Creating user profiles

As the hard drive has been formatted there are no user profiles on that console. I will be creating 2 user profiles; acc1 and acc2. One of the accounts will be used to play a game that has been installed to the hard drive and the other will be used to play a game from CD. I will be looking at the game saves and if there is any difference between the saves when running the game from hard disk and CD.

To create a user profile go to My Xbox > Sign In > Create Profile. The accounts I have created are; acc1 and acc2 selecting any of the avatars created by default.

The console is switched off and the hard drive imaged, see Xbox 360 hard drive acquisition (a single dd image will be created).

FTK results:

Analysis of this image will be performed at a later stage.

Initial setup and formatting

Starting with an unused Xbox 360 (manufacture date: 17/11/2006 (DD/MM/YYYY)), set the console up with no internet connection, just attach the necessary cables to use offline (power and video).

Turn the console on and if this is the first time it has been turned on it will ask you to create a gamer profile, I created a gamer profile called acc1 leaving the gamer picture as default and then exiting the setup. Once you exit the setup you will be asked to update the console or you will not be able to use it; accept and install the updates. When the console restarts you will be asked to sign in, select the one just created, pick an avatar then save and exit.

Next set the date/time of the console to the correct time, go to My Xbox > System Settings > Console Settings > Clock > Date and Time.

Then format the hard drive ('My Xbox > System Settings > Memory' press 'y' and select 'format); this will remove the profile you just created and anything else on the drive like videos and demo's. This will give me a fresh drive with nothing but the basic items the Xbox 360 places on it. Turn off the console and image the drive see Xbox 360 hard drive acquisition (a single dd image will be created).

FTK imager results:

Analysis of this image will be performed at a later stage.

Plan of initial experiments

I will format the Xbox 360 hard drive using the Xbox 360. A number of activities will be carried out on the Xbox 360, at each step a image of the drive will be taken for later analysis.

1. Format hard drive using  Xbox 360.
2. Create 2 profiles: acc1, acc2 - no internet access.
3. Play a game make multiple saves.
4. Install a game.
5. Play a game installed, make mulitple saves.
6. Sign in to an Xbox live account (my own account to be transferred via a USB memory stick to the experiment console).
7. Play online game.
8. Media streaming; pictures, music and video *addition to list*

This is what I intend to do, the results will be looked at after. The steps may also be extended, this is a brief overview of my first few experiments.

Note: I have quite a back log of activities, these will be put up shortly for the relevant date.

Using Xplorer360

Xplorer360 is a file browser for the Xbox 360 console. This software allows the contents of a Xbox 360 to be viewed and edited.

The physical drive can be loaded into Xplorer360 for viewing/editing or an image of an Xbox 360 drive can be loaded however an image can't be edited. Files from either method used can be extracted for later analysis.

Xplorer360 - open image

Select Xbox 360 image

Xplorer360 - view of Xbox 360 partitions

Images taken can be loaded into Xplorer360 as shown above, the all file types must be selected to see the 'dd' file extension. Once loaded into Xplorer360 the partitions (0,2 and 3) can be seen, by clicking on these partitions the files contained within will be displayed on the right and the sub-folders for that partition will also be shown underneath the given partition. By right clicking on the partition or any other file will allow all files and folders underneath to be extracted... All files shown by Xplorer360 were extracted for later analysis.

Xbox 360 hard drive acquisition

Today I am to take an image of the Xbox 360 hard drive in a forensically sound manner. I will be attempting to take an image of the hard drive whilst it is connected to a write blocker.

What I am using;

• FTK imager v2.9.0.1385 - this will be used to acquire an image of the hard drive.
• Tableau t3u - this write blocker will be used to prevent the drive being written to.
• SATA data and power cables - to connect the hard drive to the write blocker.
• External drive - this will be the destination of the image created.
• Torx 6,8 screwdriver - used to remove hard drive (Xbox 360 hard drive removal steps).
• Xbox 360 hard drive (20GB).

FTK imager can create different types of acquisition images. The types I will try are 'dd' and 'E01'. A dd image is a bit by bit copy of the device and is compatible with multiple forensic applications. A E01 image is an EnCase evidence file, this is also a copy of the device however this image includes metadata which can store the integrity data such as MD5 and CRC's for the image. For more information on disk image storage formats have a look here.

Before I can attempt to take an image of the hard disk it has to be removed. Once removed it can be connected to the Tableau T3u write blocker (connection guide) and then connected to the computer via USB. Now that the hard drive is appropriately connected the device can be imaged.

E01 image steps;

1. Open FTK imager
2. Click on File > Create disk image
3. Select the source type (physical drive) and the image source (Xbox hard drive)
4. Click Add...
5. Select type 'E01'
6. Enter case details
7. Select the destination (external hard drive)
8. Leave defaults; compression and fragment size
9. Ensure verify is selected then click start
10. The imaging process now starts; when imaging is complete allow it to verify and once done click close.

The image of the hard drive was created successfully and was verified; the image of the device is the same as the hard drive. 

The steps for creating a 'dd' image are very similar;

1. Open FTK imager
2. Click on File > Create disk image
3. Select the source type (physical drive) and the image source (Xbox hard drive)
4. Click Add...
5. Select type 'dd'
6. Enter case details
7. Select the destination (external hard drive)
8. Leave defaults; compression and fragment size*
9. Ensure verify is selected then click start
   
10. The imaging process now starts; when imaging is complete allow it to verify and once done click close.

The image of the hard drive was created successfully and was verified; the image of the device is the same as the hard drive.

Now that I have an image of the Xbox 360 hard drive I can begin to examine it.

*In order to get a single image as opposed to a split image set the fragment size to 0. Do this only if the file system supports the file size.

Removing the Xbox 360 Hard drive

In order to investigate the hard drive I will need to remove the hard drive from it's case; Its quite an easy task but still, I will show how its done.

DISCLAIMER: BY REMOVING THE XBOX 360 HARD DRIVE FROM IT'S CASE YOU WILL BE VOIDING THE WARRANTY ON THE HARD DRIVE:- YOU HAVE BEEN WARNED.

What's needed;

• T-6 TORX Screw Driver
• T-10 TORX Screw Driver
• Antistatic strap or other means of grounding yourself/discharging static before starting

Remove the hard drive unit from the top of the console. Turn the hard drive unit upside down and place it on a flat surface so the screws and the hard drive connection can be seen.

Using a T-6 TORX screw driver remove the four screws (one screw is under the Microsoft label in the corner); Note: Removing this label invalidates the warranty on the item. Gently separate the top from the chrome bottom; the button, spring and catch may drop off; remove them when you come across them to avoid losing them and reattach on reassembly.

Put the chrome piece to one side, take the other piece and turn it over so you can see the metal case the hard drive is in. Next Remove the four screws with a T-10 TORX screwdriver and lift the metal cover off from the button end.

Now, disconnect the SATA/power cable; move the hard drive down slightly from the connector and then slide the connector off the hard drive. With one hand holding the sides of the plastic piece beneath the metal case in the middle, pull the side down where the hard drive can slide out. Carefully tilt so the hard drive slides to the edge.

Now slide the hard drive all the way out and the hard drive should be fully removed.

Now I can take an image the drive.

Reassemble in reverse order; not forgetting to reattach the catch, spring, button and hard drive connector.

Project shift of focus

In order for my final year project to be viable I will be focusing more on how the Xbox 360 file system works and looking at Xbox 360 specific artefacts that are created through the use of an unmodified Xbox 360.

The information gathered from this will allow me to build a list of artefacts that could be considered known; for example this could be default installation files or system updates. By creating a list of known files it would cut the number of files needed to be searched; reducing time and money spent trying to obtain evidence.

I will be creating a comprehensive user manual for investigators that are performing an Xbox 360 investigation.

I may also look for artefacts left from other applications that run on the Xbox 360 console mentioned in the previous post.

This is a brief description I am yet to perform a MoSCoW (Must have, Should have, Could have, Won't have but would like in the future) analysis for my project.