dougee: BlackBag’s BlackLight and F-Response Field Kit

Wednesday, November 17, 2010

BlackBag’s BlackLight and F-Response Field Kit

I have been very fortunate to use both F-Response and BlackBag’s BlackLight forensic programs together. This allows the investigator to analyse a remote mounted hard drive across the network. Those familiar with F-Response will know that the product gives presents a forensically sound read only access to a remote hard drive across the network. The drive is presented as local physical or logical device. BlackBag’s BlackLight is designed to investigate Mac OSX based systems, but I figured I could harness not only its ease of use and power searching capabilities to analyze a Windows box.

I setup F-Response Field Kit on the suspect computer using my thumb drive and tested connectivity between my Macbook and the suspect computer.

F-Response Field Lit Window From Suspect Computer

Using the GlobalSAN iSCSI program I setup the iSCSI interface between my Macbook and the suspect computer.

GlobalSAN iSCSI Portal Window

I was then need to login to the F-Response physical disk using the GlobalSAN iSCSI Targets Tab.

GlobalSAN iSCSI Target Window

THe GlobalSAN iSCSI Targets Tab then showed the physical disk connected to my Macbook.

GlobalSAN iSCSI Showing Physical Disk Connected

OSX found the newly attached physical disk and presented the volume on my desktop.

Volume From Remote Computer On OSX

I then opened BlackLight and started a new case called “Uncle Bob”.

BlackLight Cases Window

BlackLight Add New Case

On opening the new case BlackLight presents you the case details window where you can fill in the information about the case including investigator and suspect details.

BlackLight Case Details Window

The next part of the process is to add the F-Response Disk to BlackLight. You need to click on the file menu and select “Add Attached Device”.

BlackLight Add Attached Disk Option

This brings up the “Evidence Selection” window and I selected in this case “disk5” labeled as type iSCSI. This added the volume “disk5s1” the remote F-Response mounted Windows XP FAT32 volume into BlackLight.

BlackLight Evidence Selection Window Showing F-Response Disk

The bottom pane shows the Processing options that can be taken to the added disk, in this case I accepted the defaults.

After adding the F-Response attached Disk, I then accessed the “Disk Status” tab and BlackLight shows the status of the analysis of the disk.

BlackLight Disk Status Window Showing Processing Task Progress

Once the analysis phase was completed I was able to use all of the powerful searching and filtering tools of BlackLight against the live mounted F-Response Volume.

BlackLight File Browser Window