Prerequisites

• Phone must be rooted (Guide)
• Phone must have clockworkmod flashed (this is optional)
• ADB Must be configured on your system (Guide for Ubuntu Users¹)

Let’s Get to Work

1. Enable debugging on the phone
2. Boot the phone into recovery mode, clockworkmod in my case
   • the reason I noted that having clockworkmod is optional is because you can pull the image while you are booted into the phone normally. However, creating an image on a mounted drive is probably not a great idea in terms of reducing the amount of alterations to the system, forensically speaking.
3. Locate the mount points, and unmount it. The points of interest are /data, /system, and /boot depending on what you are looking for. Each point will require a separate image (adb pull). Note, the following steps require root, run sudo su.

adb start-server
adb devices (verify your device is shown)
adb shell

~ # mount
rootfs on / type rootfs (rw)
tmpfs on /dev type tmpfs (rw,nosuid,relatime,mode=755)
devpts on /dev/pts type devpts (rw,relatime,mode=600)
proc on /proc type proc (rw,relatime)
sysfs on /sys type sysfs (rw,relatime)
/dev/block/platform/omap/omap_hsmmc.0/by-name/cache on /cache type ext4 (rw,nodev,noatime,nodiratime,barrier=1,data=ordered)
/dev/block/platform/omap/omap_hsmmc.0/by-name/userdata on /data type ext4 (rw,nodev,noatime,nodiratime,barrier=1,data=ordered)
/dev/block/platform/omap/omap_hsmmc.0/by-name/system on /system type ext4 (rw,nodev,noatime,nodiratime,barrier=1,data=ordered)

~ # umount /data

4. Copy the data block to your host system, in my case I only care about the userdata (This will take a while. For reference: 488 KB/s (1654635520 bytes in 3305.009s).

~ #exit
adb pull /dev/block/platform/omap/omap_hsmmc.0/by-name/userdata

…and we’re done! Now, forensically speaking, I am not sure if there exist any differences between using adb pull and dd. My reddit pal claims there is no difference, but I can’t really confirm this as recovery mode does not have dd built in. I could run dd on the phone booted normally, but it would be very difficult to tell what the differences are. Regardless, you now have duplicate of the drive and can use standard forensic tools to analyze it, like Autopsy 3.

¹Note: Use the newer openjdk7 for step 1.

Before beginning, here are a few notes:

• This is still developmental software, there will be occasional errors, don’t use this in an actual investigation!
• Do this on x86 Ubuntu, I ran into a ton of issues on x64
• Make sure your clock is correct if you are doing this in a VM
• My user account is ‘jo’ so make changes where appropriate

Install Java

sudo apt-get install openjdk-7-jdk
export JDK_HOME=/usr/lib/jvm/java-7-openjdk-i386

Compiling Sleuthkit 4 with Ext4 Support

sudo apt-get install autoconf automake libtool git ant build-essential
wget https://libewf.googlecode.com/files/libewf-20130303.tar.gz
tar xfv libewf-20130303.tar.gz
cd libewf-20130303
./configure --prefix=/usr/local/
make
sudo make install
sudo ldconfig
export LIBEWF_HOME=/usr/local/include/libewf
cd ~

That step allows Autopsy to read forensic images formatted as .ewf

git clone https://github.com/sleuthkit/sleuthkit.git sleuthkit
cd sleuthkit
git checkout
autoreconf -fiv
./configure --prefix=/usr/local/
make
sudo make install
sudo ldconfig
cd bindings/java
ant
cd ~
export TSK_HOME=/home/jo/sleuthkit/

Compiling Autopsy 3

git clone https://github.com/sleuthkit/autopsy.git autopsy
cd autopsy
ant build
ant run

And you are done! To load Autopsy, you must always issue ant run from within the autopsy folder

Scenario: I’m doing forensics malware analysis on Cridex, so I ran the malware on a clean VM. I wanted to then create a forensics duplicate of the VM’s hard drive so I could analyze changes using temporal analysis. Thus, I copied the VM’s drive “Windows XP Professional.vmdk” onto my linux (Ubuntu) box, mounted it using vmware-mount, and ran dclfdd. Unfortunately, dcfldd continued to cry:

dcfldd:/media/vdisk: Is a directory

I pounded my head against my desk until I figured out what I was doing wrong… dcfldd was expecting a mount point, and I was giving it the location of the files! This hadn’t occurred to me because fdisk -l wasn’t showing the mounted VMware disk. That said, here’s how to do it:

sudo mkdir /media/vdisk
sudo vmware-mount /home/ph34r/vmware/WindowsXP/Windows\ XP\ Professional.vmdk 1 /media/vdisk

Note: the 1 tells vmware-mount the desired partition, you can use the -p flag to list the available partitions.

Now, we have to determine the mount point of our VMware disk, since fdisk is a liar (…I was just not using the right tool here). In my case, it turned out to be “/dev/loop0″, I figured this out by using mount -l, and looking for the listing corresponding to “/media/vdisk”

Now it was easy-peasy,

sudo dcfldd if="/dev/loop0" of="/home/cidrex.dd" conv=noerror,sync bs=512

TA-DA! We have a forensically sound duplicate of our original VMWare drive. Hopefully this helps anyone frantically searching the internet!

• pandas-0.10.1.win32-py2.7.exe
  

Pandas has a few python dependencies, so you are going to want to grab the following as well:

• NumPy: 1.6.1 or higher
• python-dateutil 1.5

• pytz

Next, I needed a TCP Dump data set to work with, I visited MIT Lincoln Lab’s DARPA Intrusion Detection Page and grabbed:

• inside tcpdump data
  

Since Panda’s works with CSV files, I opened the TCP Dump in Wireshark, and exported it (“Export Packet Dissections”). Now, we can run a very simple test using our tcpdump csv:

from pandas import *
import gc

gc.disable()
experiment = read_csv("tcpdump.csv", index_col=0, na_values=[" "])
gc.enable()

print experiment

<class 'pandas.core.frame.DataFrame'>
Int64Index: 1635425 entries, 0 to 1635424
Data columns:
Time 1635425 non-null values
Source 1635425 non-null values
Destination 1635425 non-null values
Protocol 1635425 non-null values
Length 1635425 non-null values
Info 1635423 non-null values
dtypes: float64(1), int64(2), object(4)

Note that I disable Python’s garbage collection in my script, as advised by the Panda documentation… this is to speed things up.

Accessing Panda Data

Now, of course, we can work with the data within Panda, for example printing all the data of a given column:

print experiment["Source"]

0 172.16.115.234
1 172.16.115.234
2 172.16.112.50
3 172.16.112.10
4 172.16.112.20
5 172.16.112.20
6 172.16.115.234
7 Cisco_38:46:33
8 172.16.0.1
9 Cisco_38:46:33
10 Cisco_38:46:33
11 192.168.1.10
12 172.16.112.20
13 194.27.251.21
14 3com_9c:b2:54
...
1635410 172.16.112.20
1635411 172.16.112.20
1635412 Cisco_38:46:33
1635413 172.16.112.20
1635414 192.168.1.20
1635415 Cisco_38:46:33
1635416 172.16.113.50
1635417 172.16.112.10
1635418 Cisco_38:46:33
1635419 172.16.112.20
1635420 172.16.112.10
1635421 172.16.0.1
1635422 172.16.114.50
1635423 172.16.112.10
1635424 Cisco_38:46:33
Name: Source, Length: 1635425

Or even a given row:

print experiment["Source"][14]

3com_9c:b2:54

Visualizing Data

There’s still a lot more that Pandas can do by itself, but since I’m a visual person, I like to look at graphs to easily see correlations of data. In python, we can use the maplotlib module to add graphing functionality to Pandas. As a fairly simple example, I wanted to make a scatter plot all of instances that the RIPv2 protocol’s packet was captured, in relation to the time (at which the packet was captured.

from pandas import *
import matplotlib.pyplot as pl
import gc

gc.disable()
experiment = read_csv("tcpdump.csv", na_values=[" "])
gc.enable()

rip2 = experiment[experiment.Protocol == 'RIPv2']

pl.scatter(rip2["No."], rip2["Time"])
pl.ylabel("Packet Number")
pl.xlabel("Time Since Capture Since")
pl.show()

From the graph, we can sort of see that between minute 16 (1000000 ms) and minute 25 (1500000 ms) there are more RIPv2 packets. This is somewhat of a crude example, but my brain was lacking imagination when trying to think of real data that may be of interest.

As you can see, Pandas is a very powerful tool, and although it is designed for scientific data, it can be used for almost any data set. I was able to get the hang of it within a few hours by looking at the documentation and doing some research. I strongly suggest the following two videos:

ScoobysWorkshop.com

Here’s a cool testimonial snippet from the project:

Going from an old fashioned static HTML website to a dynamic one like WordPress takes far more work than meets the eye. I’m a software engineer and I hadnt even heard of these things till Jovanni educated me. Number one is security. As I found out 6 months ago when my old website was high-jacked and forwarded to a spammers website, security is a high stakes game now.

Jovanni is an expert at security (its his field) and he took a multi-layered approach to make sure the new website is safe. Cool new services and ways to protect digital assets that an old-school software engineer like myself had never heard of. I learned my lesson the hard way, you can learn from my mistake. If you have a popular website, even if its not a commercial website, you need to get a security expert involved to make sure your website is safe!

Anyways, this is my first career fair so I’m a little nervous, I don’t quite know what to expect. Hopefully I can avoid being awkward!

• New, updated resume

• Custom Redesign
• Built on Catalyst Theme Framework
• Added Multilingual Support
• Advanced SEO enhancements
• Coming Soon: Mobile Optimized Version
• http://www.camdennaz.org