Digital Forensics Exam

Digital Forensics

• Involves applying computer science and investigative procedures for legal purposes.
• Includes analyzing digital evidence after proper search authority.
• Chain of custody maintenance and validation with mathematics are critical.
• Using validated tools, repeatability in findings, and reporting is also important.
• Can also involve expert presentation.

Investigating Digital Devices

• Includes securely collecting data and examining suspect data for origin and context.
• Requires applying laws to digital device practices and presenting digital information to courts.

Digital Forensics vs Data Recovery

• Differs from data recovery, where dates can change while retrieving data.
• Aims to maintain the original state of evidence without any alteration.
• In digital forensics, you must not change anything.

Investigations Triad

• A team of forensic investigators.

Public-Sector Investigations

• Conducted by government agencies responsible for criminal investigations and prosecution.
• The Department of Justice (DOJ) regularly updates computer search and seizure information.
• Investigators in the public sector must understand laws on computer-related crimes.
• Knowledge of standard legal processes, search and seizure guidelines, and how to build a criminal case are important.
• Criminal investigations usually start with evidence discovery or a witness/victim report to the police.

Private-Sector Investigations

• Focus more on policy violations.
• Can involve crimes like E-mail harassment and falsification of data.
• Also includes gender and age discrimination, embezzlement, sabotage, and industrial espionage.
• Businesses reduce litigation risks by publishing and maintaining easily readable policies.
• Policies define rules for using company computers and networks, known as an "Acceptable use policy".
• Line of authority specifies who can initiate investigations, possess evidence, and access it.
• Businesses can avoid litigation by displaying a warning banner on computer screens.
• Banners could include warning messages such as "Use of this system and network is for official business only".
• Systems and networks are subject to monitoring, informing users about password updates, system updates, and external links.
• Businesses should specify an authorized requester who has the power to initiate investigations.

Groups With Authority

• Corporate security investigations and corporate ethics offices have authority.
• Also includes internal auditing and the general counsel or legal department.
• Private investigations search for evidence of company rule violations or attacks on assets.
• Common situations include abuse/misuse of computing assets and E-mail.

Professional Conduct

• Ethics, morals, and standards of behavior are required.
• Investigators must maintain objectivity.
• Credibility is maintained by also maintaining confidentiality.

Digital Forensics Professional Role

• Gathering evidence to prove a crime or company policy violation.
• Collect evidence usable in court or a corporate inquiry.

Chain Of Custody

• Process of documenting all actions from discovery to court case closure.
• Case duration is valid for 3 years.

Computer Information Use

• Can determine the chain of events leading to a crime.
• Can surface evidence that can lead to a conviction.

Law Enforcement Officers

• Ensure proper procedure when acquiring evidence.
• Hard disks may be password protected.

A Potential Challenge

• Includes the challenge: Information on hard disks might be password protected
• Forensics tools may need to be used in investigations where: -Encrypted drives appear -There is big data -Cloud computing is used -Data is corrputed -There are resource constraints -Anti-forensic tools are used

Systematic Approach Steps

• Making an initial assessment about the type of case is the first step.
• Determine a preliminary design or approach to the case.
• Followed by creating a detailed checklist and determining needed resources.
• Steps include obtaining/copying an evidence drive and identifying/mitigating risks.
• Test the design, analyze/recover digital evidence, investigate recovered data and complete a case report.
• Finally, critique the case and review it to enhance it.

Assessing the case

• Systematically outline the case details, like the situation and nature of the case.
• Get specific about evidence types, known disk format and evidence location.
• The case requirements can be determined based on these details.

Basic Investigation Plan

• Involves preparing a standalone forensics workstation isolated from the network.
• Retrieve evidence from the secure container and make a forensic copy.
• An evidence custody form documents actions performed on the original evidence and its copies.
• Single-evidence forms list each piece of evidence on a separate page.
• Multi-evidence forms list a maximum of 10 items.

Securing Your Evidence

• Use evidence bags to secure and catalog evidence.
• Use computer-safe products when collecting computer evidence like antistatic bags and antistatic pads.
• Write your initials on tape confirms evidence has not been tampered with.
• Safe transport and storage with computer-specific temperature and humidity ranges is needed until a secure container is available.

Private-Sector High-Tech Investigations

• Formal procedures and informal checklists are needed.
• Coverage of all issues includes ensuring correct techniques are used in an investigation.

Employee Termination Cases

• Most investigative work for termination involves employee abuse of corporate assets.
• Aggressive work environments are caused by unethical content in the workplace or inappropriate emails.
• Organizations must have appropriate policies in place.

Internet Abuse Investigations

• You will need the Organization's Internet proxy server logs, IP address data, and preferred forensics analysis tools.
• Standard forensic analysis techniques and procedures are needed.
• Use tools to extract all web page URL information.
• Contact the network firewall administrator and request a proxy server log.
• Continue analyzing the computer's disk drive data.

Email Abuse Investigations

• You will need an electronic copy of the offending Email, with message header data, if available.
• If available, e-mail server log records and access to email servers may be needed.
• Standard forensic analysis techniques are recommended.
• Email folder data and examination of header data of all relevant messages are needed.

Industrial Espionage Investigations

• Treat all suspected investigations like criminal investigations.
• Requires a digital investigator for disk forensic examinations.
• Staff should include technology and network specialists, and a threat assessment specialist (typically an attorney).
• All personnel is gathered, briefed and resources gathered.
• Steps include locating key locations, evidence gathering reporting, and management attorney reviews.

High-Tech Investigation Interview/Interrogations

• Experience and skills in investigating and interrogating leads is valuable.
• An interview collects information from a witness/suspect.
• An interrogation tries to get a subject to confess.
• As a digital investigator, instruct the investigator on what questions to ask. -Ingredients for successful questioning involves; being patient throughout the session, repeating and rephrasing questions to zero in on specific facts -Dealing with a reluctant witness or suspect/ Being tenacious

Data Recovery Workstations and Software

• Investigations are conducted a computer forensics lab.
• A computer forensics workstation that is specially configured.
• A workstation loaded with bays and software with write-blocker devices that boot to Windows without writing to drive.

Bit-Stream Copies

• A bit-by-bit copy of the original storage medium.
• It is an exact copy of the original disk.
• Different from a simple backup, where: -Backup software copies known files -Does not copy deleted files -Cannot recover file fragments
• Bit-stream images create an exact bit-by-bit duplication.
• A Forensic Image is a compressed file which contains a complete bit-by-bit copy of all data from a disk which serves as a digital replica of the original evidence.

Acquiring an Image of Evidence Media

• First rule is to preserve the original evidence.
• Analyses should be conducted only on the copy of the data.
• MS-DOS, Linux, and Windows acquisition tools are provided.
• Windows tools need a write-blocking device when gathering data from FAT or NTFS file systems.

Analysis Of Digital Evidence

• Task to recover deleted files, fragments, and complete files.
• Deleted files stay on the disk until data overwrites.
• Tools that are used to retrieve deleted files include:
  • Autopsy.
  • FTK.
  • OSForensics.
  • EnCase.

Completing the Case

• The creation of a final report and repeatable findings are needed.
• You reports should show conclusive evidence.
• You must keep keep written journals and answer the six Ws.

Critiquing the Case

Some of the questions to ask are:

• How could the performance be improved?
• Were the results expected?
• Was the documentation thorough?
• What feedback was received?
• Were any new problems found?
• Were any new techniques used?
• All are good for discussion upon completing the case.

Digital Forensics Lab considerations

• Where you conduct your investigations, Store evidence, house equipment and hardware.
• The lab must set processes for managing cases and promoting consensus during decision making.
• There is a responsibility to be responsible and promote ethical standards among staff for updates and quality assurance processes.
• The lab must set production schedules and estimate cases a user can handle
• It must create and monitor lab policies for providing a secure workplace.

Staff Duties

• Knowledge of hardware and software systems, OS and file types and deductive reasoning.
• Work is reviewed regularly by the lab manager

Getting Your Business Case together

• Is key to establishing a digital forensics lab.
• This plan helps sale of services to management or clients by showing cost savings.
• It is important to protect intellectual property, trade secrets, and future business plans.
• The team must also plan training for the facility.
• Justification for money controlling, is needed for the future.

Elements of Budget Development

• You will need to include needs like; facility options, hardware/software.
• To pass go you will need: -Approval for upper management -Implementation of approved items -A timeline of approval and inspection dates. -Facility inspections to include; security functionality, tests, comms checks and functionality

Business Case for Digital Forensic Labs.

• You will need the support of management, with the inclusion of why a business case has to be.
• What is key is an explanation of how the lab saves money and improves. You must secure funding and facility for these improvements. You will have to present upper management with a budget. You will need to find the dates things are acquired. Testing needs to be done to ensure operation correctly and anticipate the resolutions

Digital Forensics Process

The tools needed for investigation are

• For Identification identify the needs for the investigation
• Preservation to ensure what you isolate is secured preserved
• The identification of different techniques along with processing of data.
• Documentation requires the full scenes along with sketching for photographs. -Presentation of the gathered facts.

Evaluations Of Tools

• Open source tools is the way to go.
• Consider these questions: On which OS is the tool running Is the tool is is multipurpose Can the tool analyse more than one file system Can the script language be used by this tool Does automation it has What's the vendor response for support

Tools

• Hardware Tools: -Range from simple server ranges to multi-purpose components and systems.
  • Hardcopy is an example.
• Software Tools: -Command line and GUI based applications
• The tools that you have depend on the copies you want to make

Tasks Performed by Digital Forensics Tools

• There are 5 key categories to assist you in your decision.

Acquisition Subfunctions

• Copying originals for validation.
• Subcategories are hardware to drive. -Selecting data for drives. -Data types along with acquisition types. Data copying occurs on physical, logical types and remote like access data.

Validation and Verification

• Confirm function is needed .
• Filtering and sorting suspicious data is the relationship. This function includes: -Hashing, with file headers and disk extensions. -You will use the value sets that are created.

Extraction

The most challenging task is the Recovery Task. You're needed to analyze the investigations and recover and master data. This tool can do decryption and data viewing to speed process. Encrypted files are hard to manage with password crackers,

Reconstruction

Its re-creation from a previous crime. Disk to disk. is how keys can do this. Its simply the the tool makes the direct disk copying

Command-line Forensics Tools

• First analyzed data by IBM PC file systems.
• These tools use minimum configurations.

Linux Tools

• The Linux has more popularity.
• These tools are designed for many different Linux Versions.
• They can have many utilities bundled.

Forensic Tools for GUI

• The tools that have simplified can easily teach.
• These tools also make it easier to put things together.

GUI Tool Advantages

Ease of Use Multitasking No learning needed

Disadvantages

• Are many resources needed
• Produce inconsistent results
• Create a Dependency
• Should be familiar