Incident Responders regularly rely on Linux distributions like Backtrack 5R3 (which is very stable), Backtrack Reborn, Kali Linux, and SIFT – “SANs Incident Forensics Toolkit” for general purpose incident response. Although these are the most stable general purpose incident response distributions, Deft Linux is another distribution becoming more prevalent in IR Forensics Toolkits.
Deft Linux is a forensics distribution of the Linux operating system, which has tools resident to it that are geared towards computer forensics and computer incident response. It also focuses on network forensics, and cyber intelligence. The version of this Linux distribution that is currently the most common in use is based on Ubuntu 11.10. To view the release, a user would get to the command line and type:
%cat /etc/lsb – release
DISTRIB_ID = Ubuntu
DISTRIB_RELEASE = 11.10
DISTRIB_CODENAME = oneiric
DISTRIB_DESCRIPTION = “Ubuntu 11.10”
This particular Deft Linux distribution is resident on top of the 11.10 version of Ubuntu. When you go to the site, It is available as an “iso” which can be used to create a live CD or you can order a live CD from http://www.deftlinux.net . You just download Deft and use an unzip program (such as winZip or 7Zip) to unzip the file. You can use an “iso” program (such as Rufus and the executable Rufus.exe) to burn the disk. Remember to change the boot order on the system before you insert your “Live CD” (for example; hit F2 as the computer boots) after you have burned your CD/DVD and you will be able to boot your distribution on any system which has a cd/dvd drive. You can even load it on a usb for usb enabled systems.
Tools and Applications
You can boot Deft on any system you want to perform forensics on. You will also be able to analyze the hard drive, capture images of that hard drive and export it to an external drive or some other form of exit storage (such as an external hard drive). You can perform Forensics Analysis utilizing a battery of tools that come in the Deft Linux suite. It comes loaded with:
Analysis tools OSINT tools
Anti-malware tools Password Recovery tools
Carving tools Reporting tools
Hashing tools Disk utilities
Mobile forensics File managers
Network forensics G Parted
Midnight Commander Mount EWF
Mount Manager Wipe
Deft comes loaded with the typical Linux accessories, such as Apache server, Firefox, Google Chrome, MySQL server, Office utilities, Samba server and Secure Shell server (SSH). These applications are resident on top of the standard suite of Linux programs and services. You also have programs that are specific to Deft. These programs entail many forensic and incident response capabilities. Program suites such as:
We have password recovery tools like John the Ripper. It is very common to have to analyze a system that is locked due to a password. It is also common to encounter Windows users that have been locked out of their systems because they have forgotten their passwords. Deft requires the user to operate at the command line of Linux.
In Deft Linux, when we process John The Ripper, the first thing we do is print the working directory.
We locate the password list database and change to that directory…
In the password list database, we will use the database file that is in .gz format by default.
We clear the screen and unpack the file… for example; unpack#gunzip clyde.gz. The file is then processed and prepared for exploitation. A word count can be performed on the file as we prepare to run John The Ripper…
#john — wordlist=/usr/share/worlists/clyde.txt mypass
This runs a Brute Force password attack utilizing a password file which contains well known passwords. we can use the “format = crypt” option to force loading these as the type instead of as “loaded = passwd” hashes with two different salts. For example:
#john “–format = crypt” –wordlist=/usr/share/wordlists/clyde.txt mypass
This results in two password hashes being cracked. You then run the following command to print the passwords that have been cracked.
#john –show mypass
John The Ripper performs the operation in the workspace “.john” under the “/root” directory.
Deft Linux can also be used to access the Windows OS, change the appropriate settings and reset the password.
Systems and Network Analysis
There are many categories and programs available for analysis in Deft. G Parted gives you the ability to look at how a hard drive is partitioned which is a very common task to perform with a Linux system. We have a lot of capabilities within this distribution to support the hashing of MD5 sum, Sha1 sum, Sha256 sum and Sha512 sum. Our imaging tools give us the capability to gather, verify and manipulate all images. Our imaging tools actually will allow us to create images. We can boot the Deft distribution as a live CD and capture an image.
Deft gives us “Dcfldd”, “Dc3dd” and Cyclone which are various forms of “Dupe Disk”. Cyclone is a tool for cloning disks. It works the same way that “Dupe Disk” works. It is a command line curser interface that displays the hard drives that are available. You only need to type the name of the hard drive (s) that are installed for the partition name that you want to clone at the interface. Cyclone will perform the action for you.
Deft Linux has data carving tools available. “Photorec” allows you to recover graphics files or image files. Scalpel allows you to carve files out of a hard drive when the file may have been deleted, obscured or damaged. Data carving tools allow you to go and find the data on the drive and retrieve the file even though it is not available to the normal filesystem any longer.
Deft has mobile forensics which gives us the capability to perform forensics on mobile devices. “Ipddump” performs iPhone dumps and “Iphone Analyzer” allows you to perform iPhone analysis. “Bbwhatsapp” allows you to perform Blackberry analysis and decode Blackberry data bases. You also have a “SQLite” database browser. It is a GUI editor or it is used for “SQLite” databases. The Iphone stores a lot of data inside of “SQLite” databases. If you can retrieve the data you have a graphical way of looking at that data. You don’t have to view it in a manual format by using command line tools. If you can actually get a “SQLite” command interface, the “SQLite” database browser is extremely efficient. It aids you in opening up those databases to view which helps you manipulate them as well as executing SQL commands and queries against those databases which allows you to investigate the data in more detail.
Deft Linux comes with network forensic tools. We have WireShark (Wireshark is a network protocol analyzer for Unix and Windows) and Ettercap. Ettercap is a free, open source network security tool for man-in-the-middle attacks on LAN’s. It can be used for computer network protocol analysis and security auditing. It runs on various Unix-like operating systems including Linux, Mac OS X, BSD and Solaris, and on Microsoft Windows.
Deft also has PDFcrack, Samdumpz, Fcrackzip (which is optimal for cracking zip files). If there is a password on the zip file this may actually be able to crack the password so you can see what is inside that zip file.
Deft Linux is not as easy to use as the graphical programs that are available for computer forensics but, this program has a lot of capability as long as you learn how to use the various tools. You will get more out of the Deft tools if you study and run these applications. On the plus side; Deft Linux is a free “Live CD” that a user can download and burn. It will free the user from being tied to a forensic system. A Disk is easily carried around and can quickly be pressed into an analysis and recovery on any site. These advantages make Deft Linux ideal for targeted computer forensics analysis.