CSF 3403 - WK3

• gather evidence
• conduct investigation by processing digital evidence
• preserve evidence on a different computer
• prove a suspect has committed a crime/violated company policy
• summarize findings in a report
• present findings when required (to the prosecutor, in a court, to a company executive...)

Route the evidence takes from the time you find it until the case is closed or goes to court

• the chain of custody is broken
• the disk may have been tampered with
• the evidence's integrity is compromised

<ul> <li>Chain of events leading to a crime</li> <li>Evidence that can lead to a conviction</li> </ul> Signup and view all the answers

<p>easily altered</p> Signup and view all the answers

<p>follow proper procedure</p> Signup and view all the answers

<p>forensics tools</p> Signup and view all the answers

<ul> <li>Surfing the Internet</li> <li>Sending personal e-mails</li> <li>Using company computers for personal tasks during work hours</li> </ul> Signup and view all the answers

<ul> <li>Make an initial assessment about the type of case you are investigating</li> <li>Determine a preliminary design or approach to the case</li> <li>Create a detailed checklist</li> <li>Determine the resources you need</li> <li>Obtain and copy an evidence drive</li> <li>Identify the risks</li> <li>Mitigate or minimize the risks</li> <li>Test the design</li> <li>Analyze and recover the digital evidence</li> <li>Investigate the data you recover</li> <li>Complete the case report</li> <li>Critique the case</li> </ul> Signup and view all the answers

<p>by systematically outlining the case details:</p> <ul> <li>Situation</li> <li>Nature of the case</li> <li>Specifics of the case</li> <li>Type of evidence</li> <li>Known disk format</li> <li>Location of evidence</li> </ul> Signup and view all the answers

<ul> <li>Acquiring the evidence</li> <li>Completing an evidence form and establishing a chain of custody</li> <li>Transporting the evidence to a computer forensics lab</li> <li>Securing evidence in an approved secure container</li> <li>Preparing your forensics workstation</li> <li>Retrieving the evidence from the secure container</li> <li>Making a forensic copy of the evidence</li> <li>Returning the evidence to the secure container</li> <li>Processing the copied evidence with computer forensics tools</li> </ul> Signup and view all the answers

<p>it helps you document what has been done with the original evidence and its forensics copies</p> Signup and view all the answers

<ul> <li>single evidence form (Lists each piece of evidence on a separate page)</li> <li>multi-evidence form</li> </ul> Signup and view all the answers

<p>a broken chain of custody can throw out your case</p> Signup and view all the answers

<ul> <li>good for max. 10 items</li> <li>has the name of the investigator who recovered the evidence</li> <li>specifies the locker used</li> <li>lists which investigators retrieved the evidence from the locker to process it</li> <li>lists what has been done with the evidence</li> </ul> Signup and view all the answers

<ul> <li>has more flexibility in tracking separate pieces of evidence for your chain-of-custody log</li> <li>has more space for descriptions to help finalize the investigation and create a case report</li> <li>allows one to accurately account for what was done to the evidence and what was found</li> <li>can be used as a reference for all actions taken during the investigative analysis</li> </ul> Signup and view all the answers

<ul> <li>Use evidence bags to secure and catalog the evidence</li> <li>Use computer safe products when collecting computer evidence( antistatic bags and pads)</li> <li>Use well padded containers</li> <li>Use evidence tape to seal all openings (CD drive bays, insertion slots for power supply electrical cords and USB cables)</li> <li>Write your initials on tape to prove that evidence has not been tampered with</li> <li>Consider computer specific temperature and humidity ranges (Make sure you have a safe environment for transporting and storing it until a secure evidence container is available)</li> </ul> Signup and view all the answers

<p>formal procedures and informal checklists to cover all issues important to high-tech investigations, Such as:</p> <ul> <li>employee termination cases</li> <li>internet abuse cases</li> <li>email abuse cases</li> <li>Attorney-Client Privilege Investigations</li> <li>Industrial espionage Cases</li> </ul> Signup and view all the answers

<p>employee abuse of corporate assets</p> Signup and view all the answers

<p>Incidents that create a hostile work environment (viewing porn in the workplace, sending inappropriate emails).</p> Signup and view all the answers

<ul> <li>Organization’s Internet proxy server logs</li> <li>Suspect computer’s IP address</li> <li>Suspect computer’s disk drive</li> <li>Your preferred computer forensics analysis tool</li> </ul> Signup and view all the answers

<ul> <li>Use the standard forensic analysis techniques and procedures</li> <li>Use tools for Internet keyword search option to extract all Web page URL information</li> <li>Contact the network firewall administrator and request a proxy server log</li> <li>Compare the data recovered from forensic analysis to the proxy server log data to confirm that they match</li> <li>Continue analyzing the computer’s disk drive data</li> </ul> Signup and view all the answers

<p>continue analyzing the suspect computer’s drive data, and collect any relevant downloaded inappropriate pictures or Web pages that support the allegation.</p> Signup and view all the answers

<p>report that the allegation is unsubstantiated</p> Signup and view all the answers

<ul> <li>An electronic copy of the offending e-mail that contains message header data</li> <li>If available, e-mail server log records</li> <li>For e-mail systems that store users’ messages on a central server, access to the server</li> <li>Access to the computer so that you can perform a forensic analysis on it</li> <li>Your preferred computer forensics analysis tool</li> </ul> Signup and view all the answers

<ul> <li>For computer-based e-mail data files: use the standard forensic analysis techniques and procedures</li> <li>For server-based e-mail data files: contact the e-mail server administrator and obtain an electronic copy of the suspect and victim’s e-mail folder or data.</li> <li>For Web-based e-mail investigations: such as Hotmail or Gmail, use tools such as Forensic Toolkit’s Internet keyword search option to extract all related e-mail address information.</li> <li>Examine header data of all messages of interest to the investigation.</li> </ul> Signup and view all the answers

<ul> <li>disgruntled employees sending an organization's sensitive data to a news reporter</li> <li>employees attempting to embarrass management to a rival conducting a power struggle between other internal organizations</li> <li>premature release of information about new products, which can disrupt operations and cause market share loss for a business if the information is made public too soon</li> </ul> Signup and view all the answers

<ul> <li>Examine e-mail</li> <li>Examine Internet message boards</li> <li>Examine proxy server logs</li> <li>Examine known suspects’ workstations</li> <li>Examine all company telephone records</li> </ul> Signup and view all the answers

<ol> <li>Interview management privately to get a list of employees who have direct knowledge of the sensitive data.</li> <li>Identify the media source that published the information.</li> <li>Review company phone records to see who might have had contact with the news service.</li> <li>Obtain a list of keywords related to the media leak.</li> <li>Perform keyword searches on proxy and e-mail servers.</li> <li>Discreetly conduct forensic disk acquisitions and analysis of employees of interest.</li> <li>From the forensic disk examinations, analyze all e-mail correspondence and trace any sensitive messages to other people who haven't been listed as having direct knowledge of the sensitive data.</li> <li>Expand the discreet forensic disk acquisition and analysis for any new persons of interest.</li> <li>Consolidate and review your findings periodically to see whether new clues can be discovered.</li> <li>Report findings to management routinely, and discuss how much further to continue</li> </ol> Signup and view all the answers

<p>criminal investigations</p> Signup and view all the answers

<ul> <li>Digital investigator who is responsible for disk forensic examinations</li> <li>Technology specialist who is knowledgeable of the suspected compromised technical data</li> <li>Network specialist who can perform log analysis and set up network sniffers</li> <li>Threat assessment specialist (typically an attorney)</li> </ul> Signup and view all the answers

<ul> <li>Determine whether this investigation involves a possible industrial espionage incident</li> <li>Consult with corporate attorneys and upper management</li> <li>Determine what information is needed to substantiate the allegation</li> <li>Generate a list of keywords for disk forensics and sniffer monitoring</li> <li>List and collect resources for the investigation</li> <li>Determine goal and scope of the investigation</li> <li>Initiate investigation after approval from management</li> </ul> Signup and view all the answers

<ul> <li>Gather all personnel assigned to the investigation and brief them on the plan and any concerns.</li> <li>Gather the resources needed to conduct the investigation.</li> <li>Start the investigation by placing surveillance systems, such as cameras and network monitors, at key locations</li> <li>Discreetly gather any additional evidence, such as the suspect's computer drive, and make a bit-stream image for follow-up examination</li> <li>Collect all log data from networks and e-mail servers, and examine them for unique items that might relate to the investigation</li> <li>Report regularly to management and corporate attorneys on your investigation's status and current findings</li> <li>Review the investigation's scope with management and corporate attorneys to deter mine whether it needs to be expanded and more resources added</li> </ul> Signup and view all the answers

<p>An interview is usually conducted to collect information from a witness or suspect, while an interrogation is the process of trying to get a suspect to confess.</p> Signup and view all the answers

<p>to instruct the investigator conducting the interview on what questions to ask and what the answers should be.</p> Signup and view all the answers

<ul> <li>Being patient throughout the session</li> <li>Repeating or rephrasing questions to zero in on specific facts from a reluctant witness or suspect</li> <li>Being tenacious</li> </ul> Signup and view all the answers