The first phase is to "tag and bag" the live evidence. Live evidence is anything that would be lost after the computer is powered down. In addition, if you intend to pull-the-plug and duplicate the disk, you need to gather the information in order to do so (number and size of disks, type of disks, partition information and so forth).
The second phase is "evidence extraction." This is where you extract relevant data from the data you collected. It takes some skill and experience for this phase not be become the "looking-for-a-needle-in-a-haystack-where-did-the-last-four-hours-go" phase. There is benefit in close inspection once to understand what is happening at that level - you just don't want to do it every time.
The third phase is "evidence analysis." It is here that you try to determine what crime was committed and how it was done.
The final phase involves creating a reasonable response plan based on what you learned from the investigation so far.
The #1 goal when gathering information from a running system is to do so WITHOUT leaving any traces (artifacts). You must show due diligence not to modify anything on the hard drive of the suspect machine and to preserve any evidence you extract in a forensically sound way. To prove due diligence document everything you do. For this lab just create a logfile of all commands that you execute.
You do not need to download any tools for this lab. Use the commands on the suspect machine (not a good idea in practice). You will need super-user privilege which you can get with sudo.
When prompted if you "moved" or "copied" the virtual machine, select "I copied it". It will take a while for the virtual machine to boot up since it has not been used for quite some time.
Logon with the 'student' username and password that you use to logon to the desktop for the department lab machines. Immediately sudo to root.
sudo -sGive the 'student' password when prompted for the password by sudo.
To enable networking, do the following as root:
rm /etc/udev/rules.d/z25_persistent-net.rules shutdown -r nowAfter the system reboots, log back in and sudo to root following Step 2's instructions. Verify that you have networking by issuing the command:
ifconfig eth0You should be given networking information (IP address, netmask, etc) if the virtual machine has an active network connection.
date # get date
sudo -s # to get super-user access
mount # list all mounted disks
df -k # get disk sizes
fdisk -l /dev/sda # get partition information off a device
w # view who is currently logged in (utmp)
whoami # display your username
last -10 # view last 10 login/outs on the system (wtmp)
uname -a # get Unix version, processor type, and more
ifconfig # display network interface configuration
ps -ef # list all processes running on the system
ls -al /proc # list virtual files associated with processes
netstat -an # list network connections
crontab -l # list scheduled processes
lsof -p {pid} # list all open files for a particular process
file {filename} # find out the file type
{command} # any other Ch 6 command not listed above except dd
Send the output of each information gathering command into a logfile with
redirection. This is similar to what we did for Lab 3. For example, to
redirect the output of date to the logfile, use:
date >> /root/logfile.txt
When you are done gathering the information, send logfile to your cs340 desktop by using the scp command. First, use CTRL-ALT to return the keyboard and mouse to the CS340 desktop and open a Terminal on the cs340 desktop. Find out your host's VMware IP address with the following command:
/sbin/ifconfig vmnet8Look for the "inet addr" line and use that IP address as the vmwareIPaddress in the following scp command. Click back on your etch virtual machine to transfer the keyboard to the virtual machine and type the following command:
scp /root/logfile.txt cs340@<vmwareIPaddress>:Desktop/Use CTRL-ALT to transfer the keyboard and mouse control back to the desktop and continue on to the analysis portion of the lab.