SlideShare une entreprise Scribd logo

Accelerating forensic and incident response workflow: the case for a new standard in forensic imaging - HTCIA 2016

•Télécharger en tant que PPTX, PDF•
•
B
Bradley Schatz

This document discusses approaches to improving the speed and efficiency of forensic imaging workflows. It identifies current forensic image formats as a bottleneck, with linear hashing and compression algorithms not scaling well to modern multi-core systems. The Advanced Forensic Format (AFF4) is presented as a solution, using block-based hashing and faster compression to fully utilize available I/O throughput. Optimizing storage interfaces, filesystem choices, and system configuration can further increase acquisition speeds.

Données & analyses
1  sur  87
Accelerating your forensic & incident response workflow: the case for a new standard in forensic imaging Dr. Bradley Schatz Director, Schatz Forensic v1.2 - HTCIA Conference 2016 © Schatz Forensic 2016
© 2016 Schatz Forensic The volume problem increases the latency between evidence identification and useful findings Identify Acquire Analyse Reporting Latency
© 2016 Schatz Forensic Pick one of the below You can’t have both Latency Completeness Physical Acquisition Triage You preserve everything but analysis will have to wait Near immediate results at the expense of potentially missing evidence Live forensics
© 2016 Schatz Forensic How can we reduce latency? While maximising completeness Latency Completeness Physical Acquisition Triage Increase I/O throughput? Live analysis while we acquire? Dynamic partial acquisition? Live forensics
© 2016 Schatz Forensic Current forensic image formats are now a bottleneck • Deflate compression is inefficient • Linear hashing does not scale to multi-core • Copying blocks of zero filled sectors is a waste of time • Linear images prevent efficient out of order acquisition
© 2016 Schatz Forensic The Advanced Forensic Format v4 (AFF4) image format is the solution • Scalable to GB/s IO & multi-core • Enable forensically reproducible partial non- linear images (reproducible triage) • Scientifically peer reviewed (ref Daubert) • Unencumbered, open specification • Open source implementations
What’s stopping me increasing I/O throughput? Background
© 2016 Schatz Forensic Forensic Imaging v1.0: Raw Linear bitstream copy + linear bitstream hash $ dd if=/dev/hda bs=4k conv=sync,noerror | tee C1.D1.raw | md5sum > C1.D1.md5.txt
© 2016 Schatz Forensic Forensic Imaging v1.0: Raw MD5 Source Hard Drive ACMECo.C1.D1.raw ACMECo.C1.D1.raw.txt # Linear Bitstream Hash
© 2016 Schatz Forensic What affects throughput in acquisition? Target Storage Interconnect Hash Filesystem Interconnect Evidence storage
© 2016 Schatz Forensic I/O throughput in Acquisition is a systems problem Target Storage Interconnect Hash Filesystem Interconnect Evidence storage Target Storage Sustained Read 1TB Seagate 3.5” 7200rpm SATA 100 MB/s Current generation 3.5” 7200rpm SATA 200 MB/s Intel 730 SSD 550 MB/s Macbook Pro 1TB ~1 GB/s RAID 15000rpm SAS > 1 GB/s Samsung 850 NVMe 1.5 – 2.5 GB/s
© 2016 Schatz Forensic I/O throughput in Acquisition is a systems problem Target Storage Interconnect Hash Filesystem Interconnect Evidence storage Algorithm Average Throughput MB/s SHA1 619.23 MD5 745.65 Blake2b 601.87
© 2016 Schatz Forensic I/O throughput in Acquisition is a systems problem Target Storage Interconnect Hash Filesystem Interconnect Evidence storage Interconnect Gb/s Actual Gb/s Max MB/s Max GB/m PCIe / NVMe / Thunderbolt > 1000 > 60 SATA3 / SAS 6G 6 4.8 600 36 USB3 5 4 500 30 Gigabit Ethernet 1 ~100 USB2 .48 .38 48 2.9
© 2016 Schatz Forensic I/O throughput in Acquisition is a systems problem Target Storage Interconnect Hash Filesystem Interconnect Evidence storage Interconnect Gb/s Actual Gb/s Max MB/s Max GB/m PCIe / NVMe / Thunderbolt > 1000 > 60 SATA3 / SAS 6 4.8 600 36 USB3 5 4 500 30 Gigabit Ethernet 1 ~100 USB2 .48 .38 48 2.9 Can we practically achieve this?
© 2016 Schatz Forensic Not all bridges are made equal Manuf. Source Dest Form factor Year purchased MB/s Orico USB3 SATA 3.5” slide dock 2014 219 Orico USB3 SATA 2.5” enclosure 2016 247 Orico USB3 SATA 3.5” dual dock 2016 402 Kanex Thunderbolt eSATA Cable 2015 213 Nexstar USB3 SATA 3.5” dock 2014 189 Nexstar USB3 eSATA Cable 2016 249 Probox USB3 SATA Bridge 2016 416* Samsung T3 USB3 integrated SSD 2016 400 Testing tool: BlackMagicDesign Disk Speed Test Destination disk: Samsung 850 Pro SSD * Fails under heavy load
© 2016 Schatz Forensic Take Away #1 Faster destination IO is important, but beware choice of bridge • Not an issue if imaging to spinning disk <200MB/s • Raw SATA & SAS IO fastest (duplicators) • SSD/RAID speed levels require decent bridges • Thunderbolt and UASP promising – more testing needed
© 2016 Schatz Forensic Example: Forensic Duplicator 1TB Seagate Target Target Storage Interconnect Hash Filesystem Interconnect Evidence storage SHA1 600MB/s SATA3 Spinning Disk 93.6MB/s SAS 6G 600MB/s SATA3 Spinning Disk 200MB/s Acquisition 1TB @ 93.6MB/s = 2h 58m Verification 1TB @ 200MB/s = 1h 23m TOTAL = 4h 21m SAS 6G 600MB/s
© 2016 Schatz Forensic Bare Metal (LiveCD) Ancient Workstation Acquisition Target Storage Interconnect Hash Filesystem Interconnect Evidence storage SHA1 600MB/s SATA3 Spinning Disk 100MB/s USB2 45MB/s SATA3 Spinning Disk 200MB/s Acquisition 1TB @ 45MB/s = 6h 10m Verification 1TB @ 45MB/s = 6h 10m TOTAL = 12h 20m
© 2016 Schatz Forensic Bare Metal (LiveCD) Ancient Workstation Acquisition Target Storage Interconnect Hash Filesystem Interconnect Evidence storage SHA1 600MB/s SATA3 Spinning Disk 100MB/s USB2 45MB/s SATA3 Spinning Disk 200MB/s Acquisition 1TB @ 45MB/s = 6h 10m Verification 1TB @ 200MB/s = 1h 23m TOTAL = 7h 33m After copy, verify image on device with faster interconnect
© 2016 Schatz Forensic Take Away #2 Plan your acquisitions to maximise throughput • Relocate image for verification • Add a USB3 expresscard / PCIe card • Pull disks from slower machines and go bare metal (live CD) on faster ones • Use GigE (100Mb/s) instead of USB2
© 2016 Schatz Forensic Bare Metal (LiveCD) Example: Caveat User Space Filesystem Target Storage Interconnect Hash Filesystem Interconnect Evidence storage SHA1 600MB/s SATA3 Spinning Disk 200MB/s USB3 500MB/s SATA3 Spinning Disk 200MB/s Acquisition 1TB @ 100MB/s = 2h 46m Verification 1TB @ 100MB/s = 2h 46m TOTAL = 5h 22m NTFS-3g 100MB/s SAS 6G 600MB/s
© 2016 Schatz Forensic Is your forensic liveCD slowing you down? $ ntfs-3g /dev/sdd1 /mnt $ time sh –c “time dd if=/dev/zero of=/mnt/zeros bs=512k count=20k ; sync” 104s 102MB/s $ mount –t ntfs-3g –o max_read=131072,big_writes /dev/sdd1/ /mnt $ time sh –c “time dd if=/dev/zero of=/mnt/zeros bs=512k count=20k ; sync” 33s 318 MB/s Destination: Samsung T3 USB3 SSD
© 2016 Schatz Forensic Take Away #3 NTFS may be a convenient destination filesystem, but is it costing time? • Use a kernel based FS implementation • -or- • Tune the filesystem if it is a user space variant
© 2016 Schatz Forensic Forensic Imaging v2.0: EWF Original design Source Hard Drive MD5 Deflate ACMECo.C1.D1.e01 Source Hard Drive # Linear BitStream Hash Linear Compressed Block Stream
© 2016 Schatz Forensic The deflate algorithm is a significant bottleneck Target Storage Interconnect Hash Compress Filesystem Interconnect Evidence storage Data Deflate MB/s Inflate MB/s High entropy 40.4 439 Low entropy 259 IO bound *Single core of quad core i7-4770 3.4Ghz measured with gzip
© 2016 Schatz Forensic FTK Imager EWF Acquisition 1TB Seagate 75% full, 4 core i5-750 Target Storage Interconnect Hash Compress Filesystem Interconnect Evidence storage SHA1 600MB/s SATA3 Spinning Disk 100MB/s SATA3 600MB/s SATA3 Spinning Disk 200MB/s Acquisition 1TB @ 67.8MB/s = 4h 06m Verification 1TB @ 106MB/s = 2h 36m TOTAL = 6h 42m Deflate 67.8 MB/s
© 2016 Schatz Forensic Forensic Imaging v2.1: Threaded EWF Guymager (2008), X-Ways, recent ewfacquire MD5 Deflate DeflateDeflate Source Hard Drive ACMECo.C1.D1.e01 # Linear Bitstream Hash
© 2016 Schatz Forensic Lacklustre throughput reports (2013) • Practitioner reports – Low 100’s MB/s [Zimmerman 2013] • Research publications – FastDD <= 110 MB/s [Bertasi & Zago 2013] • Our experience – Low powered CPU’s give low throughtput
© 2016 Schatz Forensic Threaded EWF Acquisition 240GB Intel 730 SSD 50% full, Core 2 Duo (Lenovo X200 circa 2009) Target Storage Interconnect Hash Compress Filesystem Interconnect Evidence storage SHA1SATA3 Intel 730 SSD ~500MB/s USB3 500MB/s SATA3 Samsung 840 EVO SSD ~500MB/s Acquisition 240GB @ 91MB/s = 40m 21s Deflate 45 MB/s per core SATA2 300MB/s
Our approach to increasing I/O throughput
© 2016 Schatz Forensic Scale to 8-core i7 & uncontended IO? Threaded EWF is CPU bound Target Storage Interconnect Hash Compress Filesystem Interconnect Evidence storage SHA1 600MB/s SATA3 Intel 720 SSD ~500MB/s SATA3 600MB/s SATA3 Samsung 850 EVO Pro ~500MB/s Acquisition 240GB @ 255MB/s = 14m 35s Verification 240GB @ 350MB/s = 10m 37s TOTAL = 25m 12s Deflate 31.9MB/s/core *8 core i7-5820k @ 3.20 GHz
© 2016 Schatz Forensic How about using a faster compression algorithm? Target Storage Interconnect Hash Compress Interconnect Evidence storage Compression Algorithm Throughput MB/s/core* Deflate (ZIP, gzip) 31.9 Snappy (Google BigTable) 1,400 LZO (ZFS) 1,540
© 2016 Schatz Forensic Forensic Imaging v4.0: AFF4 (2009) • ZIP64 based container • Storage virtualization • Open source implementation & specification
© 2016 Schatz Forensic AFF4: Storage Virtualisation ACMECo.S1.RAID0.af4 ACMECo.S1.D1.af4 # Linear Bitstream Hash ACMECo.S1.D2.af4 # Linear Bitstream Hash Compressed Block Storage Stream Virtual Storage Stream (Map)
© 2016 Schatz Forensic AFF4: Storage Virtualisation ACMECo.S1.RAID0.af4 ACMECo.S1.D1.af4 # Linear Bitstream Hash ACMECo.S1.D2.af4 # Linear Bitstream Hash Compressed Block Storage Stream Virtual Storage Stream (Map) Storage virtualisation
© 2016 Schatz Forensic AFF4: Storage Virtualisation ACMECo.S1.RAID0.af4 ACMECo.S1.D1.af4 # Linear Bitstream Hash ACMECo.S1.D2.af4 # Linear Bitstream Hash Compressed Block Storage Stream Virtual Storage Stream (Map) Inter –container referencing
© 2016 Schatz Forensic Linear bitstream hashing isn’t parallelizable. Max. rate ~600 MB/s on current gen. CPU’s Target Storage Interconnect Hash Filesystem Interconnect Evidence storage Algorithm Throughput MB/s SHA1 619.23 MD5 745.65 Blake2b 601.87
© 2016 Schatz Forensic Our solution: Block based hashing. Hash Compress CompressCompress Source Hard Drive Hash Hash Block Hashes # Block Hashes Hash
Test standard composition Stored block size –v- LBA address Windows 8.1 10.2G Govdocs1 (1- 75,1-40) 59.8G /dev/random 38.4G Empty space (zeros)
Block based hashing beats linear stream hashing with low powered multicore CPU’s Dual core i5-3337U 1.8GHz Sparse data Max CPU hash throughput Sparse data Read I/O limited
© 2016 Schatz Forensic Block hashing shifts the bottleneck from from CPU to I/O Target Storage Interconnect Hash Compress Filesystem Interconnect Evidence storage SHA1 600 MB/s/core SATA3 Intel 730 SSD 500MB/s 4x SATA3 2.4GB/s RAID0 4x SATA3 2TB 800MB/s Snappy Avg 1.5GB/s/core *8 core i7-5820k @ 3.20 GHz Acquisition application Linear Acquisition Verification X-Ways Forensics 14:35 255 MB/s (15.3 GB/min) 10:37 350 MB/s (21.0 GB/min) Wirespeed (linear) 7:23 500 MB/s (30.3 GB/min) 4:12 888 MB/s (53.33 GB/min)
How can we take advantage of these speeds?
© 2016 Schatz Forensic Block hashing shifts the bottleneck from from CPU to I/O Target Storage Interconnect Hash Compress Filesystem Interconnect Evidence storage SHA1 600 MB/s/core SATA3 Intel 720 SSD 500MB/s 4x SATA3 2.4GB/s RAID0 4x SATA3 2TB 800MB/s Snappy Avg 1.5GB/s/core *8 core i7-5820k @ 3.20 GHz Acquisition application Linear Acquisition Verification X-Ways Forensics 14:35 255 MB/s (15.3 GB/min) 10:37 350 MB/s (21.0 GB/min) Wirespeed (linear) 7:23 500 MB/s (30.3 GB/min) 4:12 888 MB/s (53.33 GB/min) Realistic? More likely USB3 or 1GbE
© 2016 Schatz Forensic Idea: can we aggregate output I/O? Use 2x USB3 drives? Target Storage Interconnect Hash Compress Filesystem Interconnect Evidence storage SHA1 600 MB/s/core SATA3 Intel 720 SSD 500MB/s 2x USB3 1GB/s 2x SATA3 2TB 400MB/s Snappy Avg 1.5GB/s/core *8 core i7-5820k @ 3.20 GHz
© 2016 Schatz Forensic AFF4 Striping ACMECo.S1.D1.2.af4 ACMECo.S1.D1.1.af4 Virtual Storage Stream (Map) Disk 1 Disk 2 Source blocks striped over multiple containers on multiple output disks
© 2016 Schatz Forensic AFF4 Striping ACMECo.S1.D1.2.af4 ACMECo.S1.D1.1.af4 Virtual Storage Stream (Map) Disk 1 Disk 2 A copy of the map is stored in each container.
Test standard composition Stored block size –v- LBA address Windows 8.1 10.2G Govdocs1 (1- 75,1-40) 59.8G /dev/random 38.4G Empty space (zeros)
Multiple output channels increases throughput Especially for uncompressible data High entropy data
© 2016 Schatz Forensic Multi-destination throughput is even higher for current generation drives 1TB NVMe (Core i7-4578U, 2 Cores) Macbook Pro A1502 (Evimetry 2.1.0) Acquisition technique Acquire + Verify Evimetry Wirespeed 0:52:04 Xways + WinFE 2:48:00 Macquisition EWF 7:08:38
© 2016 Schatz Forensic Multi-destination throughput is even higher for current generation drives 1TB NVMe (Core i7-4578U, 2 Cores) Macbook Pro A1502 (Evimetry 2.2.0a) Acquisition technique Acquire + Verify Evimetry Wirespeed 0:52:04 Xways + WinFE 2:48:00 Macquisition EWF 7:08:38
© 2016 Schatz Forensic Multi-destination throughput is even higher for current generation drives 512GB Samsung 850 NVMe w/ 4 core i5 (Evimetry 2.2.0a) Acquisition technique Acquire + Verify Evimetry Wirespeed 0:52:04 Xways + WinFE 2:48:00 Macquisition EWF 7:08:38
How can we analyse while we acquire?
© 2016 Schatz Forensic How can we reduce latency? While maximising completeness Latency Completeness Physical Acquisition Triage Increase I/O throughput? Live analysis while we acquire? Dynamic partial acquisition? Live forensics
© 2016 Schatz Forensic Idea: Start with a non-linear partial image and add from there Entire disk All allocated Interactive analysis artifacts High value files Volume & FS Metadata, Memory Analysis
© 2016 Schatz Forensic Acquire and access in parallel? dd + iSCSI access to target MD5 Source Hard Drive ACMECo.C1.D1.raw ACMECo.C1.D1.raw.txt # Linear Bitstream Hash iSCSI Remote analysis tools
© 2016 Schatz Forensic Acquire and access in parallel? dd + iSCSI access to target MD5 Source Hard Drive ACMECo.C1.D1.raw ACMECo.C1.D1.raw.txt # Linear Bitstream Hash iSCSI Remote analysis tools Access is contended. Poor interactive performance (lag )
© 2016 Schatz Forensic Acquire and access in parallel? dd + iSCSI access to target MD5 Source Hard Drive ACMECo.C1.D1.raw ACMECo.C1.D1.raw.txt # Linear Bitstream Hash iSCSI Remote analysis tools Early termination may not have a complete filesystem
© 2016 Schatz Forensic Raw Image : Non-linear acquisition via sparse raw file, driven by live analysis? Source Hard Drive ACMECo.C1.D1.raw ACMECo.C1.D1.raw.txt # Linear Bitstream Hash iSCSI How do you generate a hash over a non-linear image? * X-Ways does similar, only not remote
© 2016 Schatz Forensic Forensic Imaging v4.1: AFF4 (2010) • Non-linear acquisition • Hash based imaging (deduplication)
© 2016 Schatz Forensic Partial, non-linear, block based hashing Hash Compress CompressCompress ACMECo.C1.D1.af4 Volume Metadata Filesystem Metadata Sparse Data File Content Unknown Hash Hash Block Hashes Compressed Block Stream # Block Hashes Hash Virtual Block Stream (Map) Source Hard Drive
© 2016 Schatz Forensic Forensic Imaging v4.2: AFF4 (2015) • Partial acquisition – Represent what we didn’t acquire vs. what we couldn’t acquire • Block based hashing
© 2016 Schatz Forensic Partial, non-linear, block based hashing ACMECo.C1.D1.af4ACMECo.C1.D1.af4 Block Hashes Compressed Block Stream ## Virtual Block Stream (Map) Linear Block Hash Map Hash Block Hashes Hash ## ##
© 2016 Schatz Forensic Evimetry & AFF4 Non-linear, partial physical acquisition driven by live analysis Source Hard DriveSource Hard Drive ACMECo.C1.D1.af4ACMECo.C1.D1.af4 Block Hashes Compressed Block Stream ## Block Hashes Hash Virtual Block Stream (Map) I/O Planning & Scheduling Acquisition Virtual Disk File categories Blocks
© 2016 Schatz Forensic Partial acquisition brings reproducibility and elasticity to IR and triage Target Storage Interconnect Hash Compress Network Evidence storage SHA1 600 MB/s/core SATA3 Spinning disk 200MB/s 1GbE 100MB/s RAID0 4x SATA3 2TB 800MB/s Snappy Avg 1.5GB/s/core *8 core i7-5820k @ 3.20 GHz Partial IR acquisition 21.9GiB @ 102MiB/s = 3m 39s Volume metadata, filesystem metadata, 16G pagefile, Registries, Logs, Link files, Jump lists, WMI CIM Repo, Prefetch, USN Journal, $Logfile, Scheduler artefacts
How can I work with AFF4 images?
© 2016 Schatz Forensic Why adopt this? My toolset doesn't support AFF4. • Wait for support from vendors? – In progress • Convert AFF4 to EWF on fast workstation – Can be done in roughly the same time it takes to simply copy (only compress low entropy blocks) • Emulate Raw image in the filesystem
© 2016 Schatz Forensic Virtual FS Emulation of AFF4 containers as emulated raw images
© 2016 Schatz Forensic Emulated Raw is faster than native EWF. X-Ways processing task X-Ways Native EWF X-Ways w/ Evimetry FS Bridge Verify 0:42:00 0:08:00 FS Data Recovery 0:03:35 0:03:20 Hashing & header validation 1:59:03 1:05:25 Carving unallocated 0:41:00 0:44:00 Total 3:25:43 2:02:09 Image: 1TB Macbook Pro i7, processed on 8 core i7 w/ RAID
How does this affect workflow?
© 2016 Schatz Forensic Native EWF Acquisition vs AFF4 Native EWF Processing vs AFF4 FS Bridge
© 2016 Schatz Forensic Native EWF Acquisition vs AFF4 Native EWF Processing vs AFF4 FS Bridge Single Threaded EWF?
© 2016 Schatz Forensic Native EWF Acquisition vs AFF4 Native EWF Processing vs AFF4 FS Bridge Multi Threaded EWF
© 2016 Schatz Forensic Native EWF Acquisition vs AFF4 Native EWF Processing vs AFF4 FS Bridge AFF4
© 2016 Schatz Forensic Native EWF Acquisition vs AFF4 Native EWF Processing vs AFF4 FS Bridge AFF4: Copies in half the time due to striped acquisition over 2 x 200 MB/s spinning disks. EWF: I/O bound on single 200MB/s disk
© 2016 Schatz Forensic Native EWF Acquisition vs AFF4 Native EWF Processing vs AFF4 FS Bridge AFF4: Verification completes in 8m. I/O bound by RAID. EWF: CPU bound
© 2016 Schatz Forensic Native EWF Acquisition vs AFF4 Native EWF Processing vs AFF4 FS Bridge AFF4: Filesystem search in around ½ time. EWF: CPU bound?
© 2016 Schatz Forensic Native EWF Acquisition vs AFF4 Native EWF Processing vs AFF4 FS Bridge AFF4 & EWF around the same throughput.
Will the courts accept the AFF4 format?
© 2016 Schatz Forensic Courts accept expert evidence Is it reliable? • Is the expert reliable? • Is the underlying theory reliable? – Reliable by way of the application of Scientific methods (eg. Daubert) – 4 scientifically peer reviewed papers, unrefuted • Are the methods implementing the theory reliable? – Tool testing (as always, the expert’s ultimate responsibility)
Adoption Who is using AFF4?
© 2016 Schatz Forensic AFF4 is used in the following
© 2016 Schatz Forensic Near Future • Evimetry Community Edition – Free creation, conversion & consumption of AFF4 images (Windows) • AFF4 Standardisation Effort (AFF4 Working Group) – Bradley Schatz (Evimetry), Michael Cohen (Google) chairing – Open source implementation and specification in progress – Blackbag recently joined • Sleuthkit/Autopsy – Support planned • Open Source Digital Forensic Conference 2016 – AFF4 status update
More information
© 2016 Schatz Forensic More information Implementations • https://evimetry.com/ • https://github.com/google/aff4 • http://www.rekall-forensic.com/docs/Tools/ • https://github.com/google/grr Ongoing specification and papers • http://www.aff4.org/ • http://dfrws.org/2009/proceedings/p57-cohen.pdf • http://dfrws.org/2010/proceedings/2010-314.pdf • http://dfrws.org/2015/proceedings/DFRWS2015-16.pdf
Conclusion
© 2016 Schatz Forensic Conclusion • Optimising forensic workflow is a systems problem • Existing forensic formats are a bottleneck for todays systems • Existing forensic image formats are generally incompatible with triage and reproducible live analysis • The Advanced Forensic Format 4 solves the above
Contact Hard disk head by amckgill Footprints by kimba Dr Bradley Schatz https://evimetry.com/ bradley@evimetry.com

Recommandé

AFF4: The new standard in forensic imaging and why you should care
AFF4: The new standard in forensic imaging and why you should careAFF4: The new standard in forensic imaging and why you should care
AFF4: The new standard in forensic imaging and why you should care
Bradley Schatz
 
Unlock Bigdata Analytic Efficiency with Ceph Data Lake - Zhang Jian, Fu Yong
Unlock Bigdata Analytic Efficiency with Ceph Data Lake - Zhang Jian, Fu YongUnlock Bigdata Analytic Efficiency with Ceph Data Lake - Zhang Jian, Fu Yong
Unlock Bigdata Analytic Efficiency with Ceph Data Lake - Zhang Jian, Fu Yong
Ceph Community
 
IPv4 IPv6 Multi Protocol Media Player
IPv4 IPv6 Multi Protocol Media PlayerIPv4 IPv6 Multi Protocol Media Player
IPv4 IPv6 Multi Protocol Media Player
Masaaki Nabeshima
 
Ceph on rdma
Ceph on rdmaCeph on rdma
Ceph on rdma
Somnath Roy
 
optimizing_ceph_flash
optimizing_ceph_flashoptimizing_ceph_flash
optimizing_ceph_flash
Vijayendra Shamanna
 
Decentralized storage
Decentralized storageDecentralized storage
Decentralized storage
Anurag Dashputre
 
Ceph optimized Storage / Global HW solutions for SDS, David Alvarez
Ceph optimized Storage / Global HW solutions for SDS, David AlvarezCeph optimized Storage / Global HW solutions for SDS, David Alvarez
Ceph optimized Storage / Global HW solutions for SDS, David Alvarez
Ceph Community
 
DNS Survival Guide
DNS Survival GuideDNS Survival Guide
DNS Survival Guide
APNIC
 

Recommandé

AFF4: The new standard in forensic imaging and why you should care
AFF4: The new standard in forensic imaging and why you should careAFF4: The new standard in forensic imaging and why you should care
AFF4: The new standard in forensic imaging and why you should care
Bradley Schatz
 
Unlock Bigdata Analytic Efficiency with Ceph Data Lake - Zhang Jian, Fu Yong
Unlock Bigdata Analytic Efficiency with Ceph Data Lake - Zhang Jian, Fu YongUnlock Bigdata Analytic Efficiency with Ceph Data Lake - Zhang Jian, Fu Yong
Unlock Bigdata Analytic Efficiency with Ceph Data Lake - Zhang Jian, Fu Yong
Ceph Community
 
IPv4 IPv6 Multi Protocol Media Player
IPv4 IPv6 Multi Protocol Media PlayerIPv4 IPv6 Multi Protocol Media Player
IPv4 IPv6 Multi Protocol Media Player
Masaaki Nabeshima
 
Ceph on rdma
Ceph on rdmaCeph on rdma
Ceph on rdma
Somnath Roy
 
optimizing_ceph_flash
optimizing_ceph_flashoptimizing_ceph_flash
optimizing_ceph_flash
Vijayendra Shamanna
 
Decentralized storage
Decentralized storageDecentralized storage
Decentralized storage
Anurag Dashputre
 
Ceph optimized Storage / Global HW solutions for SDS, David Alvarez
Ceph optimized Storage / Global HW solutions for SDS, David AlvarezCeph optimized Storage / Global HW solutions for SDS, David Alvarez
Ceph optimized Storage / Global HW solutions for SDS, David Alvarez
Ceph Community
 
DNS Survival Guide
DNS Survival GuideDNS Survival Guide
DNS Survival Guide
APNIC
 
Aerospike Go Language Client
Aerospike Go Language ClientAerospike Go Language Client
Aerospike Go Language Client
Sayyaparaju Sunil
 
Network OS Code Coverage demo using Bullseye tool
Network OS Code Coverage demo using Bullseye toolNetwork OS Code Coverage demo using Bullseye tool
Network OS Code Coverage demo using Bullseye tool
Vikram G Hosakote
 
Ceph Object Storage Performance Secrets and Ceph Data Lake Solution
Ceph Object Storage Performance Secrets and Ceph Data Lake SolutionCeph Object Storage Performance Secrets and Ceph Data Lake Solution
Ceph Object Storage Performance Secrets and Ceph Data Lake Solution
Karan Singh
 
Automation of Hadoop cluster operations in Arm Treasure Data
Automation of Hadoop cluster operations in Arm Treasure DataAutomation of Hadoop cluster operations in Arm Treasure Data
Automation of Hadoop cluster operations in Arm Treasure Data
Yan Wang
 
Aerospike Architecture
Aerospike ArchitectureAerospike Architecture
Aerospike Architecture
Peter Milne
 
Building the Right Platform Architecture for Hadoop
Building the Right Platform Architecture for HadoopBuilding the Right Platform Architecture for Hadoop
Building the Right Platform Architecture for Hadoop
All Things Open
 
Aerospike DB and Storm for real-time analytics
Aerospike DB and Storm for real-time analyticsAerospike DB and Storm for real-time analytics
Aerospike DB and Storm for real-time analytics
Aerospike
 
High Performance, Scalable MongoDB in a Bare Metal Cloud
High Performance, Scalable MongoDB in a Bare Metal CloudHigh Performance, Scalable MongoDB in a Bare Metal Cloud
High Performance, Scalable MongoDB in a Bare Metal Cloud
MongoDB
 
Email storage with Ceph - Danny Al-Gaaf
Email storage with Ceph - Danny Al-GaafEmail storage with Ceph - Danny Al-Gaaf
Email storage with Ceph - Danny Al-Gaaf
Ceph Community
 
Ceph Day Beijing: Big Data Analytics on Ceph Object Store
Ceph Day Beijing: Big Data Analytics on Ceph Object Store Ceph Day Beijing: Big Data Analytics on Ceph Object Store
Ceph Day Beijing: Big Data Analytics on Ceph Object Store
Ceph Community
 
Getting The Most Out Of Your Flash/SSDs
Getting The Most Out Of Your Flash/SSDsGetting The Most Out Of Your Flash/SSDs
Getting The Most Out Of Your Flash/SSDs
Aerospike, Inc.
 
Cassandra Troubleshooting 3.0
Cassandra Troubleshooting 3.0Cassandra Troubleshooting 3.0
Cassandra Troubleshooting 3.0
J.B. Langston
 
Architecting Ceph Solutions
Architecting Ceph SolutionsArchitecting Ceph Solutions
Architecting Ceph Solutions
Red_Hat_Storage
 
Vacuum more efficient than ever
Vacuum more efficient than everVacuum more efficient than ever
Vacuum more efficient than ever
Masahiko Sawada
 
Ceph's journey at SUSE
Ceph's journey at SUSECeph's journey at SUSE
Ceph's journey at SUSE
Ceph Community
 
Predictable Big Data Performance in Real-time
Predictable Big Data Performance in Real-timePredictable Big Data Performance in Real-time
Predictable Big Data Performance in Real-time
Aerospike, Inc.
 
Hot Cloud'16: An Experiment on Bare-Metal BigData Provisioning
Hot Cloud'16: An Experiment on Bare-Metal BigData ProvisioningHot Cloud'16: An Experiment on Bare-Metal BigData Provisioning
Hot Cloud'16: An Experiment on Bare-Metal BigData Provisioning
Ata Turk
 
Aerospike: Key Value Data Access
Aerospike: Key Value Data AccessAerospike: Key Value Data Access
Aerospike: Key Value Data Access
Aerospike, Inc.
 
Lessons Learned on Java Tuning for Our Cassandra Clusters (Carlos Monroy, Kne...
Lessons Learned on Java Tuning for Our Cassandra Clusters (Carlos Monroy, Kne...Lessons Learned on Java Tuning for Our Cassandra Clusters (Carlos Monroy, Kne...
Lessons Learned on Java Tuning for Our Cassandra Clusters (Carlos Monroy, Kne...
DataStax
 
Accelerating forensic and incident response workflow: the case for a new stan...
Accelerating forensic and incident response workflow: the case for a new stan...Accelerating forensic and incident response workflow: the case for a new stan...
Accelerating forensic and incident response workflow: the case for a new stan...
Bradley Schatz
 
JetStor NAS series 2016
JetStor NAS series 2016JetStor NAS series 2016
JetStor NAS series 2016
Gene Leyzarovich
 
Технологии работы с дисковыми хранилищами и файловыми системами Windows Serve...
Технологии работы с дисковыми хранилищами и файловыми системами Windows Serve...Технологии работы с дисковыми хранилищами и файловыми системами Windows Serve...
Технологии работы с дисковыми хранилищами и файловыми системами Windows Serve...
Виталий Стародубцев
 

Contenu connexe

Tendances

Automation of Hadoop cluster operations in Arm Treasure Data
Automation of Hadoop cluster operations in Arm Treasure DataAutomation of Hadoop cluster operations in Arm Treasure Data
Automation of Hadoop cluster operations in Arm Treasure Data
Yan Wang
 
High Performance, Scalable MongoDB in a Bare Metal Cloud
High Performance, Scalable MongoDB in a Bare Metal CloudHigh Performance, Scalable MongoDB in a Bare Metal Cloud
High Performance, Scalable MongoDB in a Bare Metal Cloud
MongoDB
 
Ceph Day Beijing: Big Data Analytics on Ceph Object Store
Ceph Day Beijing: Big Data Analytics on Ceph Object Store Ceph Day Beijing: Big Data Analytics on Ceph Object Store
Ceph Day Beijing: Big Data Analytics on Ceph Object Store
Ceph Community
 
Hot Cloud'16: An Experiment on Bare-Metal BigData Provisioning
Hot Cloud'16: An Experiment on Bare-Metal BigData ProvisioningHot Cloud'16: An Experiment on Bare-Metal BigData Provisioning
Hot Cloud'16: An Experiment on Bare-Metal BigData Provisioning
Ata Turk
 
Lessons Learned on Java Tuning for Our Cassandra Clusters (Carlos Monroy, Kne...
Lessons Learned on Java Tuning for Our Cassandra Clusters (Carlos Monroy, Kne...Lessons Learned on Java Tuning for Our Cassandra Clusters (Carlos Monroy, Kne...
Lessons Learned on Java Tuning for Our Cassandra Clusters (Carlos Monroy, Kne...
DataStax
 

Tendances (19)

Aerospike Go Language Client
Aerospike Go Language ClientAerospike Go Language Client
Aerospike Go Language Client
 
Network OS Code Coverage demo using Bullseye tool
Network OS Code Coverage demo using Bullseye toolNetwork OS Code Coverage demo using Bullseye tool
Network OS Code Coverage demo using Bullseye tool
 
Ceph Object Storage Performance Secrets and Ceph Data Lake Solution
Ceph Object Storage Performance Secrets and Ceph Data Lake SolutionCeph Object Storage Performance Secrets and Ceph Data Lake Solution
Ceph Object Storage Performance Secrets and Ceph Data Lake Solution
 
Automation of Hadoop cluster operations in Arm Treasure Data
Automation of Hadoop cluster operations in Arm Treasure DataAutomation of Hadoop cluster operations in Arm Treasure Data
Automation of Hadoop cluster operations in Arm Treasure Data
 
Aerospike Architecture
Aerospike ArchitectureAerospike Architecture
Aerospike Architecture
 
Building the Right Platform Architecture for Hadoop
Building the Right Platform Architecture for HadoopBuilding the Right Platform Architecture for Hadoop
Building the Right Platform Architecture for Hadoop
 
Aerospike DB and Storm for real-time analytics
Aerospike DB and Storm for real-time analyticsAerospike DB and Storm for real-time analytics
Aerospike DB and Storm for real-time analytics
 
High Performance, Scalable MongoDB in a Bare Metal Cloud
High Performance, Scalable MongoDB in a Bare Metal CloudHigh Performance, Scalable MongoDB in a Bare Metal Cloud
High Performance, Scalable MongoDB in a Bare Metal Cloud
 
Email storage with Ceph - Danny Al-Gaaf
Email storage with Ceph - Danny Al-GaafEmail storage with Ceph - Danny Al-Gaaf
Email storage with Ceph - Danny Al-Gaaf
 
Ceph Day Beijing: Big Data Analytics on Ceph Object Store
Ceph Day Beijing: Big Data Analytics on Ceph Object Store Ceph Day Beijing: Big Data Analytics on Ceph Object Store
Ceph Day Beijing: Big Data Analytics on Ceph Object Store
 
Getting The Most Out Of Your Flash/SSDs
Getting The Most Out Of Your Flash/SSDsGetting The Most Out Of Your Flash/SSDs
Getting The Most Out Of Your Flash/SSDs
 
Cassandra Troubleshooting 3.0
Cassandra Troubleshooting 3.0Cassandra Troubleshooting 3.0
Cassandra Troubleshooting 3.0
 
Architecting Ceph Solutions
Architecting Ceph SolutionsArchitecting Ceph Solutions
Architecting Ceph Solutions
 
Vacuum more efficient than ever
Vacuum more efficient than everVacuum more efficient than ever
Vacuum more efficient than ever
 
Ceph's journey at SUSE
Ceph's journey at SUSECeph's journey at SUSE
Ceph's journey at SUSE
 
Predictable Big Data Performance in Real-time
Predictable Big Data Performance in Real-timePredictable Big Data Performance in Real-time
Predictable Big Data Performance in Real-time
 
Hot Cloud'16: An Experiment on Bare-Metal BigData Provisioning
Hot Cloud'16: An Experiment on Bare-Metal BigData ProvisioningHot Cloud'16: An Experiment on Bare-Metal BigData Provisioning
Hot Cloud'16: An Experiment on Bare-Metal BigData Provisioning
 
Aerospike: Key Value Data Access
Aerospike: Key Value Data AccessAerospike: Key Value Data Access
Aerospike: Key Value Data Access
 
Lessons Learned on Java Tuning for Our Cassandra Clusters (Carlos Monroy, Kne...
Lessons Learned on Java Tuning for Our Cassandra Clusters (Carlos Monroy, Kne...Lessons Learned on Java Tuning for Our Cassandra Clusters (Carlos Monroy, Kne...
Lessons Learned on Java Tuning for Our Cassandra Clusters (Carlos Monroy, Kne...
 

Similaire à Accelerating forensic and incident response workflow: the case for a new standard in forensic imaging - HTCIA 2016

Accelerating forensic and incident response workflow: the case for a new stan...
Accelerating forensic and incident response workflow: the case for a new stan...Accelerating forensic and incident response workflow: the case for a new stan...
Accelerating forensic and incident response workflow: the case for a new stan...
Bradley Schatz
 
Технологии работы с дисковыми хранилищами и файловыми системами Windows Serve...
Технологии работы с дисковыми хранилищами и файловыми системами Windows Serve...Технологии работы с дисковыми хранилищами и файловыми системами Windows Serve...
Технологии работы с дисковыми хранилищами и файловыми системами Windows Serve...
Виталий Стародубцев
 
Oracle Open World 2014: Lies, Damned Lies, and I/O Statistics [ CON3671]
Oracle Open World 2014: Lies, Damned Lies, and I/O Statistics [ CON3671]Oracle Open World 2014: Lies, Damned Lies, and I/O Statistics [ CON3671]
Oracle Open World 2014: Lies, Damned Lies, and I/O Statistics [ CON3671]
Kyle Hailey
 
Running Apache Spark on a High-Performance Cluster Using RDMA and NVMe Flash ...
Running Apache Spark on a High-Performance Cluster Using RDMA and NVMe Flash ...Running Apache Spark on a High-Performance Cluster Using RDMA and NVMe Flash ...
Running Apache Spark on a High-Performance Cluster Using RDMA and NVMe Flash ...
Databricks
 
Storage and performance, Whiptail
Storage and performance, Whiptail Storage and performance, Whiptail
Storage and performance, Whiptail
Internet World
 
I_O Switch Thunderstorm Data Sheet
I_O Switch Thunderstorm Data SheetI_O Switch Thunderstorm Data Sheet
I_O Switch Thunderstorm Data Sheet
Dimitar Boyn
 
Storage and performance- Batch processing, Whiptail
Storage and performance- Batch processing, WhiptailStorage and performance- Batch processing, Whiptail
Storage and performance- Batch processing, Whiptail
Internet World
 

Similaire à Accelerating forensic and incident response workflow: the case for a new standard in forensic imaging - HTCIA 2016 (20)

Accelerating forensic and incident response workflow: the case for a new stan...
Accelerating forensic and incident response workflow: the case for a new stan...Accelerating forensic and incident response workflow: the case for a new stan...
Accelerating forensic and incident response workflow: the case for a new stan...
 
JetStor NAS series 2016
JetStor NAS series 2016JetStor NAS series 2016
JetStor NAS series 2016
 
Технологии работы с дисковыми хранилищами и файловыми системами Windows Serve...
Технологии работы с дисковыми хранилищами и файловыми системами Windows Serve...Технологии работы с дисковыми хранилищами и файловыми системами Windows Serve...
Технологии работы с дисковыми хранилищами и файловыми системами Windows Serve...
 
San Presentation
San PresentationSan Presentation
San Presentation
 
Oracle Open World 2014: Lies, Damned Lies, and I/O Statistics [ CON3671]
Oracle Open World 2014: Lies, Damned Lies, and I/O Statistics [ CON3671]Oracle Open World 2014: Lies, Damned Lies, and I/O Statistics [ CON3671]
Oracle Open World 2014: Lies, Damned Lies, and I/O Statistics [ CON3671]
 
Running Apache Spark on a High-Performance Cluster Using RDMA and NVMe Flash ...
Running Apache Spark on a High-Performance Cluster Using RDMA and NVMe Flash ...Running Apache Spark on a High-Performance Cluster Using RDMA and NVMe Flash ...
Running Apache Spark on a High-Performance Cluster Using RDMA and NVMe Flash ...
 
IBM Tape Update Dezember18 - TS1160
IBM Tape Update Dezember18 - TS1160IBM Tape Update Dezember18 - TS1160
IBM Tape Update Dezember18 - TS1160
 
JetStor Unified Storage NAS/SAN/Cloud 1600s
JetStor Unified Storage NAS/SAN/Cloud 1600sJetStor Unified Storage NAS/SAN/Cloud 1600s
JetStor Unified Storage NAS/SAN/Cloud 1600s
 
Storage and performance, Whiptail
Storage and performance, Whiptail Storage and performance, Whiptail
Storage and performance, Whiptail
 
The future of tape
The future of tapeThe future of tape
The future of tape
 
Optimizing the Upstreaming Workflow: Flexibly Scale Storage for Seismic Proce...
Optimizing the Upstreaming Workflow: Flexibly Scale Storage for Seismic Proce...Optimizing the Upstreaming Workflow: Flexibly Scale Storage for Seismic Proce...
Optimizing the Upstreaming Workflow: Flexibly Scale Storage for Seismic Proce...
 
What is the average rotational latency of this disk drive What seek.docx
What is the average rotational latency of this disk drive What seek.docx What is the average rotational latency of this disk drive What seek.docx
What is the average rotational latency of this disk drive What seek.docx
 
IO Dubi Lebel
IO Dubi LebelIO Dubi Lebel
IO Dubi Lebel
 
I_O Switch Thunderstorm Data Sheet
I_O Switch Thunderstorm Data SheetI_O Switch Thunderstorm Data Sheet
I_O Switch Thunderstorm Data Sheet
 
VirtualStor Extreme - Software Defined Scale-Out All Flash Storage
VirtualStor Extreme - Software Defined Scale-Out All Flash StorageVirtualStor Extreme - Software Defined Scale-Out All Flash Storage
VirtualStor Extreme - Software Defined Scale-Out All Flash Storage
 
FalconStor NSS Presentation
FalconStor NSS PresentationFalconStor NSS Presentation
FalconStor NSS Presentation
 
SQLIO - measuring storage performance
SQLIO - measuring storage performanceSQLIO - measuring storage performance
SQLIO - measuring storage performance
 
The future of tape april 16
The future of tape april 16The future of tape april 16
The future of tape april 16
 
Ceph Day New York 2014: Ceph, a physical perspective
Ceph Day New York 2014: Ceph, a physical perspective Ceph Day New York 2014: Ceph, a physical perspective
Ceph Day New York 2014: Ceph, a physical perspective
 
Storage and performance- Batch processing, Whiptail
Storage and performance- Batch processing, WhiptailStorage and performance- Batch processing, Whiptail
Storage and performance- Batch processing, Whiptail
 

Dernier

Chintamani Call Girls: 🍓 7737669865 🍓 High Profile Model Escorts | Bangalore ...
Chintamani Call Girls: 🍓 7737669865 🍓 High Profile Model Escorts | Bangalore ...Chintamani Call Girls: 🍓 7737669865 🍓 High Profile Model Escorts | Bangalore ...
Chintamani Call Girls: 🍓 7737669865 🍓 High Profile Model Escorts | Bangalore ...
amitlee9823
 
Call Girls Begur Just Call 👗 7737669865 👗 Top Class Call Girl Service Bangalore
Call Girls Begur Just Call 👗 7737669865 👗 Top Class Call Girl Service BangaloreCall Girls Begur Just Call 👗 7737669865 👗 Top Class Call Girl Service Bangalore
Call Girls Begur Just Call 👗 7737669865 👗 Top Class Call Girl Service Bangalore
amitlee9823
 
Probability Grade 10 Third Quarter Lessons
Probability Grade 10 Third Quarter LessonsProbability Grade 10 Third Quarter Lessons
Probability Grade 10 Third Quarter Lessons
JoseMangaJr1
 
Call Girls Bommasandra Just Call 👗 7737669865 👗 Top Class Call Girl Service B...
Call Girls Bommasandra Just Call 👗 7737669865 👗 Top Class Call Girl Service B...Call Girls Bommasandra Just Call 👗 7737669865 👗 Top Class Call Girl Service B...
Call Girls Bommasandra Just Call 👗 7737669865 👗 Top Class Call Girl Service B...
amitlee9823
 
Call Girls In Bellandur ☎ 7737669865 🥵 Book Your One night Stand
Call Girls In Bellandur ☎ 7737669865 🥵 Book Your One night StandCall Girls In Bellandur ☎ 7737669865 🥵 Book Your One night Stand
Call Girls In Bellandur ☎ 7737669865 🥵 Book Your One night Stand
amitlee9823
 
Jual Obat Aborsi Surabaya ( Asli No.1 ) 085657271886 Obat Penggugur Kandungan...
Jual Obat Aborsi Surabaya ( Asli No.1 ) 085657271886 Obat Penggugur Kandungan...Jual Obat Aborsi Surabaya ( Asli No.1 ) 085657271886 Obat Penggugur Kandungan...
Jual Obat Aborsi Surabaya ( Asli No.1 ) 085657271886 Obat Penggugur Kandungan...
ZurliaSoop
 
Escorts Service Kumaraswamy Layout ☎ 7737669865☎ Book Your One night Stand (B...
Escorts Service Kumaraswamy Layout ☎ 7737669865☎ Book Your One night Stand (B...Escorts Service Kumaraswamy Layout ☎ 7737669865☎ Book Your One night Stand (B...
Escorts Service Kumaraswamy Layout ☎ 7737669865☎ Book Your One night Stand (B...
amitlee9823
 
VIP Model Call Girls Hinjewadi ( Pune ) Call ON 8005736733 Starting From 5K t...
VIP Model Call Girls Hinjewadi ( Pune ) Call ON 8005736733 Starting From 5K t...VIP Model Call Girls Hinjewadi ( Pune ) Call ON 8005736733 Starting From 5K t...
VIP Model Call Girls Hinjewadi ( Pune ) Call ON 8005736733 Starting From 5K t...
SUHANI PANDEY
 

Dernier (20)

Chintamani Call Girls: 🍓 7737669865 🍓 High Profile Model Escorts | Bangalore ...
Chintamani Call Girls: 🍓 7737669865 🍓 High Profile Model Escorts | Bangalore ...Chintamani Call Girls: 🍓 7737669865 🍓 High Profile Model Escorts | Bangalore ...
Chintamani Call Girls: 🍓 7737669865 🍓 High Profile Model Escorts | Bangalore ...
 
Call Girls Begur Just Call 👗 7737669865 👗 Top Class Call Girl Service Bangalore
Call Girls Begur Just Call 👗 7737669865 👗 Top Class Call Girl Service BangaloreCall Girls Begur Just Call 👗 7737669865 👗 Top Class Call Girl Service Bangalore
Call Girls Begur Just Call 👗 7737669865 👗 Top Class Call Girl Service Bangalore
 
Week-01-2.ppt BBB human Computer interaction
Week-01-2.ppt BBB human Computer interactionWeek-01-2.ppt BBB human Computer interaction
Week-01-2.ppt BBB human Computer interaction
 
Probability Grade 10 Third Quarter Lessons
Probability Grade 10 Third Quarter LessonsProbability Grade 10 Third Quarter Lessons
Probability Grade 10 Third Quarter Lessons
 
ALSO dropshipping via API with DroFx.pptx
ALSO dropshipping via API with DroFx.pptxALSO dropshipping via API with DroFx.pptx
ALSO dropshipping via API with DroFx.pptx
 
VidaXL dropshipping via API with DroFx.pptx
VidaXL dropshipping via API with DroFx.pptxVidaXL dropshipping via API with DroFx.pptx
VidaXL dropshipping via API with DroFx.pptx
 
Edukaciniai dropshipping via API with DroFx
Edukaciniai dropshipping via API with DroFxEdukaciniai dropshipping via API with DroFx
Edukaciniai dropshipping via API with DroFx
 
ELKO dropshipping via API with DroFx.pptx
ELKO dropshipping via API with DroFx.pptxELKO dropshipping via API with DroFx.pptx
ELKO dropshipping via API with DroFx.pptx
 
Anomaly detection and data imputation within time series
Anomaly detection and data imputation within time seriesAnomaly detection and data imputation within time series
Anomaly detection and data imputation within time series
 
Call Girls Bommasandra Just Call 👗 7737669865 👗 Top Class Call Girl Service B...
Call Girls Bommasandra Just Call 👗 7737669865 👗 Top Class Call Girl Service B...Call Girls Bommasandra Just Call 👗 7737669865 👗 Top Class Call Girl Service B...
Call Girls Bommasandra Just Call 👗 7737669865 👗 Top Class Call Girl Service B...
 
BigBuy dropshipping via API with DroFx.pptx
BigBuy dropshipping via API with DroFx.pptxBigBuy dropshipping via API with DroFx.pptx
BigBuy dropshipping via API with DroFx.pptx
 
Ravak dropshipping via API with DroFx.pptx
Ravak dropshipping via API with DroFx.pptxRavak dropshipping via API with DroFx.pptx
Ravak dropshipping via API with DroFx.pptx
 
Call Girls In Bellandur ☎ 7737669865 🥵 Book Your One night Stand
Call Girls In Bellandur ☎ 7737669865 🥵 Book Your One night StandCall Girls In Bellandur ☎ 7737669865 🥵 Book Your One night Stand
Call Girls In Bellandur ☎ 7737669865 🥵 Book Your One night Stand
 
Jual Obat Aborsi Surabaya ( Asli No.1 ) 085657271886 Obat Penggugur Kandungan...
Jual Obat Aborsi Surabaya ( Asli No.1 ) 085657271886 Obat Penggugur Kandungan...Jual Obat Aborsi Surabaya ( Asli No.1 ) 085657271886 Obat Penggugur Kandungan...
Jual Obat Aborsi Surabaya ( Asli No.1 ) 085657271886 Obat Penggugur Kandungan...
 
Discover Why Less is More in B2B Research
Discover Why Less is More in B2B ResearchDiscover Why Less is More in B2B Research
Discover Why Less is More in B2B Research
 
Escorts Service Kumaraswamy Layout ☎ 7737669865☎ Book Your One night Stand (B...
Escorts Service Kumaraswamy Layout ☎ 7737669865☎ Book Your One night Stand (B...Escorts Service Kumaraswamy Layout ☎ 7737669865☎ Book Your One night Stand (B...
Escorts Service Kumaraswamy Layout ☎ 7737669865☎ Book Your One night Stand (B...
 
Invezz.com - Grow your wealth with trading signals
Invezz.com - Grow your wealth with trading signalsInvezz.com - Grow your wealth with trading signals
Invezz.com - Grow your wealth with trading signals
 
CebaBaby dropshipping via API with DroFX.pptx
CebaBaby dropshipping via API with DroFX.pptxCebaBaby dropshipping via API with DroFX.pptx
CebaBaby dropshipping via API with DroFX.pptx
 
VIP Model Call Girls Hinjewadi ( Pune ) Call ON 8005736733 Starting From 5K t...
VIP Model Call Girls Hinjewadi ( Pune ) Call ON 8005736733 Starting From 5K t...VIP Model Call Girls Hinjewadi ( Pune ) Call ON 8005736733 Starting From 5K t...
VIP Model Call Girls Hinjewadi ( Pune ) Call ON 8005736733 Starting From 5K t...
 
Call me @ 9892124323 Cheap Rate Call Girls in Vashi with Real Photo 100% Secure
Call me @ 9892124323 Cheap Rate Call Girls in Vashi with Real Photo 100% SecureCall me @ 9892124323 Cheap Rate Call Girls in Vashi with Real Photo 100% Secure
Call me @ 9892124323 Cheap Rate Call Girls in Vashi with Real Photo 100% Secure
 

Accelerating forensic and incident response workflow: the case for a new standard in forensic imaging - HTCIA 2016

  • 1. Accelerating your forensic & incident response workflow: the case for a new standard in forensic imaging Dr. Bradley Schatz Director, Schatz Forensic v1.2 - HTCIA Conference 2016 © Schatz Forensic 2016
  • 2. © 2016 Schatz Forensic The volume problem increases the latency between evidence identification and useful findings Identify Acquire Analyse Reporting Latency
  • 3. © 2016 Schatz Forensic Pick one of the below You can’t have both Latency Completeness Physical Acquisition Triage You preserve everything but analysis will have to wait Near immediate results at the expense of potentially missing evidence Live forensics
  • 4. © 2016 Schatz Forensic How can we reduce latency? While maximising completeness Latency Completeness Physical Acquisition Triage Increase I/O throughput? Live analysis while we acquire? Dynamic partial acquisition? Live forensics
  • 5. © 2016 Schatz Forensic Current forensic image formats are now a bottleneck • Deflate compression is inefficient • Linear hashing does not scale to multi-core • Copying blocks of zero filled sectors is a waste of time • Linear images prevent efficient out of order acquisition
  • 6. © 2016 Schatz Forensic The Advanced Forensic Format v4 (AFF4) image format is the solution • Scalable to GB/s IO & multi-core • Enable forensically reproducible partial non- linear images (reproducible triage) • Scientifically peer reviewed (ref Daubert) • Unencumbered, open specification • Open source implementations
  • 7. What’s stopping me increasing I/O throughput? Background
  • 8. © 2016 Schatz Forensic Forensic Imaging v1.0: Raw Linear bitstream copy + linear bitstream hash $ dd if=/dev/hda bs=4k conv=sync,noerror | tee C1.D1.raw | md5sum > C1.D1.md5.txt
  • 9. © 2016 Schatz Forensic Forensic Imaging v1.0: Raw MD5 Source Hard Drive ACMECo.C1.D1.raw ACMECo.C1.D1.raw.txt # Linear Bitstream Hash
  • 10. © 2016 Schatz Forensic What affects throughput in acquisition? Target Storage Interconnect Hash Filesystem Interconnect Evidence storage
  • 11. © 2016 Schatz Forensic I/O throughput in Acquisition is a systems problem Target Storage Interconnect Hash Filesystem Interconnect Evidence storage Target Storage Sustained Read 1TB Seagate 3.5” 7200rpm SATA 100 MB/s Current generation 3.5” 7200rpm SATA 200 MB/s Intel 730 SSD 550 MB/s Macbook Pro 1TB ~1 GB/s RAID 15000rpm SAS > 1 GB/s Samsung 850 NVMe 1.5 – 2.5 GB/s
  • 12. © 2016 Schatz Forensic I/O throughput in Acquisition is a systems problem Target Storage Interconnect Hash Filesystem Interconnect Evidence storage Algorithm Average Throughput MB/s SHA1 619.23 MD5 745.65 Blake2b 601.87
  • 13. © 2016 Schatz Forensic I/O throughput in Acquisition is a systems problem Target Storage Interconnect Hash Filesystem Interconnect Evidence storage Interconnect Gb/s Actual Gb/s Max MB/s Max GB/m PCIe / NVMe / Thunderbolt > 1000 > 60 SATA3 / SAS 6G 6 4.8 600 36 USB3 5 4 500 30 Gigabit Ethernet 1 ~100 USB2 .48 .38 48 2.9
  • 14. © 2016 Schatz Forensic I/O throughput in Acquisition is a systems problem Target Storage Interconnect Hash Filesystem Interconnect Evidence storage Interconnect Gb/s Actual Gb/s Max MB/s Max GB/m PCIe / NVMe / Thunderbolt > 1000 > 60 SATA3 / SAS 6 4.8 600 36 USB3 5 4 500 30 Gigabit Ethernet 1 ~100 USB2 .48 .38 48 2.9 Can we practically achieve this?
  • 15. © 2016 Schatz Forensic Not all bridges are made equal Manuf. Source Dest Form factor Year purchased MB/s Orico USB3 SATA 3.5” slide dock 2014 219 Orico USB3 SATA 2.5” enclosure 2016 247 Orico USB3 SATA 3.5” dual dock 2016 402 Kanex Thunderbolt eSATA Cable 2015 213 Nexstar USB3 SATA 3.5” dock 2014 189 Nexstar USB3 eSATA Cable 2016 249 Probox USB3 SATA Bridge 2016 416* Samsung T3 USB3 integrated SSD 2016 400 Testing tool: BlackMagicDesign Disk Speed Test Destination disk: Samsung 850 Pro SSD * Fails under heavy load
  • 16. © 2016 Schatz Forensic Take Away #1 Faster destination IO is important, but beware choice of bridge • Not an issue if imaging to spinning disk <200MB/s • Raw SATA & SAS IO fastest (duplicators) • SSD/RAID speed levels require decent bridges • Thunderbolt and UASP promising – more testing needed
  • 17. © 2016 Schatz Forensic Example: Forensic Duplicator 1TB Seagate Target Target Storage Interconnect Hash Filesystem Interconnect Evidence storage SHA1 600MB/s SATA3 Spinning Disk 93.6MB/s SAS 6G 600MB/s SATA3 Spinning Disk 200MB/s Acquisition 1TB @ 93.6MB/s = 2h 58m Verification 1TB @ 200MB/s = 1h 23m TOTAL = 4h 21m SAS 6G 600MB/s
  • 18. © 2016 Schatz Forensic Bare Metal (LiveCD) Ancient Workstation Acquisition Target Storage Interconnect Hash Filesystem Interconnect Evidence storage SHA1 600MB/s SATA3 Spinning Disk 100MB/s USB2 45MB/s SATA3 Spinning Disk 200MB/s Acquisition 1TB @ 45MB/s = 6h 10m Verification 1TB @ 45MB/s = 6h 10m TOTAL = 12h 20m
  • 19. © 2016 Schatz Forensic Bare Metal (LiveCD) Ancient Workstation Acquisition Target Storage Interconnect Hash Filesystem Interconnect Evidence storage SHA1 600MB/s SATA3 Spinning Disk 100MB/s USB2 45MB/s SATA3 Spinning Disk 200MB/s Acquisition 1TB @ 45MB/s = 6h 10m Verification 1TB @ 200MB/s = 1h 23m TOTAL = 7h 33m After copy, verify image on device with faster interconnect
  • 20. © 2016 Schatz Forensic Take Away #2 Plan your acquisitions to maximise throughput • Relocate image for verification • Add a USB3 expresscard / PCIe card • Pull disks from slower machines and go bare metal (live CD) on faster ones • Use GigE (100Mb/s) instead of USB2
  • 21. © 2016 Schatz Forensic Bare Metal (LiveCD) Example: Caveat User Space Filesystem Target Storage Interconnect Hash Filesystem Interconnect Evidence storage SHA1 600MB/s SATA3 Spinning Disk 200MB/s USB3 500MB/s SATA3 Spinning Disk 200MB/s Acquisition 1TB @ 100MB/s = 2h 46m Verification 1TB @ 100MB/s = 2h 46m TOTAL = 5h 22m NTFS-3g 100MB/s SAS 6G 600MB/s
  • 22. © 2016 Schatz Forensic Is your forensic liveCD slowing you down? $ ntfs-3g /dev/sdd1 /mnt $ time sh –c “time dd if=/dev/zero of=/mnt/zeros bs=512k count=20k ; sync” 104s 102MB/s $ mount –t ntfs-3g –o max_read=131072,big_writes /dev/sdd1/ /mnt $ time sh –c “time dd if=/dev/zero of=/mnt/zeros bs=512k count=20k ; sync” 33s 318 MB/s Destination: Samsung T3 USB3 SSD
  • 23. © 2016 Schatz Forensic Take Away #3 NTFS may be a convenient destination filesystem, but is it costing time? • Use a kernel based FS implementation • -or- • Tune the filesystem if it is a user space variant
  • 24. © 2016 Schatz Forensic Forensic Imaging v2.0: EWF Original design Source Hard Drive MD5 Deflate ACMECo.C1.D1.e01 Source Hard Drive # Linear BitStream Hash Linear Compressed Block Stream
  • 25. © 2016 Schatz Forensic The deflate algorithm is a significant bottleneck Target Storage Interconnect Hash Compress Filesystem Interconnect Evidence storage Data Deflate MB/s Inflate MB/s High entropy 40.4 439 Low entropy 259 IO bound *Single core of quad core i7-4770 3.4Ghz measured with gzip
  • 26. © 2016 Schatz Forensic FTK Imager EWF Acquisition 1TB Seagate 75% full, 4 core i5-750 Target Storage Interconnect Hash Compress Filesystem Interconnect Evidence storage SHA1 600MB/s SATA3 Spinning Disk 100MB/s SATA3 600MB/s SATA3 Spinning Disk 200MB/s Acquisition 1TB @ 67.8MB/s = 4h 06m Verification 1TB @ 106MB/s = 2h 36m TOTAL = 6h 42m Deflate 67.8 MB/s
  • 27. © 2016 Schatz Forensic Forensic Imaging v2.1: Threaded EWF Guymager (2008), X-Ways, recent ewfacquire MD5 Deflate DeflateDeflate Source Hard Drive ACMECo.C1.D1.e01 # Linear Bitstream Hash
  • 28. © 2016 Schatz Forensic Lacklustre throughput reports (2013) • Practitioner reports – Low 100’s MB/s [Zimmerman 2013] • Research publications – FastDD <= 110 MB/s [Bertasi & Zago 2013] • Our experience – Low powered CPU’s give low throughtput
  • 29. © 2016 Schatz Forensic Threaded EWF Acquisition 240GB Intel 730 SSD 50% full, Core 2 Duo (Lenovo X200 circa 2009) Target Storage Interconnect Hash Compress Filesystem Interconnect Evidence storage SHA1SATA3 Intel 730 SSD ~500MB/s USB3 500MB/s SATA3 Samsung 840 EVO SSD ~500MB/s Acquisition 240GB @ 91MB/s = 40m 21s Deflate 45 MB/s per core SATA2 300MB/s
  • 30. Our approach to increasing I/O throughput
  • 31. © 2016 Schatz Forensic Scale to 8-core i7 & uncontended IO? Threaded EWF is CPU bound Target Storage Interconnect Hash Compress Filesystem Interconnect Evidence storage SHA1 600MB/s SATA3 Intel 720 SSD ~500MB/s SATA3 600MB/s SATA3 Samsung 850 EVO Pro ~500MB/s Acquisition 240GB @ 255MB/s = 14m 35s Verification 240GB @ 350MB/s = 10m 37s TOTAL = 25m 12s Deflate 31.9MB/s/core *8 core i7-5820k @ 3.20 GHz
  • 32. © 2016 Schatz Forensic How about using a faster compression algorithm? Target Storage Interconnect Hash Compress Interconnect Evidence storage Compression Algorithm Throughput MB/s/core* Deflate (ZIP, gzip) 31.9 Snappy (Google BigTable) 1,400 LZO (ZFS) 1,540
  • 33. © 2016 Schatz Forensic Forensic Imaging v4.0: AFF4 (2009) • ZIP64 based container • Storage virtualization • Open source implementation & specification
  • 34. © 2016 Schatz Forensic AFF4: Storage Virtualisation ACMECo.S1.RAID0.af4 ACMECo.S1.D1.af4 # Linear Bitstream Hash ACMECo.S1.D2.af4 # Linear Bitstream Hash Compressed Block Storage Stream Virtual Storage Stream (Map)
  • 35. © 2016 Schatz Forensic AFF4: Storage Virtualisation ACMECo.S1.RAID0.af4 ACMECo.S1.D1.af4 # Linear Bitstream Hash ACMECo.S1.D2.af4 # Linear Bitstream Hash Compressed Block Storage Stream Virtual Storage Stream (Map) Storage virtualisation
  • 36. © 2016 Schatz Forensic AFF4: Storage Virtualisation ACMECo.S1.RAID0.af4 ACMECo.S1.D1.af4 # Linear Bitstream Hash ACMECo.S1.D2.af4 # Linear Bitstream Hash Compressed Block Storage Stream Virtual Storage Stream (Map) Inter –container referencing
  • 37. © 2016 Schatz Forensic Linear bitstream hashing isn’t parallelizable. Max. rate ~600 MB/s on current gen. CPU’s Target Storage Interconnect Hash Filesystem Interconnect Evidence storage Algorithm Throughput MB/s SHA1 619.23 MD5 745.65 Blake2b 601.87
  • 38. © 2016 Schatz Forensic Our solution: Block based hashing. Hash Compress CompressCompress Source Hard Drive Hash Hash Block Hashes # Block Hashes Hash
  • 39. Test standard composition Stored block size –v- LBA address Windows 8.1 10.2G Govdocs1 (1- 75,1-40) 59.8G /dev/random 38.4G Empty space (zeros)
  • 40. Block based hashing beats linear stream hashing with low powered multicore CPU’s Dual core i5-3337U 1.8GHz Sparse data Max CPU hash throughput Sparse data Read I/O limited
  • 41. © 2016 Schatz Forensic Block hashing shifts the bottleneck from from CPU to I/O Target Storage Interconnect Hash Compress Filesystem Interconnect Evidence storage SHA1 600 MB/s/core SATA3 Intel 730 SSD 500MB/s 4x SATA3 2.4GB/s RAID0 4x SATA3 2TB 800MB/s Snappy Avg 1.5GB/s/core *8 core i7-5820k @ 3.20 GHz Acquisition application Linear Acquisition Verification X-Ways Forensics 14:35 255 MB/s (15.3 GB/min) 10:37 350 MB/s (21.0 GB/min) Wirespeed (linear) 7:23 500 MB/s (30.3 GB/min) 4:12 888 MB/s (53.33 GB/min)
  • 42. How can we take advantage of these speeds?
  • 43. © 2016 Schatz Forensic Block hashing shifts the bottleneck from from CPU to I/O Target Storage Interconnect Hash Compress Filesystem Interconnect Evidence storage SHA1 600 MB/s/core SATA3 Intel 720 SSD 500MB/s 4x SATA3 2.4GB/s RAID0 4x SATA3 2TB 800MB/s Snappy Avg 1.5GB/s/core *8 core i7-5820k @ 3.20 GHz Acquisition application Linear Acquisition Verification X-Ways Forensics 14:35 255 MB/s (15.3 GB/min) 10:37 350 MB/s (21.0 GB/min) Wirespeed (linear) 7:23 500 MB/s (30.3 GB/min) 4:12 888 MB/s (53.33 GB/min) Realistic? More likely USB3 or 1GbE
  • 44. © 2016 Schatz Forensic Idea: can we aggregate output I/O? Use 2x USB3 drives? Target Storage Interconnect Hash Compress Filesystem Interconnect Evidence storage SHA1 600 MB/s/core SATA3 Intel 720 SSD 500MB/s 2x USB3 1GB/s 2x SATA3 2TB 400MB/s Snappy Avg 1.5GB/s/core *8 core i7-5820k @ 3.20 GHz
  • 45. © 2016 Schatz Forensic AFF4 Striping ACMECo.S1.D1.2.af4 ACMECo.S1.D1.1.af4 Virtual Storage Stream (Map) Disk 1 Disk 2 Source blocks striped over multiple containers on multiple output disks
  • 46. © 2016 Schatz Forensic AFF4 Striping ACMECo.S1.D1.2.af4 ACMECo.S1.D1.1.af4 Virtual Storage Stream (Map) Disk 1 Disk 2 A copy of the map is stored in each container.
  • 47. Test standard composition Stored block size –v- LBA address Windows 8.1 10.2G Govdocs1 (1- 75,1-40) 59.8G /dev/random 38.4G Empty space (zeros)
  • 48. Multiple output channels increases throughput Especially for uncompressible data High entropy data
  • 49. © 2016 Schatz Forensic Multi-destination throughput is even higher for current generation drives 1TB NVMe (Core i7-4578U, 2 Cores) Macbook Pro A1502 (Evimetry 2.1.0) Acquisition technique Acquire + Verify Evimetry Wirespeed 0:52:04 Xways + WinFE 2:48:00 Macquisition EWF 7:08:38
  • 50. © 2016 Schatz Forensic Multi-destination throughput is even higher for current generation drives 1TB NVMe (Core i7-4578U, 2 Cores) Macbook Pro A1502 (Evimetry 2.2.0a) Acquisition technique Acquire + Verify Evimetry Wirespeed 0:52:04 Xways + WinFE 2:48:00 Macquisition EWF 7:08:38
  • 51. © 2016 Schatz Forensic Multi-destination throughput is even higher for current generation drives 512GB Samsung 850 NVMe w/ 4 core i5 (Evimetry 2.2.0a) Acquisition technique Acquire + Verify Evimetry Wirespeed 0:52:04 Xways + WinFE 2:48:00 Macquisition EWF 7:08:38
  • 52. How can we analyse while we acquire?
  • 53. © 2016 Schatz Forensic How can we reduce latency? While maximising completeness Latency Completeness Physical Acquisition Triage Increase I/O throughput? Live analysis while we acquire? Dynamic partial acquisition? Live forensics
  • 54. © 2016 Schatz Forensic Idea: Start with a non-linear partial image and add from there Entire disk All allocated Interactive analysis artifacts High value files Volume & FS Metadata, Memory Analysis
  • 55. © 2016 Schatz Forensic Acquire and access in parallel? dd + iSCSI access to target MD5 Source Hard Drive ACMECo.C1.D1.raw ACMECo.C1.D1.raw.txt # Linear Bitstream Hash iSCSI Remote analysis tools
  • 56. © 2016 Schatz Forensic Acquire and access in parallel? dd + iSCSI access to target MD5 Source Hard Drive ACMECo.C1.D1.raw ACMECo.C1.D1.raw.txt # Linear Bitstream Hash iSCSI Remote analysis tools Access is contended. Poor interactive performance (lag )
  • 57. © 2016 Schatz Forensic Acquire and access in parallel? dd + iSCSI access to target MD5 Source Hard Drive ACMECo.C1.D1.raw ACMECo.C1.D1.raw.txt # Linear Bitstream Hash iSCSI Remote analysis tools Early termination may not have a complete filesystem
  • 58. © 2016 Schatz Forensic Raw Image : Non-linear acquisition via sparse raw file, driven by live analysis? Source Hard Drive ACMECo.C1.D1.raw ACMECo.C1.D1.raw.txt # Linear Bitstream Hash iSCSI How do you generate a hash over a non-linear image? * X-Ways does similar, only not remote
  • 59. © 2016 Schatz Forensic Forensic Imaging v4.1: AFF4 (2010) • Non-linear acquisition • Hash based imaging (deduplication)
  • 60. © 2016 Schatz Forensic Partial, non-linear, block based hashing Hash Compress CompressCompress ACMECo.C1.D1.af4 Volume Metadata Filesystem Metadata Sparse Data File Content Unknown Hash Hash Block Hashes Compressed Block Stream # Block Hashes Hash Virtual Block Stream (Map) Source Hard Drive
  • 61. © 2016 Schatz Forensic Forensic Imaging v4.2: AFF4 (2015) • Partial acquisition – Represent what we didn’t acquire vs. what we couldn’t acquire • Block based hashing
  • 62. © 2016 Schatz Forensic Partial, non-linear, block based hashing ACMECo.C1.D1.af4ACMECo.C1.D1.af4 Block Hashes Compressed Block Stream ## Virtual Block Stream (Map) Linear Block Hash Map Hash Block Hashes Hash ## ##
  • 63. © 2016 Schatz Forensic Evimetry & AFF4 Non-linear, partial physical acquisition driven by live analysis Source Hard DriveSource Hard Drive ACMECo.C1.D1.af4ACMECo.C1.D1.af4 Block Hashes Compressed Block Stream ## Block Hashes Hash Virtual Block Stream (Map) I/O Planning & Scheduling Acquisition Virtual Disk File categories Blocks
  • 64. © 2016 Schatz Forensic Partial acquisition brings reproducibility and elasticity to IR and triage Target Storage Interconnect Hash Compress Network Evidence storage SHA1 600 MB/s/core SATA3 Spinning disk 200MB/s 1GbE 100MB/s RAID0 4x SATA3 2TB 800MB/s Snappy Avg 1.5GB/s/core *8 core i7-5820k @ 3.20 GHz Partial IR acquisition 21.9GiB @ 102MiB/s = 3m 39s Volume metadata, filesystem metadata, 16G pagefile, Registries, Logs, Link files, Jump lists, WMI CIM Repo, Prefetch, USN Journal, $Logfile, Scheduler artefacts
  • 65. How can I work with AFF4 images?
  • 66. © 2016 Schatz Forensic Why adopt this? My toolset doesn't support AFF4. • Wait for support from vendors? – In progress • Convert AFF4 to EWF on fast workstation – Can be done in roughly the same time it takes to simply copy (only compress low entropy blocks) • Emulate Raw image in the filesystem
  • 67. © 2016 Schatz Forensic Virtual FS Emulation of AFF4 containers as emulated raw images
  • 68. © 2016 Schatz Forensic Emulated Raw is faster than native EWF. X-Ways processing task X-Ways Native EWF X-Ways w/ Evimetry FS Bridge Verify 0:42:00 0:08:00 FS Data Recovery 0:03:35 0:03:20 Hashing & header validation 1:59:03 1:05:25 Carving unallocated 0:41:00 0:44:00 Total 3:25:43 2:02:09 Image: 1TB Macbook Pro i7, processed on 8 core i7 w/ RAID
  • 69. How does this affect workflow?
  • 70. © 2016 Schatz Forensic Native EWF Acquisition vs AFF4 Native EWF Processing vs AFF4 FS Bridge
  • 71. © 2016 Schatz Forensic Native EWF Acquisition vs AFF4 Native EWF Processing vs AFF4 FS Bridge Single Threaded EWF?
  • 72. © 2016 Schatz Forensic Native EWF Acquisition vs AFF4 Native EWF Processing vs AFF4 FS Bridge Multi Threaded EWF
  • 73. © 2016 Schatz Forensic Native EWF Acquisition vs AFF4 Native EWF Processing vs AFF4 FS Bridge AFF4
  • 74. © 2016 Schatz Forensic Native EWF Acquisition vs AFF4 Native EWF Processing vs AFF4 FS Bridge AFF4: Copies in half the time due to striped acquisition over 2 x 200 MB/s spinning disks. EWF: I/O bound on single 200MB/s disk
  • 75. © 2016 Schatz Forensic Native EWF Acquisition vs AFF4 Native EWF Processing vs AFF4 FS Bridge AFF4: Verification completes in 8m. I/O bound by RAID. EWF: CPU bound
  • 76. © 2016 Schatz Forensic Native EWF Acquisition vs AFF4 Native EWF Processing vs AFF4 FS Bridge AFF4: Filesystem search in around ½ time. EWF: CPU bound?
  • 77. © 2016 Schatz Forensic Native EWF Acquisition vs AFF4 Native EWF Processing vs AFF4 FS Bridge AFF4 & EWF around the same throughput.
  • 78. Will the courts accept the AFF4 format?
  • 79. © 2016 Schatz Forensic Courts accept expert evidence Is it reliable? • Is the expert reliable? • Is the underlying theory reliable? – Reliable by way of the application of Scientific methods (eg. Daubert) – 4 scientifically peer reviewed papers, unrefuted • Are the methods implementing the theory reliable? – Tool testing (as always, the expert’s ultimate responsibility)
  • 81. © 2016 Schatz Forensic AFF4 is used in the following
  • 82. © 2016 Schatz Forensic Near Future • Evimetry Community Edition – Free creation, conversion & consumption of AFF4 images (Windows) • AFF4 Standardisation Effort (AFF4 Working Group) – Bradley Schatz (Evimetry), Michael Cohen (Google) chairing – Open source implementation and specification in progress – Blackbag recently joined • Sleuthkit/Autopsy – Support planned • Open Source Digital Forensic Conference 2016 – AFF4 status update
  • 84. © 2016 Schatz Forensic More information Implementations • https://evimetry.com/ • https://github.com/google/aff4 • http://www.rekall-forensic.com/docs/Tools/ • https://github.com/google/grr Ongoing specification and papers • http://www.aff4.org/ • http://dfrws.org/2009/proceedings/p57-cohen.pdf • http://dfrws.org/2010/proceedings/2010-314.pdf • http://dfrws.org/2015/proceedings/DFRWS2015-16.pdf
  • 86. © 2016 Schatz Forensic Conclusion • Optimising forensic workflow is a systems problem • Existing forensic formats are a bottleneck for todays systems • Existing forensic image formats are generally incompatible with triage and reproducible live analysis • The Advanced Forensic Format 4 solves the above
  • 87. Contact Hard disk head by amckgill Footprints by kimba Dr Bradley Schatz https://evimetry.com/ bradley@evimetry.com

Notes de l'éditeur

  1. Image two disks in a RAID separately as AFF4 volumes, then use a map to create a virtual image of that.
  2. Image two disks in a RAID separately as AFF4 volumes, then use a map to create a virtual image of that.
  3. Image two disks in a RAID separately as AFF4 volumes, then use a map to create a virtual image of that.