Log File – keeps a forensic log of all steps taken by the software (effectively contemporaneous notes) and makes VFC a powerful weapon in the forensic investigator’s arsenal.
  • Updates and upgrades have enhanced the product more, including further OS support, new password bypass routines and slicker processes. 

Development continues at a pace at MD5 Ltd; our constant aim and goal is to continue delivering a product that solves even more of our customers’ needs:

“Absolutely loving this version, there hasn’t been a password it hasn’t cracked!

Had absolutely no problems putting accounts offline and changing the passwords either through the password bypass… and it worked with password and PIN protected accounts, even 1 which defaulted to a picture based login it changed the local password without a hitch.

Can’t wait for this one to launch as I suspect it will prove uncommonly useful for us.”

– Peter Bayly, Digital Forensic Investigator, Northumbria Police

Download V5 Windows LiveID full article

To purchase or find out more about VFC visit the website www.vfc.uk.com or email: sales@md5.uk.com

Asking A VPS To Image Itself

by Chris Cohen

unnamedThere is a Linux Virtual Private Server (VPS) that you have been tasked to collect using a forensically sound method while ensuring confidentiality, integrity and availability. You have the password for a user who has ssh access to a shell account on that VPS and the user is in the super user group. You do not have access to the VPS control panel, and the VPS is located in a country which does not respect any legal notices from the country you are in. You need to log into the VPS via ssh and ask it to image itself.

To ensure forensic soundness we must keep any changes we make to the VPS to a minimum, to this end we will not be installing additional software. This means we will be limited to using only the default installed applications and that we will have to transmit the forensic image across the internet as it is being created. (1) To receive the image we require a Linux collection system we control with a public IP address and enough disk space for the image.

To ensure data confidentiality we will encrypt the exfiltrated data while it is in motion; it should be noted that this encryption will make the process slower than it would be if it were not encrypted. (2)

To ensure data integrity we will take a message digest hash of the image as it is being created, which can be later compared to a hash of the image received on our collection system to prove that it was transmitted without error. Integrity will also be maintained by the transmitted data being encrypted, if it were not then a man-in-the-middle could view as well as interfere with the data as it flows.

Lastly to ensure data availability we will keep the VPS running throughout this process, which means that we get a ‘smear’ of the drive and if we were to perform the imaging process again we would likely get a different hash value.

As is typical in Linux there are usually multiple ways in which any given task can be performed, the following is just my take on this problem. I’m sure that this is just one of many possible solutions and possibly not even the best.

To create the image of the disk we will be using the by-default installed file and disk copying program dd. Dd itself does not have any built-in hashing nor encryption capabilities, so we will have to use other installed programs to perform these actions. (3)

First we need to gather some information about the VPS we are on. To find what distribution of Linux is installed on the VPS use the following command if the information wasn’t display as part of the initial login:

uname -a

To find the mounted devices, the file system on these devices, their mount point and how full they are:

df -T

To show file sizes in human readable format try df -Th.

For this article we will assume that there is a single partition mounted as /dev/vda1. The disk being /dev/vda

The following command will create a disk image of /dev/vda with padded read-errors, create a MD5 hash of it and save that hash to the file called vda.img.md5. The image data will be compressed and sent via ssh to the collection system:

sudo dd if=/dev/vda bs=128k conv=sync,noerror | tee >(md5sum > vda.img.md5) | gzip -c | ssh <user>@<IP> “dd bs=128k of=vda.img.gz”

Where <user> is the username on the collection system and <IP> is its IP address. The image file can be decompressed on the collection system by running gzip vda.img.gz -d. It’s hash can then be calculated by md5sum vda.img.

To view and then remove the file containing the md5 of the image transmitted from the VPS the following commands can be entered:

cat vda.img.md5

rm vda.img.md5

One of the problems of stringing multiple Linux commands together as above is that if multiple parts of the command require additional user input like a password to be entered, then these requests can be presented to the user simultaneously, making it impossible to successfully input the requested information. In the command above, two elements may require additional user input. Firstly the dd access to the physical disk requires a super user password and secondly the ssh connection to the collection server requires a separate password to be entered. These two password entry requests can conflict. One way around this is to provide the sudo password to a command prior to the imaging command. Before the dd command is entered do a sudo ls and enter the password when prompted and it may be cached for subsequent sudo commands. If that fails (perhaps the VPS has been configured to not cache sudo passwords) then the sudo password can be passed in-line as below with the password being password:

echo ‘password’ | sudo -S dd if=/dev/vda bs=128k conv=sync,noerror | tee >(md5sum > vda.img.md5) | gzip -c | ssh <user>@<IP> “dd bs=128k of=vda.img.gz”

Outbound ssh connections to new locations also require further user input to confirm that a connection is desired to the host. Subsequent connection attempts do not require this additional input, so to avoid the conflict, create and break a ssh session to the collection server prior to running the dd command, this will also confirm the accessibility of the server.

The ssh command cannot take an in-line password, and other than installing the public key of our VPS (which may not even have been created) on the collection server, a password will have to be entered for the ssh connection. The calculated md5 cannot be sent via ssh, as a separate ssh connection would require an additional password to be entered with the ensuring conflict in entering it. This is why for the commands shown above the calculated md5 was saved to a text file on disk. While creating a file is not ideal, the file is only small and therefore is unlikely to cause any issues. Lets not forget that just connecting to the VPS will make changes to multiple files.

If you wish to avoid directly creating any files on the disk one way to do this is to send the hash via netcat (which does not require a password to be entered but will also sends the data unencrypted) with the following commands:

On collection system:

nc -l <port> > vda.img.md5

On VPS:

sudo dd if=/dev/vda bs=128k conv=sync,noerror | tee >(md5sum | nc <IP> <port>) | gzip -c | ssh <user>@<IP> “dd bs=128k of=vda.img.gz”

If you want to hash the data before it is compressed as well as after (so you have a hash of the disk itself as well as the data actually sent – which to my mind is overkill) you can do so with this command which will save the hashes to disk:

sudo dd if=/dev/vda bs=128k conv=sync,noerror | tee >(md5sum > vda.img.md5) | gzip -c | tee >(md5sum > vda.img.gz.md5) | ssh <user>@<IP> “dd bs=128k of=vda.img.gz”

Or this command which sends the hashes via netcat:

On collection system – enter these two commands into two separate terminal windows, so both run concurrently:

nc -l 9000 > vda.img.md5

nc -l 9001 > vda.img.gz.md5

On evidence VPS:

sudo dd if=/dev/vda bs=128k conv=sync,noerror | tee >(md5sum | nc <IP> 9000) | gzip -c | tee >(md5sum | nc <IP> 9001) | ssh <user>@<IP> “dd bs=128k of=vda.img.gz”

In all commands sha1sum can be used instead of md5sum but it will take slightly longer.

The block size does not have to be set at 128k, the best block size can be determined by running tests, although the results will be pretty individual to that tested device. Therefore I’ve plumped for a nice sensible 128k.

When these imaging command are running we will not receive any information about its progress, while dd itself has an option to show its progress, turning this on interferes with the ssh password entry so it has to remain off. To determine how (and indeed if) the command is progressing you can use the following commands which will continually report the progress of the dd command every 5 seconds:

ctrl-z     < this temporarily halts the command and returns the command prompt

bg     < this backgrounds and resumes the command

jobs -l     < this shows what tasks you have running and their Process IDs

while true; do sudo kill -USR1 <PID>; sleep 5; done

Where <PID> is the process ID of the running command as shown by the jobs command. To break out of the loop and return the backgrounded command to the foreground, do a ctrl-c and then a fg.

Note, running any of these disk imaging command is likely to greatly change the memory of the VPS, so if you’re interested in taking a memory dump then do that first.

Tested on:

  • Ubuntu 16.04.1 LTS.
  • Fedora 25 x64
  • Debian 8.6 x64
  • CentOS 7.3.1611

 

Chris Cohen

chris.w.cohen@gmail.com

 

(1) For the benefit of this article we will assume that no tools have been removed in an effort to harden the system and that we can trust the tools already installed. If this isn’t the case then we could transfer known good statically-compiled tools to our VPS, although this is out of scope of this article.

(2) Encryption could be omitted if the data is being transferred over a LAN, though in this scenario it is travelling the public internet and therefore encryption should be used.

(3) The Linux forensic imaging program dcfldd does have the ability to hash-on-the-fly but it is not installed as standard on any common distribution.