W. Curtis Preston: You found the backup wrap up your go-to podcast for all things
backup recovery and cyber recovery.
In this episode, we explore the crucial world of ransomware forensics with
cybersecurity expert Mike Saylor.
We cover why forensics is important during a cyber attack, the essential steps and
tools you need to do the job, and we shed light on how organizations can prepare
for and respond to ransomware incidents.
From preserving critical evidence to navigating the complexities of
mobile device forensics, this episode will explain how to use ransomware
forensics to unravel cyber attacks and protect your valuable data.
By the way, if you have no idea who I am, hi, I'm w Curtis Preston, AKA, Mr.
Backup,
and I've been passionate about backup and recovery and related topics ever since.
I had to tell my boss that we had lost the production database
and had no backup for it.
I don't want that to happen to me.
I don't want that to happen to you, and that's why I do this podcast.
Here we turn Unappreciated backup admins into cyber recovery Heroes.
This is the backup wrap up.
Welcome to the show.
Before I continue, if I could ask you to press that subscribe or follow
button so that you'll continue to get.
Our amazing content I am w Curtis Preston, AKA, Mr.
Backup, and I have with me my power loss counselor Prassanna
Malaiyandi, how's it going prasanna.
Prasanna Malaiyandi: I'm doing well, Curtis, I know you, not so much,
but hey, isn't solar and batteries and everything else supposed to
solve all these issues for you?
W. Curtis Preston: I, I was a, as you know, I've been working on behalf
of this one customer and we've been conducting the first ever backup
of some really important data.
Um, and it's like 500 terabytes of data, and we're down to the, we're kind of down
to the, I think the, the, the finish line.
And, uh, I had, I'm running a bunch of backups and I had divvied the backups up
into thousands of little policies because for many, many reasons, and some of those
policies were still, even though they were backing up, only a single sub, sub
subdirectory, they've been running for like 10 days when I lost power yesterday.
When the customer lost power
Prasanna Malaiyandi: Ouch.
W. Curtis Preston: rebooting And there is no
Prasanna Malaiyandi: my question for you
is why is there no resume functionality for.
W. Curtis Preston: there is in uh, so in this particular
customer, we're using that backup.
There is a resume functionality in that backup, but not for SMB.
Our network based backup.
So we're doing, we're backing up over s and b.
Um, we, we tried s and b and NFS, uh, we're backing up over s and b
and there's no resume functionality.
So I will start over.
Um, and we will have lost 10 days and this backup that is taking forever.
Good times.
Prasanna Malaiyandi: I am sorry Curtis, but
in,
W. Curtis Preston: That's all.
That's all I needed to hear.
Prasanna was somebody.
Say there.
Sorry.
Oh, goodness gracious.
But as I told you this morning, when I texted you, at least I found out
that the reboot that was not my fault
Prasanna Malaiyandi: Yes, it was not the server randomly
W. Curtis Preston: was not, the server was not,
yeah.
Prasanna Malaiyandi: oh, I'll, I asked you first it was like, was it CrowdStrike?
W. Curtis Preston: Yeah.
Yeah.
was not, it was not CrowdStrike.
It is a window server, but it was not CrowdStrike.
Uh, CrowdStrike is not running on the server.
I did check that, by the way.
But, uh, anyway, but speaking of the cyber world, we once again have
our friend of the pod, Mike Sailor, uh, uh, joining with us today.
How's it going, Mike?
Mike Saylor: Afternoon, I'm well.
W. Curtis Preston: So, uh, we're gonna, and, and for those of you
that follow the show, you're gonna see a lot of mike, uh, over the next
little bit, uh, because we're diving deep, diving deep into the world of
responding to a ransomware attack.
And today we're gonna talk about the forensics phase.
So, uh, Mike.
What, what do we mean when we say that?
Why would we be doing forensics in the middle of a cyber attack?
Mike Saylor: Well, uh, it's a great way to collect evidence in a, in a
safe, uh, controlled environment.
And so forensics creates a read-only image of, of your target.
So whether it's a whole machine or a particular file or object, uh.
We create an image of that that's read only so we can play with it
and look at it and not have to worry about it executing more malware
or trying to do what malware does.
But, so there's one thing.
So some, some safe analysis.
We can build a sandbox.
The other part of that is, uh, in that analysis, we, we can learn things about,
um, you know, particular, uh, artifact.
So if it's malware, uh.
Uh, is there any metadata that would indicate, you know, the type
of malware where it came from?
Uh, is the signature or hash value of this malware similar to other, um,
other cases using the same malware?
But then if we expand that from just that object or artifact into the, like
an entire system, uh, forensically without having to change, so.
I guess fundamentally I'll add, uh, forensics allows us to interact
with, with evidence without changing any of that metadata.
So if you log into a machine to review what happened to this machine, you're
also changing data in the machine.
You're, you're, you're, you're stepping on evidence potentially,
or changing.
W. Curtis Preston: what's the, there, there's a thing in science, the
observational effect for something.
There's a, there's a word for that.
Mike Saylor: Yep.
So once you interact with, with
it, it changes,
Right.
So observation, simple observation.
Sometimes, uh, uh, muddies the water.
So creating forensic image of, of whatever it is, allows you to play
with it and, and interact with it without changing the fundamental
evidence of any attributes or metadata.
It.
So if I, if if a machine as an example, uh, since we're talking about incident
response, if a machine is infected or, or we suggest something or we suspect
something happened, compromised, uh, employee downloaded a bunch of data on
their last day, whatever, whatever our suspicion is that led us to this machine,
if we do a forensic image of that, a couple of things, uh, are important,
uh, about that one, we can review all that stuff without changing anything.
So if we.
If we need to hand it over to legal counsel or it goes to court
prosecution, any of that stuff.
It, it is in the state.
It was, uh, whenever that event happened.
The other thing that allows us to do is determine attributes
of certain activities.
So if it's malware, ransomware, as an example, how did it get on this machine?
What did the log files say?
What is the, uh.
What network was it on?
Was it attached to a wifi?
Where did it go?
What connections did it make from this machine to other machines?
There's a lot of good stuff, uh, that you're able to dig into.
Uh, if you have the right tools and you know where to look.
Prasanna Malaiyandi: So when you say forensic image, what exactly do you mean?
Right.
Is it just like, 'cause I know we've talked, especially on this
podcast previously about like snapshots and backups and everything
else, but that's sort of like copying the data out sometimes.
Like if you're doing an image-based copy.
Of like a virtual machine, you get a virt, uh, duplicate
copy of that virtual machine.
Is there something different when you talk about forensic image that
goes beyond just sort of taking a copy of like a virtual machine?
Mike Saylor: There's a couple of things that, that make the term
forensic imaging a little different.
One forensic, the forensic part of that term is really just the
discipline, understanding how to approach and, and conduct, uh, a
forensic imaging, um, in a, in that, in that approved manner, you've got
a formal
Prasanna Malaiyandi: you don't change things right, like you
were talking about previously.
Mike Saylor: It's consistent.
So if it goes to court as a forensic expert, I can say I did this the
way that I've done all of them.
And there's this documented formal process that's, you know, approved and
and known by industry and accepted in court cases and that kind of thing.
So there's the discipline of forensics that lends itself
to the forensic imaging term.
Uh, more specifically it's called forensic acquisition.
Uh, so we're acquiring the data and the way that we're acquiring
it is through a forensic.
Least sound imaging process.
Now, another, another term, uh, that, and, and this goes back to just normal, like
investigative processes is best evidence.
And so for example, if, if, uh, I'm working on a MacBook Pro that's
got a, an integrated storage DR.
Drive and it's encrypted and there's just, they.
And I, and I'm time constrained or resource constrained, or the
building's on fire or whatever it is, I'm not gonna be able to do a a, a
sound forensic image of that laptop.
What would be better and more timely and possibly as valuable?
Best evidence would be an iTunes backup.
Prasanna Malaiyandi: Hmm.
Mike Saylor: Let's do an iTunes backup before this building burns down, and I run
outta time, and that is the best evidence I had the ability to get at that moment.
You mentioned snapshots or even other backups?
Um, we, we, back in the day when, when we were doing a lot of email forensics,
we were, we would do two, we would do the local PST file and then the, the
backup, uh, from the exchange server.
W. Curtis Preston: Yeah.
Mike Saylor: there's, those are good evidence, one or the other.
W. Curtis Preston: It probably falls, uh, Mike, it probably falls in, you
know, a lot of stuff we talk about here.
We talk about good, better, best, right?
So, you know, good, you know, not good is nothing.
Right.
Good is something right.
So like, you know, said like the PST files, uh, maybe an iTunes backup, maybe
any kind of backup that would help prove the, the whatever it is, the thing that
you're trying to prove or investigate the thing you're trying to investigate.
The next level, I would think would be an image of the hard drive, like
a full image of the hard drive.
The next level beyond that would be the full image of the hard drive plus.
The, the image of the memory at the time of the system running right.
Um,
Mike Saylor: And
so that, that discipline, that discipline lends itself to your
understanding as a forensics expert of, of how to approach this situation.
If the computer's on, yeah, I can do a memory dump of that if it's
not on, well, it's not even probable
unless, you know, the virtual, the, uh, like the, the drive, uh, storage
drive cache, uh, but also understanding the, the fundamentals of the device.
Your, your target is, I mean, is it a.
Can I take the hard drive out of this?
Is it sd?
Is it, you know, mechanical?
Is it flash, is it integrated?
Um, all of those things are important.
Uh, one thing I'll just add real quick to best e evidence, it's also, uh, and
I, I alluded to this in my example of the, the house is on fire, what have
you, but it's also, uh, logistics.
So if, if, if the, if the case is in, you know, in Europe.
The likelihood that we're gonna timely be able to get a forensic image of
that device is, uh, is pretty limited.
You know, they, we, I've either gotta send somebody there or
they've gotta ship it to me.
Uh, and in both cases you've got some logistics.
So if it's a virtual environment, just take a snapshot, upload it through
a cloud, make it available to me, I can pull it down or work on it.
Um, and so those are also acceptable alternatives.
W. Curtis Preston: don't, those don't, those snapshots in a virtual
environment that they usually contain, uh, the memory image, right.
Mike Saylor: From the virtual environment,
they typically do your
W. Curtis Preston: Yeah.
Yeah.
Mike Saylor: Yep.
Yep.
Prasanna Malaiyandi: So as you're describing all of this, Mike, I was
just thinking this is something that's like way outside the scope of like
what a normal IT person does, right?
Just even thinking about like how do I even approach this?
Maybe you might get some of this from like the secure, like a security person,
but just like an IT generalist probably.
Isn't thinking about things in this way, right?
They're probably thinking about how do I quickly recover my
machine if it was down right?
How do I get people back up and running?
Not necessarily how do I preserve evidence to figure out what went on?
Mike Saylor: Yep.
And it's, uh, I, I've seen it implemented just as normal standard
operating procedure in some, some environments, uh, where every
employee that leaves, they do an image
of that laptop so that they can preserve that.
They then they, uh, rebuild the machine and put it out.
Uh, redistribute it.
Uh, so that if, and that, and that's, uh, for, for it to become more efficient.
So they're not, they don't have this, this laptop on a shelf somewhere for some,
you know, 34, 5 days until management decides they don't need anything.
The day that they, they separate, they get that laptop back, they
image it takes a couple of hours, uh, they're then able to rebuild it.
So by the end of the same day, they're able to re redistribute that image
or that that laptop and then preserve that image on, on a server somewhere.
In case it's needed in the future.
W. Curtis Preston: Yeah, it's, it's a very different.
Um, like, like you said, broan, it's a very different discipline than
backup and recovery, even though it's kind of a backup, it's just a backup
done for a very different purpose.
It's just like archive.
Archive is kind of like a backup but done for a very different purpose.
Right.
This is, this is kind of like an archive.
'cause you're, you're basically making a one time copy of the drive,
um, for the, for the purposes of.
Other things, you're not doing it generally, you're not doing it.
Um, that the, the departing employee defense thing, uh, Mike, maybe one
of those where there's dual purposes, you may need that image later
because you accuse the, the, the, um, the employee of doing something.
You may need that image later when you find out, oh crap.
The, uh,
Prasanna Malaiyandi: They had a file.
W. Curtis Preston: he was the only guy working on the empty squad
project, and it's only on its laptop.
Well, first off, that was an it fail, but.
That may be a reason to use your use, use your forensic image for something else.
But in this case, primarily what we're talking about, right, is we're
in the midst of a cyber attack.
We're going to get, you know, I, I like your term best evidence.
We're gonna get the best copy that we can of the environment that we believe is,
is, uh, subject to this attack so that we can use that for multiple purposes.
You talked about.
I like that first one.
You talked about taking that image and putting it into, when you first said it,
I, I didn't understand what you meant.
You said you, you said something like, it allows you to interact
with it in a, in a safe environment or a controlled environment.
I was like, whatcha talking about controlled environment?
We're in the midst of a cyber attack here.
But you're talking about taking that image and moving it to a different
environment where you have more control over the, over, over, the network.
Is that that what you meant?
Mike Saylor: OO over the, over the image that you're,
you're playing with.
But, but forensics tools also allow you to, to rebuild an environment.
So if I image.
You know, four net networked PCs, then I can, I can load all of those
images into one case in my forensics tool and view all of the data across
all of those images concurrently.
I don't have to treat them as individually.
It becomes one big data set.
And the other thing I'll add too is that, um, you know, fundamentally, uh.
And that is consistent today.
Even the, some of the tools that forensics, uh, practitioners use
are, uh, the, the fundamental capabilities are based on traditional
system tools like DD and the Linux
Unix environment, uh, ghost and, and SIS tools in the Windows environment.
I mean, that's, those are tools we used, you know, 20 years ago to to do imaging.
Um, and then today, so today a lot of the forensics imaging tools,
some of them are available free, uh, because they want you to then use
their, their expensive analysis tool.
Um, but to your point about, uh, the, the normal IT or ops person not being familiar
with forensics, I think they are, again, to your comment about the, from the, from
a backup perspective or cloning or a.
Uh, you know, imaging, you know, I, I've, I've created a, i, I
built a laptop and this is the way I want all my laptops to be.
So I made this golden image, but then I'm gonna apply on every laptop we build
and distribute same, same principle and some of the same fundamental tools.
Um,
W. Curtis Preston: I like,
Mike Saylor: I think.
W. Curtis Preston: I like the comment that you talked about and you, you
reminded me because when you make that forensic image with some exceptions,
that that image is really just an image of a hard drive that can be mounted and
accessed without actually running the operating system of that hard drive.
So if you can get.
You know, obviously if it's encrypted, if it, you know, there's some scenarios
where this doesn't work, but in many cases you're talking about putting
those forensic images into a case in a forensic, uh, what would you call that?
A discovery tool?
What would you call it?
Forensic analysis tool, right?
Mike Saylor: Processing and analysis are
the next couple of.
W. Curtis Preston: And you can interact with those images and you can look at
the files that are on those images.
Without actually doing further risk by actually running those
images as a, as a machine.
Prasanna Malaiyandi: Or I think in addition, you could also, like,
uh, Mike was saying you could run those images if you wanted to
say, for instance, understand the interactions between those four network
W. Curtis Preston: You Yeah.
Prasanna Malaiyandi: talking about in a
safe manner, right?
W. Curtis Preston: yeah, you,
can.
I'm just saying you don't have to necessarily, depending
on what you're, uh, and it
Prasanna Malaiyandi: Trying to accomplish,
W. Curtis Preston: occur to me until he was talking about putting them in
a case in that, um, analysis tool.
Mike Saylor: So imagine, imagine as an IT ops person, uh, you've got an issue
with a, uh, a workstation and you've gotta go and, and interact with this.
But be careful not to change anything while you're also searching for whatever
it might be, a hash value, uh, reviewing logs to determine what happened in a
period of time, uh, and then correlating those log entries to well, alright,
so this, the log says this happened.
Now let me go look in the, in all the file structure and do some, you know, power
shell or whatever searches you're gonna do to see what correlates to that log entry.
Imagine how much time that would take you
W. Curtis Preston: Right.
Mike Saylor: with forensics, I'm just going to image the whole machine and,
and one thing I'll make clear too, there are different types of forensic imaging.
There is whole disc imaging.
And then there's targeted imaging.
So maybe, uh, and this is important in like cloud and, and multi-tenant
environments where I just want one VM or one piece of the vm because that's
what my, my warrant allows me, or the scope of my investigation allows me.
I can't go outside of that or shouldn't, but if, uh, if I do a,
a bit for bit, you know, first bit to last bit physical image of a, of
a drive or a of a, of a device, I.
Um, the next step in forensics, uh, the forensics process is processing.
It's also called indexing.
So I'm using my forensic software to analyze every bit of data from start
to finish, even the empty space.
And it indexes that into, well, it creates an index.
So for example, in, in my forensics tool, if I'm looking for the
occurrence of the word apple.
As I type the word apple, my results automatically in real time updates.
So when I type the letter A, I've got 7 million results, and as I finish typing
that word, it tells me specific to Apple, not just how many occurrences,
but where in the entire dataset.
I could have one computer, I could have a hundred, as long as they're
part of the same case, it will give me results across all of the different
data sets that I selected That.
Query to hit, and then I can apply more, uh, criteria like, uh, the word
apple specific to metadata related to a specific SID uh, or user, uh, within a
period of time on a particular piece of evidence related to some other attribute.
And so now you can see the power of that in real time.
They call that a live or an index search.
You can also do a live search while indexing is happening,
but it slows stuff down.
But I.
It'll, it could take, depending on the size of the device, the, the storage.
Uh, it could take a couple of hours to do the imaging.
It could take another couple of hours to do the indexing and processing,
but you could be doing other stuff while the machine's doing its thing.
And then when you sit down to do your investigation, it's almost in real time.
And it, some of the forensics tools now will do timelines for you.
Uh, they'll extrapolate all the media images and, and I mean, you can,
every, every attribute of data you can think of, you can search on and
create, you know, complex queries on.
W. Curtis Preston: So,
let's, let's, let's talk about, um, some of the things that you, you know, again,
talking about good, better, best, right?
So if you're in the midst of a cyber attack, what.
Are the things that you really have to make sure you don't
lose, if at all possible?
I'm thinking number one would be logs.
Uh, obviously what we, what we want is a, is a forensic image of every
machine that we think is, is, suspect that it, that it looks like it might
have be involved in this attack.
That's what we want.
Is there, is there things that we should grab, like logs?
Um, like the, the first thing that we grab to make sure that we, we get that.
Um, is there stuff like that besides the logs?
Mike Saylor: Certainly, and, and, and it, it may change from situation to situation,
but preserving logs is paramount because one, as you guys probably know, a lot
of environments don't have good log settings, so they're overwritten, uh,
usually based off volume, not by.
Age.
And so in a cyber attack, you can imagine the volume of logs
is gonna go up exponentially.
So the likelihood that the, uh, the initial, the initialization of
that attack, the logs related to that are preserved is, is small.
If you don't catch it and preserve those, those, those logs timely.
And we want every log we want firewall, router, switch, nas.
Uh, everything you can think of from external to, you know, from the, from
your perimeter all the way into these, uh, potentially compromised machines.
We want all those logs, uh, even exchange, uh, or Office 365, all that stuff.
Just you need, you need a, a log, uh, log preservation archiving,
SOP that just says, when bad stuff happens, here's everything we need to
preserve and where we're gonna put it.
Which is also something to think about because if your network's compromised and
you're gonna consolidate all these logs into a network location, well, bad guys
could just, well, I'll just wait until they're done and delete all of that.
Um, so there's,
W. Curtis Preston: everything all in one place.
Now let me blow that place up.
Mike Saylor: Bad guys are lazy, I'm telling you.
Um, but then also depending on, like, there's a, there was a big credit union
hack, uh, compromised recently, and it was determined that the source of
that attack came from a mobile phone.
It was a, a network user that interacted with a.
Uh, it was either a website or an email.
Uh, is a, it was a, a no click malware that infected the phone.
And then because the phone was on the production network, it was able to spread.
Uh, who would've thought to go back and get an image of that phone
Prasanna Malaiyandi: Yeah,
Mike Saylor: or that tablet?
Uh, so it does, it does.
There are some nuances based on what the situation is, but
fundamentally, you're right, Curtis, uh, preserving the logs is very
W. Curtis Preston: Is there anything that's just beyond that?
Mike Saylor: So you can go to your ISP 'cause they, they typically have some
data, uh, depending on the, the service that you, uh, you subscribe to, uh, and
your, your ISPs, uh, operating procedures, a lot of times they'll drop, they'll drop
known bad traffic before it gets to you.
Well then bad guys are just figuring that out.
We're gonna try this, this, this, this, this, and this.
Until we find the, the, the secret sauce or the recipe or, you know, whatever
it is, that allows me to finally talk to the target, the victim network.
Uh, and so the ISP may have some log data that predates, uh, the actual attack.
And that could be important 'cause you'll see bad guys change IP addresses and, and
uh, and hosts and all that good stuff.
Uh, so that, that's, that's valuable information too, to.
Uh, potentially block future attacks.
Um, the other, the other areas to consider too, um, is, is who do you outsource
or rely on from a service perspective?
If you outsource, you know, your firewall management, uh, if you
outsource your backups, if you outsource, if you have cloud environments
and, uh, you have, uh, service providers that help you with those.
Uh, if you have an it, if you have an MSP that helps, you know, does your, your
help desk and some other, those, uh, some of those other services, that's gotta
be part of your incident response plan.
You know, not just preserving logs.
And sometimes you may have to call those, those partners and service
providers to get those logs archived.
But again, you know, part of incident response is having all that figured out
today, uh, before bad stuff happens.
So you've got a, a good, a good playbook to
run to run.
Prasanna Malaiyandi: Is there, a recommendation?
So I know you've talked about how logs are super important in all of this.
Is there a recommendation on how long, I know you talked about sometimes people
do more volume-based than date-based for keeping logs, but is there sort of like.
A recommended practice in terms of how long they should keep their logs.
'cause speaking from the privacy side, which I'm very interested in, right,
there's sort of the downside of keeping too much data for too long, right?
Versus uh, not having enough data so you can do these incident
responses and where's that balance?
Mike Saylor: There's a couple of parts to my answer there, and
the first, the fundamental, uh, response is making sure your logs
are configured, uh, appropriately.
So our, we, we call that the value of your log data.
So what's the value of the information your logs are collecting?
Um, and that value could be business related.
So when we review a log, we, we always ask, why are you logging that?
Well, because we use it for X, Y, and Z.
Okay?
Uh, but if it's, if it's just a, I don't know, someone set, set it up
that way, I'm not sure why we do that.
Uh, so let's, let's have a conversation about in improving the value of your logs.
So there's one thing, and that could reduce the size of logs, it
could expand the size of logs, but nonetheless, it's more valuable.
And that's both from a, like a, a, a detection perspective,
uh, but also incident response.
So, uh, logs are important for a lot of reasons.
Uh, and then some regulatory, um, situations.
Logs are
required simply because of the business you're in, like
financial, the financial sector.
So making sure your logs are valuable is step one.
Uh, and that could then dictate.
How long you keep them based on the, the resulting log
size.
But ideally, you want, you want whatever that host is.
Creating the logs, you want something else to collect that log from the host.
So if the host is impacted, you're not worried about the logs on the host.
They've already been sent
somewhere else, like a SIS log server.
Um, that, I mean, sis log servers are Kiwi servers, I think they used to be called.
Uh, you can do some cool stuff with those.
You can write rules and have 'em, you know, email you or
paid you back in the day.
Uh, but good, better, best, best would be let's have all the.
the.
The, the good log sources, the good data sources, let's ingest those into
a true sim like security incident,
event management platform that can run analytics 24 hours a day and do some
better, cooler, more effective stuff, while also giving us good visibility
across the environment, both east and west and, you know, uh, within the environment,
north, south, in and out of the
environment.
W. Curtis Preston: and also by doing that, you.
Um, you know, if you, if you did it right, I would think you would also provide a
separation so that those logs are not as easily accessible by the bad guys, right.
Um, right.
having having them all in one place.
I like the idea of having a, a Sims o tool.
Look at it, um, and look at these logs on a regular basis to say, Hey,
there's something going on here.
You might want to take a look.
Right.
It'd be nice to be notified of, of something suspicious.
Um, you know, versus that, and this is, I I think one of the recurring themes that
we're we're going here is there are things that you really need to do in advance.
So, you know, la last call we talked about assume breach, right?
At some point you're going to be breached.
You need to be prepared for that.
And so one of the things that we're talking about is be prepared to do
forensic images, be but be prepared, uh, to, to separate these logs, right?
You know, like you talked about, like having a Syslog server,
having a centralized log.
Uh, management system.
And then I do like the idea of, of that, you know, the best would be putting
that into an actual, uh, like a sim sort tool that's gonna actually analyze that.
Um.
So let's go back to the, to the, to the, to the imaging.
I, I, I completely agree with you that the tool, many of the tools, they're
using the same techniques that we used back in the day to do what we used
to call bare metal recovery, right.
Um, a hundred years ago, before everything was virtualized, the idea
of being able to restore a server from bare metal was a thing that we tried
to do, uh, and that required an image.
Right.
That's when we talk about forensic imaging, all we're talking about
essentially is, you know, an image that's typically a, a level
below the file system, right?
This isn't just a, a file system backup, which is generally all we take now.
Uh, well, I'll, I'll back that up.
In the virtualized world, we also take, um, images, we, we've, we've figured out
how to do backups at the image level.
While being able to do file level recovery, which is a beautiful thing.
Right.
Um, and so I would think that having this is yet another advantage of having
a fully virtualized environment is forensic imaging, I think is a lot easier
to do in the, in the virtual world.
Um, what are the, some of the tools that you run into out there are, there are,
are there really common ones that you see or is it just all over the board?
Mike Saylor: So there's, there are common ones depending on what
the, um, the source device is.
W. Curtis Preston: Right.
Mike Saylor: So if you're talking and, and really today there's, there's
two, there's two forensic disciplines.
There's traditional forensics, which really continues to follow
and is very rigid on forensic, um, process and principles.
Like you, you don't touch the data.
If it's off, you leave it off.
If it's on you leave it on,
um, you handle it in a certain way.
W. Curtis Preston: And, and that's pro, sorry to interrupt you, but
that's probably more focused on like lawsuits and things like that, right?
Is that, am I correct that particular discipline?
Mike Saylor: It, it well that, that discipline is focused on traditional
computers like laptop servers,
workstations, things that have hard drives,
W. Curtis Preston: Okay.
Mike Saylor: and Linux, Unix,
Mac and Windows operating systems.
Um.
So that, that, that traditional forensics, the, the procedures that
you follow are possible because of that traditional hardware.
When you, when you compare that then to a mobile device like an iPhone, you cannot
image an iPhone when it's turned off.
You cannot image an iPhone in some cases by itself, iPhones and some, some of
these mobile devices, smartphones, they have to be mounted in order to be imaged.
Well, you've already violated the traditional forensic principles
of do not modify the data.
Well, I've just mount You had to mount it in order to, to get access to the device.
So a lot of, when, when mobile forensics first came out years
ago, the, the discipline, it was, uh, it was, it was, uh.
Argued very heavily that it shouldn't be called forensics because it doesn't
follow the traditional forensic
W. Curtis Preston: Oh, interesting.
Mike Saylor: Um, however, going back to best evidence when mobile
data made its way to court.
And opposing counsel started to argue, well, it didn't
follow forensics principles.
We were able then to fall back to, well, best evidence, this is the only
way to get data out of this phone.
And so the what you, what you do to make up the difference is good note taking.
I did this on this data time, so when you see that in the mobile device
evidence, you know, that was me and I was diligent in taking those notes.
So, to, to answer your question.
Traditional forensics has its own tool set, and there are
industry leaders, uh, access data.
Uh, I can't remember the name of their company.
It was just acquired, uh, maybe in the last year or two.
Uh, but Access Data was the name of the company, and the product was
called Forensics Toolkit or FTK.
And FTK was most heavily used by law enforcement because of the, of
the, of Access data's willingness to customize and let them do things
that they needed to do to support, you know, law enforcement activities.
Well, that
Prasanna Malaiyandi: comp, oh, sorry.
I was just gonna chime in, Mike, that that company is now owned by Xero,
Mike Saylor: ero Yep.
Prasanna Malaiyandi: which does e-discovery.
Mike Saylor: And, and that was a, a brilliant move on their part.
Uh, the other competitor is, is guidance software and they make, um, their
own, um, their own forensics tools.
Uh, and interestingly enough, uh, guidance software is most heavily used by law firms
and, uh, legal, uh, legal specializations.
And even though.
FTK is more heavily deployed around the world.
Uh, guidance is the one that set the standard for how forensic imaging,
uh, formats, uh, were, were expected.
They call it the EO one format.
Um.
And, and guidance software's, tools called nk, E-N-C-A-S-E.
And so NK or, or, and that's where the e comes from in the, in the,
in the file extension, EO one.
But most forensic software today, the imagers will, you, you've
got the option to, to select what format you want your image in.
It could be dd, it could be raw, it could be E oh one.
Uh, and then on the flip side of that, so I could, I could make an image with FTK.
And not have a problem importing and analyzing that image in NK,
as an example, or vice versa.
So that's traditional.
Well, then you get to mobile forensics and the, the, the, the field of, of
vendors and tools out there just blew up.
There's, you know, black bag and oxygen and paraben and
cellebrite, which you probably
hear a lot.
Prasanna Malaiyandi: Yeah.
Mike Saylor: As far as getting into stuff, and they're, they're probably on the
leading edge of, of, uh, mobile forensics.
Um, they're, they're always able to do whatever the next best thing is,
uh, and all of these things.
Now, traditional forensics, the pricing is pretty similar.
The licensing models are pretty similar when you get into mobile forensics.
It can be very specific.
Like I just want a tool that tells me that extracts all the chat messages and media.
That's all I want.
Very low cost, but that's all it does.
Then you've got tools that, like Cellebrite that run the gamut
and they have access to every phone, all the way back to the,
the car phones of the eighties.
Uh, and, and, and other stuff like, I need data out of a Nest thermostat
or a wireless, uh, microwave.
You know, there's it, the, the,
scope.
Capabilities, uh, vary widely as well as the the price and licensing.
W. Curtis Preston: Yeah, I know my employer uses Cellebrite quite a bit.
when, when when grabbing, uh, images from phones.
Um.
Mike Saylor: you can, you can get trained and certified in, in all
of those tools like paraben and Cellebrite, uh, certified in that thing.
Um, but much like other disciplines in it, you kind of become a one trick pony.
Like that's all I can do.
Uh, and the same with traditional forensics.
They have certifications for that.
Um, but to become a general forensics practitioner, man, it's, it's
like, uh, it, it's like a lot of different, um, like trades type
Prasanna Malaiyandi: Yes,
W. Curtis Preston: Yeah,
Mike Saylor: job.
You've just gotta, you've gotta live it for
a period of time to
really.
Prasanna Malaiyandi: so basically people like me who get all their
knowledge from YouTube will not succeed in doing forensics.
W. Curtis Preston: You might succeed, but you might have trouble if
you're in some sort of court of law.
Right.
Um.
Mike Saylor: A YouTube video long enough to to give you the
exposure you need for just one
W. Curtis Preston: Yeah, so, so it sounds like, you know, like, like the
other things we've been talking about, this is yet another discipline where.
If you're in the midst of the fire, this is why going back to the previous
episode, you need to, in advance of the fire, get a relationship with a company,
perhaps via your cyber insurance carrier.
Get a relationship with a company that does know this stuff cold so
that they know how, they know what they need to take an image of.
They know how to take that image and they, they know how to do it in such a
way that they get the evidence that they need, uh, without changing the evidence.
And they also know how to manipulate and look at that evidence without,
uh, you know, making the fire worse.
Um, does that sound
like a good summary there?
Mike Saylor: it
does.
And if I could add one more thing that would just enhance the value
of everything you just said.
Is every organization needs to sit through what's called a business impact
analysis and figure out where all those key critical, you know, secret sauce,
jewels of the company are so that when something bad happens, we know
what the bad guys are probably after.
Or at least we know the specifics around all that stuff so that
we're not having to figure it out on, on, your worst day.
Um, and then I think there are a couple of things that, that.
Organizations can document as far as like good first steps in, in helping
preserve evidence in an incident response.
Preserving logs are critical.
Um, but being trained on some forensic acquisition tools like the FTK, uh,
imager, which is free, and having a maybe a small inventory of extra drives that
you can, you can preserve evidence to.
Uh, that stuff, you can write a procedure and it's no different than
like a backup or recovery procedure.
It's just do these things and maybe there might be some decision trees here and
there, but I've written, I've written several, like incident response forensics
kit procedures and, and toolkits for, for clients around the world so that
they can preserve that evidence before I,
before I, you know, it takes me to get there.
Prasanna Malaiyandi: was, The last thing you want, right, Mike?
Based on what you said is like an IT person freaking out that this has
hit and being like, oh, I just need to recover my machines and going
and formatting the drives and then
just starting over.
Right.
That's like literally the last thing that you want.
Mike Saylor: That's right, because now you don't know how it happened.
W. Curtis Preston: So I, I like what you're talking about, Mike.
There's nothing wrong with, with learning some of that stuff,
learning what you can do to support a forensic team that's coming in.
I, I, I do wanna just emphasize, learn, right?
Make sure you're learning it from somebody who says, okay, I.
We're, we're gonna be your team.
We're gonna come in.
Here's what you can learn how to do on your own to support us.
Right?
And here's what not to do.
Right.
Please don't just go shut all the machines down, for example.
We want to get it for, you know, we wanna see if we can get an
image of that memory right.
Um, because that's, that was what I would think would be the first step is literally
just going, powering everything off.
Right.
Mike Saylor: It depends.
If it's, if it's
ransomware, call the plug.
W. Curtis Preston: Uh, and so you have those conversations in advance.
Figure out what it is that you should be doing, uh, to support that team and then
get that team in as quickly as possible.
Well, um, uh, I think, I think we beat this topic to death enough.
Uh, thanks again for, uh, your help, Mike.
Mike Saylor: Certainly, and there are, there are some intro courses
to forensics, uh, that are part of, uh, continuing education programs.
Uh, or degree programs.
Uh, I teach, uh, intro to Forensics, uh, and investigations for UT San Antonio.
Uh, it's a, it's a 700 page textbook.
Uh, but there, there's some parts of this that are more related to
law enforcement and criminal justice degrees that we don't focus so much on.
But it's a great, uh, great insight into some of the elements of
forensics that are important to know.
If you do wanna.
Run a, you know, clone a drive or, or do an image to preserve data
and, and how that data can be used.
W. Curtis Preston: I like it.
Well, thanks, uh, thanks for coming on
Mike Saylor: Certainly anytime I.
W. Curtis Preston: and Prasanna, thanks again for, you know, consoling me
in the midst of my power attack and also asking great questions as usual.
Prasanna Malaiyandi: I try and, yeah, hopefully they realize maybe they
should think about battery backups,
W. Curtis Preston: Well, they had it, it just, it was, the power
outage was long enough that it exceeded the, uh, the backups.
Prasanna Malaiyandi: they just need to expand it.
Mike Saylor: They didn't consider
how long of a battery
they needed.
W. Curtis Preston: Yeah.
apparently, apparently longer than four hours.
Uh, anyway.
All right.
Well, thanks to the listeners.
Uh, we'd be nothing without you.
That is a wrap.
The backup wrap up is written, recorded and produced by me w Curtis Preston.
If you need backup or Dr.
Consulting content generation or expert witness work,
check out backup central.com.
You can also find links from my O'Reilly Books on the same website.
Remember, this is an independent podcast and any opinions that you
hear are those of the speaker.
And not necessarily an employer.
Thanks for listening.