An Ontology for Digital Forensics in IT Security Incidents - OPUS

24 CHAPTER 4. FORENSICS
vulnerable to tampering as any other le. Another problem mentioned in
[Kruse and Heiser, 2001, pp 320f] is the admissibility of log les. Depending
on the legal boundaries some of them are allowed and others are not. If one
needs the information from log les in the ontology one can add it. Another
problem of log les is that if they were disabled neither investigators nor tools
may be able to detect that or reconstruct the data[Harris, 2006]. Details on
adding other data with the example log les can be found in section 7.7.
4.2.4 Example
After the data was collected as explained in section 4.1.3 the next step is to
split it up to the structures explained above.
The hard disk data is separated according to section 4.2.1. In the data
structure of the le system category all le name entries are listed except the
ones for the ImportantDocument and the Malware le. All le name entries,
metadata entries, and all data units are still on the disk, although the les
were deleted, and get assigned to the corresponding categories. The data of
the Registry le is extracted and categorized.
The processes are data in the random access memory that belong to
the Runtime Organization Metadata category, whereas the handles and
connections belong to the according Data category and the registry belongs
to the OS-specific Data category. The registry is extracted and categorized
similar to the Registry le on the hard disk.
The content of the Registry le on the hard disk is shown in gure 4.3.
The content if the Registry memory object diers from the one on the hard
disk only in the Firewall/Status which has the value 0 instead of 1.
How the data ts to the ontology will be explained in section 6.10.
4.3 Forensic Tools
This section provides an overview of the used forensic tools. As for most use
cases there are alternatives for these tools. The selected tools are all released
under open source licenses. This has some advantage over closed source tools.
As explained in [Carrier, 2003] using open source tools, respectively having
access to the relevant code for commercial tools, simplies the procedure of
proving the admissibility of the found evidence. In [Manson et al., 2007]
open source forensic tools are compared to a proprietary one. It shows that
the open source tools are robust and easy to use.
This section is not intended to be a manual for the tools and all their
options, thus it will discuss only those parts that are useful for this work.