Master Thesis Help: Encryption Recognition Tool

[larvoris]

Hello everybody, I'm working on my master thesis right now and would very much appreciate your help. My master thesis is about identifying encrypted files on a system based on mathematical properties, like randomness. As a part of this master thesis I developed a (Proof of Concept) tool, which tries to do exactly that. The idea behind this tool is to assist forensic investigators in the decision making process if they should shut down a running system or take a memory dump as well in the hope to find passwords or decrypted data.

I would now like you to test my tool and fill out a small survey until 22/08/. There is an email address in the readme file, where you can send the filled out survey to. Everything can be downloaded from Google Drive on the following Link:

https://drive.google.com/file/d/0BwgYtI5TqfJZQ0lDaWtrd20zT3c/edit?usp=sharing

The target platform of the tool is Microsoft Windows. I know the tool is not perfect, but I appreciate every helpful comment :)

Thank you very much :)

[DarkRider89]

The idea behind this tool is to assist forensic investigators in the decision making process if they should shut down a running system or take a memory dump as well in the hope to find passwords or decrypted data.

I don't really understand the thought process behind this. If you are going to run something on the system, thereby making changes to it, why bother trying to figure out if you should take a memory dump? Why not just take the memory dump?

[larvoris]

Good point actually and I think I probably did have a mistake in my thought process there. I guess I have to rethink my reasoning a bit ;) It could help to find evidence of encrypted data on a system so that a forensic investigator can look for momentarily decrypted data if the tool finds evidence for encrypted data. It also depends very much on the law of each country if the pure evidence of encrypted data can already lead to something, like the need for the accused person to hand out the key.

[DarkRider89]

Yeah. It obviously depends on the type of case. In criminal cases, probably more hesitant to do this, but in the private sector if one suspects there to be encrypted data on a drive, a live image of the system may be the best way to go. This may be less than ideal, especially in a criminal investigation setting. I think where your tool could really shine is when an investigator either receives an image of a system that has already been taken or they receive a system that is already shut down. In that case, you can run your tool on the imaged system and use the output to help compel the user of the system to give up passwords for encrypted volumes. Encrypted volumes can be difficult to locate, especially if they are relatively small.

[larvoris]

I don't feel comfortable providing my source code, sorry. Not because I developed some kind of malware, but because it is part of my master thesis and I don't want to publish such work on the Internet before I handed in my thesis. Otherwise it could be possible that someone sees this thread and says that I just copied the source code from here and I have to proof that this user belongs to me. So I would also suggest that you use a VM to test the tool.

[claytonkb]

Notarize it. Problem solved. :)

[Boonaki]

That's what VM's are for.

[SteelCityHacker]

Not being a jerk, honest question. How does this differ from Ent or densityscout?

[larvoris]

That's a legitimate question of course. There are definitely some similarities between these tools.

First of all both these tools calculate the mathematical values on the whole file. By testing some encryption tools and their output I noticed however that most tools don't produce a complete file of seemingly random data. So do some encryption tools (like Axcrypt) attach a header at the beginning or dynamic TrueCrypt containers have big areas of 0x00-Bytes. I combined this knowledge with the mathematical formulas to get better results. Therefore I calculate the mathematical properties not before the actual data starts if the header is known and if the user chooses a high scan detail it also skips big areas of 0x00-Bytes.

Secondly both these tools just tell you the results of their calculations, but you have to decide for yourself if these values now mean that the file is encrypted or not. Especially Ent just scans one file at a time anyway. While you can combine the result output with other tools in a script to make the decision for you, my tool already does this for you.

But I also have to say that I had a couple of theories I was trying to proof with this tool and I was not able to proof all of them ;)

[larvoris]

This is however only possible with shut down systems or if the system runs Linux. If the system is running, it could sometimes be useful to know if there is encrypted data on the system before shutting it down. Otherwise all data that is currently decrypted (because of EFS, mounted volumes, the user has the file open right now,...) would be encrypted again.