| Project: | Licitware |
| Industry: | Government |
| Categories: | Security, Automation |
| Duration: | 01.06.2003 - 28.02.2004 (7,200h) |
| Platform: | .NET and Win32 ( Fat Client, N-Tier ) |
| Operation System: | Windows 9x/NT |
| Database: | MySQL |
| Programming Language: | C++ |
The Disk Browser (DB) is being designed as a Computer Forensic Tool used in the investigation of computer crimes. There several types of Specimens (Evidences) can be created and investigated such as Image of drive, File or Folder, Mailbox and Address Book, Instant Message History, Internet Explorer History and so on.
One of the main scopes of activity for Disk Browser is the Forensic Disk Image. DB is able to create exact images of a physical or logical disk drive that captures the complete disk, including Slack [1] and Free Space [2]. This image is able to be hashed [3] as to prove it is an exact copy of the original disk. The DB has the ability span the image file across multiple media for archiving purposes, the image file then is able to be restored to another disk or mounted in the Disk Browser for investigation. Also DB allows mounting disk image as a virtual drive so other programs.
--------------------------------------------------
[1] Slack space is the unused bytes of a sector when a file is not exactly divisible by the sector size. For example a 3k file stored in a 4k cluster or sector would have 1k of slack space because only one file can occupy a cluster, sector or range there of. The space after the <EOF> and before the start of the next allocation unit.
[2] Space marked as unused by the Volumes File System. This may contain deleted or temp information.
[3] A message digest using MD5, SHA1 or any other algorithm should be the same for the Image File as it is for the Disk or Volume.
Once a Specimen is created then opened in the disk browser the investigation starts. The DB allows for viewing the content of the Specimen as a tree. For disk image viewing deleted files and directories is implemented. DB allows files or Raw Clusters to be opened in a HEX Viewer or viewing in internal viewer without native Software to be installed. The content of the file also can be sent to a third party viewer or even MS Imaging. The ability implemented to open and investigate common mailbox formats and recover deleted e-mail. Address Books and Mailboxes content is shown as in mail application.
The investigator is able to use build in search features to investigate data. Query Builder is available using file filters, hash libraries and keyword lists.
ACL (Access Control List) - a method of controlling access to the functions of the software, with logging, is built in. This allows supervisors to control case creation, which investigator has access to a case and what functions are available on a case by case basis. Windows authentication allows implementing deep security level to access to objects.
Disk Browser can be installed as Stand-along application as well as at the Network configuration. So all DB features can be used for Workgroup.