Als externer Doktorand stellte Michael Mundt die Arbeit "Gib dem Dino Futter – adaptive Detektion von Bedrohungen in KRITIS-Netzwerken mittels Open-Source-Forensik" auf der 31. DFN-CERT Konferenz am 30./31. Januar vor.

SISDON armada iniciar sesión

Crimes involving Internet of Things (IoT) or embedded devices like drones are on the rise. A widespread class of file systems for storing data on embedded devices are flash file systems (FFS). FFS are optimized to manage conceptual limitations and characteristics of raw flash memory, i.e., memory that is not managed by an additional hardware controller that hides the characteristics of flash (called the Flash Translation Layer). Thus, FFS incorporate mechanisms and structures, which are not part of traditional block-based file systems like NTFS, APFS, or ExtX. Regarding analyses of FFS-based embedded devices, digital forensics tools handling FFS are needed. Unfortunately, currently available tools are not able to analyze FFS or raw flash images in general. In this paper, we provide a concept and an open-source implementation of a digital forensics tool bridging this gap for the widespread UBI File System. Our concept is inspired by the well-known Sleuth Kit and reflects the different abstraction layers of a digital forensics analysis (e.g., the storage device level, the volume level, the file system level). We provide an open-source tool of our concept, which we call UBIFT. In contrast to previous work, UBIFT is able to parse file system structures like the directory tree or the UBIFS journal to recover deleted files including the respective metadata. We show the usefulness of UBIFT by a twofold evaluation: we first apply our tool to a publicly available Internet camera flash dump to perform a forensically sound analysis of the flash device. Our second evaluation comprises both a methodology for creating adaptable flash dumps in general and the comparison of our tool to competitors with similar functionality on the basis of self-generated flash dumps. Finally, we address the usability aspect of UBIFT by providing an Autopsy plugin of our tool.

SISDON Armada Ecuador

Our article on Hypervisor-based Data Synthesis: On its Potential to Tackle the Curse of Client-side Agent Remnants in Forensic Image Generation was accepted at DFRWS EU 2024. The article presents a novel approach for the automatic generation of forensically sound hard disk and memory dumps based on its agent-less data synthesis approach. The paper will be presented at the Digital Forensic Research Workshop (DFRWS) EU 2024 in March 2024.

Diffraction gratings are optical devices that consist of a series of parallel lines or grooves etched onto a surface. They are used to diffract light into its component wavelengths, creating a spectrum. To create diffraction gratings, a common method is to use a negative film with a pattern of lines etched onto it. The film is then placed onto a substrate, such as glass, and coated with a reflective material.

Zimbra Armada del Ecuador login

Zimbra Armada del Ecuador

Several factors should be considered when creating diffraction gratings from negative film, including the desired grating frequency, the depth of the grooves, and the angle of the grooves. These factors will determine the diffraction angle and the quality of the grating. The type of photoresist and etching process used will also affect the final product.

Our paper on "Scenario-based Data Set Generation for Use in Digital Forensics: A Case Study" was accepted for presentation at the IWODF (INFORMATIK) 2024.

Diffraction gratings have a wide range of applications, including in spectroscopy, telecommunications, and laser technology. They are used to analyze the composition of light sources, to separate different wavelengths of light for communication purposes, and to create lasers with specific wavelengths. They can also be used in optical instruments, such as spectrometers and monochromators.

Sisper armada

To create diffraction gratings from negative film, the film is first developed and washed to remove any residual chemicals. Then, it is dried and placed onto a flat, clean surface. A layer of photoresist material is applied onto the film and exposed to UV light through a mask with the desired grating pattern. The exposed photoresist is then developed and etched, leaving behind the desired grating pattern on the film. The film is then coated with a reflective material and the photoresist is removed, leaving behind the diffraction gratings.

Yes, there are alternative methods for creating diffraction gratings, including direct laser writing, electron beam lithography, and holography. These methods offer greater precision and control over the grating pattern, but they also require more advanced equipment and expertise. The method of using negative film is a more accessible and cost-effective option for creating diffraction gratings.

Our two papers on "Data Synthesis is Going Mobile – On Community-driven Dataset Generation for Android Devices" and "Causal Inconsistencies are Normal in Windows Memory Dumps (too)" were accepted for presentation at the IMF 2024.

Furthermore our article on Ubi est indicium? On Forensic Analysis of the UBI File System was accepted at DFRWS EU 2024, too. The article presents a concept and a tool (including an evaluation) to analyse UBI file system dumps (e.g., as found in chip-off dumps of drones).  The paper will be presented at the Digital Forensic Research Workshop (DFRWS) EU 2024 in March 2024.

Digper2 evaluacion

In the field of digital forensics, the number and heterogeneity of devices typically involved in an investigation is increasing. In order to train digital forensic experts and make faster progress in the development and validation of forensic tools, the demand for up-to-date data sets is high. However, manually creating data sets is a complex, tedious, and time-consuming task increasing the need for automated solutions. Existing data generation frameworks typically use components that run directly on the simulated client (e.g., a client-side agent, over an SSH server). On the one hand, this facilitates simulation by providing direct feedback from the client and the ability to use client-side libraries to access software. On the other hand, however, this approach creates unintended traces in the generated data sets that quickly reveal their synthetic origin and affect their realism and thus their relevance. To avoid such traces, this paper presents a hypervisor-based solution to eliminate such a client-side software component in a recent digital forensic data set generator, while compensating for its absence only through host-side means. To demonstrate the practicability of the proposed approach as well as the indistinguishability of the generated traces, a multi-participant scenario is performed as a proof-of-concept to replicate a realistic attack scenario on a Linux system from a Kali attacker machine. During the evaluation, the generated data set is compared in terms of unintended traces and realism to a data set generated by the same framework using an agent component. In this way, we demonstrate the benefits and overall usefulness of an agent-less data synthesis approach.

Authors: Dennis Wolf (Zentrale Stelle für Informationstechnik im Sicherheitsbereich (ZITiS)), Thomas Göbel and Harald Baier (Universität der Bundeswehr München)