Easy Documentation

Is your documentation look like this?
Step 1: (‎1/‎10/‎2014 12:49:40 PM) User left click on "Start (list item)" in "Start"

It is important to document problems precisely and record error messages exactly how they appear for technical support to help troubleshoot system errors.  Recording the precise steps that a user took in order to reproduce the exact error is even more useful in troubleshooting technical issues when the client is not technical at all.  This is especially important if we need to troubleshoot technical problems remotely.

The word I’ve mentioned above was “reproduce”.   It is very important in forensics to reproduce the exact steps an investigator performs on a live system in order to create repeatable and verifiable steps for volatile or sparse data acquisition.  We can provide hand written documentation or record steps on the system itself.  We can use third party tools for this purpose, but Windows includes a very useful utility that not many people talks about even though it’s been available since Windows 7. 

It is nice to know that we have this utility available that we will not have to take with us or install on the suspect drive.  It is less than 600KB in size and does a great job recording precise steps using official Microsoft terminology and includes time tamps as well.  It creates screenshots with auto highlight of focus area.  It creates the report as a flat report in MHTML format that can be viewed as a slide show as well.  It also allows the saving of the report and it does it automatically as a compressed ZIP archive to save space. 

One of the drawbacks I can see is that it does not record actual characters typed in Command Line Interface ( CLI ).  I guess, it was not meant to be a keylogger, just a Graphical User Interface ( GUI ) action recorder.  For any typed keywords or commands, the user can add comments to the specific step to make it clear if the user finds it necessary.  This can be a useful feature as well since no password will be recorded by mistake and shared with unintended parties.

You can start the Steps Recorder from the Run dialogue or directly from C:\Windows \System32. The executable is called psr.exe.   Give it a try and see if you can utilize its capabilities in your environment.  I would be curious if anyone is using this tool already or if you can see its benefits in some cases.

Galaxy backup - Convert TEC files to JPEG

A Samsung cell phone backup can be made with Kies that is stored by default in the following directory:

C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130417091016

The pattern of the backup directory is very easy to identify. 
The backup history is stored under C:\Users\<UID>\AppData\Roaming\Samsung\Kies\BatchImportExport in file BackupHistory.xml

Many basic configuration settings can be located in the registry under

HKEY_CURRENT_USER\Software\Samsung\Kies

 

If you find out that our evidence contains backup of devices, even if the images were not backed up, we can look at other locations for cached items.  Some of the items will be located in SQLite database, but some of them in individual files;  these files are stored under a BR folder and have a file extension of BK. The BK files can be renamed to ZIP files and extract the database from each.  The location below will have the image thumbnails of pictures and videos.

C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130417091016\Others\DCIM\Camera\cache

I have mentioned in the previous post that TEC files are just modified JPEG files with 6 Bytes extra at the beginning of each file and one additional Byte at its end. 

In this post, I wanted to explore a simple way to extract the images so Windows Explorer's thumbnail view could be used to quickly browse through the images for relevancy.  Dcfldd was an easy and obvious tool to use for this purpose.  The TEC files were copied into input folder under the dcfldd folder and an output folder was created to store the extracted files.

C:\dcfldd>for /f %i in ( 'dir /b .\input' ) do dcfldd if=input\%i of=output\%i.jpg bs=1 skip=6

Where
'dir /b .\input' means to display the basic output of file listings in the input directory 
output\%i.jpg means to save the modified files in the output directory with appended JPG file extensions
bs=1 block size of one Byte
skip=6 skip 6 block or 6x1Bytes at the beginning of the file

iPhone Repair

I just got a broken iPhone that I wanted to examine in its native environment, but the digitizer was broken, so I used my other, working, iPhone to temporarily repair the broken iPhone to extract some information.  This might be valuable process for some of you, but you should not do this without practicing before hand.

http://youtu.be/qudGgNNwGRM

Let me know if you find this useful.

Samsung Galaxy S II Wipe

Android phones can be easily wiped of personal data, but does it really wipe all data?  I have played with an SPH-D710 this time.

I have tried the basic hard reset:
- turn off phone
- press the volume up + power button until then open chested android icon shows up
- wipe data/factory reset ( navigate with volume control, select with power button )
    Note: did not select the "wipe cache partition"
- select yes to delete all user data
- press power to reboot

I also tried the interface option to wipe the device:
Settings->Privacy->Factory data reset

The results were the same in either case.  Downloaded files, videos, Picasa cache, and Google account email address was still accessible easily by backing up the "wiped" device in Kies and reading the resulting files.  The backup is stored in a folder structure without any proprietary structure or protection.  Some files like the CallLog.bk is a simple ZIP file with SQLite 3 database.

 

 The backup is located, by default, in the following directory C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730 where the backup folder is made unique by including the date and time of the backup.  

Some cache folder can contain files with TEC file extension that contains a single JPG image that can be viewed by removing a few bytes before and after the jpeg signatures.  picasa-cache.0 can also be carved for JPG images.  

The list below shows the backup structure of the Galaxy S II after wiping the phone 3 times.  Image caches, audio downloaded files, videos, and the email address of the user was not removed.  The ... shows the removal the same type of files to shorten the output. 

C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\CALL

C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\CONFIGURATION
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\EMAIL
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\MESSAGE
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Music
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\CALL\BR
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\CALL\BR\CallLog.bk
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\CONFIGURATION\BR
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\CONFIGURATION\BR\Configuration.bk
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\EMAIL\BR
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\EMAIL\BR\Email.bk
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\MESSAGE\BR
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\MESSAGE\BR\Message.bk
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Music\media
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Music\MP3Download
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Music\Music_Audio
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Music\Notifications
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Music\Ringtones
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Music\media\audio
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Music\media\audio\notifications
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Music\media\audio\notifications\facebook_ringtone_pop.m4a
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Music\MP3Download\AUDIO_FILES.mp3
...
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Music\Music_Audio\AUDIO_FILES.mp3
...
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Music\Notifications\hangout_dingtone.m4a
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Music\Notifications\hangout_ringtone.m4a
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Music\Ringtones\hangout_ringtone.ogg
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\USER1
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\astrid
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\c360_debug.txt
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\DCIM
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\download
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\jorte
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\jp.co.johospace.jorte
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\MP3Download
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\Music_Audio
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\Pictures
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\preview.vpl
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\USER1\IMG_VIDEO_FILES.qt
...
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\astrid\auto.121024-0021.xml
...
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\DCIM\Camera
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\DCIM\NAME2
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\DCIM\Camera\cache
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\DCIM\Camera\cache\2047040784001.tec
...
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\DCIM\Camera\cache\8484480800.arc
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\DCIM\NAME2\cache
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\DCIM\NAME2\cache\2047040784001.tec
...
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\DCIM\NAME2\cache\8484480800.arc
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\download\119091.pdf
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\download\20120417154424.ics
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\download\49052662.pdf
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\download\abscissa-1.apk
...
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\jorte\capture
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\jorte\fonts
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\jorte\capture\.nomedia
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\jorte\fonts\cmunst.otf
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\jorte\fonts\cmuntb.otf
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\jorte\fonts\Dancing_Script
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\jorte\fonts\lists.csv
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\jorte\fonts\Dancing_Script\DancingScript-Bold.ttf
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\jorte\fonts\Dancing_Script\readme.txt
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\jp.co.johospace.jorte\jorte.db
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\MP3Download\lyric
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\MP3Download\lyric\AUDIO_FILE.txt
...
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\Music_Audio\db
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\Music_Audio\downloadingMedia_0.dat
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\Music_Audio\downloadingMedia_3.dat
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\Music_Audio\downloadingMedia_6.dat
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\Music_Audio\playingMedia11.dat
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\Music_Audio\playingMedia5.dat
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\Music_Audio\db\mdd.db
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\Music_Audio\db\mdd.db-journal
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\Pictures\cache
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\Pictures\cache\com.google.android.googlephotos
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\Pictures\cache\com.google.android.googlephotos\.nomedia
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\Pictures\cache\com.google.android.googlephotos\cache_versions.info

//Can be carved for JPG images
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\Pictures\cache\com.google.android.googlephotos\picasa-cache.0

C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\Pictures\cache\com.google.android.googlephotos\picasa-cache.1
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\Pictures\cache\com.google.android.googlephotos\picasa-cache.idx
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Camera360
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.box.android
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.dropbox.android
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.google.android.apps.books
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.box.android\cache
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.box.android\cache\filecache
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.box.android\cache\working
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.box.android\cache\filecache\1580054785.jpg
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.box.android\cache\working\2901071601_1345350763
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.box.android\cache\working\2901071601_1345350763\frontface.jpg
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.dropbox.android\cache
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.dropbox.android\cache\thumbs
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.dropbox.android\cache\thumbs\20120516_151344.mp4
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.dropbox.android\cache\thumbs\Camera Uploads
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.dropbox.android\cache\thumbs\Photos
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.dropbox.android\cache\thumbs\20120516_151344.mp4\large.jpg
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.dropbox.android\cache\thumbs\Camera Uploads\2011-05-15 22.32.24.jpg
...
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.dropbox.android\cache\thumbs\Photos\Sample Album
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.dropbox.android\cache\thumbs\Photos\Sample Album\Boston City Flow.jpg
...
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.google.android.apps.books\files
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.google.android.apps.books\files\accounts
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.google.android.apps.books\files\accounts\USER_EMAIL@gmail.com
...
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Camera360\Data
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Camera360\Data\test_old.png

Conclusion

If you don't have specialized forensic tools to analyze a phone and the phone appears to contain no relevant data navigating the interface, a simple device backup can reveal many valuable leads and relevant data.  If a device can not be examined, think about examining the device backup on the computer the user had access to.  Locating and examining mobile device backups can be an easier alternative and easier to validate than acquiring the actual mobile device. 

Crop in Word 2010

 

It was an interesting concept and a welcomed addition to Office 2007 that we were able to edit images right in the Word document itself.  So, what happens to the original image that we cropped?  We know that older version of Office was keeping tracked changes even after tracking was turned off, so leaving something intact is not a new concept to Microsoft.

So, what happens when you add an image add crop it.  Let me show you.

Here, I added an image to a Word document.  Nothing special here.

So, now I cropped a portion of the image where the CNSS logo is not showing anymore.  So, if I open this document, I will only see CSEC from now on.  So, what happens behind the scene?

Looking at the Word document in Hex viewer, we can see that a Word document .docx is just a ZIP file with standard signature PK.

Therefore, we can just simply change the file extension to .zip and extract its contents.  It seems the media additions to a word document is stored in word\media folder.  It is also interesting to see the time stamp associated with this image.  IT is even more interesting that some tools like FTK Imager shows this time stamp as 1/1/1980 instead of 12/29/1899.

Never the less, if we open the image, we can see that it is the original full sized image.

Just to show what it looks like in the $MFT record, the time stamp ( Green ) is the actual time stamp when the zip file was extracted, but the ( Yellow ) time stamp is the seemingly a default time since I have not seen other time stamp, but this value in all documents.

Conclusion

It might be important to filter for DOCX files and extract the media from them to see if anyone manipulated and cropped portions of the images.  On the other hand, since word documents are zip archives, some forensic tools report them as wrong file types while there is nothing wrong with them.  In any case, if an investigator mounts the file structure of these files, the full image will show up in the Gallery view and the investigator might believe the user actually must have seen the full image while it is possible that only a portion of the image was visible to the user.  So, keep this in mind in your investigations.

Turn it off or not?

It has been a "gray" area in forensic acquisitions if we should turn a system off or not.  If we look at certification exam requirements, we have to pull the plug on client OS and turn the system off with OS commands if it is a server. 

In today's computers, we have 4GB or more memory that was the size of a hard drive not too long ago.  In a few years back, if someone said, "I've thrown an 8GB hard drive into the trash since I thought it was not important" would have landed investigators in jail.  We can not make those kind of decisions anymore just because we did it in the past. 

The memory is a wealth of information in malware investigations and dealing with encryption.  This also shown in the new tool "Elcomsoft Forensic Disk Decryptor". http://www.elcomsoft.com/efdd.htm


The documentation mentions how it recovers the master key from live memory or from the hibernation file.

"By analyzing the hibernation file (if the PC being analyzed is turned off);
 By analyzing a memory dump fie
 By performing a FireWire attack (PC being analyzed must be running with encrypted volumes mounted)."

Now, if that is the case, then turning the system off will lose this information and you can wait for weeks, if you're lucky, to crack the password for BitLocker, PGP or TrueCrypt. 

Why not just include into the methodology and certification exam requirements to at least consider the option of capturing the memory before turning the system off.  I like the option of forcing the hibernation file to update and then pull the plug if necessary. 

powercfg.exe -h off
powercfg.exe -h on

This way, you can turn your system off and still have the memory to analyze.

"Drawbacks?"  You might ask.
I believe digital forensics is just like any other science discipline is based on pattern recognition, risk management, and process control.  Therefore, we have to look at any drawbacks in this method.  Since the Hiberfil.sys file will be as large as the physical memory in the system, you will overwrite, 8GB in this case, unallocated space.  Thus, if you plan to data carve for previously deleted files, this might destroy evidence that can be just as much devastating to your case.  So, a light weight memory dump utility ( fau's dd, mdd, or winen ) might be the answer to this dilemma.  The main idea is to consider this option when encryption is suspected or as a standard collection methodology.

Cell Phone in Faraday Bag! Why?

As we test tools and technology in our ITDF 2320 course, we never know what information we can discover.  This week, we've tested the cell phone protection by placing them in Faraday bag and multilayer of antistatic bags. 

To our surprise, even though the Faraday bag work fairly well in some cases and not at all in others, in all cases the mesh on the Faraday bag interacted with the smart phone screen.  In one case, the movement of the bag over the screen caused the email client to open and to check one of the emails to be checked.  In most cases, just random movement was noticeable as the phone moved around in the bag. 

It might be strange to call a Faraday bag a protection mechanism when it causes more changes than just placing the phone in airplane mode and carrying it in a paper bag.