Breaking Forensic Images Booted as a Virtual Machine

Requirements

• VMWare and a virtual machine of a Windows system with the .NET 2.0 Framework installed (if you want to do some testing)
• A little programming experience with VB.NET (C++, C# or x86 ASM if you want to mess with the original source code)

Terminology

• Forensic image: A bit for bit copy of an entire storage medium like a hard disk drive that can be split into segments or multiple images to fit on file systems with file size restrictions (i.e., FAT32 at 4GB).
• Virtual machine: In the context of this article it is a system that has been booted from either forensic images or a physical disk into a virtualized environment using LiveView and VMWare.

What exactly does “Breaking Forensic Images Booted as a Virtual Machine” mean?

Forensic images and physical storage media such as a hard drive can be virtualized and booted as a virtual machine in VMWare with no modification to the actual images themselves. This allows an examiner to interact with their evidence. They can boot the DD or raw format images through software such as LiveView and interact with the system as if they were actually standing in front of it.

This technique of virtualizing the images is becoming very common in investigations. It not only gives an examiner a view of what the system was like the last time it was turned off but it allows them to better present findings to clients or even in court giving everyone a view they will probably recognize.

What I’ve done…

I’ve dug around a bit and found some older examples of software that will detect whether or not the current system is being run in a virtual environment. According to the author of the original software, VMWare creates a special “port” which interfaces between the virtual machine and VMWare itself which allows it to be detected.

So what I’ve done is compiled his detection library (it’s a .dll) and written a very tiny program in VB.NET which uses the library to determine whether or not the system is running in VMWare. If the software determines that it is in fact running in a virtual environment it calls a shutdown command which then powers off the operating system which happens to be Windows XP with the .NET 2.0 Framework installed.

If you were to have a small program like this run at Windows startup, it would rein all sorts of difficulty down on an examiner who wishes to virtualize the images. Now they can’t boot the forensic images in VMWare and to do this they now need to figure out what is happening to the system to cause it to shutdown. If they figure out that you’ve a small program running then they’ll need some way of removing it.

An examiner will have to reverse or restore (in EnCase terminology) the images back to a physical hard disk and modify the new disk copy disabling the software. Then they can successfully boot the physical disk with software like LiveView into a virtual environment with VMWare. This creates a lot of extra hassel and adds time to an investigation if they decide they want to spend those hours figuring out why the system shuts down, then take the time to restore the images and finally disable the software.

Purpose and Ideas

Since all of the detection functions and routines are in the detection library (the .dll file) you should be able to easily code a bit of software that utilizes it in your own language of choice. I believe in the original source code the C++ example is all contained in one executable as well.

I’ve not added any routines that add this program to any startup registry keys or directories and adding this functionality would not be difficult at all. Currently all it does is run and perform an extremely simple check (if/else) to determine if the system is virtualized. If it is, it executes a shutdown command. If it is not it promptly kills itself in under a second. 

To help avoid detection it may be wise to compress the executable and library and make sure their filenames are not all that suspicious much like in this article.

It may also be wise to add some sort of check that determines if the software is being run from the same machine. This is because an examiner may find it and decide to copy it out and run it to see what it does. If you could devise a routine that checks for say… some file buried in a directory in the Windows folder then it would trip up most examiners even more. Many will probably not break out a debugger to see what is really happening but some probably would.

The main purpose here is to trip up the examiners. Make them waste their time, their client’s time and everyone else’s. Make the costs of a computer forensics examination even more expensive.

Issues

Well, obviously if it is discovered that someone is running software like this by an examiner, it probably won’t look all that great when that person is then being questioned in court.

This also does not stop a forensic examination. Examiners have lived without this technology and there have been countless examinations that have never involved using LiveView and virtualizing evidence.

The fact remains that virtualizing evidence is becoming very common and convenient in investigations and I can only see this technology and software increasing in use. This is definitely another method I would add to my anti-forensics arsenal.

The Goods

The author of the original code is named Elias aka lallous. I found the original source code on CodeProject and this programmer definitely deserves a shoutout for his work. He has also credited a Ken Kato for work that had been done in reversing VMWare.

My download below includes the binaries for the program I created as well as the library created by lallous. It also contains the source code for the program. You can find the original source code in the link one paragraph up.

Download Here

If you have suggestions, comments or want to share your own modifications then please comment below!

Other Downloads

VB.NET 2008 Express Edition from Microsoft