Stories
Slash Boxes
Comments
Search

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

Vista For Forensic Investigators

Posted by kdawson on Tue Apr 17, 2007 05:30 PM
from the recovering-it dept.
Operating Systems Software Windows Security IT
Ant writes "SecurityFocus has a two-part article offering a high-level look at changes in Windows Vista that a computer forensic investigator needs to know about. Part 1 covers the different versions of Vista available and Vista's built-in encryption, backup, and system protection features. Part 2 continues with a look at typical user activities such as Web browser and email usage."
+ -
story
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

Vista For Forensic Investigators 50 Comments More /

 Full
 Abbreviated
 Hidden
More
Loading... please wait.

  • Oh n0es (Score:5, Interesting)

    by mboverload (657893) on Tuesday April 17 2007, @05:36PM (#18774881) Journal
    The smart people already use drive encryption via TrueCrypt and other methods.

    This may make it easier for the not so completely stupid criminals to protect themselves, but I doubt it will have any real effect.

    People are stupid. Thats why they get caught.

    • Re: (Score:3, Informative)

      by mboverload (657893)
      If you didn't RTFA, which I don't blame you, it's short on any radical ideas or editorials, there is one thing I didn't know before:

      Bitlocker (which encrypts the whole windows volume ala Truecrypt but bootable) requires a TPM 1.2 chip in it, which you'd be hard pressed to find in ANY computer.

      • Re: (Score:3, Informative)

        by PitaBred (632671)
        The notebook I bought last September has a TPM v1.2 chip in it... and I know many current other notebooks do. But TPM is primarily useful in the mobile space, anyway, not on the desktop space where most people keep their machines reasonably physically secure.

      • Bitlocker (which encrypts the whole windows volume ala Truecrypt but bootable) requires a TPM 1.2 chip in it, which you'd be hard pressed to find in ANY computer.


        At the risk of sounding like an overly-eager Apple fanboi (bleck!), recent Macs have an Infineon TPM 1.2 chip in them.

      • Re:Oh n0es (Score:5, Informative)

        by THESuperShawn (764971) on Tuesday April 17 2007, @06:57PM (#18775845)
        Actually, that's not correct. Bitlocker does not "require" TPM 1.2, it CAN be used without it. You can boot from a USB drive, make a few edits in the local policy, or manually set the 48 digit recovery password just to name a few.

        And just about any computer manufactured after January 2006 will have TPM 1.2.

      • Re:Oh n0es (Score:5, Insightful)

        by Detritus (11846) on Tuesday April 17 2007, @07:34PM (#18776249) Homepage
        See the Fifth Amendment [wikipedia.org].

        The defendant has no obligation to provide the prosecution with incriminating information.

        • The defendant has no obligation to provide the prosecution with incriminating information.
          But aren't they obligated to follow court orders (such as the one, the grand parent was speaking of)?
          • A court order doesn't override the defendant's constitutional rights. If the prosecutor really wants the information badly enough, the defendant can be granted immunity or "use immunity". Then the defendant could be held in contempt of court if he refused to testify, the grant of immunity having negated the possibility of self-incrimination.
        • I thought that part of the Fifth Amendment referred to self-incrimination during testimony (you know, that ...nor shall be compelled in any criminal case to be a witness against himself... part). I don't think it allows you to refuse to turn over evidence legally requested via a search warrant. If the police/DA have a warrant for the contents of your drive (plaintext/non-encrypted), I'm pretty sure you are legally obligated to give up the key/passphrase.

          It would be similar to them naming the contents

          • Re:Oh n0es (Score:5, Interesting)

            by Detritus (11846) on Tuesday April 17 2007, @08:31PM (#18776775) Homepage
            There is a legal distinction between testimony and material objects like diaries and journals. From what I've read, a court can compel someone to hand over material objects, like a safe, but it can't compel someone to say the combination. This issue came up quite often during Prohibition. Many rum runners kept their business records in code. The government would often seize these records during a raid. The government used their own cryptanalysts to break the codes and testify in court as expert witnesses.

          • Re: (Score:2, Informative)

            by Anonymous Coward
            I'm sure it's obvious by now, but just in case - IANAL

            Indeed, it is obvious. IANAL either and while there is some truth to your argument it is mostly false. The fifth amendment applies at any time. If the police go to your house and ask if you killed your wife, your refusal to answer can not be used as evidence of your guilt. If they ask for the combination to your safe, you can claim the fifth amendment and decline to answer.

            You can even invoke the fifth amendment as a witness. For example, if the

        • Re:Oh n0es (Score:4, Informative)

          by ucblockhead (63650) on Tuesday April 17 2007, @08:39PM (#18776837) Homepage Journal
          In the past, courts have rules that an encryption key is analogous to a physical key, and like a physical key, can be demanded with a warrant.

          • Re: (Score:3, Interesting)

            by grahamm (8844)

            In the past, courts have rules that an encryption key is analogous to a physical key, and like a physical key, can be demanded with a warrant.

            Does anyone know why they came to that decision rather than treating encrypted computer documents the same way as paper documents (journals, diaries etc) which are written in code? IANAL but AFAIK the precedent with the latter is that they cannot force you to decode them. In both cases they are in possession of the physical document - that they are unable to understand it is their problem.

        • The Law (Score:3, Informative)

          by bussdriver (620565)
          The past rulings indicate and its rather clear that the 5th amendment only applies if you hurt yourself with the information disclosed. There is a "Fisher Test" of requirements to get around the 5th:
          1) evidence exists
          2) the person has a key for getting/finding the evidence
          3) producing the key does not link the evidence to the person (aka authentication)
          Fisher v US

          Its like you have evidence in your safe but so do other people, so they can force you to open the safe despite the 5th- is my understanding of the

          • Re: (Score:3, Informative)

            by Beefysworld (1005767)
            I can't believe this didn't get a bite. US citizens aside, this article relates to any other country that uses Vista, so it's a worthwhile topic. Just because one country's constitution states something, doesn't mean that all has been said and done.

  • Vista is for criminals, it assists encryption (Score:4, Funny)

    by Anonymous Coward on Tuesday April 17 2007, @05:40PM (#18774937)
    If someone uses encryption, then obviously they are trying to hide somthing illegal or unlawful.

    In Linux, encryption is done with unusual and special commands in conjuction with mounting a "loop" device to a filesystem; requiring administrator privileges to try to encrypt data like that, and adding to the subversion of a system with evidence of a corrupt administrator.

    What kind of administrator would allow encryption on a filesystem? Obviously, a criminal.

    Information is meant to be free, and open source. Encryption is somthing we would expect Mycrow$oft to use to help criminals be found by the good god-fearing men and women of the DEA/FBI/CIA/GATT/IMF/IRS just to atone for their sins.

    Good people use OSX.

    Call me,
      Eve.

  • Wow. (Score:4, Funny)

    by eviloverlordx (99809) on Tuesday April 17 2007, @05:40PM (#18774939)
    I would've figured that the investigators' computers would be too slow from running Vista to investigate much of anything.
    • Sorry, I can't resist a dig at that stupid concept.

      If your OS is *disgustingly, *alarmingly inefficient with resources, you can stick a thumbdrive in it and cross your fingers that the email you just spent half an hour typing on will go through.

      In other news if your car gets 1.4 miles per gallon, you can drive around with a few 50-gallon drums of gasoline to get you through out of those tight spots.

  • No encryption by default (Score:4, Informative)

    by 5, Troll (919133) on Tuesday April 17 2007, @05:41PM (#18774949) Journal
    One misconception is that encryption in Vista is turned on "by default." Actually, it is not. In fact, it is not even available in most versions of Vista. Vista is available in five SKUs, only two of which support encryption (a feature known as "BitLocker", or "BitLocker Drive Encryption" - BDE). Vista Home Basic, Media Edition, and Business *do not* support BDE. Vista Enterprise and Ultimate - the two more expensive editions - do support BDE. Also, encryption is not turned on by default. An important step during encryption involves defining the encryption and decryption keys. This cannot be done by default by someone other than the owner of the system. If it could, then that someone else would be able to gain access to the secure data - exactly what is trying to be controlled.

    • Re:No encryption by default (Score:4, Insightful)

      by RedElf (249078) on Tuesday April 17 2007, @05:45PM (#18775011) Homepage
      With Vista, the OS from MS that phones home more than any previous release, can we really trust it not to "Phone Home" the encryption keys of bitlocker once it's enabled?
      • While a great example of "Microsoft Gone Wild!" they would never risk something like that being exposed. It would kill them.

        Yes, I am aware of the "NSA secret backdoor thing".
      • Why stop there?

        They could be sending credit card numbers, or SSNs, or your personal files, or your porn, or even every single piece of data on your computer!

        • There's a good reason many encryption technologies support "recovery" options

          Sounds more like an obfuscation system than en encryption system. The point with encryption is that no one except those you give the key to, should be able to decrypt the information.

          • Do you think it's beyond everyone else to not notice if they did? The amount of people paranoid about MS, who'll run it behind eg, a linux firewall, watching all the traffic that goes through during installation etc?

            I don't think MS would be able to get away with doing anything like that now, too many eyes on packets comin from Windows.

    • if i remember correctly from 4-5 years ago.. BDE also stood for "borland database engine".. or in colloquial english, the spyware that kazza installed.

      now microsoft has made it a feature in their new os, giving us greater spyware value by cutting out the middle man!

  • If they want to bust you, they will (Score:3, Insightful)

    by heretic108 (454817) on Tuesday April 17 2007, @05:44PM (#18774991)
    I see from TFA that they're shitting themselves at the prospect of widespread drive-level encryption. They console themselves with the fact that only the high-end Vista versions support BitLocker.

    But in the end, encryption offers only limited protection. If some well-resourced hostile authority wants to take you down, there's endless options for framing you up. For instance, they could mess with your ISP's logs to fabricate http hits to k1dd13 pr0n sites, or infect your box with a bot that hits such sites on your behalf, which will cause the hits without messing with the ISP's logs...

    • Re: (Score:3, Informative)

      by mboverload (657893)
      Criminals usually aren't smart enough to enable drive encryption or buy a $400 copy of Windows Vista. They are probably not smart enough to even install TrueCrypt, which is by far the most incredibly easy to use encryption product on the market.

      And by the way, what kind of bozo puts incriminating evidence on a computer period? Unless they deal in child pornography they wouldn't even have that data on the computer. (Unless you're that one idiot that used Microsoft word to print off a fake suicide note)

      Like

    • I see from TFA that they're shitting themselves at the prospect of widespread drive-level encryption.

      Whenever it comes to these things, I find myself in a bit of a quandary. Of course I want various criminals to get busted, but these investigators are essentially relying on poor security to get their information. I generally want computers to have good security. I don't like the idea of people being able to see my personal info or browsing history, but I'm also not really hiding anything.

      oh well...

      • IF YOU HAVE NOTHING TO HIDE THEN YOU WON'T MIND US LOOKING THROUGH YOUR BROWSER HISTORY, MR NINE

        *mboverload is sad because he hears these arguments from people but doesn't know how to fight against it. Someone help.*

        • Re:If they want to bust you, they will (Score:4, Insightful)

          by Qzukk (229616) on Tuesday April 17 2007, @06:34PM (#18775631) Journal
          *mboverload is sad because he hears these arguments from people but doesn't know how to fight against it. Someone help.*

          "If you have nothing to hide, then you won't mind taking out a newspaper ad with your SSN, your DOB, your credit card numbers, your mother's maiden name, and your driver's license number. Either you have something to hide, or you'll quickly learn that you had something you should have kept hidden."

        • Re: (Score:3, Informative)

          by vux984 (928602)
          If you look through my browser history then you don't respect and trust me.
          If you don't respect and trust me, than there is something fundamentally wrong with our relationship.

          If there is something fundamentally wrong with our relationship then I wish to end it. **OR**
          If there is something fundamentally wrong with our relationship then we need to fix that.

          As far as society, and police/government initiatives its the same baseic question of trust and respect. Do we want to live in a police state? What fundame

        • Re: (Score:3, Interesting)

          by quanticle (843097)
          I've found that the most effective counterargument is to point out that the whole "nothing to hide, nothing to fear" argument is based upon the presumption that the government is infallible and perfectly competent. Sure, I have nothing to hide. However, I do fear the government looking at bits and pieces of my personal data and then coming to an erroneous conclusion about my future behavior because they didn't get the whole picture.

          Also, I don't like the thought of government being able to make arbitrary
        • The correct reply to that arguement is: "cool, can I come over to your house and install these Web Cams in your house, specifically, your bedroom and your shower, they are gunna broadcast on the internet 24/7"

          Also, demand all government officials (including senators and the president) must be bugged and have their movements and conversation monitored 24/7, and the full details made public, with archives and live feed to ensure that they aren't corrupt. Remember, they won't object if they have nothing

  • encypted backups? (Score:5, Interesting)

    by RedElf (249078) on Tuesday April 17 2007, @05:51PM (#18775095) Homepage
    After reading the article (I know we're not supposed to do that) I'm a little confused on if you backup an encrypted volume if the backup is also encrypted. If not, doesn't that defeat the whole purpose of encrypting that data in the first place?

    • It depends on why you're encrypting and how you're backing up. In this case, copying the files to an unencrypted disk will give you unencrypted files.

      In short, the purpose of encrypting your hard drive in this way is to prevent hacking from someone who as physical access to the machine. For example, if you give me a standard XP system, I can use a boot CD to reset your passwords. I can boot to another OS and access your files directly. If your system is up and running, Windows will protect your files w

    • Re: (Score:3, Interesting)

      by nwetters (93281)
      You should worry more about the disk cache. Previously opened files are cached in RAM in an unencrypted state.

      Firewire ports and PCMCIA slots have direct memory access, so can be used to copy an image of your computer's RAM even if no one is logged in. This can recover useful forensic material even after a reboot cycle, as modern BIOS's don't clear RAM.

      It looks like Vista's disk encryption is useless if you switch on the PC and access files.

  • I find it funny. (Score:4, Funny)

    by figleaf (672550) on Tuesday April 17 2007, @05:54PM (#18775135) Homepage
    that the article mentions Slashdot and Register as a reference for a Microsoft OS.

  • Encryption use is low anyway... (Score:3, Interesting)

    by Blittzed (657028) on Tuesday April 17 2007, @06:33PM (#18775623)
    Part of my job entails working with law enforcement officials in the field of digital forensics. They have told me that the use of any encryption system by criminals is very low, to the point of non-existent. This is fortunate for the Police, as it makes it easier for them to keep these scumbags off the streets (unfortunately a lot of the crime they deal with is child pornography). There are so many barriers to Bitlockers use (TPM, correct version of Vista, off by default etc etc), that its widespread use just doesn't seem likely. If the bad guys aren't using EFS and other encryption systems now, and these are easy to implement, why would they bother of going through the hassle to use Bitlocker? There are also laws being enacted in certain countries to force the bad guy to give up passwords/ keys etc (ie we are going to lock you up until you give it to use so you may as well do it now...).
    • "oops, that was the destroy all data password".. sorry about that i was so shaken up by being jailed when i am innocent that i was confused and gave you the wrong one.

      • "oops, that was the destroy all data password".. sorry about that i was so shaken up by being jailed when i am innocent that i was confused and gave you the wrong one.
        "Oh, we understand, that's fine. We only tried it on a copy of your drive; care to try again with another copy? We'll give you lots of time to calm down, relax, and think about it."
        • With full TPM enabled in hardware ( which is coming soon to a nightmare near you ) you wont be able to use a copy of the HD.

  • Know what's interesting? (Score:3, Insightful)

    by Opportunist (166417) on Tuesday April 17 2007, @09:19PM (#18777189)
    Reading those comments, more than the article itself.

    Peruse them and you might notice something. Well? Right. A handful deals with the problem of having your notebook stolen, while the majority discusses the effects of it on a search. I.e. more people being concerned of the effects to a search than to having your computer stolen.

    Makes me wonder... does it tell me something 'bout the people here or about the governments we live in?

  • how secure is vista, really? (Score:3, Interesting)

    by v1 (525388) on Wednesday April 18 2007, @06:57AM (#18780111) Homepage Journal
    The macintosh home folder security is called "filevault", and uses encryption to encrypt the entire user home folder, where most of the user information is. The actual key to the vault is large (128bit aes?) and is stored at the start of the vault, but the key is encrypted using the password the user provides when it is created. Another copy is stored there, encrypted using the master password's certificate, which is encrypted using the master password. So if you lose your password and lose the master password, the data is truly gone forever, and there is no "back door" at Apple. There's nothing stopping you from deleting the master key, it's one document easily located. There is no known back door to the filevault system, and the system is very careful to point out if you lose the password and master password, your data is irrecoverable. The master key requires you to enter a password because the key itself is also encrypted, so simply having access to the master key certificate is not useful in breaking into a locked vault, because the master password is required still.

    From what I have heard, all rumor and third-party, windows' encrypted home folders is worthless from a true security standpoint. I have been told that there is a master key in use similar to the master password in OS X, but that it is not one that the user makes, it comes pre-made from microsoft. No one outside microsoft has the private key to unlock that certificate. So if you lose your password, YOU are screwed, but if microsoft really wanted into your data they could get into it. (or let someone else into it) I don't know if there is a documented way to erase this copy of the image's crypto key encrypted with microsoft's back door password. Also I wonder if an administrator could simply reset the password on the account and then login with the new password to just waltz by the entire security of the system?

    How much of this is fact and how much is fiction? We have seen time and time again that security by secrecy and security by "but we would NEVER misuse our master key" is a complete laugh, because (A) the secret ALWAYS gets out, and (B) someone ALWAYS ends up misusing the master key. In this respect I feel sorry for the windows users because the wolves are guarding the sheep.

    Sidenote: OS X also has a built-in feature that lets you create a regular encrypted disk image. When you make one of those, the machine's master password is not used to store another encrypted copy of the image key as with filevault, so those disk images have only one actual key. I use this to store a password list on my flash drive because of how easy they are to lose, and I am completely confident that anyone that finds the flash drive will be absolutely unable to access my information. I assume that a 3rd party solution is required for windows users?

    Somewhat OT, but I have also been told that it's essentially impossible for even an administrator to just read another user's data on the same hard drive, that they have to "take ownership" of the files to read thm, thus altering the data. Yet viruses apparently can multiply at will, infecting all accounts on the computer. Why is it that the viruses have no problem circumventing windows security while at the same time it's nigh imposible for the administrator to do the same thing? Tha does not make sense.

All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2010 Geeknet, Inc.