Forensic Analysis with Helix

Computer forensics is the investigation of computer media

for discovering and analyzing available, deleted, or 'hidden' information.

It seeks to find out exactly what happened on a digital system and who was

responsible for it. This is very critical in legal matters given the fact a

hacker, rather a cracker in this case, always leaves some tracks behind. Once

digital evidence has been found it can be used by law in depositions and

litigations to determine the extent and nature of the crime. There are

essentially three phases for recovering evidence from a computer system or

storage medium. In this article we peek into the role software plays in this

field by using Helix, a Live CD based distro that focuses on Incident Response

and Forensic tools. It's a modified version of Knoppix, with terrific tools

for forensics.

The best part about the Helix Live CD is its additional

functionality for Windows, where it runs as a standard application and collects

information from a 'live' (still turned on and logged in) Windows session.

When a system is 'live,' its state is constantly

changing but collecting information from such systems is handy  when they

cannot be turned off. Because on shutting down a hacked or compromised machine,

all the evidence available in the volatile memory, cache and sometimes in the

disks, are lost. While working with Helix, the system is not affected, which is

important because if it would install itself to the system, the original state

of the system would be altered. Therefore, some tracks of the criminal might be

lost.

From acquiring images to analyzing, Helix creates an md5

checksum file of every file created or imported to ensure the



integrity of the files, ie, the files are not modified by anyone. This is

crucial, as even if one bit of a file is tampered with, its md5 checksum will

change.

Helix can acquire images from live Windows as well as Linux systems, but to analyze this image, you need to boot into Helix

The Helix toolset for Windows doesn't install itself on

the system; instead, it runs directly from the CD. The distro has



applications such as FTK Imager (a physical disk image acquiring tool), Windows

Forensic Toolchest (an automated Incident Response tool) and Incident Response

Collection Report (a system report generation tool). Helix can be used as a

portable forensic environment since it provides access to many Windows-based

utilities such as Putty, File Recovery tools, VNC Server, Registry Viewer and

Asterisk Logger.

Using Helix 



Using Helix in Linux is easy. When Helix boots, it runs entirely off CD and

mounts the hard drives in read only mode to prevent modification. This is very

useful for an in-depth analysis of 'dead' (power off) systems. Helix has

some very good forensic tools in Linux mode. It has Adepto, AIR and Linen, which

are GUI tools to



acquire image of a system.

For Incident Response it has tools such as Ethereal and

anti-viruses like ClamAV and F-Prot.

It also comes with popular tools such as Autopsy and PyFlag

for analysis of acquired images, drives. To start Helix in Windows, you need to

first download the Helix ISO image from the its URL and burn it as a regular

bootable CD.

Analyzing acquired image



To start forensic analysis of a Windows based system, we first need to

acquire its image. To do so, select the Live Acquisition button. The Live

Acquisition application will appear in a new window, which is a Windows

graphical front end of 'dd'. Now, choose the source drive, ie the drive or

physical memory to be analyzed forensically.

Once the acquired image is imported into Autopsy, copies of the file can be moved to the locker folder with MD5 checksums

Next, you need to give the destination for the image file

you are about to acquire. If you want this image to be stored locally, check

Attached/Share option and in the destination field



define the path for saving the image. If you want to save the



image over the network, check the Netcat option and define destination IP as

well as the port number. Next, click on Acquire button to acquire the image.

After the image has been acquired, you need something like Autopsy or PyFlag for

analyzing. Unfortunately, for Windows, Helix doesn't have any application to

analyze the image. To do so, you need to boot a system with Helix (i.e. Linux

mode). 

Once the system is booted with Helix, launch Autopsy from

Helix's forensic menu in the main menu and create a New Case. Then, you will

be asked to add hosts. Click on Add Host button and a new page will appear. It

will ask you to add an image to  investigate. Here, give the location of

the image you just acquired.

Below the image-location field, you will find three radio

boxes to select between copy, move or create a link to the actual image file to

your locker directory.

This directory contains the files that Autopsy reads and

writes. It contains all the investigation details including a file called 'Autopsy.log.'

The best option is to copy the entire image file to the

locker directory. Finally, click on the Add Image button. Now, its time to run

tests on the case you just created. From the Case Gallery, first select the

case, host and the image on which you want to run the tests. For example, if you

want to know all the deleted files in the image, click on the File Analysis

button and then hit 'All Deleted Files' button. This will show you the names

and dates of all the deleted files. Autopsy by default generates md5 values for

all the files imported or created, which ensures integrity of the files.

Bottom line



That was a small window on Helix's functionality. Its muliplatform

functionality makes it a handy tool for security professionals to carry along.

Swapnil Arora