CHAPTER 5 NOTES
Popular in Cyber Forensics
Popular in Department
This 13 page Class Notes was uploaded by Matt Curtis on Friday February 6, 2015. The Class Notes belongs to IST 454 at Pennsylvania State University taught by Chao Chu in Spring2015. Since its upload, it has received 218 views.
Reviews for CHAPTER 5 NOTES
Report this Material
What is Karma?
Karma is the currency of StudySoup.
You can buy or earn more Karma at anytime and redeem it for class notes, study guides, flashcards, and more!
Date Created: 02/06/15
Matthew Curtis 5 January 2015 IST 454 CHAPTER 5 NOTES Identjfving Digital Evidence 0 Digital Evidence 0 Can be any information stored or transmitted in digital form 0 Digital evidence is considered physical evidence in courts l Digital data is treated as a tangible object such as 0 Weapon 0 Paper document 0 Visible injury I As long as it s related to criminal or civil incident 0 Some courts require digital evidence be printed out and presented in court 0 Scienti c Working Group on Digital Evidence SWGDE 0 International Organization on Computer Evidence IOCE I Set standards for recovering preserving and examining digital evidence 0 General tasks investigators perform when working with digital evidence Identify digital information or artifacts that can be used as evidence Collect preserve and document evidence Analyze identify and organize evidence Rebuild evidence or repeat a situation to verify that the results can be reproduced reliably 0 Collecting computers and processing a criminal or incident scene must be done 0 OOO systematically 0 Minimize confusion 0 Reduce risk of losing evidence 0 Avoid damaging evidence 0 Only one person should collectcatalog evidence at crime scene or lab I Should use standardized forms for tracking evidence 0 Ensures evidence handling in a safe and secure manner Understanding Rules of Evidence 0 Consistent practices help verify your work and enhance your credibility 0 Comply with your state s rules of evidence or with the Federal Rules of Evidence 0 Evidence admitted in a criminal case can be used in a civil suit and vice versa Keep current on the latest rulings and directives on collecting processing storing and admitting digital evidence Data you discover from a forensic examination falls under your state s rules of evidence 0 Or the Federal Rules of Evidence Digital evidence is unlike other physical evidence because it can be changed more easily 0 The only way to detect these changes is to compare the original data with a duplicate Distinguishing a duplicate from original electronically is impossible 0 Digital evidence requires a special legal consideration Most federal courts have interpreted computer records as hearsay evidence 0 Hearsay is secondhand or indirect evidence Federal rules exceptions 0 Business records including those of a public agency Certain public records and reports Evidence of the absence of a business record or entry Learned treatises used to question an expert witness Statements of the absence of a public record or entry The catchall rule which doesn t require that the declarant be unavailable to 00000 testify It does say that evidence of a hearsay statement not included in one of the other exceptions can be admitted if it meets the following conditions I It has sound guarantees of trustworthiness It is offered to help prove a material fact It is more probative than other equivalent and reasonably obtainable I evidence Its admission would forward the cause of justice The other parties have been notified that it will be offered into evidence Businessrecord exception 0 Allows records of regularly conducted activity such as business memos reports records or data compilations O Authenticated by verifying their creation at or near the time by or from information transmitted by a person with knowledge Generally computer records are considered admissible if they qualify as a business record Computer records are usually divided into Computergenerated records 0 Data the system maintains such as system log files and proxy server logs 0 Output generated from a computer process or algorithm not usually data a person creates Computerstored records 0 Electronic data that a person creates and saves on a computer I Such as a spreadsheet or word doc Computer records must be shown to be authentic and trustworthy 0 To be admitted into court as evidence Computergenerated records are considered authentic 0 If the program that created the output is functioning correctly 0 Usually considered exceptions to the hearsay rule Collecting evidence according to the proper steps of evidence control helps ensure that the computer evidence is authentic 0 So do forensic software tools When attorneys challenge digital evidence 0 Often they raise the issue of whether computer generated records were altered I Or damaged after they were created 0 May challenge authenticity of computergenerated records I By questioning the program that created them One test to prove that computerstored records are authentic is to demonstrate that a speci c person created the records 0 The author of a Microsoft Word document can be identified by using file metadata The process of establishing digital evidence s trustworthiness originated with written documents and the best evidence rule Best evidence rule states 0 To prove the content of a written document recording or photograph ordinarily the original writing recording or photograph is required Federal Rules of Evidence 0 Allow a duplicate instead of originals when it is produced by the same impression as the original As long as bitstream copies of data are created and maintained properly 0 The copies can be admitted in court although they aren t considered best evidence Collectin2 Evidence in PrivateSector Incident Scenes Privatesector organizations include 0 Businesses and government agencies that aren t involved in law enforcement Agencies must comply with state public disclosure and federal Freedom of Information Act FOIA laws 0 And make certain documents available as public records 0 Disclosure laws define state public records as open and available for inspection FOIA allows citizens to request copies of public documents created by federal agencies O A special category of privatesector businesses includes ISPs and other communication companies 0 ISPs can investigate computer abuse committed by their employees but not by customers 0 Must preserve customer privacy especially when dealing with email 0 Except for activities that are deemed to create an emergency situation 0 Investigating and controlling computer incident scenes in the corporate environment 0 Much easier than in the criminal environment 0 Incident scene is often a workplace 0 Typically businesses have inventory databases of computer hardware and software 0 Help identify the computer forensics tools needed to analyze a policy Violation I And the best way to conduct the analysis 0 Corporate policy statement about misuse of computing assets 0 Allows corporate investigators to conduct covert surveillance with little or no cause 0 And access company systems without a warrant 0 Companies should display a warning banner or publish a policy 0 Stating that they reserve the right to inspect computing assets at will 0 Corporate investigators should know under what circumstances they can examine an employee s computer 0 Every organization must have a welldefined process describing when an investigation can be initiated 0 If a corporate investigator finds that an employee is committing or has committed a crime 0 Employer can file a criminal complaint with the police 0 Employers are usually interested in enforcing company policy 0 Not seeking out and prosecuting employees 0 Typically approve computer investigations in order to identify who is misusing company assets 0 Corporate investigators are therefore primarily concerned with protecting company assets 0 Finding evidence of a criminal act turns an internal civil matter into an external criminal complaint 0 If you discover evidence of a crime during a company policy investigation 0 Determine whether the incident meets the elements of criminal law 0 Inform management of the incident 0 Stop your investigation to make sure you don t Violate Fourth Amendment restrictions on obtaining evidence 0 Work with the corporate attorney to write an affidavit confirming your findings Processing Law Enforcement Crime Scenes 0 You must be familiar with criminal rules of search and seizure 0 You should also understand how a search warrant works and what to do when you process one 0 4th Amendment limits how governments can search and seize evidence 0 Law enforcement officer may search for and seize criminal evidence only with probable cause 0 Facts or circumstances that lead a reasonable person to believe a crime has been committed or is about to be committed I With probable cause a police officer can obtain a search warrant from a judge 0 That authorizes a search and seizure of specific evidence related to the criminal complaint 0 The Fourth Amendment states that only warrants particularly describing the place to be searched and the persons or things to be seized can be issued Understanding Concepts and Terms Used in Warrants 0 Innocent information 0 Unrelated information 0 Often included with the evidence you re trying to recover I Judges often issue a limiting phrase to the warrant O Allows the police to separate innocent information from evidence 0 Must list which items are being seized 0 Plain view doctrine O Objects falling in plain view of an officer who has the right to be in position to have that view I Are subject to seizure without a warrant and may be introduced in evidence 0 Must meet three criteria I The officer is where he or she has a legal right to be I Ordinary senses must not be enhanced by advanced technology I Any discovery must be by chance I The officer must be lawfully present at the place where the evidence can be plainly viewed I The officer must have a lawful right of access to the object I The incriminating character of the object must be immediately apparent 0 Knock and announce 0 With few exceptions warrants require that officers knock and announce their identity I When executing a warrant Preparing for a Search 0 Preparing for a computer search and seizure O Probably the most important step in computing investigations 0 To perform these tasks 0 You might need to get answers from the victim and an informant I Who could be a police detective assigned to the case a law enforcement witness or a manager or coworker of the person of interest to the investigation Identifving the Nature of the Ci 0 When you re assigned a computing investigation case 0 Start by identifying the nature of the case I Including whether it involves the private or public sector 0 The nature of the case dictates how you proceed 0 And what types of assets or resources you need to use in the investigation Identifying the Type of Computing System 0 For law enforcement O This step might be difficult because the crime scene isn t controlled 0 Unsure of where what and how computers were used to commit the crime 0 If you can identify the computing system 0 Estimate the size of the drive on the suspect s computer I And how many computers to process at the scene 0 Determine which 08s and hardware are involved Determining Whether You Can Seize a Computer 0 The type of case and location of the evidence 0 Determine whether you can remove computers 0 Law enforcement investigators need a warrant to remove computers from a crime scene 0 And transport them to a lab 0 If removing the computers will irreparably harm a business 0 The computers should not be taken offsite 0 An additional complication is files stored offsite that are accessed remotely 0 If you aren t allowed to take the computers to your lab 0 Determine the resources you need to acquire digital evidence and which tools can speed data acquisition Obtaining a Detailed Description of the Location 0 Get as much information as you can 0 Identify potential hazards 0 Interact with your HAZMAT team 0 Recovery process may include decontaminating computing components needed for investigation 0 HAZMAT guidelines 0 If decontamination may destroy electronic evidence HAZMAT must make an image of suspect s drive 0 Put the target drive in a special HAZMAT bag 0 HAZMAT technician can decontaminate the bag 0 Check for high temperatures Determining Who Is in Charge 0 Corporate computing investigations 0 Require only one person to respond 0 Processing evidence requires an image of suspect s drive 0 Law enforcement agencies 0 Handle largescale investigations 0 Designate lead investigators Using Additional Technical Expertise 0 Look for specialists 0 08s 0 RAID servers 0 Databases 0 Identify applications suspect uses 0 Oracle databases 0 Finding the right person can be a challenge 0 Educate specialists in investigative techniques 0 Prevent evidence damage Determining the Tools You Need 0 Prepare tools using incident and crime scene information 0 Initialresponse eld kit 0 Lightweight 0 Easy to transport 0 Extensiveresponse eld kit 0 Includes all tools you can afford Preparing the Investigation Team 0 Review facts plans and objectives with the investigation team you have assembled 0 Goals of scene processing 0 Collect evidence 0 Secure evidence 0 Slow response can cause digital evidence to be lost Securing a Computer Incident or Crime Scene 0 Goals 0 Preserve the evidence 0 Keep information confidential 0 Define a secure perimeter 0 Use yellow barrier tape 0 Legal authority 0 Professional curiosity can destroy evidence 0 Involves police officers and other professionals who aren t part of the crime scene processing team 0 Automated Fingerprint Identification System AFIS 0 Identifies Fingerprints in the police database to find any matches with collected evidence Seizing Digital Evidence at the Scene 0 Law enforcement can seize evidence 0 With a proper warrant 0 Corporate investigators rarely can seize evidence 0 When seizing computer evidence in criminal investigations 0 Follow US DoJ standards for seizing digital data 0 Civil investigations follow same rules 0 Require less documentation though 0 Consult with your attorney for extra guidelines Preparing to Acquire Digital Evidence 0 The evidence you acquire at the scene depends on the nature of the case 0 And the alleged crime or Violation 0 Ask your supervisor or senior forensics examiner in your organization the following questions 0 Do you need to take the entire computer and all peripherals and media in the immediate area 0 How are you going to protect the computer and media while transporting them to your lab Is the computer powered on when you arrive Is the suspect you re investigating in the immediate area of the computer 0 Is it possible the suspect damaged or destroyed the computer peripherals or 00 media 0 Will you have to separate the suspect from the computer Processing an Incident or Crime Scene 0 Guidelines 0 Keep a journal to document your activities 0 Secure the scene I Be professional and courteous with onlookers I Remove people who are not part of the investigation 0 Take video and still recordings of the area around the computer I Pay attention to details 0 Sketch the incident or crime scene Check computers as soon as possible Don t cut electrical power to a running system unless it s an older Windows 9X or MSDOS system Save data from current applications as safely as possible Record all active windows or shell sessions Make notes of everything you do when copying data from a live suspect computer Close applications and shut down the computer Bag and tag the evidence following these steps I Assign one person to collect and log all evidence I Tag all evidence you collect with the current date and time serial numbers CO 00000 or unique features make and model and the name of the person who collected it I Maintain two separate logs of collected evidence I Maintain constant control of the collected evidence and the crime or incident scene 0 Look for information related to the investigation I Passwords passphrases PINS bank accounts 0 Collect documentation and media related to the investigation I Hardware software backup media documentation manuals 0 Analysis and processing of a scene I Hardware including peripheral devices I Software including OS and applications I All media such as backup tapes and disks I All documentation manuals printouts and handwritten notes Processing Dag Centers with RAID Svstems I Sparse acquisition 0 Technique for extracting evidence from large systems 0 Extracts only data related to evidence for your case from allocated files I And minimizes how much data you need to analyze 0 Drawback of this technique 0 It doesn t recover data in free or slack space Using a Technical Advm 0 Technical advisor 0 Can help you list the tools you need to process the incident or crime scene 0 Person guiding you about where to locate data and helping you extract log records I Or other evidence from large RAID servers 0 Can help create the search warrant by itemizing what you need for the warrant O Responsibilities 0 Know aspects of the seized system Direct investigator handling sensitive material Help secure the scene Help document the planning strategy Conduct ad hoc trainings Document activities during search and seizure OOOOO Documentin2 Evidence in the LE 0 Record your activities and findings as you work 0 Maintain a journal to record the steps you take as you process evidence 0 Goal is to be able to reproduce the same results 0 When you or another investigator repeat the steps you took to collect evidence 0 A journal serves as a reference that documents the methods you used to process digital evidence Processing and Handling Digital Evidence 0 Maintain the integrity of digital evidence in the lab 0 As you do when collecting it in the field 0 Steps to create image les 0 Copy all image files to a large drive 0 Start your forensics tool to analyze the evidence 0 Run an MD5 or SHAl hashing algorithm on the image files to get a digital hash 0 Secure the original media in an evidence locker Storing Digital Evidence 0 The media you use to store digital evidence usually depends on how long you need to keep it 0 CDRs or DVDs 0 The ideal media 0 Capacity up to 17 GB 0 Lifespan 2 to 5 years 0 4mm DAT Magnetic tapes 0 Capacity 40 to 72 GB 0 Lifespan 30 years 0 Costs drive 400 to 800 tape 40 0 Slow at reading and writing data Evidence Retention and Media Storage Needs 0 To help maintain the chain of custody for digital evidence 0 Restrict access to lab and evidence storage area 0 Lab should have a signin roster for all visitors 0 Maintain logs for a period based on legal requirements 0 You might need to retain evidence indefinitely 0 Check with your local prosecuting attorney s office or state laws to make sure you re in compliance Documenting Evidence 0 Create or use an evidence custody form An evidence custody form serves the following functions 0 Identifies the evidence 0 Identifies who has handled the evidence 0 Lists dates and times the evidence was handled 0 You can add more information to your form 0 Such as a section listing MD5 and SHAl hash values 0 Include any detailed information you might need to reference 0 Evidence bags also include labels or evidence forms you can use to document your evidence Obtaining a Digital Hash 0 Cyclic Redundancy Check CRC 0 Mathematical algorithm that determines whether a file s contents have changed 0 Most recent version is CRC32 0 Not considered a forensic hashing algorithm 0 Message Digest 5 MDS 0 First algorithm for computer forensics use 0 Mathematical formula that translates a file into a hexadecimal code value or a hash value 0 If a bit or byte in the file changes it alters the digital hash A unique hexadecimal value that identifies a file or a drive 0 Three rules for forensic hashes 0 You can t predict the hash value of a file or device 0 No two hash values can be the same 0 If anything changes in the file or device the hash value must change 0 Secure Hash Algorithm version 1 SHAl O A newer hashing algorithm o Developed by the National Institute of Standards and Technology NIST 0 In both MDS and SHAl collisions have occurred 0 Most computer forensics hashing needs can be satis ed with a nonkeyed hash set 0 A unique hash number generated by a software tool such as the Linux md5sum command 0 Keyed hash set 0 Created by an encryption utility s secret key 0 Alternative to a nonkeyed hash O Creates a unique hash value for a file 0 You can use the MDS function in FTK Imager to obtain the digital signature of a le 0 Or an entire drive Reviewing a Case 0 General tasks you perform in any computer forensics case 0 Identify the case requirements 0 Plan your investigation 0 Conduct the investigation 0 Complete the case report 0 Critique the case lmnle Civil Investigation 0 Most cases in the corporate environment are considered lowlevel investigations 0 Or noncriminal cases 0 Common activities and practices 0 Recover specific evidence 39 Suspect s Outlook email folder PST file 0 Covert surveillance I Its use must be well defined in the company policy I Risk of Civil or criminal liability 0 Sniffing tools for data transmissions 0 Allows network administrators to determine what data is being transmitted over the network server Sample Criminal Investigation 0 Computer crimes examples 0 Fraud 0 Check fraud 0 Homicides 0 Need a warrant to start seizing evidence 0 Limit searching area Reviewing Bz mround Information for a Case 0 Company called Superior Bicycles 0 Specializes in creating new and inventive modes of humandriven transportation 0 Two employees Chris Murphy and Nau Tjeriko have been missing for several days 0 A USB thumb drive has been recovered from Chris s office with evidence that he had been conducting a side business using company computers Identifvin2 the Case Requirements 0 Identify requirements such as 0 00000 Nature of the case Suspect s name Suspect s activity OS on suspect s computer Media needed to be examined Suspect s hardware and software specifications Planning Your Investigation 0 List what you can assume or know 0 O 0 Several incidents may or may not be related Suspect s computer can contain information about the case If someone else has used suspect s computer 0 Make an image of suspect s computer disk drive 0 Analyze forensics copy Conducting the Investigation Acquiring Evidence with AccessDail FTK 0 Functions 0 0 Extract the image from a bit stream image file Analyze the image
Are you sure you want to buy this material for
You're already Subscribed!
Looks like you've already subscribed to StudySoup, you won't need to purchase another subscription to get this material. To access this material simply click 'View Full Document'