0

Let's assume that I have access to an EC2 instance (whether a private key for a Linux instance or the username and password for Windows instance), and I used a software like FTK Remote Agent to acquire an image. Isn't this image the same as if I was able to go to the data center and physically connect and acquire the image?

I'm asking this because I was reading a paper in which the researchers were evaluating current tools (like FTK and EnCase) in cloud environment. They wanted to know whether these tools can acquire forensic data. So they created an EC2 instance, downloaded Apache on that instance, made some web pages and compromised the machine using a web-based vulnerability. Then they acquired an image and checked if they can find the timeline of their activities.

My other question: is it considered acceptable to install a tool or a service on a remote machine in order to acquire a Forensic image or is it considered to be damaging to the integrity of the evidence? For example connecting to an EC2 instance using remote desktop and installing a tool that would let me connect to acquire a remote image.

  • What I've learned through my forensic studies is that you should avoid as much contamination as possible. If you install software on a target machine you begin to contaminate the machine. The more you contaminate, the less it will hold up in court. That is why it is important to take checksums before and after examination and find out exactly what you added to the machine. – Grimmjow Jan 11 '15 at 18:30
  • Agree with @Grimmjow. It would be better to take a copy of the instance at least. Then you can run up the copy to do initial investigations. If you find something of interest, you could then try to work out other methods of forensic evidence gathering. – Julian Knight Jan 13 '15 at 13:32
  • Out of interest; Please link to the paper you talked about! – Mrtn Jul 3 '15 at 13:48
1

I try not to do this but this is very much a yes and no answer.

Tools like FTK Remote Agent run as a service on the system. An investigator can connect to those tools and perform tasks (such as pulling a remote image of that particular system.) If you were to walk into the data center of AWS and could get console level access and installed than ran your tools from there, you would be doing a very similar thing (and actually better since you have less network for potential problems.

If your goal is to preserve the state of the machine as it relates to AWS, pulling an image from the VM may not be the way you want to approach this. The more preferable method would likely be to clone the virtual files that make up your AWS system.

I try to think of virtual environments and forensics in this way, what would I rather have, a copy of the files that make up the state of an OS, or a copy of the container that has the entire state of the OS as it relates to its current environment.

FTK will provide you a clone of your OS from the OS's perspective into a format (ISO most likely), but if you could pull the AWS files that make up the entire VM, you have, IMO more solid forensic evidence.

  • Problem is if that system runs directly from RAM, nothing can be used except the OS logs, as there is no actual data on a disk to dig into. – Overmind Apr 12 at 11:19
0

You are correct yes using something like FTK remote age is the same however you do have the added fun that it is potentially a live system so things are changing as you're working.

In a real world environment you're correct they contaminated the evidence (a BIG no-no), and would most likely be inadmissible in a court room. The most likely scenario would involve getting the courts permission to ask amazon for a snapshot / clone of that particular VM which can then be examined.

The best way is probably to use some of the VM's snapshot-ing abilities their are some tools which can work with the likes of VMDK files (VMWare) quite easily to allow investigators to carry out their duties.

  • VM snapshotting would require access to the host, which is not really available in most cases. – Overmind Apr 24 at 6:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.