Digital Forensics

Threatscape and Best Practices

John Sammons

• Publisher: Syngress
• Year: 2015
• Print ISBN: 9780128045268
• eBook ISBN: 9780128045428
• Topic: Computer Science
• Subtopic: Human Resource Management
• Index: Computer Science

Digital Forensics: Threatscape and Best Practices surveys the problems and challenges confronting digital forensic professionals today, including massive data sets and everchanging technology. This book provides a coherent overview of the threatscape in a broad range of topics, providing practitioners and students alike with a comprehensive, coherent overview of the threat landscape and what can be done to manage and prepare for it. Digital Forensics: Threatscape and Best Practices delivers you with incisive analysis and best practices from a panel of expert authors, led by John Sammons, bestselling author of The Basics of Digital Forensics. - Learn the basics of cryptocurrencies (like Bitcoin) and the artifacts they generate - Learn why examination planning matters and how to do it effectively - Discover how to incorporate behaviorial analysis into your digital forensics examinations - Stay updated with the key artifacts created by the latest Mac OS, OS X 10.11, El Capitan - Discusses the threatscapes and challenges facing mobile device forensics, law enforcement, and legal cases - The power of applying the electronic discovery workflows to digital forensics - Discover the value of and impact of social media forensics

Chapter 1

The cryptocurrency enigma

Preston Miller Consultant at an international cybersecurity and forensics firm, USA

Abstract

Bitcoin has become a fixture in today’s modern society, a source of innovation and mystery, and has begun to change the way we think about currency. Because of Bitcoin’s success, many modern cryptocurrencies are simply variations on the Bitcoin framework. These Bitcoin derivatives are referred to as Altcoins. By understanding the cryptocurrency framework, through analysis of Bitcoin, examiners will be capable of understanding artifacts in a wide range of cryptocurrencies. In this chapter, we learn Bitcoin through example by first understanding the underlying theory and then seeing it in action. By using the MultiBit HD client, we observe transactions coming across the wire and look for their network and disk-based artifacts. From this approach we accomplish two things: the reader obtains a technical understanding of how cryptocurrencies work and how to forensically analyze and evaluate cryptocurrency artifacts.

Keywords

Bitcoin

blockchain

cryptocurrencies

asymmetric encryption

network and disk-based artifacts

MultiBit HD

digital signature

decentralized

proof of work

mining

Purpose

The goal of this chapter is to serve as a primer for cryptocurrency conventions and artifacts. By focusing on the technical aspects of Bitcoin, the most popular cryptocurrency, and examples from wallet software, the examiner should be more knowledgeable and comfortable while investigating crimes involving cryptocurrency.

Introduction

Bitcoin has become a fixture in today’s modern society, a source of innovation and mystery, and has begun to change the way we think about currency. In this chapter, we are going to explore the context, underlying framework and protocol, and artifacts related to Bitcoin. This chapter will focus exclusively on Bitcoin. However, because of Bitcoin’s success, many modern cryptocurrencies are simply variations on the Bitcoin framework. These Bitcoin derivatives are referred to as Altcoins. By understanding the cryptocurrency framework, through analysis of Bitcoin, examiners will be capable of understanding artifacts in a wide range of cryptocurrencies.

Often synonymous with providing anonymity for the acquisition of nefarious goods online, cryptocurrencies, such as Bitcoin, have been brought to the forefront after gaining traction due to recent media attention. Increased exposure has publicized the utility of cryptocurrencies and spurred the production of new currencies at a rate previously unseen. As more consumers depend on cryptocurrencies to purchase both legal and illegal goods, understanding cryptocurrencies and the channels through which they travel is vital.

As of August 2015, there are 678 cryptocurrencies on the market that come in varying types. A list of these cryptocurrencies and their prices can be found at coinmarketcap.com. Cryptocurrencies are often perceived as an unknown quantity; however, for the most part they are extremely well documented for those who want to read the technical details. For most of these cryptocurrencies a white paper is available that explains the underlying framework of the currency.

What makes a currency?

When talking about cryptocurrencies, it is not uncommon to be asked why they have a value at all. These currencies have a cost associated with them, despite lacking a physical component, and for some this is a tough concept to come to terms with. However, nonphysical currencies have value for the same reason physical ones do.

People’s beliefs and economics, another social construct, are the reason anything has value. The worth of an object is entirely dependent on the estimated value held by society and their rules governing commerce. Gold, for example, has long been considered very valuable in our society. The easily recognizable sheen and color of the material is often used in media to illustrate great wealth. But why is this the case?

Outside of modern electronics, gold has very little use. In spite of this gold has been featured as a currency even in ancient civilizations. As a metal gold is quite malleable and would not have been suitable for most tasks. However, it has persisted into modern times as an object of great worth because society still holds it in high regard.

People’s beliefs and economics can quickly change the worth of something. After World War I, Germany printed currency at a very high rate and, by doing so, hyperinflated their currency to pay for war reparations. Because of simple economics, as more currency was printed the value of them individually decreased. During this period, it became more economical t...

Table of contents

• Cover
• Title page
• Table of Contents
• Copyright
• Dedication
• List of Contributors
• Editor Biography
• Biographies
• Acknowledgments
• Chapter 1: The cryptocurrency enigma
• Chapter 2: The key to forensic success: examination planning is a key determinant of efficient and effective digital forensics
• Chapter 3: Psychological profiling as an investigative tool for digital forensics
• Chapter 4: The intersection between social media, crime, and digital forensics: #WhoDunIt?
• Chapter 5: Mobile device forensics: threats, challenges, and future trends
• Chapter 6: Digital forensics in an eDiscovery world
• Chapter 7: OS X El Capitan forensics
• Chapter 8: Cybercrimes: an overview of contemporary challenges and impending threats
• Chapter 9: Legal
• Author Index
• Subject Index