CSF 3403 - WK3

Play an AI-generated podcast conversation about this lesson

What is the role of a digital forensics investigator?

gather evidence
conduct investigation by processing digital evidence
preserve evidence on a different computer
prove a suspect has committed a crime/violated company policy
summarize findings in a report
present findings when required (to the prosecutor, in a court, to a company executive...)

What is a "Chain of Custody"?

Route the evidence takes from the time you find it until the case is closed or goes to court

What happens if you don’t know (or cannot establish) who took a suspect hard disk from the crime scene to the lab?

the chain of custody is broken
the disk may have been tampered with
the evidence's integrity is compromised

What does the information contained by computers help law enforcement determine?

<ul> <li>Chain of events leading to a crime</li> <li>Evidence that can lead to a conviction</li> </ul> Signup and view all the answers

Digital evidence can be _ _____ by an overeager investigator

easily altered Signup and view all the answers

Law enforcement officers should _____ when acquiring the evidence

follow proper procedure Signup and view all the answers

information on hard disks might be password protected so _____ _ may need to be used in your investigation

forensics tools Signup and view all the answers

What are some examples of employee misuse of company resources?

<ul> <li>Surfing the Internet</li> <li>Sending personal e-mails</li> <li>Using company computers for personal tasks during work hours</li> </ul> Signup and view all the answers

What are the steps to taking a systematic approach to problem solving?

<ul> <li>Make an initial assessment about the type of case you are investigating</li> <li>Determine a preliminary design or approach to the case</li> <li>Create a detailed checklist</li> <li>Determine the resources you need</li> <li>Obtain and copy an evidence drive</li> <li>Identify the risks</li> <li>Mitigate or minimize the risks</li> <li>Test the design</li> <li>Analyze and recover the digital evidence</li> <li>Investigate the data you recover</li> <li>Complete the case report</li> <li>Critique the case</li> </ul> Signup and view all the answers

How can you determine the case requirements?

by systematically outlining the case details: <ul> <li>Situation</li> <li>Nature of the case</li> <li>Specifics of the case</li> <li>Type of evidence</li> <li>Known disk format</li> <li>Location of evidence</li> </ul> Signup and view all the answers

What activities should a basic investigation plan include?

<ul> <li>Acquiring the evidence</li> <li>Completing an evidence form and establishing a chain of custody</li> <li>Transporting the evidence to a computer forensics lab</li> <li>Securing evidence in an approved secure container</li> <li>Preparing your forensics workstation</li> <li>Retrieving the evidence from the secure container</li> <li>Making a forensic copy of the evidence</li> <li>Returning the evidence to the secure container</li> <li>Processing the copied evidence with computer forensics tools</li> </ul> Signup and view all the answers

What is the purpose of an evidence of custody/chain-of-evidence form?

it helps you document what has been done with the original evidence and its forensics copies Signup and view all the answers

What are the two types of evidence of custody forms?

<ul> <li>single evidence form (Lists each piece of evidence on a separate page)</li> <li>multi-evidence form</li> </ul> Signup and view all the answers

Why is documenting evidence during a forensics analysis very important?

a broken chain of custody can throw out your case Signup and view all the answers

What is the multi-evidence form good for and what does it contain?

<ul> <li>good for max. 10 items</li> <li>has the name of the investigator who recovered the evidence</li> <li>specifies the locker used</li> <li>lists which investigators retrieved the evidence from the locker to process it</li> <li>lists what has been done with the evidence</li> </ul> Signup and view all the answers

Describe a single-evidence form.

<ul> <li>has more flexibility in tracking separate pieces of evidence for your chain-of-custody log</li> <li>has more space for descriptions to help finalize the investigation and create a case report</li> <li>allows one to accurately account for what was done to the evidence and what was found</li> <li>can be used as a reference for all actions taken during the investigative analysis</li> </ul> Signup and view all the answers

How can you secure your evidence?

<ul> <li>Use evidence bags to secure and catalog the evidence</li> <li>Use computer safe products when collecting computer evidence( antistatic bags and pads)</li> <li>Use well padded containers</li> <li>Use evidence tape to seal all openings (CD drive bays, insertion slots for power supply electrical cords and USB cables)</li> <li>Write your initials on tape to prove that evidence has not been tampered with</li> <li>Consider computer specific temperature and humidity ranges (Make sure you have a safe environment for transporting and storing it until a secure evidence container is available)</li> </ul> Signup and view all the answers

When dealing with private-sector high-tech investigations procedures, what should you develop?

formal procedures and informal checklists to cover all issues important to high-tech investigations, Such as: <ul> <li>employee termination cases</li> <li>internet abuse cases</li> <li>email abuse cases</li> <li>Attorney-Client Privilege Investigations</li> <li>Industrial espionage Cases</li> </ul> Signup and view all the answers

What do the majority of investigative work for termination cases involve?

employee abuse of corporate assets Signup and view all the answers

What are the predominant types of employee termination cases investigated?

Incidents that create a hostile work environment (viewing porn in the workplace, sending inappropriate emails). Signup and view all the answers

What do you need to prepare to conduct an internet abuse investigation?

<ul> <li>Organization’s Internet proxy server logs</li> <li>Suspect computer’s IP address</li> <li>Suspect computer’s disk drive</li> <li>Your preferred computer forensics analysis tool</li> </ul> Signup and view all the answers

What steps outline outline the recommended processing of an Internet abuse case?

<ul> <li>Use the standard forensic analysis techniques and procedures</li> <li>Use tools for Internet keyword search option to extract all Web page URL information</li> <li>Contact the network firewall administrator and request a proxy server log</li> <li>Compare the data recovered from forensic analysis to the proxy server log data to confirm that they match</li> <li>Continue analyzing the computer’s disk drive data</li> </ul> Signup and view all the answers

Step 4 of processing an internet abuse case: Compare the data recovered from forensic analysis to the proxy server log data to confirm that they match. What should you do if the URL data matches the proxy server log and the forensic disk examination?

continue analyzing the suspect computer’s drive data, and collect any relevant downloaded inappropriate pictures or Web pages that support the allegation. Signup and view all the answers

Step 4 of processing an internet abuse case: Compare the data recovered from forensic analysis to the proxy server log data to confirm that they match. What should you do if there are no matches between the proxy server logs, and the forensic examination shows no contributing evidence?

report that the allegation is unsubstantiated Signup and view all the answers

What do you need to prepare to conduct an email abuse investigation?

<ul> <li>An electronic copy of the offending e-mail that contains message header data</li> <li>If available, e-mail server log records</li> <li>For e-mail systems that store users’ messages on a central server, access to the server</li> <li>Access to the computer so that you can perform a forensic analysis on it</li> <li>Your preferred computer forensics analysis tool</li> </ul> Signup and view all the answers

What steps outline the recommended processing of an E-mail abuse case?

<ul> <li>For computer-based e-mail data files: use the standard forensic analysis techniques and procedures</li> <li>For server-based e-mail data files: contact the e-mail server administrator and obtain an electronic copy of the suspect and victim’s e-mail folder or data.</li> <li>For Web-based e-mail investigations: such as Hotmail or Gmail, use tools such as Forensic Toolkit’s Internet keyword search option to extract all related e-mail address information.</li> <li>Examine header data of all messages of interest to the investigation.</li> </ul> Signup and view all the answers

What things may lead to a media leak?

<ul> <li>disgruntled employees sending an organization's sensitive data to a news reporter</li> <li>employees attempting to embarrass management to a rival conducting a power struggle between other internal organizations</li> <li>premature release of information about new products, which can disrupt operations and cause market share loss for a business if the information is made public too soon</li> </ul> Signup and view all the answers

What do you need to consider to conduct a media leak investigation?

<ul> <li>Examine e-mail</li> <li>Examine Internet message boards</li> <li>Examine proxy server logs</li> <li>Examine known suspects’ workstations</li> <li>Examine all company telephone records</li> </ul> Signup and view all the answers

What steps outline the recommended processing of Media Leaks?

<ol> <li>Interview management privately to get a list of employees who have direct knowledge of the sensitive data.</li> <li>Identify the media source that published the information.</li> <li>Review company phone records to see who might have had contact with the news service.</li> <li>Obtain a list of keywords related to the media leak.</li> <li>Perform keyword searches on proxy and e-mail servers.</li> <li>Discreetly conduct forensic disk acquisitions and analysis of employees of interest.</li> <li>From the forensic disk examinations, analyze all e-mail correspondence and trace any sensitive messages to other people who haven't been listed as having direct knowledge of the sensitive data.</li> <li>Expand the discreet forensic disk acquisition and analysis for any new persons of interest.</li> <li>Consolidate and review your findings periodically to see whether new clues can be discovered.</li> <li>Report findings to management routinely, and discuss how much further to continue</li> </ol> Signup and view all the answers

All suspected industrial espionage cases should be treated as ______

criminal investigations Signup and view all the answers

What kind of staff do you need to conduct industrial espionage investigations?

<ul> <li>Digital investigator who is responsible for disk forensic examinations</li> <li>Technology specialist who is knowledgeable of the suspected compromised technical data</li> <li>Network specialist who can perform log analysis and set up network sniffers</li> <li>Threat assessment specialist (typically an attorney)</li> </ul> Signup and view all the answers

What guidelines should you follow when initiating industrial espionage cases?

<ul> <li>Determine whether this investigation involves a possible industrial espionage incident</li> <li>Consult with corporate attorneys and upper management</li> <li>Determine what information is needed to substantiate the allegation</li> <li>Generate a list of keywords for disk forensics and sniffer monitoring</li> <li>List and collect resources for the investigation</li> <li>Determine goal and scope of the investigation</li> <li>Initiate investigation after approval from management</li> </ul> Signup and view all the answers

What steps outline the recommended processing of an industrial espionage case?

<ul> <li>Gather all personnel assigned to the investigation and brief them on the plan and any concerns.</li> <li>Gather the resources needed to conduct the investigation.</li> <li>Start the investigation by placing surveillance systems, such as cameras and network monitors, at key locations</li> <li>Discreetly gather any additional evidence, such as the suspect's computer drive, and make a bit-stream image for follow-up examination</li> <li>Collect all log data from networks and e-mail servers, and examine them for unique items that might relate to the investigation</li> <li>Report regularly to management and corporate attorneys on your investigation's status and current findings</li> <li>Review the investigation's scope with management and corporate attorneys to deter mine whether it needs to be expanded and more resources added</li> </ul> Signup and view all the answers

What is the difference between an interview and an interrogation?

An interview is usually conducted to collect information from a witness or suspect, while an interrogation is the process of trying to get a suspect to confess. Signup and view all the answers

What is the role of a digital investigator in an interview?

to instruct the investigator conducting the interview on what questions to ask and what the answers should be. Signup and view all the answers

What are the ingredients to a successful interview or interrogation?

<ul> <li>Being patient throughout the session</li> <li>Repeating or rephrasing questions to zero in on specific facts from a reluctant witness or suspect</li> <li>Being tenacious</li> </ul> Signup and view all the answers