A recent article on Networkworld.com mentions how difficult it can be to recover information from smartphones and game consoles.

I can imagine smartphones are particularly difficult, given the constantly changing nature of the hardware in use and the proliferation of mobile operating systems such as Windows Mobile 7, Android, iphone OS, WebOS and BlackBerry OS. The modified or custom file systems can also be challenging as I've read that the xbox360 uses FATX and that the PS3 uses a proprietary version of ext2.

However a particular quote from the article that caught my eye was ""You can take a Wii onto the Internet and it doesn't save sites or browser history....If you type in a Web address and surf, 10 minutes later there's no record of it." Intrigued by this comment, a bit more digging came up with this paper [pdf] on Wii Forensics.

Dr Turnbull highlights the lack of internal storage (excluding the 256MB flash memory) and proprietary file system as being some of the difficulties in Wii Forensic analysis. The paper makes for interesting reading.

ENISA (The Europrean Network and Information Security Agency) have freely released alot of materials on setting up a CSIRT or CERT.

The step-by-step guide [pdf] seems like a great starting point and they even include exercise materials.

They also have a section on CSIRT-related tools which lists useful tools for every stage of an investigation.

I'm a big fan of virtualization, and have seen first-hand how much of a 'game changer' it has been when it comes to infrastructure. With my recent studies of Digital Forensics I wondered how does virtualization 'change the game' when it comes to forensics?

In my so-far brief researching, there seems to have been a bit written about the use of virtualization in forensic analysis. The paper entitled 'Virtual Forensics' [pdf] from ForensicsFocus.com is an interesting start, discussing VMs as a target and the use of VMs to make analysis easier. This presentation from 2005 is boldy titled "Virtual Machines: The Ultimate Tool for Computer Forensics" while this paper [pdf] claimed that "the environment created by VMWare differs considerably from the original computer system, and because of that VMWare by itself is very unlikely to produce court admissible evidence" and suggests that a hybrid approach of using a standard forensic image along with a VM for analysis is the best approach.

There also seem to be plenty of ready to run virtual machine images or appliances to assist the forensics practitioner, but what happens when the target machine is a VM?

This article from cio.com mentions one of the potential problems is that VMFS (VMWare's file system used to store the 'guest' virtual machine images) is not well understood. A virtual machine is simply files on a disk, but when you want to capture a forensic image of a VM do you simply capture the 'disk files' (eg: vmdk file, NVRAM file, etc) or do you need the underlying host storage volume (the VMFS partition) to capture metadata (such as the last accessed time etc)?

The sheer size of the VMFS partition may also cause problems (think multi-terabyte LUNs), along with the fact that vmfs partitions may be shared amongst many guest VMs, which may cause problems if a forensic investigator is only authorized to investigate a single machine.

With continuing explosive growth of server virtualization and now the increase in interest in desktop virtualization it will be interesting to see what changes (if any) will be required for digital forensic investigators in the near future.

Forensics Focus had an article about some software that "Decrypts TrueCrypt Hard Disks in Minutes". A pretty impressive & scary claim! Wondering how it works? I was too, so a quick visit to the manufacturers website gives some details on how the software works for HDD decryption:

Passware Kit scans the physical memory image file (acquired while the encrypted BitLocker or TrueCrypt disk was mounted, even if the target computer was locked), extracts all the encryption keys, and decrypts the given volume. Such memory images can be acquired using Passware FireWire Memory Imager (included in Passware Kit Forensic), or third-party tools, such as ManTech Physical Memory Dump Utility or win32dd.

Overall Steps

* Acquire a memory image of the seized computer
* Create an encrypted disk image (required for BitLocker only)
* Run Passware Kit to recover the encryption keys and decrypt the hard disk

So there is no gaping hole in the full disk encryption of bitlocker or truecrypt, the software extracts the keys from the forensically captured physical memory while the encrypted volume is mounted. This just further highlights the importance of being able to perform a live acquisition of the physical memory when the use of encryption is suspected...