Remotely accessing a computer, is it any safer than using the computer itself? Can it be?

[iamgenius]

Hi folks.

I'm no expert when it comes to networking, and I have a question that I have been wandering about for some time. For forensics applications, it is usually recommended that you don't use a PC that is not yours or is not a forensic workstation to extract evidences or acquire images. You never know what is in this PC, and you never know what's installed and what could happen. You should only use a PC you trust 100% for things like this. Otherwise, the evidence will not be reliable. The unknown PC might also contain some malware or spyware or other nasty infections which can hinder the acquisition.

Say for example, a suspect who probably has been doing some criminal activities, connected his smartphone to his PC. As it is currently the norm, the smartphone will most probably carry so many evidences against the criminal. The crime scene was reached and the phone was found connected to the PC. Proper forensics procedures aside, say I want to image or acquire a physical image of the phone on site. Now, I can do that from the machine it is physically connected to. But, like I explained above, that is not recommended or useless let's say.

My question is: Does it make any sense to you (networking gurus ^_^) to access the phone remotely from another machine that is networked to the suspect's machine and acquire the image? SSH? Hack into it using Kali Linux using metasploit maybe? Is there a case where something like this would be advisable ? I know I know: One would say why don't you just disconnect it and connect it to the machine of your preference? Well, I don't want to do that because it will wipe out all data. It is an anti-foresics technique I'm trying to fight.

Two questions here: the other machine can see the external storage only of the phone, right? And that is only if it is shared across the network, right? If it is not shared, how can one do it? There must be a trick out there...
This would also mean that only a logical acquisition is possible. There is no way to access files in the internal storage of the phone like system, data, or user files. So, is there a way to get a full physical image??

To make a network of course, I can just hook my trusted PC or laptop to the suspect's machine with a crossover cable.

Logical? Or simply very stupid? One might say why go the other way around when you have a machine that is already physically connected to your evidence? I don't really know, that's why I'm asking! This has to do with network protocols. So, can it be any safer in some scenarios?

I appreciate and is thankful to all comments and recommendations. This has been bugging me for some time now.

 

[[DHT]Osiris]

Not 100% sure what you're asking here, but it sounds like you're curious as to whether it's safe to do forensics on a suspected compromised system? That shouldn't be your 'forensics box' under any circumstances, and remoting in doesn't really change that. I mean, with a phone plugged in, i suppose it could just be treated as externals storage, which would just be accessible from the local machine. You wouldn't get a capture of it with an OS image though if you were going that route, you'd have to do it separately (which would naturally require installing/running something on the compromised system, if you weren't willing to disconnect the phone).

For what it's worth, external storage is perfectly accessible from a remote session as you're remote connecting to the OS (which can see the local storage fine). There may be methods of obtaining an image of a locally connected storage from a remote system, which would require you connecting your forensics box to the machine (via direct connection or a switch/hub, as you mentioned) which you may be doing anyhow.

 

[iamgenius]

Not 100% sure what you're asking here, but it sounds like you're curious as to whether it's safe to do forensics on a suspected compromised system? That shouldn't be your 'forensics box' under any circumstances, and remoting in doesn't really change that. I mean, with a phone plugged in, i suppose it could just be treated as externals storage, which would just be accessible from the local machine. You wouldn't get a capture of it with an OS image though if you were going that route, you'd have to do it separately (which would naturally require installing/running something on the compromised system, if you weren't willing to disconnect the phone).

For what it's worth, external storage is perfectly accessible from a remote session as you're remote connecting to the OS (which can see the local storage fine). There may be methods of obtaining an image of a locally connected storage from a remote system, which would require you connecting your forensics box to the machine (via direct connection or a switch/hub, as you mentioned) which you may be doing anyhow.

Yes, you understood what I want. I have been discussing the physical acquisition bit heavily with some folks at work today. It is not possible, that's the conclusion I got.

>>There may be methods of obtaining an image of a locally connected storage from a remote system, which would require you connecting your forensics box to the machine (via direct connection or a switch/hub, as you mentioned) which you may be doing anyhow.

This is one thing I'm looking for. If there are ways, what are they? But, based on today's discussion, it is not possible. In order to acquire a full image, you need to be in the host machine. The tool doing the acquisition need to have the device connected directly to the machine it is installed on.

As for the original question of this post, I understand. I expected that. It is just stupid. Remoting in doesn't really change anything.

So I guess my method fails.

But, if we go back to the original problem I'm dealing with: To counter the smartphone ability to wipe itself after being disconnected that is. What would one do? After all my research, this proofed to be very effective and very hard to fight? To put it in different words, how do I acquire a physical image in a case like this?????????

-Use the suspect machine? Not recommended !

-Connect the smartphone to another machine? This will wipe everything !

I think it is just best to acquire a physical image using the suspect machine and live with that . But, what do you do if the machine is locked with a strong password? You are doomed I think. Rebooting the machine will be like disconnecting the phone I think...


Any body?

 

[JackMDS]

The issue is Not weather the Questionable computer is doing what you call criminal activities but rather if the computer is infested with spreading "Junk" (or not).

If the computer is Infested then it can effect remote control as well.

In other words. if (as an example) what you call criminal activity is surfing Pr0n sites that (most of the time) infect computers with Malware, then Remotely connect to such computer might not be "smart".

 

[iamgenius]

The issue is Not weather the Questionable computer is doing what you call criminal activities but rather if the computer is infested with spreading "Junk" (or not).

If the computer is Infested then it can effect remote control as well.

In other words. if (as an example) what you call criminal activity is surfing Pr0n sites that (most of the time) infect computers with Malware, then Remotely connect to such computer might not be "smart".

Got it Jack. Thanks.