Don't Let This Happen To YOU !

Here is list of interview questions compiled by Libby - my Computer Forensics study partner. I've added a few more towards the end. They were sourced from questions posted on websites and questions asked in interviews. Feel free to add more questions and/or any tips for answering in the Comments section.
From my limited (entry-level) interview experience, it seems that character related questions are just as, if not more important as the technical ones. Having an encyclopaedic technical knowledge is probably less important than showing that you can work effectively with others (ie the interviewers). Showing a willingness/capability to learn independently and communicate ideas is also important. I also think that while you should be on your best behaviour (so-to-speak), you should also be YOURSELF. The interviewers will find out one way or another if you are acting. Speaking of which, it can't hurt to get some background on the interviewers (eg read their LinkedIn page, their company profile). If you have something in common, you might like to mention it during the interview (in a completely non-stalker way of course!) so as to build a rapport/be more memorable.

• Describe the different file systems? FAT 12, FAT 16, FAT 32, NTFS
• Describe the Windows operating systems?
• What imaging tools and techniques are you familiar with?
• What is the basic command line syntax for dd or dcfldd? What are the differences between the two?
• Describe the steps to image a laptop with a bootable forensic cd?
• What are some options to write block a drive before imaging or previewing?
• What are two ways to do a network acquisition using Helix? List hardware and software required for each method.
• What is the bare minimum equipment needed to image a desktop?
• What is an MD5 checksum and how is it used in forensics?
• What are some other hashing algorithms besides MD5?
• What is a .ISO?
• What is a bit level image and how is that different from an ISO?
• What is the SAM file? Which operating system has it?
• What is data carving?
• What is live previewing of a system?
• How would you image a hard drive on a system that cannot be shut down?
• If a file is labeled .tar.gz what is it and why is it in .tar.gz format?
• Describe the chain of custody in detail?
• How would you be able to tell at the hex level that a file has been deleted in FAT 12?
• How would you go about imaging a network without taking it down?
• What is metadata? What is affected by it? What attributes does it represent?
• Why is it important to sanitize your analysis media?
• You have an IDE drive and it is not reading. Why is this?
• Describe the difference between wiping and formatting drives?
• How many timestamps are there in NTFS and what are they?
• Does the registry have any timestamps?
• What is the ntuser.dat file?
• What do the MRU keys tell you in the registry?
• What is a three way handshake in TCP/IP?
• How does TCP differ from UDP?
• What would I bring to the position?
• What are the steps when taking a computer from the home?
• What is the step by step procedure after receiving a hard drive which contains child pornography?
• Someone willingly brings their computer in for some minor offense. After imaging, it is returned to the person. During the examination child pornography is found, what do you do?
• What is slack space?
• What is unallocated space?
• What are bits, bytes, nibbles and clusters?
• What is the hex value for a deleted file or directory in FAT systems?
• What is the hex value for a directory?
• How to calculate disk capacity?
• What is volatile data?
• What happens when a disk is formatted?
• What is the numeric base system for hexadecimal, decimal, octal and binary?
• What motivates you?
• What are some challenges to computer forensics in the future?
• Tell us about a time you faced a (technical) challenge and how you overcame it?
• Give us an example of when you worked independently/within a team to meet a deadline?
• Have you ever communicated technical concepts to a non-technical audience?
• What brought you to this point in your career?
• What do you know about our industry? Our organisation?
• How can you help us? eg What skills do you have?
• What are your career plans for the next 3 and 5 years?
• What are your strengths/weaknesses?
• Do you have any other interests/hobbies?

And here are some questions candidates might like to ask the interviewers ...

• Where would I fit into the team? How big is the team? What is the experience level of the team?
• What is the technical environment like? What tools/storage/hardware do you use?
• What upcoming projects will I be involved in?
• How is training organised?
• What are the typical working hours/travel requirements?

And here are some websites chock full of forensicky advice goodness for the newbie ...

 "What makes a good forensicator? or how to get a job in Digital Forensics..."

(*GRATUITOUS NAMEDROP* Written by Mike Wilkinson - one of my previous Lecturers :)

Corey Harrell blogs about entry into Computer Forensics

Harlan Carvey blogs about entry into Computer Forensics

ForensicFocus Job Seeking Advice by Joe Alonzo

Magazine Article on Digital Forensics in Australia

Eric Huber Interviews Detective Cindy Murphy (Law Enforcement)

M57.biz Practice Investigation (Pt 3 - Final)

RESULTS AND LEARNING OUTCOMES


Welcome to the M57 entry where I present what I learnt during this investigation. Due to its ongoing use, I have removed my results/analysis section. I have also removed any comments mentioning any tools/strategies.

Learning Outcomes:

I spent several days on this - the briefing PDF mentions spending "until lunch" using EnCase (LOL!).
This investigation took a lot longer than I estimated - part of it was learning about/setting up the tools, part of it was discovering Windows places of interest (eg Registry artefacts), part of it was the snoopy factor ("What has this user been up to?") and part of it was just repeating commands so I could document the results more comprehensively. I am still not 100% sure that someone from the company was NOT involved with the bogus email but I can't seem to find anything to support it.

In the future, I should pay more attention to documenting my progress as I investigate. I was using a old fashioned notebook and pen - maybe I should be using a text file / word document? It would certainly make capturing the command lines / paths much easier.
By learning on the fly/diving in and not having a set process to follow, I don't think I was maximising my efficiency either. Still, I guess you have to walk before you run etc.
Also, all details from the client brief should be confirmed/verified before starting - I spent quite some time searching for a .xlsx file as stated in the PDF brief only to find it was a .xls file.



Postscript:
'Nother practice scenario which might interest y'all (see, I can speak like a Southerner too!) is:
http://www.cfreds.nist.gov/dfrws/Rhino_Hunt.html
In this scenario, possessing more than 9 Rhino pictures has been declared illegal in New Orleans (those dirty Rhinos!). You've been tasked to find as much evidence as you can from 3 tcpdumps and a 256 Mb USB key dd image. This is good for gaining experience using the WireShark network analyser (also included on SANS SIFT) and "foremost". And they have kindly supplied the answers too!

M57.biz Practice Investigation

INTRODUCTION AND SETUP

The first image my study partner ( http://computerforensicgraduate.wordpress.com/ ) and I decided on is located here:
http://digitalcorpora.org/corpora/scenarios/m57-jean

Its an investigation into how a spreadsheet was exfiltrated from a laptop. The laptop image is contained on 2 EnCase .E0 files (3 Gb total) which you can look at using a similar methodology to whats listed in "Digital Forensics with Open Source Tools" by Altheide & Carvey (the "Simon and Simon" of Computer Forensics, if I might be so bold / old).

Note: the case briefing pdf lists a different filename / filetype for the spreadsheet. I tried doing a "m57plan.xlsx" keyword search but didn't find it - using FTK Imager I found it as "m57plan.xls". Double-DOH! Live and learn ... take client briefings with a grain of salt?

We have both installed VMware Player 3 thru which we use the SANS SIFT Ubuntu virtual workstation (1.8 Gb download).
The SIFT workstation already contains several of the tools mentioned in Altheide & Carvey plus more. There's unallocated file carving, email extraction from PST files, RegRipper, FTK Imager just to name a few and all for FREE!
Be sure to download the VM "Distro version" ZIP file and not the bootable ISO image. SANS have set it up so you can unzip that file and then use VMWare Player 3 to open the "SIFT Workstation 2.1.vmx" file (via File, Open a New VM and then select the .vmx file). Keep the ZIP file after extracting it so that after each case you can delete the SIFT VM in VMWare player and start again fresh. Anyhow, once you've told VMWare Player where to find the .vmx file you just "play it" by double clicking on it. Everything should be automatic from then on and hopefully you get the login window.

Ubuntu will probably run a bit slower via VMware than if installed seperately but I found it OK using a circa 2003 single core Athlon64 with 2 Gb RAM running WinXP. And this way, I didn't need to spend time reformatting or dual booting the sucker and/or if I stuff up the SIFT, I can easily reset to a known good state. There's a pretty helpful forum at http://ubuntuforums.org/ if you have Ubuntu issues.

Tools Used:

VMWare Player 3.1.5 ( http://downloads.vmware.com/d/info/desktop_downloads/vmware_player/3_0 ) - you might have to sign up first (for free)
SANS SIFT Workstation ( http://computer-forensics.sans.org/community/downloads ) - requires a SANS login (free)
Forensic Corpora Jean Encase Image ( http://digitalcorpora.org/corpora/scenarios/m57-jean )

Aim: 

To find out:
- When did Jean create this spreadsheet?
- How did it get from her computer?
- Who else from the company is involved?

Setup Method:

A. Install SANS SIFT Virtual machine under VMWare Player 3 (as described earlier).

B. Download/Copy Jean's Encase files (.E01 & .E02) to the SANS SIFT VM "/cases" directory.
I used Windows File Explorer to copy the 2 EnCase files to the "cases" folder on the SIFTWorkstation in the SANS workgroup but you could also download it directly to the SIFT using the SIFT Firefox browser.

C. Read-only Mount the Encase image such that we can see them from the Ubuntu OS
Tthis blog describes how to do it (more or less):
http://stephenventer.blogspot.com/2009/02/mount-ewf-e01-on-linux.html

The SIFT 2.1 VM has most of the software/tools mentioned in the blog already installed / configured.
And pp 20-22 of "Digital Forensics with Open Source Tools" (Altheide & Carvey) details a similar process.
But there is one complication - the SIFT VM doesn't seem to recognise the HPFS (High Performance File System) / NTFS filesystem of the given EnCase files. The blog example doesn't mention this as a problem but I couldn't follow the blog/book procedures without getting errors.
I ended up using the Ubuntu Synaptic Manager (from the System, Control Center, Synaptic Package Manager menu) to install the "ntfs-config" package/software and Ubuntu then recognised/mounted the image. Not 100% sure why, but it seems to work ...
The Synaptic Package Manager is a GUI for installing Ubuntu software packages. Its kinda like the App store for iPhones. However, unlike iPhones you can also download source code seperately and compile/build it on your Ubuntu system. eg if its not available in a package.

So here's the full procedure I ended up performing:

1. Boot up SIFT VM and login as sansforensics (password is "forensics" ... shhh! )
2. At a terminal window, use the command "sudo su -" to login as root so we can issue commands with the appropriate privileges i.e. make data accessible/mount stuff.
3. Use the command "mount_ewf.py /cases/nps-2008-jean.E* /mnt/ewf/" to combine the two evidence files into a single Unix style image file called "/mnt/ewf/nps-2008-jean" (note: we use the "nps-2008-jean.E*" argument so it picks up all EnCase parts). Afterwards, there will also be a text file containing the MD5 hash as originally calculated by EnCase. You can then use the command "md5sum /mnt/ewf/nps-2008-jean" to calculate a local MD5 hash for comparison with EnCase but it took a few minutes on my VM.
4. Install the "ntfs-config" package using the Synaptic Manager.
5. Use "losetup -o32256 -r /dev/loop0 /mnt/ewf/nps-2008-jean" to map the image file to a loop device (ensuring you specify the offset 32256 so the loop device is mapped to the Filesystem and not the beginning of the disk image. Blog/book has more info).
6. Use "mkdir /mnt/m57jean" to create a mountpoint directory that we can use later.
7. Use "mount /dev/loop0 /mnt/m57jean/ -o loop,ro" so we can map the loop device to a read only directory.
8. As a test, use "ls -al /mnt/m57jean" to list the contents of the filesystem. You should see your typical Windows XP folder structure eg Documents and Settings, Program Files etc.

So to summarise, we've combined the 2 EnCase image files into one large image file and then mapped it to a read only directory called "/mnt/m57jean".

This article also has more information on read-only mounts for SIFT:
http://computer-forensics.sans.org/blog/2009/02/19/digital-forensic-sifting-how-to-perform-a-read-only-mount-of-evidence/

Some other potentially useful information:
Between steps 4-7 above, you can also use "fdisk -lu /mnt/ewf/nps-2008-jean" to show the filesystem type info (ie HPFS / NTFS).
If you need to unmount a directory, use "umount /mnt/m57jean" for example.
If you need to reset the loopback device, you can use the "losetup -d /dev/loop0" command.
If you restart the SIFT, it will lose all the mounting stuff and you'll have to do it all over. Can be helpful if you make a mistake and can't figure out how to recover.

You can also load up FTK Imager to preview the .E01 file directly from "/cases" but while you can browse the files thru FTK Imager, the other SIFT tools won't be able to read the EnCase format.
You can also browse the "/mnt/m57jean" folder using the Ubutu file explorer - just double click on one of the folders on the left hand side of the desktop and navigate to "/mnt/m57jean" (after completing steps 1-7).

I'll stop here and post my method(s) of investigation in the next post - just in case you want to figure out the next part yourself...

Law Enforcement?

To be balanced and equally offend / amuse our Law Enforcement friends, here's a LE version ... I was thinking of having Cheeky4n6Monkey toting a nightstick and Ray Ban sunglasses but thought he'd look a little too mean / fierce.
For my next post, I reckon I should post some actual CF stuff. I'll give a summary of a couple of practice investigations using SANS SIFT. Hopefully, that might help other beginners save some time.

E-Disco(very)?

This idea came to me after coming across the shortened slang term for Electronic Discovery ... Admittedly, this is VERY loosely related to computer forensics - but wait, there's more to follow ...

So What Next?

So, what next? I'm kinda out of ideas for now ...
Any suggestions related to computer forensics and/or themes for future monkey mayhem are welcome at this time.

Just For Laughs

So this one was just for laughs. Nothing too forensicky about it. Like I said before, I have a weird (juvenile/disturbing/dirty) sense of humour ... Monkeys with lipstick on FTW!
It looks like a bit of rush job - drawing that monkey body took AGES. So by the time I got to the face, I don't think I kept it consistent with the earlier toons.

My Previous Career

So this is what I used to do for a career. Truth be told, I was OK at it - I could get by but I was not a guru. Not even close. Probably explains why I got so frustrated with it. That and the fickleness of GUI design.

Still, I figure it should help with all the scripting in Computer Forensics.
Dilbert was popular at my old workplace(s) - especially the Software Development themed ones. Who knows, maybe Cheeky4n6Monkey could find another "alternative career" ... But not yet with this clumsily drawn monkey anatomy!

Job Hunt

Like so many others, I have finished my formal University studies in Forensic Computing and have been trying to land that oh-so-elusive first Computer Forensics job. Something in law enforcement would be ideal but E-Discovery and/or Consulting has not been ruled out either. Beggars can't be choosers and all. This toon is just summing up my frustration at my current employment situation.
In the meantime, I have been doing some research - mainly using the SANS SIFT kit to work though some scenarios and reading up on whatever Computer Forensics material I can get my paws on.

First Post

So this is my first publishable attempt at humour. I was tempted to use Harlan Carvey's Windows Forensic Analysis for the book title but figured he might not share my sense of humour. Not many people do ;)

Welcome To The Jungle

Greetings fellow primates!

Cheek4n6Monkey just checking in here. I originally started drawing these pictures for a laugh and to pass the time away ... Its not like computer forensics peeps don't spend enough time in front of a computer screen already eh?
Anyway, from time to time, I may stumble my way through an ephiphany (for me) but I shall try to keep it light and entertaining. At some point, I may also try talking about some technical stuff - please feel free to correct/advise me.
Comments are always welcome and appreciated.

Yours in Bananas,

Cheeky4n6Monkey