CHAPTER 8
Detecting the Use of Cryptocurrencies

I was speaking to a police officer in a European country a few weeks ago, and he was explaining to me why he would not need to read this book. He said they had invested in an expensive cryptocurrency analysis tool, so he would not need to actually understand how cryptocurrencies worked or how to investigate them manually. I asked him if he realized that the tool only analyzed Bitcoin. His reply was, “Are there others?” This was somewhat of a shock to me. When I mentioned a few names, he realized that he had heard of them but wasn't worried because none of them had appeared in cases. I added the word “yet” to the end of his sentence. I reminded him that seven or eight years ago, high-tech crime units were saying something similar about Apple computers: that they didn't need knowledge to investigate those computers because none ever appeared in the lab. Now, of course, a huge number appear as evidence, and those high-tech units are often still behind the curve. Worse, they've probably just bought and been trained on a tool, and do not actually know the fundamentals of OSX investigation without the software tool.

I then asked this police officer if the high-tech crime team always actively looked for the existence of cryptocurrency use on the hard drives and mobile devices they analyzed. He admitted that not only was that not done, he didn't think they would really know what they were looking for. I humbly suggested he read this book.

Before you can start any investigation to follow transactions on a blockchain, you need to locate evidence of cryptocurrency use and then find the addresses or private keys that are being used by a suspect. This is not just the task of a high-tech crime investigator but needs to start right at the initial premises search.

The Premises Search

Several years ago, I stood in the corner of the room of a Middle-Eastern house. The walls were roughly painted, with no pictures hanging on them, and the floor was dusty with a couple of worn Turkish-style rugs strewn across it. It was really hot and pitch dark—the room was only visible with the night vision goggles pressed against my face. In the background, I could hear the sounds of life from outside: neighbors squabbling in the far distance set to the backdrop of sounds animals and insects make in the hour or so before dawn. I knew people were coming, but it was still a shock when the front door clicked and quietly opened. The first four law-enforcement officers that came into the room looked other-worldly—moving smoothly and low, respirators and Kevlar helmets enveloping their heads and, most concerningly, automatic weapons lifted to eye height sweeping left and right as they covered their individual arcs of fire. They silently cleared the room and the room to my left, moving past me like I was invisible. They were being watched by a different instructor, so I wasn't really interested in them—I was there to watch who came next. The next two counterterrorism officers that came into the room were different. Their sidearms were holstered, and they carried a couple of flight cases, which they put down next to a laptop on a desk in the far corner from my observation spot. Their job was to create, if possible, a forensic copy of the memory and hard drive of the laptop. They covered the screen to obscure any light, and the touchpad was tapped. Even with the cover on the laptop screen, the light burned into the screens of the night-vision goggles, and the officers had to self-adjust to the new light source. As the screen came into view, I saw the Enter Password box I knew would appear. One flight case was open on the floor with small tools, hard drives, hardware write-blockers, and other bits of kit. I knew the officers had been trained how to use these things, but would they take the hard or the easy route? They would get extra points if they managed to extract the contents of the computer memory, but in this instance, that would mean cleanly logging in, which would require the password. The room search had already started and was being carried out with speed, yet with care and precision, by a team that had done this task 100 times before. As the U.S. Special Forces say, “Slow is smooth, and smooth is fast.”

In the bottom drawer, which was deliberately tricky to open, was a book, and in the front cover of the book was a sticky note. On the sticky note was written a single word in Arabic. It took them less than 5 minutes to find it. One of the officers would now need to enter the word onto the unfamiliar keyboard, plug in a device from one of the flight cases, and wait while the device did the copying job for them. The only female in the group, recognizable only from her slightly smaller stature, spoke a little Arabic, so she stepped up and entered the word. It worked, as I knew it would. They fired up the imaging kit and relaxed slightly, with one of the team looking over at me for the first time. I gave a thumbs-up signal and looked to the instructor to my right. He was watching two other officers who needed to locate a small SD camera card hidden in a break-in the concrete under a rug. He also gave a thumbs-up, and the exercise was over, goggles off, lights came on, and we all headed down the 50-foot tunnel where the training houses were located and out into an unusually bright but cold day in the English countryside.

The search was an interesting one. The officers knew the SD card was there, and they were tasked to image the laptop. They were limited by a defined time on target and had no way of knowing if there was a password anywhere to be found. Their search drill was flawless, and they found what they needed as well as 9 of the 10 bonus items. But would they have found evidence of cryptocurrency use? In this case, if any of the team had found a string of disconnected words or numbers, they would probably have recorded it, and either photographed or seized it depending on the job. The team was so good that they would have seen anything out of the ordinary as interesting even if they didn't know exactly what it was. Would that be the case with your search teams?

A New Category of Search Targets

Police search teams are routinely trained to look for technical equipment or data, whether that is uncovering USB drives, CD-ROMs, or especially finding notes that may contain passwords. In the current technical climate where encryption is being used more often by suspects, finding a password can be very useful indeed. Most people only use three passwords or derivatives of them. If you can find one password, you have around 33 percent of their passphrases.

Search teams also need to be trained to look for evidence of cryptocurrency use both at the premises search and later in the lab when examining computers and mobile devices. This is a new category of search, but it's one that is not complex to train. For many years, search teams have been trained to look for passwords on sticky notes, in notebooks, and written on pieces of paper. Passwords are fairly easy to identify because they are a simple word or phrase written down, often without context. It is even better if a suspect writes down a complex password with numbers and characters, which will then often be clearly identifiable as a passphrase. Finding evidence of cryptocurrency use can be just as straightforward.

Public Addresses

You learned in Chapter 4, “Transactions,” that Bitcoin addresses start with the character 1 or 3, are 34 characters long, and are formatted as Base58. For example:

1AMdziK76JwP6DzEGyB9ruddBxQhM1oeZE

Ethereum addresses start with 0x and are 42 characters long. For example:

0x66febdddc377e2ee0b997c72b76d12c4aa2ce9be

These simple rules make it easy for a search team to learn what to look for. After all, why would someone have a seemingly random series of characters recorded that clearly is not a phone number, bank account number, or something that looks like a very peculiar password?

Some of the places where a search team might find an address or private key are in the following list, and you can see the examples in Figure 8-1. These examples are taken from real-world cases where addresses have been found:

  • white board
  • Included in a printed e-mail
  • Printed on paper in a file
  • On a sticky note on the computer monitor
  • On a card in a suspect's wallet

Illustrations of some examples of seized addresses.

Figure 8-1: Examples of seized addresses.

Addresses can also be recorded as QR codes (see Figure 8-2). This method is often used because it is easier to send someone an image of a long address than to have to manually type it. If a QR code cannot readily be seized, then a photo can be taken of it that can be scanned later.

Snapshot illustration of an example of a paper wallet with QR code.

Figure 8-2: Example of a paper wallet with QR code.

Private Keys

You can sometimes find private keys on pre-printed gift cards or other paper-based wallets such as the ones mentioned in the last section. If a paper-based wallet contains the private key, this enables you to take control of the funds. (You'll learn more about this later in Chapter 14, “Seizing Coins.”)

Although users may not protect the public key as much, they tend to be more careful when it comes to the private key. Private keys are unlikely to be written on a piece of paper and discarded, but they could still be found in filing cabinets or safes.

Bitcoin private keys can be in a number of formats, and searchers should be aware of them all. They may be in a standard 256-bit hex format and 64 characters long, or more often, they will be in Wallet Import Format (WIF), 51 characters long, and start with the number 5. There is also a mini-private key format where the string is 21 characters long.

Private keys can also be in the form of a string of mnemonic code words often called a seed. These are used by blockchain.info, the Electrum software wallet, and the Trezor hardware key. Again, this should stand out to a searcher as a list of handwritten or typed words that do not relate to each other (see Figure 8-3). If you find such words, you can reverse the seed back into the private key by using the appropriate software tool such as Electrum or by entering them into an online recovery engine, which will then provide the private key. Remember that it is dangerous to enter or recover a private key online as there is the risk it could be stolen. To recover a private key you can enter a seed into the online form at http://bit.ly/2Bcakgl.

Photo illustration showing a list of unrelated words.

Figure 8-3: List of unrelated words.

Ethereum private keys are 64 characters long. For example:

aba7e63318ebe4450911b62d5e79139310ad35545338bb89fcb7183365cc3375

Ethereum public keys are 42 characters long and start with 0x. For example:

0x310B065125DDBACeB4822CA5e4F130025F8c9f07

These are all fairly easy to train and for searchers to recognize without having to teach detailed technical information. This ensures that potentially vital information is not missed.

Questioning

Although I am not going to give a lesson on questioning a suspect, just as it is important that search teams are told what to look for in relation to cryptocurrency use, it is also important to provide some instruction to those who will question a suspect. Knowing what to ask is important but not as vital as asking at all! Asking if cryptocurrency is used by a suspect should be a question that is regularly included in fact finding. Of course, a suspect may just give a “no comment” interview, as is common here in the UK; however, there are times when asking the right questions can be very useful.

A few years ago, my friend John and I were asked to assist the UK Child Exploitation and Online Protection unit in carrying out a house search. The suspect was using a very secure type of Linux called TAILS, and the unit wanted more specialized help when they went through the door. The first thing John saw when he entered the suspect's bedroom was the computer screen switched on with a login screen displayed. John asked if the suspect had been read his rights and then simply asked him for his password. The suspect just handed it over. Asking the right question can save a lot of time.

Here are some questions you might ask:

  • Do you use cryptocurrencies?
  • Which do you use (Bitcoin, Litecoin, Ethereum, and so on)?
  • How do you store your private keys?
  • Do your private keys require passwords, and if so, what are they?
  • Where do you buy and sell your cryptocurrencies?
  • What are the passwords for those sites?
  • How much currency do you have?
  • What do you buy with cryptocurrency?

Obviously, there are many more questions you can ask, depending on the circumstances or the investigation type, but enabling the questioning officers with the right questions can be the difference between success and failure.

Searching Online

Information about an address can often be obtained online. It is amazing how often addresses are posted in these places:

  • Websites
  • Forums
  • Software-sharing sites
  • Twitter
  • Social media

Remember that sites such as forums often prevent search engines from indexing all their posts, so it's necessary to browse to the forum and use its own search system. Although cryptocurrency addresses are sometimes found in messages with one user asking for payment for services, for example, it's incredible how often addresses are in forum signatures (see Figure 8-4).

Snapshot illustration of an example of address in a forum.

Figure 8-4: Example of address in a forum.

The simplest way of searching online for an address is to just use a search engine such as Google. The problem is that most of the results come from blockchain viewers. For example, a search on the Bitcoin address 1PZ5ebvdt43dvRRgRNgBhsq2PwAKN4X6W results in what's shown in Figure 8-5.

Snapshot illustration showing how searching for addresses just returns blockchain viewers.

Figure 8-5: Searching for addresses just returns blockchain viewers.

However, if you adjust your search a little and add the “not” identifier - (a hyphen), you will be able to filter the results somewhat. Try the following Google search:

1PZ5ebvdt43dvRRgRNgBhsq2PwAKN4X6W -block

This search will remove any results with the word block. The results now look somewhat better, and you should be able to more easily find that the address belongs to the UK's Royal National Lifeboat Institution (RNLI).

You can use the site modifier to find results on a specific site, forum, or other online resource that Google indexes. This can be particularly useful when an online resource does not have a search capability of its own. To use this modifier, you just add site: and the domain name of the site you want to search. For example:

site:bitcointalk.org 1PZ5ebvdt43dvRRgRNgBhsq2PwAKN4X6W

This provides search results only from the site domain that you specified (see Figure 8-6).

Snapshot illustration providing the search results of searching a specific site.

Figure 8-6: Searching a specific site.

Searching using a search engine or even a search system on a website is fine if you know the address that you're looking for, but what if you want to search a website for any address—for example, a Bitcoin address? Google and other search engines do not allow searches that use regular expressions or pattern-based searches, so you cannot ask a search engine to look for any and all addresses in its index for the whole web or for a specific site.

However, there is a way around this—you can download the site you want to search. This may sound extreme, but it is simple to do and provides you with the ability to search in a completely different way. You will need the following two tools:

Install both of these tools on your system using their default settings.

Running Httrack is very simple. You just fill in the project name and then add the URL or URLs that you want the tool to download. In my example, I am using omninano.org. A number of options exist to change the way that the tool spiders and downloads the website; for example, you can decide to not download images and other media. The first time you run it, simply stick with the defaults (see Figure 8-7 and Figure 8-8).

Snapshot illustration for entering the project name and the location where the files should be saved.

Figure 8-7: Enter the project name and the location where the files should be saved.

Snapshot illustration for adding the URLs to download.

Figure 8-8: Add the URLs to download.

Once the site has downloaded, run Agent Ransack. This is a superb software tool that enables you to do powerful text searching within files and recursively search through a series of subfolders. There is an excellent Help facility if you want to learn how to use the tool better.

Within Agent Ransack, perform the following steps:

  1. In the File Name field type .html or .htm (check in the downloaded website files to find the right extension).
  2. In the Containing Text field, type the following: 
    - [13] 1-9A-HJ-NP-ZA-km-z](26,33}<
    This is the regular expression that will locate Bitcoin addresses for you. (I will not be explaining what the expression means, but please feel free to Google it if you want to learn more.)
  3. Using the browse button set the Look In field to the path of the downloaded files from Httrack. By default, this is c:My Web Sites<folder to search>, which in my example is omni.
  4. Select the Subfolders option check box.
  5. Click the Options tab and set Contents to Regular Expression.
  6. Click Start. Your screen should now look something like Figure 8-9.
    Snapshot illustration showing the setup of Agent Ransack.

    Figure 8-9: Setup of Agent Ransack.

    Agent Ransack will now search the entire structure of downloaded web pages, looking for matches to the specified regular expression. If there are any to find, this should locate any Bitcoin addresses (as shown in Figure 8-10 for my example). The regular expression can be adjusted to look for addresses for other cryptocurrencies too.

Snapshot illustration for the recovery of a Bitcoin address from the website.

Figure 8-10: Recovery of a Bitcoin address from the website.

Extracting Private and Public Keys from Seized Computers

Computers and mobile devices are routinely seized during the course of almost any type of investigation. People often ask me how many computer crimes I work on. I answer that only a small percentage of digital investigations are actually solely computer-based crimes, and virtually any crime committed can have digital evidence associated with it, whether that be evidence in e-mail or other messaging programs, GPS locations, digital CCTV footage, … the list goes on. In the same vein, I have been asked a few times how many cryptocurrency crimes I have investigated. Crimes committed exclusively on a cryptocurrency are currently relatively rare, and I've only investigated a few in the past year. However, if the question was phrased a little differently, and I was asked how many crimes have I investigated that included an aspect of cryptocurrency use, the answer would be very different. In fact, one of the “pure” cryptocurrency cases I was involved with was the stealing of a person's private keys, which is really just a basic theft.

Commercial Tools

When a seized computer arrives in the lab, the first thing that happens is the drives are imaged, or forensically copied. Those images are then loaded into a variety of digital investigation tools such as Guidance Software's EnCase, AccessData's Forensic Toolkit (FTK), X-Ways, or one of the other available forensics tools. There are also data-carving tools such as the excellent AXIOM tool from Magnet Forensics.

Here is a brief overview of some of these tools:

  • AXIOM This tool is designed to look for file headers and other values to carve data from forensic images and hard drives. As of version 6.1, AXIOM will natively carve Bitcoin addresses from a Bitcoin wallet, as well as queries on the Bitcoin network from log files created by the Bitcoin client software. You can learn more about this tool at http://bit.ly/2i3UBHT.
  • EnCase In many labs, EnCase is the default digital investigation tool for computer hard drives, although labs are often polarized between EnCase and FTK from AccessData. They are both excellent tools with their own pros and cons. EnCase does not have Bitcoin extraction capabilities built-in; however, an EnScript finder is available that can locate addresses on drive images or other media using the regular expression that you used earlier in this chapter. You can learn more about this tool at http://bit.ly/2BlXFGI.
  • FTK FTK has always been my personal tool of choice, but it does not have the ability to script add-ons like EnCase does. However, you can just use the regular expression searching feature with the expression mentioned previously: [13][1-9A-HJ-NP-Za-km-z]{26,33}<. Although this expression works fairly well on a website as detailed in the previous section, you will find many false positives when searching a hard drive.

Extracting the Wallet File

If possible, it's best to try to find and recover the wallet file. The wallet contains everything you need to investigate Bitcoin usage, private keys, and addresses, records of transactions, and other metadata. If you can get a wallet from a suspect's computer, it's time to celebrate!

Finding the location on a drive of the wallet file for a particular type of cryptocurrency software is usually just a case of googling it, but I'll give you some examples of where the most popular software tools store the wallet file. With most software, you can choose your own installation location (see Figure 8-11), so the default addresses that you can find in the software documentation may not be accurate, but you have the option to search for a wallet file if you can't find it by heading to the default location.

Snapshot illustration showing how one can change the default storage location in Bitcoin Core.

Figure 8-11: You can change the default storage location in Bitcoin Core.

The default wallet locations for the most popular wallet software programs are listed next. The list contains the name of the software, the operating system, the path to the wallet and, if relevant, the name of the wallet in parentheses.

Bitcoin Core

  • Windows XP: C:Documents and Settings <username>Application dataBitcoin
  • Windows Vista through Windows 10: C:Users <username> AppdataRoamingBitcoin
  • Linux: ˜/.bitcoin/
  • Mac: ˜/Library/Application Support/Bitcoin

Litecoin

  • Linux: /home/ <username> /.litecoin.conf
  • Mac: /Users// <username> /Library/Application Support/litecoin.conf
  • Windows XP: c:Documents and Settings <username> Application DataLitecoinlitecoin.conf
  • Windows Vista through Windows 10: c:Users <username> AppDataRoamingLitecoinlitecoin.conf
  • Armory: %appdata%Armory (.wallet)
  • Bitcoin Unlimited/Classic/XT/Core: %appdata%Bitcoin (wallet.dat)
  • Bither: `%appdata%Bither` (address.db)
  • Blockchain.info: (wallet.aes.json)
  • MultiBit HD: %appdata%MultiBitHD (mbhd.wallet.aes)
  • Electrum:%appdata%Electrumwallets
  • mSIGNA: %homedrive%%homepath% (.vault)

But what if a wallet.dat file or similar has been installed to a different location or moved? It is likely that a copy of backup of a wallet.dat file would still have the .dat extension, so you could simply use your digital forensics tool to search first wallet.dat and then just *.dat, although that will result in a significant number of false positives.

Perhaps the best method is to search for a “magic value” that always exists inside the wallet.dat file. Similar magic values can be found by installing the cryptocurrency software, extracting the wallet, and analyzing it either in a hex editor or simply by extracting all the strings from it. This is really easy to do but requires the strings.exe tool written for Windows by SysInternals, which you can download from http://bit.ly/2kbz7wY. The strings.exe file will extract all of the ASCII or Unicode strings from any file, by default with three characters or more, although this value can be changed in the command.

If you have a wallet.dat file (which you will if you installed Bitcoin Core in Chapter 2, “The Hard Bit”), locate the file and copy it to the same folder that strings.exe is in. Open a command shell in the folder where the wallet.dat file exists and type the following:

strings wallet.dat > walletstrings.txt

This will create a new file with a long list of human-readable strings. If you scroll down, you will begin to see text that you may remember from Chapter 6, “Wallets” (see Figure 8-12).

Snapshot illustration showing the hierarchical paths in the recovered text.

Figure 8-12: Hierarchical paths in the recovered text.

These are the Hierarchical Deterministic paths that make up an HD wallet. If you keep scrolling through the list, you will eventually find a Bitcoin address in plain text that looks similar to what's shown in Figure 8-13.

Snapshot illustration for finding an address with its prefix.

Figure 8-13: Finding an address with its prefix.

This address has an interesting value prefixing it: name"1. This value, which includes the 1 from the start of a Bitcoin address, has always existed in a wallet.dat file (in my experience). So, now you have a “magic value” that should locate a wallet.dat file, no matter what it is called. Simply use your digital forensics tool to search for name"1, and you should find the correct file (see Figure 8-14).

Snapshot illustration of wallets found in the Recycle Bin and renamed.

Figure 8-14: Wallets found in the Recycle Bin and renamed.

Notice that four files have been found in this example, including one in the Recycle Bin and one that has been renamed to bitcoincore-wallet.dat. This method is very successful, and you can simply install other wallet-management software and use the same strings technique to locate your own “magic value” to find renamed and hidden wallets.

If you installed Bitcoin Core on your own computer, you can prove this works by using Agent Ransack. Get Agent Ransack to search all of c: for the text name"1 (see Figure 8-15).

Snapshot illustration of recovered addresses with the magic value prefix.

Figure 8-15: Recovered addresses with the magic value prefix.

Automating the Search for Bitcoin Addresses

If you have some programming experience, it is fairly straightforward to write some tools to automate the extract of information from a blockchain. Especially with access to the reasonably straightforward API URLs, simple scripts can be written to automatically grab virtually anything from transactions to balances. I know that a number of police forces have written their own scripts, and most keep them to themselves; however, a researcher named Chris Cohen posted an excellent Python script to GitHub in 2014 called BTCscan. You can download it at http://bit.ly/2BE6Bbw. It was accompanied by a very informative article published on the Forensic Focus website in January of 2015. You can find this article at http://bit.ly/2iykm73, and I highly suggest that you read it.

In his article, Chris points out that just searching a drive for addresses using the regular expression that you used earlier in this chapter works well, but on a large data set like an entire hard drive, you are likely to get numerous false positives. To counter this, the implementation of Base58 (which, as you may recall, is what Bitcoin addresses are written in) has built-in error checking. By analyzing the checksum of a recovered value, you can confirm whether a recovered value that looks like a Bitcoin address really is. Chris's script does this for you.

The tool is very easy to run and will attempt to recover public and private Bitcoin addresses and/or keys in a variety of formats. The command is built using the primary command and switches in the following list:

  • Btcscan.py
  • -i—Use this input command to specify the drive, directory, and/or files to search.
  • -q—This command signifies Quick mode, which does not search BIP32 HD wallet keys.
  • -u—This command signifies Unicode mode, only search for Unicoded items.
  • -n—This command signifies Non-Unicode mode, which only searches for non-Unicoded items.

The tool requires Python 3.5, which you can download from www.python.org/downloads. If you have been following along with instructions in the book, you will already have both Python 2 and 3 installed, so you need to tell your computer which version you wish to use. You do this in the command shell by prefixing the btcscan command with the command py -3.

Open a command shell in the folder where the btcscan program exists. You can then run the software tool against anything from a raw hard drive image to a folder or even a mobile phone dump.

To search an imaged hard disk file, you will need to have a single raw image. For example, if your image is called HD_01.dd, then the command would be:

py -3 btcscan -i HD_01.dd

If you want to search a folder, the command would be:

py -3 btcscan -i="C:folder"

The output creates a comma-delimited file that can easily be imported into a spreadsheet for analysis.

The output is also useful in that it provides an offset of where the address was found in the image file you have searched. This enables you to use your favorite digital forensics tool to go and find the value manually and see it in its context.

Finding Data in a Memory Dump

Computer memory or RAM (random access memory) contains a significant amount of recoverable data. Investigators can mistakenly think that RAM is overwriting itself all the time and there is nothing useful to recover, when in fact, nothing could be further from the truth. There is a significant amount of data to be found, including files, passwords, encryption master-keys, and so on.

Imaging RAM creates significant controversy in the digital forensics world because it means, in most cases, running an executable on the suspect's computer. However, investigators know that “best evidence” means making no changes to the suspect's data sets and that running any software tool will make only minor changes to the drive. With the size of RAM increasing to significant levels in recent years and with tools available that can acquire vast amounts of data from the memory, the small changes made are seen as an appropriate offset to imaging 4, 8, 16, or more gigabytes of evidence. In the past five years, the thinking has changed and most primary police and government digital-forensics departments image RAM as a matter of priority if a computer is on when they search a suspect's premises.

You may wonder why it's worth imaging and searching the RAM when you have the disk. Of course, any addresses loaded into RAM from a wallet file will likely be recoverable from the disk. But what about in the situation where RAM is imaged, the computer is powered down, and the disk is imaged only to discover that the disk is fully disk-encrypted or that the cryptocurrency software is in an encrypted container? An undercover unit may only have access to a computer for a short time—not long enough to image the entire disk but sufficient time to get the memory. In these instances, the RAM may be all you have. Also, a recovery seed may have been generated which could still be recoverable from RAM but was never written to the disk.

Imaging RAM is fairly straightforward. Personally, I am a fan of the RAM imager tool by forensics company Belkasoft, which you can download from http://bit.ly/2BvPTdr. Although this tool can be run from the command line, you can simply double-click the executable file (choosing either the 32- or 64-bit build), provide an output path and name, and click Capture! (see Figure 8-16).

Snapshot illustration for running the Belkasoft RAM capture software.

Figure 8-16: Running the Belkasoft RAM capture software.

Running the Belkasoft imager tool will create a .mem file that is a raw dump of the memory. Once you have your memory dump, you can do a number of things to look for cryptocurrency artifacts.

One thing you can do is use Chris Cohen's tool BTCscan as discussed previously. It works very well against RAM dumps and is a quick win to see if there is anything extractable. With a command shell open in the folder where BTCscan resides, you can just run the following:

py -3 btcscan -i <path_to_RAM_dump>

For example:

py -3 btcscan -i c:	emp201811.mem

The output will be the same as from a disk, but of course, it will run much more quickly against the smaller data set.

Alternatively, you can simply use Agent Ransack to either search the memory dump for the regular expression [13][1-9A-HJ-NP-Za-km-z]{26,33}< that you used previously or just search for the name"1 string.

Working on a Live Computer

Most police first-responders now accept that if a computer is running when they enter the premises, it is best evidence to, at the very least, acquire the memory. However, there may be circumstances where you would want to extract more data from the live computer before it was imaged or powered down—for example, if the drive is encrypted and battery power is limited with no obvious power source or you do not have the means at your disposal to image the drive while the computer is live. It may be worth considering seizing cryptocurrency assets from the live computer if at all possible, because a third party may also have a copy of the private keys of the suspect. If you wait until you are back at the lab, the assets may already have been moved by the other person. (This process will be discussed in Chapter 14, “Seizing Coins.”)

Should you wish to gather evidence on a live running computer, bear the following in mind:

  • It is vital to document the date and time you start work on the computer, noting both the computer's time and the actual time on your watch, phone, or other means.

    A few years ago, a police search team entered a location just as the suspect was copying illegal images of children from an SD card onto his hard drive. The suspect was detained, and the investigator sat down to image the memory. Although this was the right thing to do, he failed to notice that the system time was off by 1 hour. If you simply correlated the times in the police notebooks with the times of the activity on the computer, it appeared that the police entered the premises and then they proceeded to copy illegal images onto the computer. This does not look good in court!

  • Limit the changes made to the computer, and know what changes are made when you insert a USB key or run a particular tool.
  • Document what you did with the times and likely changes made.

One thing you might be looking for on a live computer is whether any cryptocurrency tools were installed or running. If so, it would be good to extract the wallet file. Let's consider a few ways of achieving that.

Acquiring the Wallet File

Many first-responder toolkits can be adjusted to acquire specific data types or filenames; however, this can also be achieved successfully with a simple batch file. My favorite text tool is Notepad++, which you may have installed back in Chapter 2. Let's use it to write a very simple script to find and copy out any wallet.dat file that it can find on the system. This works best from an external drive, so I suggest that you find a USB key, portable hard drive, or something similar to run the batch file from. Then follow these steps:

  1. Open Notepad++ and type the following into a document: 
    xcopy "%systemdrive%walle*.dat" /s
  2. Save the document as walletfind.bat onto your USB drive.
  3. Browse to the batch file and run it.

    The xcopy command has been around for many years and can be found on virtually all versions of Windows. The command will search the entire system drive (which is usually c:) and look for anything with a filename pattern walle*.dat, and the /s parameter will search all subdirectories. Any results will be written back to your USB key in the folder structure that it found on the disk.

    As you can see in Figure 8-17, I ran the command straight from a command shell. It recovered two wallet.dat files, which it wrote to the root of where I ran the command from. In the case of the batch file saved to the USB key, this will save the results straight to the key.

Snapshot illustration for finding and extracting the wallet file.

Figure 8-17: Finding and extracting the wallet file.

It can also be useful to know if any cryptocurrency programs are installed on the computer. For this, I use a tool that is built into Windows 7, 8, and 10. The easiest way to run the command is to add it to the walletfind.bat script that you have just written. Follow these steps:

  1. Add this line to your script: 
    WMIC product get name, version > installedapps.txt
  2. Save the batch file to your USB key and run it.

    This will create a text file called installedapps.txt. If you open the text file, you will see a large list of installed applications (see Figure 8-18).

    Snapshot illustration of the subset of the many applications found.

    Figure 8-18: Subset of the many applications found.

    The problem here is that the WMIC command only lists installed applications and would miss any programs that ran from an executable file without installing. For this reason, it can be a good idea to add a second xcopy line to the batch file that will copy all the executable files on the system to your USB key. This will be a lengthy list, but at least you won't miss anything. Just add the following line to your walletfind.bat batch file:

    xcopy "%systemdrive%*.exe" /s

This works well and gives you a fairly quick way of ascertaining what is installed on the system without poking around Windows Explorer windows and changing all the Last Accessed Dates, which is not a good thing when working on a suspect's system! With the extracted lists of all installed applications and executable files on your USB key, you can browse the list for known cryptocurrency wallet applications.

Exporting Data from the Bitcoin Daemon

Copying a wallet from an operating system can have problems. For example, if the wallet.dat file was being written to when you copy it, there is always the chance of corruption. In fact, I have had this happen. The original file was not corrupted, but the version copied to my USB key was. Windows should handle this, but you never know.

Another way of extracting data from a cryptocurrency program such as Bitcoin Core is to run commands from its console interface. If you want to try this, you will need to have Bitcoin Core installed, which was detailed back in Chapter 1, “What Is a Cryptocurrency?”

To use this data-extraction method on a system with Bitcoin Core installed, follow these steps:

  1. Open a command shell and change to the following folder: 
    C: C:Program FilesBitcoindaemon
  2. Type the following line in the command shell: 
    bitcoind
    It is likely that Windows will pop up a Security Alert window. If that happens, click the Allow Access button.
  3. Minimize (do not close) the command shell.
  4. Open a second command shell and browse to: 
    C: C:Program FilesBitcoindaemon
  5. To cleanly dump the wallet from Bitcoin Core, run the following command from this second command shell: 
    bitcoin-cli backupwallet <pathtoUSB>
    For example: 
    bitcoin-cli backupwallet e:
    This will dump the wallet file out to your USB key as illustrated in Figure 8-19.

Snapshot illustration for using Bitcoin Core to back up a wallet.

Figure 8-19: Using Bitcoin Core to back up a wallet.

There are some other very useful commands that you can run while the computer is live to obtain information that will be extremely difficult to get once the drive is imaged and you are searching via a digital forensics tool. For example, you can run the following command:

bitcoin-cli walletinfo

This command will write out some very useful information about the wallet including the current balance, the unconfirmed balance (transactions not yet confirmed), and the number of transactions the wallet has done (see Figure 8-20).

Snapshot illustration of the output from the walletinfo command.

Figure 8-20: Output from the walletinfo command.

It is possible to output this information to a text file by adding > and an output path. For example:

bitcoin-cli walletinfo > walletinfo.txt

You may wish to extract information on the network usage. The following command will provide information on the number of bytes sent and received (see Figure 8-21):

bitcoin-cli getnettotals
Snapshot illustration of the output from getnettotals.

Figure 8-21: Output from getnettotals.

You can also use the following command to get information on the type of signaling that is being used to send and receive data (see Figure 8-22):

bitcoin-cli getnetworkinfo
Snapshot illustration of the output of getnetworkinfo.

Figure 8-22: Output of getnetworkinfo.

You can use this command to find out whether the Bitcoin Core client is configured to use the TOR Onion network.

Try using the following command to see information on the peers that the Bitcoin Core node is currently connected to (see Figure 8-23):

bitcoin-cli getpeerinfo
Snapshot illustration of the output of getpeerinfo.

Figure 8-23: Output of getpeerinfo.

This command will enable you to see the IP address of the peer as well as data such as the time offset from UTC, the amount of data sent, and received and the ping time.

The following daemon command is one of my favorites because it lists all the transactions that the node has done (see Figure 8-24):

bitcoin-cli listtransactions
Snapshot illustration of the output of listtransactions.

Figure 8-24: Output of listtransactions.

This shows all the addresses that the suspect has transacted with, which is vital information for an investigator. You can also see the local addresses the suspect has used, so you'll have a huge head start in tracking payments. This can be a large list, so I recommend that you always use > after the command to output the results to a text file.

You can also see all the unspent transactions by running the following command:

bitcoin-cli list unspent

The commands I've introduced to you in this section are invaluable to extract actionable data from Bitcoin Core. However, they are quite complex to remember, so I suggest that you write them into a batch script by following these steps:

  1. Open a new Notepad++ document and type the following: 
    cd "%systemdrive%program filesitcoindaemon"
bitcoind –d
  2. Save this document to your hard drive with the name start_server.bat.
  3. Open a new Notepad++ document and type the following: 
    cd "%systemdrive%program filesitcoindaemon"
bitcoin-cli getwalletinfo > c:	empwalletinfo.txt
bitcoin-cli getnettotals > c:	emp
ettotals.txt
bitcoin-cli getnetworkinfo > c:	emp
etworkinfo.txt
bitcoin-cli getpeerinfo > c:	emppeerinfo.txt
bitcoin-cli listtransactions "*" 1000 > c:	emp	ransactions.txt
bitcoin-cli listunspent > c:	empunspent.txt
  4. Save this file to your hard drive as getdata.bat.
  5. Create a folder at c: emp for the results.
  6. Browse to your USB key and first double-click the start_server.bat file and then double-click the getdata.bat file.

    Your USB key should now contain a list of files with significant data from the Bitcoin Core node. This is an excellent way of quickly gathering data that is invaluable to an investigator but will be difficult to extract later from a disk image.

Extracting Wallet Data from Live Linux and OSX Systems

I won't spend significant time detailing the methods you can use to search for and extract data from Linux and OSX systems, because they are very similar to Windows. For example, all of the bitcoin-cli commands in Bitcoin Core work exactly the same in Linux as they do in Windows. When you install Bitcoin Core for Linux, the daemon is also installed into the system path. This means that you can simply open a terminal and type the following command to start the server:

bitcoind -daemon

Another terminal will then allow you to run all the cli commands. These commands are the same as in Windows, including getnetworkinfo, getnettotals, and gettransactions.

By default, Bitcoin is installed on Linux here:

˜/.bitcoin/

And it is installed on OSX here:

˜Library/Application Support/Bitcoin

There is also an easy way to search for the wallet file in both Linux and OSX. You can use this method to find the wallet file as well as to copy it out of the OS to a connected drive. The command is simply:

find / -name wallet.dat

To copy the file out, you either need to know the path to your connected USB device or have a shell script, similar to a batch file, on the key that you run. The command looks like this:

find / -name wallet.dat -exec cp {} <path_to_USB> ;

It may be that you have to run the command as an Administrator user to have success. In that case, you'll need to prefix the command with sudo and provide the associated password.

Although I will not cover writing shell scripts in any detail, they are very similar to the batch scripts. One difference is that you must start the script with the path to a terminal such as the following:

#!/bin/sh

And you exit your script with something like this:

exit 0

So, for example, you can run the bitcoin-cli commands in Linux as follows:

  1. Open a text editor in your Linux operating system and type the following: 
    #!/bin/sh
bitcoin-cli getwalletinfo > walletinfo.txt
bitcoin-cli getnettotals > nettotals.txt
bitcoin-cli getnetworkinfo > networkinfo.txt
bitcoin-cli getpeerinfo > peerinfo.txt
bitcoin-cli listtransactions * 1000 > transactions.txt
bitcoin-cli listunspent > unspent.txt
exit 0
  2. Save the file as bitcoin-cli.sh.
  3. This next step needs to be done with the file on a Linux OS because you need to make the file executable. This is straightforward—you just need to open a terminal in the same folder as your .sh file and type the following: 
    chmod +x bitcoin-cli.sh
  4. Copy the .sh file to a USB key, plug it into a Linux system that has Bitcoin Core installed on it, and double-click the shell script you created. This will run the commands and write the output to the USB key just as it does in Windows.

Summary

In this chapter, you have learned how to find and then acquire cryptocurrency keys in a variety of situations. You have considered how to approach premises searches, what to look for, how to find known addresses online, and how to search for addresses in downloaded websites. You also looked at how to find addresses on acquired hard drives and computer memory as well as how you can work on a live running computer and find and extract addresses in that environment.

I have not spent time considering the legal obligations that may exist in your country pertaining to working on live computers or imaging systems. Please research the legal ramifications of anything you do while acquiring data to ensure that your methodology does not put the case, or you, at risk.

Also, the ideas suggested in this chapter are in no way the final word on the subject. Other concepts, tools, and processes certainly exist, but I believe that the ones I presented are fairly simple to implement and will work effectively.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
3.137.164.24