05 - Forensic data decoding

Question 1

Suppose we’re inspecting a text file (ilovepessoa.txt)
using different editors
They may show different things! Why?

Answer 1

Data is encoded using a character encoding scheme
that editor application is having trouble to identify

Question 2

What is the common code text representation?

Answer 2

ASCII
(7 bits)

Question 3

How many bits the ASCII extension uses?

Answer 3

8 bits

Question 4

What is the most common unicode?

Answer 4

UTF-8

Question 5

Why do we in forensics usually need to inspect the raw
bytes, for which we use a hexadecimal editor (hex editor)?

Answer 5

Because the raw bytes contain the ground truth.

Question 6

Most chars use 1 byte, accented chars use … bytes.

Answer 6

Accented chars use 2 bytes.

Question 7

How an editor determines the encoding of text file?

Answer 7

Uses a default encoding scheme
Uses heuristics
Uses embedded information: BOM

Question 8

What is BOM?

Answer 8

The Byte Order Mark (BOM) is a Unicode char that appears as a magic number at the start of a text stream telling its encoding.

Question 9

How does an editor see if it’s ASCII?

Answer 9

Test if the bit 7 of all bytes is unset.

Question 10

Integers are stored as a … of one or more bytes.

Answer 10

sequence

Question 11

Endianness tells the … in which the sequence of bytes is stored

Answer 11

order

Question 12

Is it possible to encode 2/4-byte characters in little endian or big endian?

Answer 12

Yes.

Question 13

Does the BOM marker includes information about endianness?

Answer 13

Yes.

Question 14

UTF-16/UTF-32 without BOM is big endian or small endian by default?

Answer 14

Big endian.

Question 15

Base64 is a popular encoding scheme, for what?

Answer 15

Used to encode email attachments and certificates.

Question 16

Base64 encoding mechanism?

Answer 16

[Dados binários] -> 3 bytes (24 bits)
↓ divide
[4 grupos de 6 bits] -> 4 números (0-63)
↓ tabela Base64
[4 caracteres ASCII seguros]

Question 17

What if we need to forensically analyze structured data types?
They are everywhere, e.g., file formats, disk layouts, network packets, etc.

Answer 17

Strategy: decode raw bytes using knowledge of the data type layout (tools can help us).

Question 18

Beyond payload data, can file formats include useful meta-data?

Answer 18

Yes.
E.g., timestamps, camera model, GPS coordinates, user name, software version that generated the file, etc.

Question 19

Raster image?

Answer 19

array of pixels, each encodes a specific color.

Question 20

How many bits per pixel in a raster image?

Answer 20

24-bit RGB images encode each pixel with 3 bytes, one per channel: red, green, and blue
Each value tells the intensity of the color varying from 0 (min) to 255 (max) of each channel.

Question 21

What is BMP?

Answer 21

Bitmap Image File (ou simplesmente “bitmap”).
File Header - 14 bytes
DIB Header (Bitmap Info Header) - 50-byte
Pixel Data (Bitmap Data) - variável

Question 22

ZIP files: archives that store multiple files. Start with letters…

Answer 22

PK.

Question 23

How to decode a file not knowing its format?

Answer 23

• Look for magic numbers: consist of constant numerical
  or text value used to identify a file format or protocol.
• ## Use helper tools, such as “file” (‘file’ and other tools check for magic numbers)

Question 24

What does the string command do?

Answer 24

Strings command: prints out the readable characters from a file.
Useful for looking at data fiels without the originating program, searching executables for useful strings, etc.

Question 25

What if the file is corrupted?

Answer 25

Inspect the file using a hex editor and apply fix.

Question 26

What if files are encrypted?

Answer 26

Cracking approaches: - Brute force: try every possible key / password until succeeds - Dictionary attacks: reduce the number of trials required and will usually be attempted before brute force Automated by password cracking software - A password cracker works by trial and error - Examples: fcrackzip (for zip files), pdfcrack (for pdfs)

Question 27

What is a rainbow table attack?

Answer 27

- Type of dictionary attack that uses pre-computed tables of data to reduce the time required to crack passwords - Rainbow tables are usually created by hashing all possible passwords with a cryptographic hash function and then storing the hashes in a large database - If have access to the hashed pwd and the pwd hash is not salted (i.e., same pwd will always generate same hash), you can compare it with value in table

Question 28

Tips for interpreting file content?

Answer 28

Extension not entirely reliable Open the file and check between (text / binary) Look for known header and footer information - In particular check for file format signatures (e.g., magic numbers) Use tools that know how to interpret specific file format If the file format is unknown, we analyze it manually

Question 29

What is Steganography?

Answer 29

Steganography: Art and science of communicating in a way that hides the existence of a message. Steganography simply takes one piece of information (secret) and hides it within another (carrier / cover).

Question 30

What is digital steganography?

Answer 30

Digital steganography works by encoding secret bits in files, such as photos or audio files, with secret data. - The secret message and the carrier message are digital objects.

Question 31

Ways to do steganography (exploiting the image format).

Answer 31

Hide the secret into unused portions of the carrier file. Idea behind this is to abuse the recognition of EOF: - Opening Stego.jpg on photo editor ignores anything coming after the EOF tag - However, when opened in Notepad, our message reveals itself Append secret into headers: - In Extended File Information (EXIF) - In GIF’s comment extension - ZIP also has a region for adding comments

Question 32

What is LSB?

Answer 32

Least Significant Bit (LSB): - The LSB of a pixel is used to encode hidden information.