Playing online (Xbox Live)

For this experiment I will be playing 'Call of Duty 4: Modern Warfare 2'. A profile with an Xbox live Gold membership will be used, transferred via USB. The game will then be played online.

Activities;

• Transfer profile to Xbox console via USB.
• Start with USB account.
• Start the game straight from disk [1948].
• Accept any updates via Xbox live [1949].
• Begin online game play [1949].
• Stopped [2022].

Imaging started at home, imaging at home [2025].

MD5 HDD: 9fccbb0bea48e2dac983c54d9cacb0d7
MD5 Image:9fccbb0bea48e2dac983c54d9cacb0d7

Analysis of this image will be performed at a later stage.

Playing a game from the hard drive

For this experiment I will be playing a game that has been installed on the hard drive, multiple saves will be made (manual and automatic).

Activities;

• Install Mass Effect 2     
• Start with Acc2 profile  
• Start the game
• Select 'new game' then select 'male'.
• Accept defaults.
• Achievement gained (5g) [1651]
• Accept defaults (name, details, etc...).
• Select the hard drive as the storage device.
• Select 'Quick Start'.
• Save [1656].
• Autosave [1706].
• Autosave [1711].
• Achievement (10g) [1714].
• Save [1714].
• Autosave [1716].
• Autosave [1717].
• Autosave [1718]. 
• Autosave [1721].
• Autosave [1723].
• Autosave [1737].
• Save [1740].

Experiment performed at home; imaging at home.

MD5 HDD: 4D157A46641DB3BAE4DAE4DAE8E09165451A
MD5 Image: 4D157A46641DB3BAE4DAE4DAE8E09165451A

Analysis of this image will be performed at a later stage.

Playing a game from CD

For this experiment I will be playing a game from the CD and will make multiple saves(manually and automatically(auto saves)). The game I have used for this experiment is Mass Effect 2; it is one of the games I have that I know I can save manually. The time at which game saves are made and when achievement's are gained will be noted. Once this experiment is completed the hard drive will be imaged.

Activities;

• [Time set]*.
• Signed in with acc1.
• Insert game and play.
• Select 'new game' then select 'male'.
• Accept defaults.
• Achievement gained (5g) [1423]
• Accept defaults (name, details, etc...).
• Select the hard drive as the storage device.
• Select 'Quick Start'.
• Save [1428].
• Save [1445].
• Achievement (5g) [1446].
• Auto save [1447].
• Achievement (10g) [1449].
• Auto save [1453].
• Auto save [1500].
• Save [1500].

* Console has been taken home to continue experiments, power loss causes the time to be lost.

Experiment performed at home; imaging at home.

MD5 HDD: 480BCD0558AA3F0D5ED2D09B31CE946F
MD5 Image: 480BCD0558AA3F0D5ED2D09B31CE946F

Analysis of this image will be performed at a later stage. 

Creating a disk image using a write blocker and 'dd'

I do not have FTK imager at home but I can borrow a write blocker to aid me in imaging the hard drive. I have an installation of Linux (Ubuntu 10.04) with 'dd' installed and a Tableau t3u write blocker. Acqusition steps:

1. Remove hard drive from the Xbox 360 hard drive unit (see removal steps).
2. Connect the hard drive to the write blocker.
3. Open up the terminal in Ubuntu.
4. Next you must identify where the hard drive is located, I located the hard drive under /dev directory as sdc.
5. Next calculate the md5 of the hard disk:
1. md5sum /dev/sdc > XboxDiskName.md5
6. Next the drive is imaged, this was done by typing the following:
1. sudo dd if=/dev/sdc of=/media/externalHDD/XboxImageName.dd
7. To check is the image created is the same the hard disk the MD5 is calculated:
1. md5sum XboxImageName.dd > XboxImageName.md5
8. The md5's can be compared to see if they are identical.

Once these steps have been completed an image should be created of the Xbox disk that is a duplicate of the data stored on the actual hard drive.

Creating user profiles

As the hard drive has been formatted there are no user profiles on that console. I will be creating 2 user profiles; acc1 and acc2. One of the accounts will be used to play a game that has been installed to the hard drive and the other will be used to play a game from CD. I will be looking at the game saves and if there is any difference between the saves when running the game from hard disk and CD.

To create a user profile go to My Xbox > Sign In > Create Profile. The accounts I have created are; acc1 and acc2 selecting any of the avatars created by default.

The console is switched off and the hard drive imaged, see Xbox 360 hard drive acquisition (a single dd image will be created).

FTK results:

Analysis of this image will be performed at a later stage.

Initial setup and formatting

Starting with an unused Xbox 360 (manufacture date: 17/11/2006 (DD/MM/YYYY)), set the console up with no internet connection, just attach the necessary cables to use offline (power and video).

Turn the console on and if this is the first time it has been turned on it will ask you to create a gamer profile, I created a gamer profile called acc1 leaving the gamer picture as default and then exiting the setup. Once you exit the setup you will be asked to update the console or you will not be able to use it; accept and install the updates. When the console restarts you will be asked to sign in, select the one just created, pick an avatar then save and exit.

Next set the date/time of the console to the correct time, go to My Xbox > System Settings > Console Settings > Clock > Date and Time.

Then format the hard drive ('My Xbox > System Settings > Memory' press 'y' and select 'format); this will remove the profile you just created and anything else on the drive like videos and demo's. This will give me a fresh drive with nothing but the basic items the Xbox 360 places on it. Turn off the console and image the drive see Xbox 360 hard drive acquisition (a single dd image will be created).

FTK imager results:

Analysis of this image will be performed at a later stage.

Plan of initial experiments

I will format the Xbox 360 hard drive using the Xbox 360. A number of activities will be carried out on the Xbox 360, at each step a image of the drive will be taken for later analysis.

1. Format hard drive using  Xbox 360.
2. Create 2 profiles: acc1, acc2 - no internet access.
3. Play a game make multiple saves.
4. Install a game.
5. Play a game installed, make mulitple saves.
6. Sign in to an Xbox live account (my own account to be transferred via a USB memory stick to the experiment console).
7. Play online game.
8. Media streaming; pictures, music and video *addition to list*

This is what I intend to do, the results will be looked at after. The steps may also be extended, this is a brief overview of my first few experiments.

Note: I have quite a back log of activities, these will be put up shortly for the relevant date.

Using Xplorer360

Xplorer360 is a file browser for the Xbox 360 console. This software allows the contents of a Xbox 360 to be viewed and edited.

The physical drive can be loaded into Xplorer360 for viewing/editing or an image of an Xbox 360 drive can be loaded however an image can't be edited. Files from either method used can be extracted for later analysis.

Xplorer360 - open image

Select Xbox 360 image

Xplorer360 - view of Xbox 360 partitions

Images taken can be loaded into Xplorer360 as shown above, the all file types must be selected to see the 'dd' file extension. Once loaded into Xplorer360 the partitions (0,2 and 3) can be seen, by clicking on these partitions the files contained within will be displayed on the right and the sub-folders for that partition will also be shown underneath the given partition. By right clicking on the partition or any other file will allow all files and folders underneath to be extracted... All files shown by Xplorer360 were extracted for later analysis.

Xbox 360 hard drive acquisition

Today I am to take an image of the Xbox 360 hard drive in a forensically sound manner. I will be attempting to take an image of the hard drive whilst it is connected to a write blocker.

What I am using;

• FTK imager v2.9.0.1385 - this will be used to acquire an image of the hard drive.
• Tableau t3u - this write blocker will be used to prevent the drive being written to.
• SATA data and power cables - to connect the hard drive to the write blocker.
• External drive - this will be the destination of the image created.
• Torx 6,8 screwdriver - used to remove hard drive (Xbox 360 hard drive removal steps).
• Xbox 360 hard drive (20GB).

FTK imager can create different types of acquisition images. The types I will try are 'dd' and 'E01'. A dd image is a bit by bit copy of the device and is compatible with multiple forensic applications. A E01 image is an EnCase evidence file, this is also a copy of the device however this image includes metadata which can store the integrity data such as MD5 and CRC's for the image. For more information on disk image storage formats have a look here.

Before I can attempt to take an image of the hard disk it has to be removed. Once removed it can be connected to the Tableau T3u write blocker (connection guide) and then connected to the computer via USB. Now that the hard drive is appropriately connected the device can be imaged.

E01 image steps;

1. Open FTK imager
2. Click on File > Create disk image
3. Select the source type (physical drive) and the image source (Xbox hard drive)
4. Click Add...
5. Select type 'E01'
6. Enter case details
7. Select the destination (external hard drive)
8. Leave defaults; compression and fragment size
9. Ensure verify is selected then click start
10. The imaging process now starts; when imaging is complete allow it to verify and once done click close.

The image of the hard drive was created successfully and was verified; the image of the device is the same as the hard drive. 

The steps for creating a 'dd' image are very similar;

1. Open FTK imager
2. Click on File > Create disk image
3. Select the source type (physical drive) and the image source (Xbox hard drive)
4. Click Add...
5. Select type 'dd'
6. Enter case details
7. Select the destination (external hard drive)
8. Leave defaults; compression and fragment size*
9. Ensure verify is selected then click start
   
10. The imaging process now starts; when imaging is complete allow it to verify and once done click close.

The image of the hard drive was created successfully and was verified; the image of the device is the same as the hard drive.

Now that I have an image of the Xbox 360 hard drive I can begin to examine it.

*In order to get a single image as opposed to a split image set the fragment size to 0. Do this only if the file system supports the file size.

Removing the Xbox 360 Hard drive

In order to investigate the hard drive I will need to remove the hard drive from it's case; Its quite an easy task but still, I will show how its done.

DISCLAIMER: BY REMOVING THE XBOX 360 HARD DRIVE FROM IT'S CASE YOU WILL BE VOIDING THE WARRANTY ON THE HARD DRIVE:- YOU HAVE BEEN WARNED.

What's needed;

• T-6 TORX Screw Driver
• T-10 TORX Screw Driver
• Antistatic strap or other means of grounding yourself/discharging static before starting

Remove the hard drive unit from the top of the console. Turn the hard drive unit upside down and place it on a flat surface so the screws and the hard drive connection can be seen.

Using a T-6 TORX screw driver remove the four screws (one screw is under the Microsoft label in the corner); Note: Removing this label invalidates the warranty on the item. Gently separate the top from the chrome bottom; the button, spring and catch may drop off; remove them when you come across them to avoid losing them and reattach on reassembly.

Put the chrome piece to one side, take the other piece and turn it over so you can see the metal case the hard drive is in. Next Remove the four screws with a T-10 TORX screwdriver and lift the metal cover off from the button end.

Now, disconnect the SATA/power cable; move the hard drive down slightly from the connector and then slide the connector off the hard drive. With one hand holding the sides of the plastic piece beneath the metal case in the middle, pull the side down where the hard drive can slide out. Carefully tilt so the hard drive slides to the edge.

Now slide the hard drive all the way out and the hard drive should be fully removed.

Now I can take an image the drive.

Reassemble in reverse order; not forgetting to reattach the catch, spring, button and hard drive connector.

Project shift of focus

In order for my final year project to be viable I will be focusing more on how the Xbox 360 file system works and looking at Xbox 360 specific artefacts that are created through the use of an unmodified Xbox 360.

The information gathered from this will allow me to build a list of artefacts that could be considered known; for example this could be default installation files or system updates. By creating a list of known files it would cut the number of files needed to be searched; reducing time and money spent trying to obtain evidence.

I will be creating a comprehensive user manual for investigators that are performing an Xbox 360 investigation.

I may also look for artefacts left from other applications that run on the Xbox 360 console mentioned in the previous post.

This is a brief description I am yet to perform a MoSCoW (Must have, Should have, Could have, Won't have but would like in the future) analysis for my project.

Creating and gathering artefacts

I will be carrying out a number of experiments to determine if artefacts are created by carrying out certain actions on the Xbox 360; if artefacts are created I intend to locate the artefacts and find out what they mean.

What may generate artefacts?

1. Use of Facebook
2. Use of Twitter
3. Use of Windows messenger
4. Using Xbox live
5. Using Windows media center
6. Logging into console/signing in
7. Playing on games; game saves

I will need to acquire an image of the Xbox 360 hard drive after performing an action on the console that I suspect will create artefacts. So I need a way to take an image of the Xbox hard drive; I will also need to identify a forensically sound method of doing this.

I will also see what artefacts are created on USB drives used on the Xbox 360. I will see if by removing the hard drive the USB drive is used as an alternative; causing artefacts to be created on the device. The USB drive will also be used in conjunction with the hard drive. As with the hard drive I will need a way to image the USB drive in a forensically sound manner.

A network/packet sniffer could be used to monitor the packets sent to and from the console when performing certain experiments. Information may be able to be gathered from analysing the packets; if a network was under surveillance this information could help to determine that a console is being used and the actions being performed on the console.

The Xbox 360 can communicate with other PC's on the network, this means artefacts could be left on the computer that is communicating with the console (for example by using windows media center). The computers hard drive can be imaged and searched for artefacts.

Final year project - Xbox 360 investigation

Hello, my name is Matt Walker and I am in the final year of my forensic computing degree at UCLAN. As you may have gathered this blog is to do with Xbox 360 forensics. I have created this blog to aid me with keeping track of my findings and my progress for my final year project. But also if anyone else is interested console forensics they may find this useful. -feel free to comment

Why am I investigating an Xbox 360 for my final year project?

Today's game consoles are much more complex than they have previously been. Game consoles used to be bought for one thing; playing games. However consoles now are much more powerful and can be used for more than just gaming. Consoles can quite easily play a role in certain crimes and may be overlooked as a source of intelligence.

What will the outcomes of this project be?

• To find out how the Xbox 360 file system works.
• Gain greater knowledge on how the Xbox 360 console works.
• Identify Xbox 360 specific artefacts and their meaning/purpose.
• Identify common artefacts that are of little interest to an examiner (Known Xbox 360 files)
• Find out if artefacts are created from the use of applications and services on the console.
• If these artefacts do exist then, find the location of them and attempt to make sense of what has information has been obtained.
  
• I will use various methods for acquiring evidence and make an analysis of each one to determine what can be gained from each method and which is most effective.
• The importance of Xbox 360 investigations.