Digital Forensics Principles

Forensic Analysis for Computer Systems - Course Plan

• The course covers forensic analysis for computer systems
• It includes topics on legal informatics and multimedia
• The course plan includes introduction, evolution of computer forensics, computer forensics process, computer forensics techniques and tools, types of computer forensics, and forensics readiness

Computer Forensics Process - Introduction

• Forensic examiners use scientific methods to identify and extract digital evidence
• Examiners generally follow a clear process and use well-defined procedures
• The increasing number of digital activities and diverse devices has made the analysis process more complicated

Computer Forensics Process - Challenges

• Lack of clear and relevant data
• Time required for filtering evidence data sets
• Constant change in network, cloud, and digital media devices data
• Difficulty in predicting false alarms versus detection rate
• Potential manipulation of features/data attributes

General Process of Computer Forensics

• Four steps are involved in computer forensics:
  • Identification (assessing the situation): Analyze investigation scope and actions
  • Collection (acquiring data): Gather, protect, and preserve evidence
  • Examination (analyzing data): Examine and correlate digital evidence with events
  • Reporting (the investigation): Gather and organize information to write a final report

Collection (Acquire the data):

• The investigator either performs a search or receives digital media for analysis
• Documenting the hardware/software characteristics of the device
• If the machine is running, a capture of live memory (RAM) is important for a dump analysis
• Creating copies of persistent memory (especially hard drives) for later analysis (chain of custody)

Collection (Acquire the data) - File Imaging

• Computer use may lead to data loss, so evidence collection must not be delayed
• Accurate bit-by-bit copies of evidence are critical using specialized forensics software or hardware
• A sector-by-sector copy is the preferred forensic method for copying data
• Created files (forensic images) can have various formats (.AFF, .ASB, .E01, .dd, .raw, .mem, .VMDK, .VDI)

Collection (Acquire the data): File Imaging - continued

• Evidence should not be altered during the copying process
• Hardware write protection devices can prevent changes to the evidence hard drive
• Evidence should be physically secured, and sealed for transport to prevent tampering
• Evidence acquisition can involve live box (running computers) or dead box (turned off computers) approaches

Collection (Acquire the data): Live Box

• Collect volatile information from RAM as an image file
• Establish the operating system and use appropriate software
• Avoid trying multiple software tools in live acquisition
• Rely on trustworthy and accepted software to maintain evidence integrity

Collection (Acquire the data): Dead Box

• Copy the hard drive using write-blocker(devices) without turning the device on
• Creating a dead box image using write protection hardware
• Forensic analysts use applications designed specifically for creating forensic images of media

Examination (Analyze the data)

• Examine collected data using standard procedures, techniques, and tools
• Establish a timeline of events from the device (ordered history of OS, applications, disks, etc.)
• Focus on the period of interest to identify initial scenarios from the recovered data
• Explore possible artifacts to either confirm or reject hypotheses
• New scenarios can arise from the initial hypothesis investigation
• Tools need legal justification for court use

Report the Investigation

• The investigator documents the steps taken in the investigation process
• Documenting methodologies and tools used for this process
• Reporting needs to present the findings and support them evidence
• Each step of the process can be further divided into parts, each following its own standard operating procedures
• Present results, including the attack start points, and details of actions taken for prevention measures
• The investigator's reports must comply with all relevant local laws
• Expect cross-examination on report contents in court
• Report writers need to consider audience technical awareness during report writing

Report Edition

• Report writers need to define investigation goals when writing to limit the scope and cost of investigation
• Audience technical knowledge needs consideration in writing reports
• Formal reports and preliminary reports need to be created, depending on conclusion status
• Includes expected questions and answers documentation

Report Structure

• Report structure aligns with common official and scientific report structures
• Must include a title that specifies the case being investigated
• Abstract summaries the examination and results in short paragraphs
• A table of contents is a roadmap that allows easy navigation
• The body of the report is the core section, including introduction and discussion sections
• Includes conclusion, references, glossary, and acknowledgments
• Appendixes provide supplementary but helpful material that does not fully belong in the main body