Full Disk Encryption & TrueCrypt

I have been working diligently on the selection topic to the dissertation process and I would say that it is starting to come together. Although I'm still having some trouble narrowing a topic to something specific, I would say I'm on the right track.

In the literature I've been pouring over as of late, I have discovered a trending issue, the use of full disk encryption. This all started with a mandate that all UT Arlington issued laptops be subjected to full disk encryption. Reading more I learned that they were using WinMagic to complete this UT mandate. I have never used WinMagic, but it is cross platform and seems to be well received in the security community.

This lead me (of course) to search for open source options, and to check up on the progress of TrueCrypt. The last time I looked at TrueCrypt there were some issues in using the restore functionality but these have been resolved. The community is strong and support is well maintained for an open source project. Cross platform has always been a standard for this group and it's good to see that has been maintained as well. TrueCrypt does exactly what it states, full disk encryption (although it does do more than these basic functions).

This leads me to the issue at hand. How are investigators to know when full disk encryption is being utilized in a search and seizure? The current best practices for most electronic seizure states to turn off the power and transport. When you disable power to a machine running FDE, you reset the encryption state, and unless you can get the key through forensic means or by compelling (legally compelling) the owner, what you have is a fully encrypted disk. This is not weak encryption I might add. TrueCrypt uses what the industry considers adequate and strong encryption (link takes you to the encryption supported). Unless an investigator notes the use of FDE, then the investigation to files and logs may very well end badly at the seizure scene.

This is the same argument that Casey and  Stellatos make in the paper "The impact of full disk encryption on digital forensics" (Casey & Stellatos, 2008). They argue quite well that the use of full disk encryption could effectively hamper an investigation quickly. This issue leaves only a few possibilities.

1. React and treat all electronic devices as though FDE were enabled and running
2. Modify the best practices to incorporate FDE analysis
3. Compel FDE makers to supply a back door
4. Compel users to release the key

There are of course issues with 3 & 4, mainly that back doors to algorithms are generally bad and would compromise the integrity of the software and its legitimate use. Compelling users to release a key when software can create fake volumes or separate information when supplied a second key are becoming more available (See Grover 2004). One would have to prove in court that the defendant was not cooperating, which would be difficult to show in that case.

Obviously 1 & 2 are the easiest to enable and utilize, but getting the necessary training and use to practitioners is already an issue, which is only being compounded by increases in security. It leaves a lot open for discussion. I'm interested in studying this further from a process, technical, and legal standpoint. 

Bibliography:

Casey, E., & Stellatos, G. J. (2008). The impact of full disk encryption on digital forensics. SIGOPS Oper. Syst. Rev., 42(3), 93-98. doi: 10.1145/1368506.1368519

Casey, E., Fellows, G., Geiger, M., & Stellatos, G. (2011). The growing impact of full disk encryption on digital forensics. Digital Investigation, 8(2), 129-134. doi: 10.1016/j.diin.2011.09.005

Grover, D. (2004). Dual encryption and plausible deniability. Computer Law & Security Review, 20(1), 37-40. doi: 10.1016/s0267-3649(04)00007-x

TrueCrypt Icon by Flashhack @ deviantart
http://flakshack.deviantart.com/art/TrueCrypt-Flurry-Icon-274705836

BackTrack 5 & Sleuth Kit

The more I use BT5 the more I am falling in love with it. As a set of tools and resources it is by far one of the most complete I have ever seen. I really wish I had stumbled across it prior to this year instead of building my own loads and distros all this time.

One of the more useful things I have done this year is to replace my aging desktop at home. It took months to build as I acquired the parts necessary for the machine I wanted (as compared to the machine which would accomplish the goal). Now that it is completed and working, I have begun setting up my tools again and getting things organized as I normally operate. I have added BT5 in a VirtualBox environment to this suite of tools. Now that I have seen the offensive and monitoring capability of the BT5 suite, I need to look into the Live CD and its set of forensics tools. I would really like to move my digital crime course to more hands on and more of a lab environment for the students. I'm trying to find a way to do this both realistically and systematically at the same time. The hands on items of interest I am currently doing in the course seems to be not only very popular among the students, but also seems to be the most retained knowledge throughout the semester, which is somewhat straightforward.

I need to just set aside some time to see how many (if any) videos and tutorials already exist for Sleuth Kit and PTK. Both of these tools are on BT5 and several other Live disks. I would not be difficult to create 10-20 laptop drives as a project for using these tools and from what I'm reading in the academic journals, a team based approach seems to work better and produce more interaction. At the same time the course has been moved from an 8am to a 2pm course, I'm sure that alone will inspire more interaction.

For those of you who are not familiar with BackTrack 5 or The Sleuth Kit (TSK), just click the links.