CHFI: Computer Forensics

Computer Hacking Forensic Investigator (CHFI)

• CHFI is a book by EC-Council

Table of Contents

• Outlines various modules for the CHFI certification
• Module 01: Computer Forensics Fundamentals
• Module 02: Computer Forensics Investigation Process
• Module 03: Understanding Hard Disks and File Systems
• Module 04: Data Acquisition and Duplication
• Module 05: Defeating Anti-forensics Techniques
• Module 06: Windows Forensics
• Module 07: Linux and Mac Forensics
• Module 08: Network Forensics
• Module 09: Investigating Web Attacks
• Module 10: Dark Web Forensics
• Module 11: Database Forensics
• Module 12: Cloud Forensics
• Module 13: Investigating Email Crimes
• Module 14: Malware Forensics
• Module 15: Mobile Forensics
• Module 16: IoT Forensics

Understanding Computer Forensics

• A part of digital forensics focusing on crimes involving computing devices like networks, computers, and digital storage media
• Involves methodological procedures and techniques
• Identifies, gathers, preserves, extracts, interprets, documents, and presents evidence
• Ensures evidence is admissible in legal or administrative proceedings

Need for Computer Forensics

• Ensures the integrity and existence of an organization's computer system and network infrastructure
• Captures important information when computer systems or networks are compromised
• Helps prosecute cybercrime perpetrators
• Extracts, processes, and interprets evidence to prove attacker actions and guilt or innocence
• Efficiently tracks perpetrators/terrorists globally, using IP addresses to pinpoint locations of terrorists
• Saves money and time, as managers allocate significant IT budgets to computer and network security
• Tracks complex cases, including email spamming and other nefarious activities

Why and When To Use Computer Forensics

• Computer forensics should be used to prepare for incidents, ensuring integrity and continuity of network infrastructure
• Helps identify and gather cybercrime evidence for a forensically sound manner
• Aids in protecting data resources and ensuring regulatory compliance
• Protects organizations from similar incidents in the future
• Used to counteract online crimes like abuse, bullying, and reputation damage
• Minimizes intangible and tangible losses organizations or individuals endure
• Supports cybercrime prosecution
• Used to prepare for incidents by strengthening defense mechanisms and closing security loopholes
• Provides knowledge of cyber law regulations for compliance
• Used to report cybersecurity breaches, identify incident response actions, and address copyright/intellectual property theft
• Settles disputes among employees or between employers and employees
• Estimates and minimizes damage to resources in a corporate setting
• Sets security parameters and formulates security norms for forensic readiness

Understand Cybercrimes and Investigation Procedures

• Cybercrime is any illegal act involving computing systems, applications, or networks, generally intentional
• Cybercrime types includes:
• Internal/Insider attacks originate from within an organization
  • Attacks may be from disgruntled, current or terminated employees, business associates, contractors, and undertrained staff
• External attacks originate from outside sources
  • Frequently occurs when proper information security policies and procedures are absent or inadequate

Examples of Cybercrimes

• Espionage
• Theft of Intellectual Property
• Manipulation of Data
• Trojan Horse Attack
• Structured Query Language Attack
• Brute-force Attack
• Phishing/Spoofing
• Privilege Escalation Attacks
• Denial of Service Attack
• Cyber Defamation
• Cyberterrorism
• Cyberwarfare

Impact of Cybercrimes at the Organizational Level

• Loss of confidentiality, integrity, and availability of stored information in an organization's systems
• Theft of sensitive data causing compromise
• Disruption of business activities stopping operations
• Loss of trust from customers and stakeholders impacting business confidence
• Reputational damage
• Huge financial losses
• Penalties for failure to comply with regulations

Cybercrime Investigation

• Study the crime's impact and details to identify the source, perpetrators, and their guilt
• Involves meticulous collection of clues and forensic evidence
• Analysis of evidence, reconstruction of incident, and presentation of evidence admissible in court
• Approaches to manage cybercrime investigation include civil, criminal, and administrative

Civil vs. Criminal Investigation

• Civil cases involve disputes between two parties and lawsuits with verdicts, generally resulting in monetary damages
• Criminal cases involve crimes considered harmful to society
• Law enforcement agencies take action against a company, individual, or group
• Results in monetary damages, imprisonment, or both

Administrative Investigation

• Internal investigation by a company to see if employees, clients, and partners comply with policy
• Organizations often limit these investigations to staff, though they can include partners, corporations, and individuals linked to the organization

Understand Digital Evidence

• Probative information stored on/transmitted through an electronic device
• Must be acquired and examined in a forensically sound manner
• Digital evidence is defined as "any information of probative value that is either stored or transmitted in a digital form"
• Information is from digital storage media, monitoring network traffic, or making duplicate copies of digital data during a forensics investigation

Types of Digital Evidence

• Volatile data refers to temporary information on a digital device needing constant power which is deleted if the power is interrupted
• Volatile data includes system time, logged-on user(s), open files, network information, process information, process-to-port mapping, process memory, clipboard contents, service/driver information, command history, etc
• Non-volatile data refers to permanent data stored on secondary storage devices
• Examples include hidden files, slack space, swap file, index.dat files, unallocated clusters, unused partitions, hidden partitions, registry settings, and event logs

Rules of Digital Evidence

• Examples of cases where digital evidence may help the forensic investigator include:
• Identity theft
• Malicious attacks on the computer systems themselves
• Information leakage
• Unauthorized transmission of information
• Theft of commercial secrets
• Internet use/abuse
• Production of false documents and accounts
• Unauthorized encryption/password protection of documents
• Abuse of systems
• Email communication between suspects/conspirators

Sources of Potential Evidence

• User-Created Files
• Address books
• Database files
• Media files
• Documents
• Internet bookmarks, favorites, etc
• User-Protected Files
• Compressed files
• Password-protected files
• Misnamed files
• Hidden files
• Encrypted files
• Steganography
• Computer-Created Files
• Backup files
• Swap files
• Log files
• System files
• Configuration files
• History files
• Printer spool files
• Temporary files
• Cookies

Rules of Evidence

• Before a legal proceeding, the evidence to be presented must comply to five basic rules:
• Understandable: Evidence must be presented clearly
• Admissible: Evidence must be presented in an admissible form
• Authentic: Authenticity should be clear, with supporting documents authenticating the evidence with detail such as source and relevance
• Reliable: Forensic investigators should extract and handle the evidence carefully
• Complete: Completeness of evidence with the aim to prove or disprove claims
• Best evidence rule
• Requires original evidential documentation - copies are not permitted

Federal Rules of Evidence (US)

• Rule 105: Limited Admissibility
• Rule 801: Hearsay Rule
• Rule 801: Statements That Are Not Hearsay
• Rule 803: Hearsay Exceptions - Availability of Declarant Immaterial
• Rule 804: Hearsay Exceptions; Declarant Unavailable
• Rule 1002: Requirement of Original
• To prove the content of a writing, recording, or photograph, the original writing, recording, or photograph is required, except as otherwise provided in these rules or by Act of Congress
• Rule 1003: Admissibility of Duplicates
• Rule 1004: Admissibility of Other Evidence of Contents

Scientific Working Group on Digital Evidence (SWGDE)

• https://www.swgde.org/
• Law enforcement and forensics organizations must have an effective quality system

The Association of Chief Police Officers (ACPO) Principles of Digital Evidence

• Principle 1: No data should be changed by agencies or their agents
• Principle 2: Access to original data requires competence to explain the implications of actions
• Principle 3: An audit trail should be created and preserved
• Principle 4: The investigator in charge is responsible for ensuring that law and these principles are followed

Forensic Readiness

• An organization's ability to use digital evidence in a limited time with minimal investigation costs
• Involves technical and non-technical actions for maximizing competence in using digital evidence

Forensic Readiness Planning

• A set of processes to follow to acheive readiness
• Includes the following activities
• Identifying/determining potential evidence required for an incident by defining the purpose of evidence collection and to gather information
• Determining evidence sources of potential evidence
• Defining a policy that allows you to legally extract electronic evidence with minimal disruption
• Establishing a policy of securely handling and storing collected evidence for future retreival
• Identifying if the incident requires a fill of formal investigation
• Creating a documented process
• Establishing a legal advisory board to guide the investigation
• Keeping an incident response team ready

Role of SOC in Computer Forensics

• Security operations are handled and managed with the help of the Security Operations Center (SOC)
• SOC is a centralized unit that continuously monitors, manages, and analyzes ongoing activities on information systems
• Goal is to maintain functionality of an organization by determining, preventing, detecting, and responding to intrusion events
• Referred to as Security Defense Center (SDC), Security Analytics Center (SAC), Cyber Security Center (NSOC), Threat Defense Center, and Security Intelligence and Operations Center (SIOC)

SOC Workflow

• Includes the following activities
• Security logs collected and forwarded to Security Information and Event Management (SIEM)
• SIEM ingests log data, threat information, indicators of compromise, and asset inventory for machine-based correlation and find out activity detection
• SOC analysts identify indicators of compromise, triage alerts, and validate incidents
• Incidents are submitted to the incident response teams through a ticketing system
• The SOC team reviews incidents and conducts response activities, including detailed forensics
• Incidents are documented for business audit purposes

Need for a Forensic Investigator

• Forensic investigators use their skills and experience to find cybercrime perpetrators
• If technically inexperienced people examine evidence, it may become inadmissible in a court of law
• Investigators help with organization and maintaing readiness, and incident response

Roles and Responsibilities of a Forensics Investigator

• Evaluates the damages of a security breach
• Identifies and recovers data required for investigation
• Extracts evidence forensically
• Ensures appropriate handling of evidence
• Is a guide to the investigation team
• Creates reports and documents for presenting in a court of law
• Reconstructs damaged storage devices and uncovers hidden information
• Updates the organization about various methods of attack and data recovery techniques
• Represents issues in a court of law to attempt to win the case by testifying

What Makes a Good Computer Forensics Investigator?

• Interviewing skills to extract information
• Researching skills relating to client, victim, witnesses and suspects
• Maintains Accuracy
• Patience to work long hours
• Excellent writing skills
• Analytical skills
• Communication skills
• Updates with new tech
• Knowledge of platforms and languages
• Knowledge of technologies, hardware and software
• Network with Professionals

Understand the Challenges Faced in Investigating Cybercrimes

• Computer forensic investigators need to identify, extract, preserve, and document digital evidence
• Presents as difficult tasks
• Cybercrimes face new challenges and issues
• categorized into general, legal, and privacy issues

Understand Legal Compliance in Computer Forensics

• Gramm-Leach-Bliley Act (GLBA)
• Requires financial institutions to explain information-sharing practices and safeguard sensitive data
• Federal Information Security Modernization Act of 2014 (FISMA)
• Amendment to FISM Act of 2002
• Implemented a framework for federal information systems to have more effective information security controls
• Health Insurance Portability and Accountability Act of 1996 (HIPAA)
• Provides federal protections for an indivudally identifiable health information held by covered businesses and offers rights to the patients
• Payment Card Industry Data Security Standard (PCI DSS)
• Proprietary information security standard to protect cardholder data
• Sarbanes-Oxley Act (SOX) of 2002
• Protects investors from accounting fraud