Computer Forensics with Windows 7

I'm working on researching the impact of Windows 7 on computer forensic investigations. While Windows 7 appears to be implementing new computer network security and pc security features, these same features may impact digital forensics. Some traditional data recovery tools may no work. I will be writing more about this and the impact of Solid States Disks shortly.

Dangerous Software

Want to hide from the law, steal intelectual property or just do bad things with your PC without people knowing about it. Well there's a company that can help you. The company touts their product as a "powerful security suite". Bu the product Invisible Secrets 4 will hide files, encrypt files, destroy Internet traces, shred files, make secure IP to IP password transfer and even lock any application on your computer. Perfect for crooks and bad guys.

However, I think the courts will determine that the existance of such software on people's PC will be evidence enough to say that there was faul play.

Check out the following Anti-Forensic sites:

http://www.networkintrusion.co.uk/foranti.htm
http://www.metasploit.com/projects/antiforensics/
http://www.forensicswiki.org/wiki/Anti-forensic_techniques

Best Place to Commit Fraud: Europe

Don't read into this article that I'm anti-Europe. Trust me I'm not. My wife is European and my parents are also. But it's ironic that the European Union is all up in arms about Google's search engine possibly violating the European privacy rules (see article), when these same rules allow for the increase perpetration of fraud or at a minimum slow investigations of it down to a halt.

I investigate fraud every day - it's literally my job - both here in the United States and in Europe. So I know a thing or two about this topic. But I wanted address an issue which no one seems to recognize or at least not willing to acknowledge.

Here's a war story. We were conducting an investigation in Germany. One the best sources of information for a case is the hard drive from the laptop of the suspected perpetrator. So we create forensic images of the hard drive in order to (1) preserve it and (2) easily analyze it in a read-only manner. Well in this case we wanted to image the hard drive of the suspect - normal procedure in the US. In fact, here we can usually do it with out telling the person what or why we are doing it. Not the case in Germany. After taking a 2 hour train ride in from Switzerland to conduct the image, I had to wait another 2 hours until the suspects 3 lawyers showed up. After that it was finally agreed that I could start the imaging. But the fun doesn't stop there! As part of our imaging process, we verify that the image was made correctly. When I got to that point in the procedure, the lawyers ears perked up - "there's no way you are doing that, you might see something of a personal nature". What!! All I'm going to do is verify the MD5 hash is correct and I can read the files on the drive. No. Out of the question. Then the perp pulls out a document from his back pocket that basically says nobody can look at the contents of his hard drive with out his union rep and lawyer present and then nothing marked "private" or "personal" can be looked at by any party.

Now, think about it. You want to commit fraud in Europe, plaster or hide all your bad stuff in a folder or email that says "private" or "personal". Also, make sure you put your grandmother's recipes at the bottom of every email! That way you get away with it and your friends get to eat good.