Gopher Proxy
gopher.petergarner.net:70 gopher.petergarner.net:70/0/Cybertech/Anti_Computer_Forensics.txt
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Computer Anti-Forensics
Introduction
Devices such as phones laptops, desktops, hard drives, and much
more can be seized and forensically analyzed by a variety of
tools used by law enforcement. There are ways to prevent and
hinder these forensic investigations. This guide will focus on
local computer forensics which includes mobile devices, hard
drives and other storage media, personal computers, and possibly
for the first time smart watches.
Encryption
Strong encryption is a forensic experts nightmare. It is nearly
impossible to get around with current technology when certain
conditions are meant. Strong encryption should be open source,
tested, and actively developed and maintained. There are
currently 2 disk encryption tools that meet this criteria, LUKS2
and VeraCrypt. You should use a passphrase for your disk
encryption, I an 8 word Diceware passphrase.
Avoid using BitLocker as BitLocker is closed source and often
times tricks the user into storing a recovery key in an insecure
location or having an insecure authentication mechanism, such as
TPM only BitLocker. Do not use TrueCrypt, it is deprecated, and
insecure, some people still use TrueCrypt because its TrueCrypt,
use VeraCrypt instead.
Plausible Deniability
Some countries such as the UK can force the disclosure of your
passphrase. This is where plausible deniability comes into play.
VeraCrypt is currently the only disk encryption available that
allows for reliable plausible deniability when the right
conditions are met. VeraCrypt allows the creation of a hidden
volume inside of the free space of the outer volume, and if you
are forced to disclose a password you can give up the password
to the outer volume (decoy volume) and there is no way under the
correct conditions to prove the existence of the hidden.
To have the correct conditions for plausible deniability, a live
OS should be used such as Tails OS or if you want to be less
conspicuous you can use a live Ubuntu or Fedora USB. This way,
when the operating system caches information in or about the
hidden volume, it is stored in RAM which is completely gone when
the system shuts down instead of being stored on disk where it
can be extracted, examined, and used to prove the existence of a
hidden volume. Another thing is the passphrase for the hidden
volume should be completely different than the passphrase used
for the outer volume, again I recommend 8 word Diceware
passphrases.
VeraCrypt hidden volumes should only be created on magnetic hard
disks, flash storage often has TRIM and Wear Leveling which will
give away the existence of the hidden volume.
Mobile Devices
For mobile devices, you should avoid Samsung at all costs and
use a long pin, password, or even passphrase on your device and
shut it off to remove the encryption keys from RAM before law
enforcement is able to obtain the device. It is best to keep the
absolute minimum amount of information on a mobile device as the
security of such devices varies widely from model to model.
For messaging, use Signal or Molly, preferably Molly. Molly
which is a hardened signal fork, allows you to set a passphrase
to encrypt messages at rest instead of relying only on the
Android Keystore system. Signal is fine if you know your Android
Keystore system on your device is adequately protecting secrets,
but most of the time, knowing this is nearly impossible. Enable
disappearing messages, sure deleted information can be recovered
but with Signal or Molly recovering deleted messages is more
difficult (not impossible) but it will limit the amount of
information obtained by a significant amount if compromise
occurs.
Plausible deniability does not exist on mobile phones, at least
not yet. Maybe in the future there will be a custom open source
ROM that supports plausible deniability.
When using a phone, disable clipboard history. This is
especially important if you are using a Samsung device. Samsung
keeps a record of about the last 50-70 things you copied
depending on the device. Even if you hit the delete button on
the clipboard history, it doesn’t delete, its just made
invisible, again Samsung is especially bad about this. There are
apps that allow you to overwrite the clipboard history and these
may be more reliable one app for Android devices is S.S.E
(Secret Space Encryptor) which will allow you to quickly wipe
the clipboard by automatically copying a series of incrementing
numbers.
Encryption for external storage devices
All external storage devices should be encrypted even if it
doesn’t contain sensitive information. This makes it harder to
target one specific drive. This also makes it so the
argument/assumption cannot be made that “X person specifically
encrypted Y drive so it must contain Z data” even though this
is not a valid conclusion, it still causes serious problems such
as in the US where the “Forgone Conclusion Doctrine” may be
used and in the UK where there are key disclosure laws and in
some cases, Australia.
Avoid using applications such as Steghide, these are easy to
detect and their encryption by modern standards is not strong.
Avoid image and audio steganography in general every single
application made for this purpose no matter the algorithm, LSB,
F5, etc. can be detected and it only makes things work as it
shows the intention to hide information.
Data erasure
For SSDs and many forms of flash storage, you can use blkdiscard
on Linux or delete all the files and run TRIM to wipe the
device. Note that this is not reliable as it relies on the
firmware of the flash storage device. Some SSDs may act like
they did permanently discard the data when in fact they did not.
SSDs are not a good choice if you anticipate ever having to wipe
a device. Never overwrite SSDs using wipe passes such as Gutman,
these were meant for hard disks and they will kill SSDs and
won’t actually get rid of the data because of wear leveling.
HDDs can be easily and reliably wiped by overwriting all the
sectors on a drive with random data, or zeros. One pass is good
enough on modern drives and most use cases, however some older
drives from 15-20 years ago may require two or three. The Gutman
35 pass wipe is overkill and there is almost no reason to use it
except to waste time. A wipe can also be performed on individual
files by overwriting them with random data or zeros, this works
on HDDs but not SSDs. A wipe of an entire drive can be performed
by using the shred or dd command, for wiping individual files
you may use the shred or srm command.
Bleachbit will also delete cache files from your system and
optionally overwrite them to prevent recovery.
Data decoys
To waste time in a forensic investigation if your drives are
decrypted you can use decoy files, sometimes referred to as
chaff files. Note that this is only for defense in depth and
will not be enough to stop a forensic investigation, it will
only hinder and slow one down.
Bleachbit is able to generate chaff files using the data from
Hillary Clinton's emails or the 2600 magazine. These files can
be deleted (but not wiped) afterwards in order to have them sit
in unallocated space on the drive. These chaff files are
supposed to match key words that forensic investigators may
search for, this way forensic investigators will have to sort
through the chaff to find any meaningful data.
Not saving any data
In some cases you may be able to not save any data on your
device at all. Some cloud storage providers allow you to access
their web interfaces via Tor. If you encrypt your files before
upload using something such as GnuPG and upload them via Tor
through a live OS such as Tails, it will be extremely difficult
to find your data, and even if it is found it would still need
to be decrypted.
This effectively makes it so nothing is stored on your device.
Tor would hide what cloud storage provider you are using to
network observers and maybe even the fact that you are using
cloud storage. If your device is seized, forensics will not
reveal anything, not even an encrypted partition on your device
because there is nothing on the device.
This is useful for some threat models and scenarios such as when
you are crossing the border into another country and anticipate
a search or seizure of your electronic device.
Smart Watches
Avoid smartwatches, if you decide to use one, do not connect it
to your phone. Smart watches collect and cache a large amount of
data including text messages. If you are using Signal, the
notifications from Signal containing decrypted messages can be
cached on a smart watch even after attempts to get rid of it.
There is no current way to reliably prevent digital forensics on
smart watches.
There is one exception to this, and that is the PineTime. Still
do not connect it to your phone as it will receive the phones
notifications and store them in plain text, but it works just
fine without connecting it to your phone as the time can be set
manually and none of the built in apps require a phone in order
to be used.
##
you're on gopher.petergarner.net^70/0/Cybertech/Anti_Computer_Forensics.txt
back link is gopher.petergarner.net:70/1/Cybertech