Elsevier

Digital Investigation

Volume 18, Supplement, 7 August 2016, Pages S55-S65
Digital Investigation

DFRWS USA 2016 — Proceedings of the 16th Annual USA Digital Forensics Research Conference
dbling: Identifying extensions installed on encrypted web thin clients

https://doi.org/10.1016/j.diin.2016.04.007Get rights and content
Under a Creative Commons license
open access

Abstract

Researchers have developed forensic analysis techniques for so many types of digital media that there is a procedure for almost every digital media that a law enforcement officer may encounter at a crime scene. However, a new type of device has started to gain momentum in the consumer market: web thin clients. These web thin clients are characterized by native support for basic web browsing, yet other functionality relies on a combination of web applications and web storage. In fact, these devices are so different from other types of computing and storage devices that virtually all of the techniques forensic examiners and researchers typically use do not apply.

The most popular web thin client, Chrome OS, has additional forensic challenges: (1) all data associated with users is encrypted, (2) Chrome OS correctly uses TPM and Secure Boot, and (3) user data is stored on the device and in the cloud.

In this work, we present a novel approach to extract residual evidence stored on Chrome OS devices that successfully bypasses these challenges. Specifically, we are able to determine which extensions and apps are installed on an encrypted Chrome OS device, without breaking or otherwise extracting the encryption keys. Our framework, called dbling, generates signatures or fingerprints of extension and app code that persist after encryption, and we are able to use these fingerprints to identify the installed extensions and apps. We create fingerprints of 160,025 extensions for Chrome OS, we measure the uniqueness of these fingerprints, and we perform a case study by installing 14 extensions on a Chrome OS device and attempt to find their fingerprints.

Keywords

Web thin clients
Digital forensics
Forensics on encrypted data
Chrome OS

Cited by (0)