Skip to content
BoKSA

CYBOK 09.1 3 Forencics Operating System Memory Storage

CYBOK 09.1-3 Forencics Operating System Memory Storage

1. The Foundations of Digital Forensics and the Socio-Technical Landscape

Digital forensics has evolved from a niche application of physical science into a strategic cornerstone of modern cybersecurity. Traditionally, forensic science relied upon Locard’s Exchange Principle—the premise that physical contact inevitably leaves a "natural" trace of matter. In the digital realm, however, we must account for a critical socio-technical shift: traces are rarely "natural" occurrences. Instead, they are the byproducts of conscious engineering decisions. Understanding this is vital for evaluating evidence reliability; digital traces exist because a developer chose to log an event or because a system architecture necessitates a specific data structure. Consequently, the investigator's task is not just to find a trace, but to actively prove its provenance and authenticity within an engineered environment.Concept Explanation

  • Digital Forensic Science (Working Definition): The technical process of identifying and reconstructing the relevant sequence of events that led to the currently observable state of a target IT system or digital artifacts.
  • Explicit vs. Implicit Traces: Explicit traces directly record events (e.g., timestamped system logs), while implicit traces allow events to be deduced from the system's state and engineering logic. A key investigator’s insight is recognizing that the observed absence of normal log files is itself an implicit trace, often pointing to a deliberate attempt by a perpetrator to cover their tracks.
  • Socio-Technical Context: Because digital evidence is easily modified and traces result from engineering choices rather than natural laws, the burden of proof regarding data integrity is significantly higher than in physical forensics.Starting Points for Investigation
  • Legal & Quality Thresholds: Familiarize yourself with the Daubert Standard (testability, peer review, error rates, and general acceptance) and the ACPO Good Practice Guide .
  • Accreditation: In professional practice, adherence to ISO/IEC 17025 is the gold standard for laboratory function, certifying the quality, rigour, and competence of the processes used to recover or image electronic data.Points of Attention
  • Integrity: Ensure no action changes the original data.
  • Audit Trail: Every process must be reproducible. An independent third party, following your documentation, must be able to achieve the same result.
2. Conceptual Models: Sense-Making and Information Foraging

Professional investigators manage the "mountain of raw data" using cognitive models to prevent information overload. This involves navigating two primary modes of analysis: bottom-up processes (synthesizing high-level theories from specific bits of evidence) and top-down analysis (using hypotheses to drive a directed search). A fundamental building block of this process is differential analysis , which is applied across various levels of abstraction to identify changes and anomalies.Concept Explanation

  • The Foraging Loop: This is a tactical balancing act where the investigator starts with a high-recall/low-selectivity query to capture a broad set of data. The loop then involves:
  • Exploring: Expanding the "shoebox" (the subset of potentially relevant data).
  • Enriching: Narrowing data through specific, high-selectivity filters.
  • Exploiting: Deeply analyzing artifacts to extract specific facts.
  • The Sense-Making Loop: The process of creating situational awareness by structuring the problem, employing evidentiary reasoning (supporting or disproving hypotheses), and transforming evidence into a legal presentation.
  • Shift in Focus: Modern forensics is moving from state-centric analysis (static snapshots) to log-centric analysis, leveraging high-granularity telemetry and persistent histories of events.Starting Points for Investigation
  • Frameworks: Review Figure 1 (Notional model of sense-making loop) to visualize the journey from raw data to the final "Story."
  • Cost-Benefit: Apply Information Foraging Theory to optimize the time spent on deep analysis versus broad data searching.Points of Attention
  • Bias Check: Avoid "top-down" tunnel vision, where you only seek evidence that supports your preferred theory.
  • Relevance: Triage is essential; you must filter out system noise to prevent the investigation from stalling.
3. Operating System and Storage Forensics

The technical foundation of forensics rests on the von Neumann architecture (CPU, memory, storage). For the investigator, the system is a series of layers of abstraction. Understanding these layers is essential to bypass subverted system interfaces or malware that might lie to the Operating System.Layers of Data Abstraction

  • Physical Media: The lowest level (bits on a disk). Technical recovery here might involve "chip-off" (desoldering memory) from embedded devices.
  • Block Device: The medium as a sequence of fixed-size blocks. Traditionally 512 bytes, the Advanced Format standard (2011) transitioned modern drives to 4,096-byte blocks.
  • File System: The layer organizing blocks into files, directories, and metadata (e.g., NTFS, ext4).
  • Application Artifacts: High-level data (documents, browser history) that relate directly to human actions.Acquisition & Recovery Methods
  • Pseudo-physical Acquisition: Using Host Bus Adapter (HBA) protocols like SATA, SCSI, or NVMe to obtain a block-level copy. This is often more accurate than a simple "logical" copy.
  • Logical Acquisition: Using an API to extract specific files; it is faster but relies on the integrity of the potentially compromised OS.
  • File Carving: Recovering deleted data without metadata by scanning for hexadecimal signatures (e.g., JPEG headers FF D8 and footers FF D9).Points of Attention
  • Hardware Write Blockers: These are mandatory during acquisition to prevent operator error from modifying the original evidence.
  • Data Smearing: Imaging a live system can cause inconsistencies; virtualized snapshots or "cold" imaging are preferred for consistency.
  • Encryption: Technical acquisition is often impossible without keys. Distinguish between technical subversion (exploiting bugs) and legal compulsion (ordering the surrender of keys).
4. Main Memory Forensics: Bridging the Semantic Gap

Memory forensics is the superior method for identifying modern threats like "living off the land" or memory-only malware. It addresses the Semantic Gap —the distance between raw binary in RAM and high-level OS concepts like "processes." While disk forensics shows the past, memory forensics reveals the system’s state at a single, frozen moment in time.Concept Explanation

  • Volatile Data: Information lost when power is cut. An early view in forensics suggested "pulling the plug" to preserve the disk, but this is now discouraged as it causes the irreversible loss of encryption keys, active network connections, and sending/receiving queues of data.
  • Live vs. Snapshot:
  • Live Analysis: Uses a pre-installed agent. It is convenient but can be manipulated by rootkits.
  • Snapshot (Memory Dump): Analyzing a raw capture of RAM. Tools must "reconstruct" the meaning of raw bytes to identify running threads and open files.
  • Accidental Evidence: If a memory dump wasn't manually taken, look for hibernation files , page swaps , or crash dumps , which act as unintentional snapshots of RAM stored on the disk.Points of Attention
  • Trustworthiness: Never fully trust "live" results from a compromised host; the OS kernel may be subverted.
  • Volatility: Memory changes constantly; your acquisition is only a snapshot of one specific moment.
5. Advanced Notes (For 3rd and 4th Year Students)

As storage technology evolves, traditional "bit-for-bit" carving is becoming less effective, and the focus is shifting toward the cloud.

Comparison of Forensic Environments

Feature,Traditional HDD Forensics,Modern SSD & Cloud Forensics
Data Recovery,High Carving Success: Deleted data remains until overwritten.,Near-Zero Recovery (SSD): TRIM/UNMAP commands trigger active garbage collection.
Primary Interface,Hardware-Centric: Focus on physical media and HBA protocols.,"API-Centric (Cloud): The Cloud API is the primary acquisition interface, not the hardware."
Artifact Nature,Serialized Files: Documents exist as discrete files on a local disk.,"Opaque Links (SaaS): A ""file"" (e.g., Google Doc) is often just a link to a cloud-native document with no local representation."
Evidence Source,State-Centric: Focus on the final state of the disk.,"Authoritative Cloud Source: The primary historical record resides on the provider's server, not the client."
Approximate Matching (AM) As datasets reach millions of files, exact hashing is supplemented by AM to find similar data. You must distinguish between:

  • Resemblance: Comparing two peers (comparably-sized objects) to see if they are versions of each other.
  • Containment: Determining if a larger object (like a disk image) contains a smaller object or fragment (like a specific network packet).The Cloud Shift In Software as a Service (SaaS), logical acquisition is now the norm. Investigators must navigate Cloud-native artifacts where "acquiring" a local document might only yield a link. True forensic depth requires requesting the document's revision history directly from the service API to see the evolution of the data over time.