| |||||||||||
|
| |||||||||||
Linux tool speeds up police computer forensics (ZDNet)Linux tool speeds up police computer forensics (ZDNet)Posted Mar 7, 2008 1:30 UTC (Fri) by drag (subscriber, #31333)In reply to: Linux tool speeds up police computer forensics (ZDNet) by xorbe Parent article: Linux tool speeds up police computer forensics (ZDNet)
I think that it's more likely that it's done on the kernel-level. That they actually made a patch that removed the ability of the kernel to write to drives. With a live cdrom you should be able to eliminate all ability to write to any media, period. The only thing you would have to have write access to is tmpfs. I bet it would be useful for making images. Say you use dd to read the drive then netcat to transmit the image over a network to another machine that has read-write ability. That way you could prove in court that under no circumstances any OS other then the one used by the defendant had any ability to write to that drive. It would be demonstratable that the investigator could not write to the drive even if they tried.
(Log in to post comments)
Linux tool speeds up police computer forensics (ZDNet) Posted Mar 7, 2008 3:33 UTC (Fri) by ncm (subscriber, #165) [Link] Except it's also, mysteriously, unable to write to the network.
Linux tool speeds up police computer forensics (ZDNet) Posted Mar 7, 2008 3:51 UTC (Fri) by njs (subscriber, #40338) [Link] >I think that it's more likely that it's done on the kernel-level. That they actually made a patch that removed the ability of the kernel to write to drives. That would be the cool way to do it, but I doubt that a few random admins in Australia really want to start maintaining their own modified ATA/USB/Firewire/etc. stacks. It also is incompatible with the quote in the article that says "if for some reason a disk is writeable, the system will halt automatically", which wouldn't make sense if their kernel had no writeable state in the first place. It sounds more like they just made a livecd that mounts filesystems readonly, and also as a crude defense against "mount -o rw,remount" they added a cronjob that does "mount | grep -q rw && halt" every few seconds. Which makes sense, in context -- it sounds like the goal was to create a tool that ordinary police officers could use to quickly check for the presence of contraband material, to reduce the amount of work that skilled technicians would need to do. Those who are clever enough to convince the CD to give them a shell, remount the drives, and start modifying things, are already working back in the lab anyway :-). > I bet it would be useful for making images. Say you use dd to read the drive then netcat to transmit the image over a network to another machine that has read-write ability. That way you could prove in court that under no circumstances any OS other then the one used by the defendant had any ability to write to that drive. *cough* ...and the OS running on the machine that's actually writing out the disk image? This sounds more like gee-whiz -- not that there's anything wrong with gee-whiz! -- than real security...
Linux tool speeds up police computer forensics (ZDNet) Posted Mar 7, 2008 5:58 UTC (Fri) by drag (subscriber, #31333) [Link] > *cough* ...and the OS running on the machine that's actually writing out the disk image? This sounds more like gee-whiz -- not that there's anything wrong with gee-whiz! -- than real security... The investigator can molest that all he wants. That's the entire point of making a image in the first place. Of course your going to have more then one copy. In order to investigate files he will have at some point access a copy of that file system and essentially every time you do that it makes changes. If there is any doubt to the validity of the investigater then you can get a third party to run their own investigation on his investigation by making their own image of the original, pristine drive. As far as network security goes you just do it on the physical level. ie don't connect it to any router or anything that can access any external network. The point is not so much security as audit-ability.
|
|||||||||||