An Ontology for Digital Forensics in IT Security Incidents - OPUS

56 CHAPTER 7. IMPLEMENTATION
7.3 RDF
The next step was to create the program that converts the output of the
forensic tools that extract the information from the hard disk and random
access memory images. Most forensic tools print their output to the standard
output. The program, which is written in Java, asks for the location of the
hard disk and memory images and the database to use and then runs the
tools with the correct parameters. The output of the dierent tools is parsed
and converted to RDF les that use the structures of the ontology. These
RDF les are then stored in the selected database. The execution of the tools
is partly parallelized to speed up the process. A screenshot of the program is
shown in the appendix in listing C.4. The information about the tools that
are used, the location of the database and other information that is needed
to run the program is stored in a conguration le. An example for this le
is shown in the appendix in listing A.1. The listing A.2 shows an example
for the progress information printed by the program.
One important point when lling the ontology is to add the data with
references to the tools it way retrieved by. But if all values, timestamps and
tools are added to an object, one cannot distinguish which timestamps and
values belong to which tool. So blank nodes are put between the object and
the corresponding value to eliminate this indistinguishability. For example,
in gure 7.1 there is a registry key for which two tools found dierent values
and the blank nodes _:blanknode* helping to separate these.
7.4 Volatility plugin: hivedump2
When implementing the extraction of the registry from the random access
memory respectively the image of it, the rst solution was it to call the
printkey function of volatility for each hive. The hive addresses can be
located with the hivelist function. The output of the printkey function for
one registry key looks similar to listing 7.1.
Registry : \ Device \ HarddiskVolume1 \ WINDOWS \ system32 \ config \ SECURITY
Key name : SECURITY (S)
Last updated : 2012 -09 -20 10:33:58
Subkeys :
(S) Policy
(S) RXACT
(V) SAM
Values :
Listing 7.1: Sample output of printkey
If this function is executed with only the hive specied, it prints the root
key of the hive. From this output one can extract the sub keys. For each of
the sub keys the printkey function is called again. If this is done recursively,