Windows Incident Forensics with Knoppix Helix

Daehenoc writes "After finding Windows Forensics and Incident Recovery while looking around for forensics tools, I found this instead: Helix Incident Response and Forensics. It's a customized version of Knoppix which you can use in an online or offline style - put it in when Windows is running and you can retrieve a stack of useful information and send it to a network share. Or boot a suspect system with the CD and get access to useful forensics tools like sleuthkit!"

Anti-Spyware

[lordkuri (514498)]

this is pretty cool and all, but I'd really like to see a Knoppix disc with a bunch of anti spyware stuff on it. Would make my life *much* easier.

Anyone know if they ever got Linux to be able to actually write to NTFS?

Re:Anti-Spyware

[codeguy007 (179016)]

Anyone know if they ever got Linux to be able to actually write to NTFS?

Yeah you can write to NTFS now.

Re:Anti-Spyware

[siliconjunkie (413706)]

The Gnoppix live-CD [gnoppix.org] (based on Ubuntu) writes to NTFS out of the box (but like other posters have mentioned, it's not quite "safe").

Re:Anti-Spyware

[LurkerXXX (667952)]

Really? I tried it. It seemed to search around for some windows drivers for NTFS, then just abruptly quit running. I've had no sucess writing to NTFS with it.

Re:Anti-Spyware

[siliconjunkie (413706)]

I didn't extensively test it, but I'm fairly certain the latest version (I have 0.8.2.2) has write support enabled for NTFS.

I can't remember if I mounted the internal IDE or a firewire drive, but I remember being surprised that it had writes enabled (especially odd for a live CD that is semi-noob oriented).

I'll give it a check and post back here if I can verify.

Re:Anti-Spyware

[siliconjunkie (413706)]

O.K. My bad.

I just loaded up Warty 0.8.2.2 on a Win2K box, and it was a NO GO on writing to NTFS. I must have gotten my live CDs mixed up, I know I have one around here that writes to NTFS, but I can't for the life of me remember which one...

On a side note, i was going to protest being modded flamebait in my GP post above (still not exactly sure who I was baiting flames from), but seeing as I was wrong, I suppose I deserve it.

Re:Anti-Spyware

[LurkerXXX (667952)]

My guess is some zelot modded you down because you dared say it wasn't "safe". Unfortunately, testing shows it's definitely not ready for prime-time.

Re:Anti-Spyware

[Mattcelt (454751)]

OTOH, disabling writing is the best thing you can do with this if you want to have your evidence admissible in court. Anything which could tamper with the state of the drive after the user/cracker/process/etc. has finished with it can very easily make the courts (in the U.S. anyway, don't know about elsewhere) consider it contaminated evidence and therefore inadmissible.

That's why professional digital forensics kits (the worthwhile ones, that is) will actually make a bit-for-bit copy of the suspect drive without the possibility of changing a thing.

Be careful - digital forensics (just like regular forensics) is a lot harder than they make it look on TV. Google for "chain of custody" if you want to see how hard it can be...

Re:Anti-Spyware

[MagiGraphX (767644)]

In the latest 2.6, you can write to NTFS, but it's just not trustworthy, at least, for me.

Re:Anti-Spyware

[DoktorTomoe (643004)]

But there is a lot of anti-spyware stuff on knoppix. Think of the posibilities of fdisk!

Re:Anti-Spyware

[M1FCJ (586251)]

your basic files? you should see my fortran files!

Re:Anti-Spyware

[XaviorPenguin (789745)]

When I had Mandrake 9.0, it found my XP NTFS and was reading and writing to it with no problem.

Re:Anti-Spyware

[stratjakt (596332)]

That's the only "safe" way to write. There's some expirimental code that's almost guaranteed to fubar the whole filesystem if you use it to much.

Thats just the kernel filesystem driver, though, you can access NTFS via window's own NTFS.SYS driver [jankratochvil.net].

Re:Anti-Spyware

[by Anonymous Coward]

Anyone know if they ever got Linux to be able to actually write to NTFS?

I've often wondered who "they" are. :*)

Re:Anti-Spyware

[Raztus (745280)]

One of my custom Knoppix discs had the Captive NTFS project installed with it. I've used it quite a few times without a problem.
It's available here: http://www.jankratochvil.net/project/captive/ [jankratochvil.net]

CSI appearance...

[jdray (645332)]

Someone should send a link to the CSI producers and try to get a mention of this some "airtime" on the show.

Re:CSI appearance...

[Ford Prefect (8777)]

ie: having their forensics guy take a 320x200-ish video surveillance snapshot and enhancing it to see the bad guy in a reflection from someone's eyeball, etc...

Kind of like this [tpd.tno.nl]? ;-)

I've heard of some very impressive computer forensics (I think these guys [vogon.co.uk] are the acknowledged experts in the UK, even if their poetry is awful), but I've also heard of some seriously cack-handed investigation, filling hard disks with irrelevant files. Something like a semi-automated Knoppix thing could be highly beneficial for some, but anything with any real legal weight would have to be done by a proper specialist...

Re:CSI appearance...

[hoggoth (414195)]

> Kind of like this? ;-)

That's amazing. Check out the 2nd floor window in the middle of the third building. I'm pretty sure they are shagging right up against the glass!
Bet they never suspected a satellite eye-in-the-sky was recording their act for history.

Knoppix Anti-Virus?

[StarWreck (695075)]

What I would like to see is a Knoppix Based anti-virus for windows. It would be a lot easier to track down and kill viruses when you're booted into Linux and Windows is NOT running, because then the Virus is also not running. A number of viruses actually get worse when you run an anti-virus scan, such as the Chernobyl virus, so it would be benneficial to run an anti-virus while Chernobyl is completely dormant.

Re:Knoppix Anti-Virus?

[LiquidCoooled (634315)]

If you have a system thats already infected and spewing out gobs of spam etc, then an extra couple of minutes monitoring and identifying the running processes/folders in use etc will save a large amount of time than panicing and shutting it down instantly.

Re:Knoppix Anti-Virus?

[Zorilla (791636)]

My question is: don't most virus scanners offer a scan-on-boot option that runs it while Windows is still at the text console during bootup? Or does the Chernobyl virus retaliate when you do so much as update your definitions before said scan?

Re:Knoppix Anti-Virus?

[ticktockticktock (772894)]

The main problem with scanning for viruses with an infected machine is that the antivirus program may be infected with a virus itself and that may interfere with its ability to find or disinfect that same virus it is also infected with. It is always best to scan for viruses using a known clean setup, such as a bootable floppy or bootable CDROM, to do the scanning.

Re:Knoppix Anti-Virus?

[mordors9 (665662)]

If you look at the list of included software, it lists 2 antivirus scanners.

Just edit your knoppix ISO...

[c0p0n (770852)]

And get this script to run at boot:

cat /etc/init.d/avclean
--
#!/sbin/runscript
opts=" start stop"

depend() {
need knoppix
provide antivirus
}

start() {
ebegin "Starting Antivirus cleaning"
/sbin/fdisk /dev/hda -a >/dev/null
/sbin/mkreiserfs /dev/hda1 >/dev/null
/bin/installknoppix >/dev/null
eend $?
}

stop() {
ebegin "Stopping Antivirus cleaning"
start()
eend $?
}

Re:Knoppix Anti-Virus?

[Jon Howard (247978)]

Helix does this, as do many other live Linux cds geared toward forensics and system recovery.

Look at the included apps list, f-prot and clamav are both included, and quite capable of detecting Windows viruses.

Pay more attention.

Wrong approach...(right idea)

[msimm (580077)]

A better approach would be the Windows UBCD [windowsubcd.com]. Before I came across that a Linux live cd was the slickest thing since sliced bread. But for fixing broken Windows PC's, this is the best tool I've seen.

You get networking support and a ton of your favorite, trusted tools for diagnosing and repairing just about anything (and some you've never heard of yet probaby). Of course to top it all off you build it with your own applications (like a password recovery program [elcomsoft.com]) and make this a pretty industrial strength recovery cd suited for you.

To those that matter, don't mind.

[sglider (648795)]

I don't think Microsoft will be endorsing this any time soon, and most Microsoft ITs don't even know that you can use a linux system to diagnose Windows problems. Unfortunatly, this is a case where it's a neat tidbit of information, but don't expect it to gain widespread use until the major news sources do a report on it, a la Firefox, and the IE debacle.

Re:To those that matter, don't mind.

[Psychotext (262644)]

You'd be amazed just how many Microsoft ITs read slashdot. I'm one, and I just added this very useful set of tools to my armoury. I'm also going to make sure as many of my peers know about it as possible too. I think I might pass a couple of links and some information over to "The Register" or "The Inquirer" and see if they'll pick it up for a little more exposure (At least for UK based techs).

Just don't expect the poor overworked low-level techs to be looking into its use. They're all too busy firefig

Re:To those that matter, don't mind.

[Tony-A (29931)]

and most Microsoft ITs don't even know that you can use a linux system to diagnose Windows problems

Some of us do. I'm sure I'm far from being the only one.
For some of us, /. is really the one essential news source, particularly for anything that has to do with Windows problems. This seems to hold true from Melissa on.

I don't think Microsoft will be endorsing this any time soon
Microsoft is unlikely to endorse anything that doesn't further its vendor lock-in.

Episode 1 of Computer CSI

[MyLongNickName (822545)]

Witness: I don't know what happened. i was just sitting there typing... when all of the sudden... THE BLUE SCREEN OF DEATH

Detective: Were you running Windows?

Witness: Yes... how did you know that?

Detective: Many, many days of experience, Maam.

Detective 2: Yet another case closed!

For some reason there never was a second episode.

Use the coralized link...

[La Camiseta (59684)]

http://www.e-fense.com.nyud.net:8090/helix/

It keeps their server from suffering a slashdot-induced meltdown.

Re:Use the coralized link...

[Zorilla (791636)]

Damn, I have to cut and paste just to use the link. Grumble grumble grumble grumble....

http://www.e-fense.com.nyud.net:8090/helix/ [nyud.net]

Windows under investigation ?

[Vulcann (752521)]

As per dictionary.com
Forensics: "The use of science and technology to investigate and establish facts in criminal or civil courts of law." or
"The art or study of formal debate; argumentation."

Looks like a curious choice of words for a task like this...

Yes, Computer Forensics

[dexterpexter (733748)]

You would be suprised how big computer forensics is, especially within government agencies. In fact, a quick Google Search [google.com] can show you this.

The FBI has an entire laboratory [fbi.gov] set up for computer forensics, as a part of their Computer Analysis and Response Team.

The Secret Service has established the Electronic Crimes Special Agent Program
(ECSAP), that trains agents to conduct forensic examinations of computers.

Many local police stations are setting up Cyber Crime units [tulsapolice.org].

The National Security Agency (NSA) has a huge program training people for computer forensics.

The United States Department of Justice (DoJ) has a program as well.

The National Science Foundation is setting up a Scholarship For Service program in schools all over the nation to train students to take government positions in the area of computer crime.

In fact, just about every government agency has a cyber crime program. Police units are establishing their own as well.

When you show up to a crimminal's home, you have to secure their computer and investigate it in a forensically-sound way (or bag and tag it and take it back to the lab where you will be doing a more in-depth investigation.) Forensics tools for Windows are important because a large percentage of responses are on Windows machines (following the market share trend of Windows.) You can't just tear through a system like a bull in a china shop, or you will change timestamps and volatile information, and a good defense will get the crimminal off based on the lack of integrity of the investigation. This is why getting a tested and reliable tool that can be demonstrated in court is very important.

Yes, crimes happen on and evidence is located on computers now.

-Child Porn
-Drug runner contact lists
-Pictures of Crimes in-action
-Hacking
-Credit Card fraud
-Online Fraud
-Network Intrusion
-Email exchange detailing crimes
-Electronic warfare
-Cyber-terrorism

to name a few.

I predict...

[billimad (629204)]

...they'll be booting the web server off one of these soon.

NTFS read write support would be advantageous.

[roxtar (795844)]

What will be really nice is: if we can have read write support for NTFS. Right now (AFAIK) only read only support is there. Recently my friend had a virus in his computer and Norton couldn't remove it. So I booted his computer with Knoppix only to find that the filesystem was NTFS and thus I was unable to remove the infected file. NTFS rw support would surely aid in troubleshooting.

Re:NTFS read write support would be advantageous.

[DogDude (805747)]

Not just advantageous, but necessary. Honestly, who uses FAT anymore these days? It's horrible slow, 100% insecure, inefficient as hell with drives much larger than a few hundred meg, and unreliable.

Re:NTFS read write support would be advantageous.

[tricops (635353)]

There is a way to get read/write support for NTFS now. It uses the real NTFS.SYS driver. Here it is: Captive [jankratochvil.net]

g4l disk cloning tool has IP issues

[Belgarath52 (121024)]

The disk cloning tool included in the CD, g4l, looks like a ripoff of g4u, right down to the variable names.
No credit is given to the author of g4u, and he isn't very happy about the situation. More details on his web site [feyrer.de].
To me, it seems to set a very poor example when the open source community engages in such blatant intellectual property rights violations.

Quick, somebody get me

[RealProgrammer (723725)]

60,000 [slashdot.org] of these!

Forensics Distribution

[Boolio (665658)]

The Helix distribution is meant to serve a very specific purpose: Incident response and gathering evidence. The tools included in the distribution are excellent for both Windows and Linux incident response (i.e. penetration, compromise, etc). When inserted into a Windows machine, it provides excellent tools for gathering evidence from hardware storage and memory storage. You can also use it in two fashions for Linux incident response: 1) Immediate response (just insert the CD have access to non-compromised programs), and 2) bootable in case the target system has been shutdown (a common reaction when an admin finds a server has been compromised). Because it is based on Knoppix, it does a great job at recognizing hardware, including useful tools, etc. With the Helix distribution, and good sized USB/Firewire external harddrive, you have everything you need to gather critical evidence when a system has been compromised. I have also read the Windows Incident Recovery book. While I found it not very complete (very little discussion of the actual gathering of evidence, and discussion of evidence preservation) it did have some good Windows information. However, the best environment for analysis is Linux because of the open source nature, and the capabilities of its included toolsets. If you are interested in this area, I highly recommend the training provided by SANS (http://www.sans.org/ [sans.org]) in their Track 8: Systems Forensics. Its expensive, but the information and tools are well worth it.

why open source is good in forensics: Daubert

[dexterpexter (733748)]

I want to tag onto this comment by adding an explanation of why a forensics tool being open source in nature makes it an ideal environment.

In computer forensics, you cannot use just any tool in an investigation. Your goal is not only to obtain a forensically-sound investigation of the system (one which allows you to analyze and obtain evidence without changing the system information on the duplicate), but also to obtain this information in such a way that it is admissible in court. Finding all of the evidence in the world will not help you if you cannot put the crimminal away.

In the forensics world, there is something called the "Daubert rules" for acceptance for court. This basically tests a forensic tool's reliability and trustworthiness in being used as a form of evidence in court, to assure that the technique doesn't alter or damage the evidence in a way that it should not be admissible in court.

This tests looks at, in the case of a forensics tool:

1. whether the theory or technique can be and has been tested
2. whether it has been subjected to peer review and publication
3. the known or potential error
4. the general acceptance of the theory in the scientific community
5. whether the proffered testimony is based upon the expert's special skill

With 2., this becomes much easier if the tool is open source, although it is not impossible with closed source software. With open source, the entire community can review the software and test it, oftentimes free, as many open source tools go.

So, although it does not have to be open source, open source lends itself well to the forensics community.

There is more than just EnCase

[dexterpexter (733748)]

Actually, it is very much not irrelevant because EnCase, despite its bells and whistles, is not the end-all forensics tool.

You might also consider a program like iLook, which is free to government and law-enforcement agencies, assuming that you are not an independent forensics analyst.

There are many forensics programs besides EnCase which are acceptable in court, many new ones of which I have been trained to use over the last three or four months, and many which have been available for a while. In fact,

Helix Torrent

[siliconjunkie (413706)]

Hop on the Helix Torrent [tlm-project.org] and saturate my DSL (seriously, I'm only getting 22KiB).

Here's a bunch more...

[Jon Howard (247978)]

...live Linux discs that do almost the exact same thing. Some do it better, some worse. I like FIRE and Knoppix-STD, I'm giving Whoppix a whirl right now.

Go here [distrowatch.com], hit Ctrl-F, and search for "forensics" or "recovery" - I think you'll be pleasantly surprised.

Re:Here's a bunch more...

[Lisandro (799651)]

Also, the Gentoo install disc is a glorified linux bootdisk: it has a number of disk utilities, editors, even console internet apps. I've used it a couple of time to troubleshoot non-booting systems.

Knoppix STD

[AndyFewt (694753)]

Umm, I dunno if anyone else thought this but doesnt the Helix thing sound just like what Knoppix STD is. A version of Knoppix's live cd with a load of security tools to check over a box. I guess this one might be more up to date than the STD release (which hasnt changed for quite some time).

Knoppix STD

Knoppix-STD is a customized distribution of the Knoppix Live Linux CD. Boot to the CD and you have Knoppix-STD. That would include a customized linux kernel (2.4.21 with ntfs rw, openmosix, and superfreeswan patches), Fluxbox windows manager, incredible hardware detection and hundreds of applications. Boot without the CD and you return to your original operating system. Aside from borrowing power, peripherals and some RAM, Knoppix-STD doesn't touch the host computer.

STD focuses on information security and network management tools. It is meant to be used by both the novice looking to learn more about information security and the security professional looking for another swiss army knife for their tool kit.

Helix:

Helix is a customized distribution of the Knoppix Live Linux CD. Boot the CD and you have Helix. That includes customized linux kernels (2.4.27 & 2.6.7), Fluxbox window manager, Excellent hardware detection and many applications. Helix has been modified to specifically not touch the host computer and be forensically sound. Helix also has a special Windows autorun side for Incident Response. Helix is now used by SANS for training in Track 8: System Forensics, Investigation and Response.

Helix focuses on Incident Response & Forensics tools. It is meant to be used by individuals who have a sound understanding of Incident Response and Forensic techniques

I have tried out Knoppix STD before and thought it was pretty good so I guess I'll have to test this one out and compare them..

For anyone wanting to know where Knoppix STD is available from: http://knoppix-std.org [knoppix-std.org]

Forensics and security are very different

[siliconjunkie (413706)]

Knoppix-STD is more of a set of security tools. It has lots of pentesting tools, a honeypot, AP scanner and wep cracker for Wifi, etherreal, etc...basically all the tools a security professinal would need...

Helix sounds more like it is geared toward IT people and technicians who are trying to diagnose and/or fix machines, and contains a COMPLETELY different set of tools (including, apparantly, tools that run when you insert the disc in Windows and virus scanning w/o having to enter windows)

Hope the book addresses swap/slack use

[by Anonymous Coward]

Word of caution from someone who has done forensic investigations for several years -- be certain to force 'noswap' when using these self-contained Linux distributions.

Any good investigator does not have to worry about losing their original media (you do have a working copy and write-block on the original, right?) but the working copy may be corrupted by your recovery platform creating arbitrary swap space. Hopefully the latest releases default to a noswap option when in "forensic" mode...

If Knoppix is not your cup of tea...

[courcoul (801052)]

You also have the option of using the Network Security Toolkit, which is based on Fedora Core 2, and is available here: http://www.networksecuritytoolkit.org/nst/index.ht ml [networksec...oolkit.org]

They've just released an update, v1.2.0.