Backtrack 4 Forensics Capabilities
When you first boot up the new Backtrack 4, you may have noticed something slightly different.
So what is this “Start BackTrack Forensics” option about?
Live CDs and Forensics
For a long time now, Linux Live CDs have been very useful for
forensic acquisition purposes in instances where for one reason or
another you can’t utilize a hardware write blocker. When configured not
to automount drives, and a little bit of know how, a Linux Live CD can
be a wonderful software write blocker. For a Linux live CD to be
considered for this purpose however, it is of the utmost importance that
the use of the live CD in no way alters any data in any manner. In the
past, this ruled out the use of Backtrack for forensic purposes.
Backtrack would automount available drives and utilize swap partitions
where available. This could cause all sorts of havoc, changing last
mount times, altering data on disk, and so on. Well, no longer! The
Backtrack 4 Live CD has incorporated changes to allow a boot mode which
is forensically clean. This is great news, as with Backtrack being such a
popular live CD, a copy can often be found close at hand.
How?
So, lets have the scoop. Forensic people are often detail oriented
and very conservative, so how do we know it is safe to use? Well, first
off the Backtrack 4 Live CD is based off of Casper, and contains no
filesystem automount scripts at all. The system initialization scripts
have been altered in the forensic boot mode so that Backtrack 4 will not
look for or make use of any swap partitions which are contained on the
system. All those scripts have been removed from the system.
Verification
To test this functionality, we have tested this boot mode with
multiple hardware configurations. For each test, we took a before MD5
snapshot of the system disks, booted BT4 in forensic boot mode, verified
no file systems were mounted and swap was not in use, did a number of
activities on the system, then shut the system back down and took an
after MD5 snapshot. In comparing the two MD5 snapshots, in every case
they were a match, demonstrating no changes on the disks has been made.
So, can you trust Backtrack 4 for your forensic purposes? Well, not
until you verify it as well! Just like any forensic tool, its negligent
to just take someone else’s word that any tool works properly. Its up
to you to independently verify the tool before you use it. We expect
your results will match ours, and you will find Backtrack 4 is a great
addition to you tool set. (And, if your results find a problem, please
let us know ASAP and include details as to how you conducted your
testing. As, that would be a real problem.)
Usage
When you utilize Backtrack for forensics purposes, be sure you don’t
let it go through an unattended boot. Default boot for Backtrack is
standard boot mode, which will use swap partitions if they are present.
There is a nice long delay however, so you will have plenty of time to
select the proper boot mode. Also, please remember, this is a
Linux distribution. It is highly suggested that you become familiar with
Linux before use this, or any other Linux Live CD for any forensic
purpose. Also, be sure to check out the additional forensic tools added
to Backtrack 4. We have concentrated on the addition of imaging and
triage tools, but if you find that one of your favorite utilities is not
in place please let us know so we can look into having it added.
So what is this “Start BackTrack Forensics” option about?
Comments