Forensics When You're Broke with Phil Cochran | CypherCon 3.0

### Overview In this presentation at CypherCon 3.0, Phil Cochran addresses how organizations facing budget constraints—such as public institutions—can conduct digital forensics effectively without expensive commercial software suites. Aimed both at budget-conscious practitioners and newcomers to the field, the talk outlines the core objectives of computer forensics, walks through a practical investigative workflow, highlights accessible and free open-source tools for each phase, and emphasizes rigorous methodology, tool validation, and documentation.

### Key Topics - **Core Purpose of Forensics**: Cochran stresses that digital forensics is not about analyzing evidence to prove a preconceived point, but rather about reviewing evidence impartially to determine the facts (answering who, what, when, why, and how) so that legal or organizational decisions can be grounded in truth. - **The Forensic Process Lifecycle**: The speaker presents a practical step-by-step workflow: Communication (receiving the alert or request), Preserving the Evidence, Processing the Evidence, Analyzing the Evidence, and Reporting Findings. - **Evidence Preservation and Integrity**: Preservation forms the foundation of any investigation. Without proper write-blocking and bit-by-bit imaging, the integrity and legal admissibility of evidence are compromised. - **Free and Open-Source Forensic Tooling**: Cost-effective tools exist across all phases, from imaging and file carving to memory analysis and timeline generation. - **Tool Validation and Accuracy**: Forensic examiners must independently validate their tools and understand their limitations. In courtroom settings or disputed findings, reliance on unverified tools can undermine a case.

### Technical Details - **Acquisition and Write-Blocking**: - Hardware write blockers are preferred to avoid software bugs, though Linux distributions with built-in write-blocking policies (such as CAINE, the Computer-Aided Investigative Environment) provide a free alternative, particularly for hardware like SSDs that cannot be easily attached to standard interfaces. - FTK Imager is demonstrated to create physical disk images (capturing the entire drive rather than logical partitions) stored in either uncompressed bit-by-bit raw DD format or compressed Expert Witness Format (E01), with proper case and examiner metadata. - **Memory & Volatile Evidence**: Memory is volatile and lost upon system shutdown. Tools such as Volatility, Mandiant Redline, LiME, and FTK Imager can capture and analyze volatile RAM. - **Artifact Extraction & Processing**: - **Timeline Analysis**: Using Plaso suite tools (specifically `psteal.exe` and `log2timeline`), examiners can extract and correlate system events from the Master File Table (MFT), Windows event logs, and file system metadata into CSV formats for spreadsheet analysis. - **File Carving**: Tools like Scalpel and PhotoRec inspect raw disk space for headers and trailers (magic numbers/signatures) to recover deleted files that are not overwritten. - **Registry, Network, and Malware Analysis**: RegRipper extracts registry artifacts; Wireshark and Snort analyze network traffic and data exfiltration; ClamAV and VirusTotal aid in malware assessment. - **Tool Compatibility Pitfalls**: Cochran recounts a real-world trade secret theft case where opposing experts disagreed on USB insertion timestamps. The discrepancy stemmed from the opposing examiner using an outdated tool incompatible with Windows versions newer than Vista, illustrating the necessity of manual registry verification and validation. - **Reporting & Cloud Considerations**: Reports must tailor technical complexity to the audience (e.g., CISO vs. attorney). For cloud environments (e.g., AWS, Gmail), traditional write-blocking may not apply; examiners must authenticate, document every collection step, and maintain transparency regarding modifications.

### Takeaways Organizations do not need multi-thousand-dollar proprietary tools to conduct thorough, legally defensible digital forensics. By combining free tools (such as FTK Imager, CAINE, Volatility, and Plaso) with scripting, automation, and evidence baselining, examiners can build robust pipelines. However, technical success relies on strict adherence to preservation, thorough chain-of-custody documentation, understanding tool boundaries, and verifying artifact accuracy.