Guide to Computer Forensics and Investigations PDF

Guide to Computer Forensics and Investigations Fifth Edition Chapter 2 The Investigator’s Office and Laboratory  Objectives Describe certification requirements for digital forensics labs List physical requirements for...

Guide to Computer Forensics and Investigations Fifth Edition Chapter 2 The Investigator’s Office and Laboratory  Objectives Describe certification requirements for digital forensics labs List physical requirements for a digital forensics lab Explain the criteria for selecting a basic forensic workstation Describe components used to build a business case for developing a forensics lab Guide to Computer Forensics and Investigations, Fifth Edition 2 © Cengage Learning 2015  Understanding Forensics Lab Certification Requirements Digital forensics lab – Where you conduct your investigation – Store evidence – House your equipment, hardware, and software American Society of Crime Laboratory Directors (ASCLD) offers guidelines for: – Managing a lab – Acquiring an official certification – Auditing lab functions and procedures Guide to Computer Forensics and Investigations, Fifth Edition 3 © Cengage Learning 2015  Identifying Duties of the Lab Manager and Staff Lab manager duties: – Set up processes for managing cases – Promote group agreement in decision making – Maintain fiscal responsibility for lab needs – Enforce ethical standards among lab staff members – Plan updates for the lab – Establish and promote quality-assurance processes – Set reasonable production schedules – Estimate how many cases an investigator can handle Guide to Computer Forensics and Investigations, Fifth Edition 4 © Cengage Learning 2015  Identifying Duties of the Lab Manager and Staff Lab manager duties (cont’d): – Estimate when to expect preliminary and final results – Create and monitor lab policies for staff – Provide a safe and secure workplace for staff and evidence Staff member duties: – Knowledge and training: Hardware and software OS and file types Deductive reasoning Guide to Computer Forensics and Investigations, Fifth Edition 5 © Cengage Learning 2015  Identifying Duties of the Lab Manager and Staff Staff member duties (cont’d): – Their work is reviewed regularly by the lab manager and their peers to ensure quality. Check the ASCLD Web site for online manual and information Guide to Computer Forensics and Investigations, Fifth Edition 6 © Cengage Learning 2015  Lab Budget Planning Break costs down into daily, quarterly, and annual expenses Use past investigation expenses to extrapolate expected future costs Expenses for a lab include: – Hardware – Software – Training personnel Guide to Computer Forensics and Investigations, Fifth Edition 7 © Cengage Learning 2015  Lab Budget Planning Estimate the number of computer cases your lab expects to examine – Identify types of computers you’re likely to examine Take into account changes in technology Use statistics to determine what kind of computer crimes are more likely to occur Use this information to plan ahead your lab requirements and costs Guide to Computer Forensics and Investigations, Fifth Edition 8 © Cengage Learning 2015  Lab Budget Planning Check statistics from the Uniform Crime Report (see next slide) – For federal reports, see www.fbi.gov/ucr/ucr.htm Identify crimes committed with specialized software When setting up a lab for a private company, check: – Hardware and software inventory – Problems reported last year – Future developments in computing technology Time management is a major issue when choosing software and hardware to purchase Guide to Computer Forensics and Investigations, Fifth Edition 9 © Cengage Learning 2015 Lab Budget Planning 10 © Cengage Learning 2015  Acquiring Certification and Training Update your skills through appropriate training – Before enlisting in a certification program, thoroughly research the requirements, cost, and acceptability in your area of employment. – Most certification programs require continuing education credits or reexamination of candidates’ skills, which can become costly. International Association of Computer Investigative Specialists (IACIS) – Created by police officers who wanted to formalize credentials in computing investigations – Candidates who complete the IACIS test are designated as a Certified Forensic Computer Examiner (CFCE) Guide to Computer Forensics and Investigations, Fifth Edition 11 © Cengage Learning 2015  Acquiring Certification and Training ISC² Certified Cyber Forensics Professional (CCFP) – Requires knowledge of Digital forensics Malware analysis Incident response E-discovery Other disciplines related to cyber investigations – The CCFP Web site (www.isc2.org/ccfp/Default.aspx) lists requirements and processes needed for this certification. Guide to Computer Forensics and Investigations, Fifth Edition 12 © Cengage Learning 2015  Acquiring Certification and Training High-Tech Crime Network (HTCN) – Certified Computer Crime Investigator, Basic and Advanced Level – Certified Computer Forensic Technician, Basic and Advanced Level EnCase Certified Examiner (EnCE) Certification – Open to the public and private sectors – Is specific to use and mastery of EnCase forensics analysis – Candidates are required to have a licensed copy of EnCase Guide to Computer Forensics and Investigations, Fifth Edition 13 © Cengage Learning 2015  Acquiring Certification and Training AccessData Certified Examiner (ACE) Certification – Open to the public and private sectors – Is specific to use and mastery of AccessData Ultimate Toolkit – The exam has a knowledge base assessment (KBA) and a practical skills assessment (PSA) Other Training and Certifications – EC-Council – SysAdmin, Audit, Network, Security (SANS) Institute – Defense Cyber Investigations Training Academy (DCITA) Guide to Computer Forensics and Investigations, Fifth Edition 14 © Cengage Learning 2015  Acquiring Certification and Training Other training and certifications (cont’d) – International Society of Forensic Computer Examiners (ISFCE) – High Tech Crime Consortium – Computer Technology Investigators Network (CTIN) – Digital Forensics Certification Board (DFCB) – Consortium of Digital Forensics Specialists (CDFS) – Federal Law Enforcement Training Center (FLETC) – National White Collar Crime Center (NW3C) Guide to Computer Forensics and Investigations, Fifth Edition 15 © Cengage Learning 2015  Determining the Physical Requirements for a Computer Forensics Lab Most of your investigation is conducted in a lab Lab should be secure so evidence is not lost, corrupted, or destroyed Provide a safe and secure physical environment Keep inventory control of your assets – Know when to order more supplies Guide to Computer Forensics and Investigations, Fifth Edition 16 © Cengage Learning 2015  Identifying Lab Security Needs Secure facility – Should preserve integrity of evidence data Minimum requirements – Small room with true floor-to-ceiling walls – Door access with a locking mechanism – Secure container – Visitor’s log People working together should have same access level Brief your staff about security policy Guide to Computer Forensics and Investigations, Fifth Edition 17 © Cengage Learning 2015  Conducting High-Risk Investigations High-risk investigations demand more security than the minimum lab requirements During the Cold War, defense contractors were required to shield sensitive computing systems and prevent electronic eavesdropping of any computer emissions. The U.S. Department of Defense calls this special computer- emission shielding TEMPEST. – TEMPEST facilities Electromagnetic Radiation (EMR) proofed http://nsi.org/Library/Govt/Nispom.html – TEMPEST facilities are very expensive Guide to Computer Forensics and Investigations, Fifth Edition 18 © Cengage Learning 2015  Using Evidence Containers Known as evidence lockers – Must be secure so that no unauthorized person can easily access your evidence Recommendations for securing storage containers: – Locate them in a restricted area – Limited number of authorized people to access the container – Maintain records on who is authorized to access each container – Containers should remain locked when not in use Guide to Computer Forensics and Investigations, Fifth Edition 19 © Cengage Learning 2015  Using Evidence Containers If a combination locking system is used: – Provide the same level of security for the combination as for the container’s contents – Destroy any previous combinations after setting up a new combination – Allow only authorized personnel to change lock combinations – Change the combination every six months or when required Guide to Computer Forensics and Investigations, Fifth Edition 20 © Cengage Learning 2015  Using Evidence Containers If you’re using a keyed padlock: – Appoint a key custodian who’s responsible for distributing keys. – Stamp sequential numbers on each duplicate key – Maintain a registry listing which key is assigned to which authorized person – Conduct a monthly audit – Take an inventory of all keys – Place keys in a lockable container – Maintain the same level of security for keys as for evidence containers – Change locks and keys annually Guide to Computer Forensics and Investigations, Fifth Edition 21 © Cengage Learning 2015  Using Evidence Containers Container should be made of steel with an internal cabinet or external padlock When possible, build an evidence storage room in your lab Keep an evidence log – Update it every time an evidence container is opened and closed Guide to Computer Forensics and Investigations, Fifth Edition 22 © Cengage Learning 2015  Considering Physical Security Needs Enhance security by setting security policies Enforce your policy – Maintain a sign-in log for visitors Anyone that is not assigned to the lab is a visitor Escort all visitors all the time – Use visible or audible indicators that a visitor is inside your premises Visitor badge – Install an intrusion alarm system – Hire a guard force for your lab Guide to Computer Forensics and Investigations, Fifth Edition 23 © Cengage Learning 2015  Auditing a Digital Forensics Lab Auditing ensures proper enforcing of policies Audits should include inspecting the following facility components and practices: – Ceiling, floor, roof, and exterior walls of the lab – Doors and doors locks – Visitor logs – Evidence container logs – At the end of every workday, secure any evidence that’s not being processed in a forensic workstation Guide to Computer Forensics and Investigations, Fifth Edition 24 © Cengage Learning 2015  Determining Floor Plans for Digital Forensics Labs How you configure the work area will depend on: – Your budget – Amount of available floor space – Number of computers you assign to each computing investigator Ideal configuration is to have: – Two forensic workstations – One non-forensic workstation with Internet access Guide to Computer Forensics and Investigations, Fifth Edition 25 © Cengage Learning 2015  Determining Floor Plans for Digital Forensics Labs Small labs usually consist of: – One or two forensic workstations – A research computer with Internet access – A workbench (if space allows) – Storage cabinets Guide to Computer Forensics and Investigations, Fifth Edition 26 © Cengage Learning 2015  Determining Floor Plans for Digital Forensics Labs Guide to Computer Forensics and Investigations, Fifth Edition 27 © Cengage Learning 2015  Determining Floor Plans for Digital Forensics Labs Mid-size labs are typically those in a private business – Have more workstations – Should have at least two exits, for safety reasons – More library space for software and hardware storage Guide to Computer Forensics and Investigations, Fifth Edition 28 © Cengage Learning 2015  Determining Floor Plans for Digital Forensics Labs Guide to Computer Forensics and Investigations, Fifth Edition 29 © Cengage Learning 2015  Determining Floor Plans for Digital Forensics Labs State law enforcement or the FBI usually runs most large or regional digital forensics labs – Have a separate evidence room – One or more custodians might be assigned to manage and control traffic in and out of the evidence room – Should have at least two controlled exits and no windows Guide to Computer Forensics and Investigations, Fifth Edition 30 © Cengage Learning 2015  Determining Floor Plans for Digital Forensics Labs Guide to Computer Forensics and Investigations, Fifth Edition 31 © Cengage Learning 2015