A COMPREHENSIVE APPROACH TO

DIGITAL INCIDENT INVESTIGATION

An Article Appearing in Elsevier Information Security Technical Report

By Peter Stephenson, CISM, CISSP, CIFI, FICAF

Copyright © 2003 Elsevier Advanced Technology

1
Copyright © 2003 Elsevier Advanced Technology
A COMPREHENSIVE APPROACH TO DIGITAL INCIDENT INVESTIGATION
By Peter Stephenson, CPE, CISM, CISSP, CIFI, FICAF

Abstract. The investigation of digital incidents and computer-related crimes has, over
the past 18 months, become increasingly complex. Although the majority of digital
incidents investigated by law enforcement still comprise child pornography, on-line
frauds and other common crimes, two disturbing trends have emerged. First, digital
incidents are becoming more complex and, second, they are becoming more expensive to
investigate.

Attacks such as the recent SQLSlammer worm affect tens of thousands of corporate
computer users. Attackers are bouncing attacks off of home computers connected to the
Internet by DSL and cable modem. Many of these home computers have no firewall and
are left turned on most of the time. Attackers, recognizing the importance of anonymity,
use these unprotected PCs to launch and further attacks against corporate targets.

The need for a comprehensive incident investigation technique is becoming obvious. This
paper discusses one such technique: End-to-End Digital Investigation or “EEDI”. EEDI
is a very structured approach to conducting complex digital investigations using the
investigation framework developed by the Digital Forensics Research Workshop1
(DFRWS). The EEDI process allows investigators to use a very structured investigation
technique that mixes computer technology with traditional investigative methods. In
trials during actual investigations as well as in presentations to law enforcement and
civilian practitioners EEDI has received a positive response.

A primary advantage of EED is its ability to feed a formal modeling program. By using a
specialized process language such as the Digital Investigation Process Language
(DIPL), investigators can model investigations and compare their models with
standardized benchmark models of idealized investigations. EEDI and DIPL are not
intended for use in simple digital forensic examinations. Rather, they are most useful in
complex investigations where other sophisticated tools such as link analyzers are also in
use.

In this paper we will describe the underlying background for EEDI, the EEDI process
and the top level approach using the DIPL. We begin with some background.

1
. "A Road Map for Digital Forensics Research 2001." Digital
Forensics Research Workshop 6 November (2001)
2
Copyright © 2003 Elsevier Advanced Technology
INTRODUCTION investigative resources and, if possible, find
ways around the gaps. One approach is to
analyze what is available in minute detail. This
The Underlying Issues can be problematic. Digital investigations are
distinguished from other types of investigations
As pointed out in the abstract to this paper, the in two very important ways. First, they may be
state of digital crime is that it is increasing in remote crimes. That means that the attack was
both complexity and quantity. The recent initiated at some indeterminate distance from the
Computer Security institute/Federal Bureau of target. The attacker may have used any of a
Investigation computer crime and security survey number of techniques to obfuscate his or her true
reported almost half a billion dollars (USD) in location. The crime scene, literally, could extend
quantified financial loss with 74% reporting their around the world to a cyber café in a third world
Internet connection as the key point of attack. country.

The SQLSlammer worm, as an example, shut The second distinguishing factor is the amount
down entire sections of the Internet (Korea, as an of data available to analyze. In a serious digital
example) for up to six hours. To the date of this incident there can be terabytes of data that may
writing, the exact source of the worm has not (or may not) contain bytes of evidence.
been traced. This writer participated in an Analyzing digital attack data can be like looking
incident post mortem for a large multi-national for a one-inch needle in a haystack the size of
organization and found that, once the worm was North America. This problem is exacerbated by
inside the organization’s enterprise, it became the fact that the investigator does not even know
very difficult to locate its precise entry point. that the needle exists or, if it does, what it looks
like. Structuring a complex digital investigation
Attacks using multiple sources, such as requires that some very important factors be
compromised computers on the Internet addressed:
(“zombies”) used in some types of distributed
denial of service, are extremely difficult to trace • What is the nature of the incident?
and, in some cases, impossible given available • How can we be sure that there even was
information and trace back techniques. an incident?
Penetrations resulting in massive data loss may • What was the entry point into the target
be equally difficult. Earlier this year a system? Was there only one?
penetration into a US credit card processing
• What would evidence of an attack look
service resulted in the theft of approximately 8
like? What are we looking for?
million credit card numbers. The exact source of
• What legal issues need to be addressed
the attack has yet to be located. It is conceivable
(policies, privacy, subpoenas, warrants,
that such an attack could wreck such financial
etc.)?
havoc on the victim that toe organization would
collapse and go out of business. • Who was in a position to cause/allow
the incident to occur?
A big part of the reason that such attacks are • What security measures were in place at
difficult to trace is that the targets, effectively, the time of the incident?
“ask for it” by not preparing their systems to • What non-technical (business) issues
sustain an investigation. In both of the instances may have impacted the success or
cited above the victim organizations were not failure of the attack?
prepared to defend their computing infrastructure • Who knew what about the attack and
from a determined attack and they were not when did they know it?
prepared to investigate the attack once it was • Etc.
successful. Standard information protection
countermeasures were not in place in either case In a complex attack these questions comprise,
and there were no effective logs, monitoring or often, several parallel investigative threads.
other forensic information sources available with Sometimes these threads converge and
which to investigate the attack. sometimes they don’t. Investigating digital
crime is not like investigating any other crime, at
In such instances the investigator needs the least not exactly. However, it has much in
ability to pinpoint exactly what is lacking in
3
Copyright © 2003 Elsevier Advanced Technology
common with certain aspects of traditional nature of digital forensics, for example, centers
investigation. upon the fear by practitioners that by
characterizing digital forensics as science, they
The overriding difference is complexity. There will be required to become scientists. Nothing
is no other type of crime with the potential for could (or, probably, should) be farther from the
complexity that digital crime has. It is that very truth, at least not in the stereotypical sense.
complexity that makes the digital world ideal as
a venue for conducting traditional crimes such as While, to be sure, there may be a place for the
fraud, theft and extortion. In order to investigate stereotypical scientist in the digital forensic
complex digital incidents successfully, the world, that place probably is not in the field
investigator needs tools, techniques and methods conducting routine investigations. That does not
that far surpass the tools, techniques and mean that those in the field do not need to use
methods required by investigators of non-digital some basic scientific principles as the basis for
crime. their work. This may be the main difference
between digital forensic science and other
The Genesis of a Solution forensic sciences. There are other forensic
sciences, forensic pathology for example, that
are the pure domain of scientists. Digital
There are two ongoing debates within the digital forensic science is, however, a mixed bag of
investigative community that have relevance. investigators, digital forensic examiners and
The first is whether it is better to try to make an digital forensic scientists. They have a common
investigator out of a technologist or to teach ground however: reliable methods of inquiry.
technology to an investigator. The second debate
is whether digital investigation, and, by Jon Nordby, writing in Forensic Science - An
extension, digital forensics, is art, technology or Introduction to Scientific and Investigative
science. The only response to the first debate Techniques2 tells us that the common ground
appropriate to this paper is that the writer has between theoretical and forensic science is
seen both approaches work and it is unlikely that reliable methods of inquiry that possess
the debate ever will be settled to everyone’s characteristics of integrity, competence,
satisfaction. defensible technique and relevant experience.
It is the second issue that impacts the techniques Nordby goes on to discuss the scientific method.
we discuss here. First, the writer would not Using his approach we begin to see where art,
disagree that there is, indeed, art in the technology and science converge in digital
investigation of cyber or any other type of crime. forensics and digital investigation.
It is that art that provides the unexplainable
intuition plentiful in talented investigators, Basically, and simplistically, we know that the
regardless of their level of investigation. scientific method requires that we form
Forensic examiners are as much investigators as hypotheses and the test those hypotheses with
the Sherlock Holmes style detective. evidence. This is the approach a good
investigator uses, whether he or she is
Digital investigation, perhaps more than any investigating a crime or performing a forensic
other type of detection, involves technology. examination of evidence. However, Nordby is a
The landscape for digital crime is, potentially, bit more specific in his discussion of the
highly technical. The tools and techniques used scientific method. He forms the framework for
can be highly technical. In short, we see a his definition by clarifying his view of
technical landscape for technical crimes investigative science:
requiring a technical solution. Mix that with the
art and we begin to see how a combination of art “Whatever the scientific investigation at
and technology defines the cyber gumshoe. issue, how one’s scientific opinion is
constructed mirrors the certainty of the
Arguably, technology is the practical output of result. Certainty, in the medical and
science. However, when we think of science in
the context of digital investigation and forensics,
2
things become a bit more murky – a bit less Forensic Science – An Introduction to Scientific and
simplistic. Part of the debate about the scientific Investigative Techniques ed. James and Nordby, pub CRC
Press, 2003
4
Copyright © 2003 Elsevier Advanced Technology
 scientific sense, remains determined by Adding the Legal Dimension
the method of derivation applied in the
investigation. Medical and scientific Nordby and others have defined forensic science
certainty remains distinctly independent as the application of natural science to matters of
from either absolute certainty or mere law. That clearly frames the context for
mathematical probability.” forensics of any kind. However, digital forensics
and digital investigation do not derive from the
He then goes on to detail “…some of the many natural sciences. Rather they derive from
features reliable methods implement, enabling computer science and mathematics. Thus we
the productive scientific investigation of facts might extend the common definition of forensic
before the court.” science, in the case of digital forensic science, as
the application of computer science and
“Reliable methods mathematics to matters of law. The clear
common ground here, of course, is that we
• Help distinguish evidence from applying science to the law.
coincidence without ambiguity.
• Allow alternative results to be ranked So, we must look to the law for help in how we
by some principle basic to the sciences practice our science, and, most especially, the
applied. tools, methods and techniques that we use. The
• Allow for certainty considerations clear guidance here comes from Daubert v
wherever appropriate through the Merrell Dow Pharmaceuticals. This landmark
ranking of relevant available case has, along with a few others not quite as
alternatives. important, defined what it means to present
• Disallow hypotheses more scientific evidence in a court of law in the United
extraordinary than the facts themselves. States. Out of that case we have the four
• Pursue general impressions to the level “Daubert Tests” for scientific method and the
of specific details. evidence gathered therewith:
• Pursue testing by breaking hypotheses
(alternative explanations) into their 1. Whether the theory or technique in
smallest logical components, risking question can be and has been tested.
one part at a time. 2. Whether it has been subjected to peer
• Allow tests either to prove or disprove review and publication.
alternative explanations (hypotheses).” 3. Its known potential rate of error along
with the existence and maintenance of
Thus we probably can say with a fair amount of standards controlling the technique’s
confidence that a competent digital investigator operation.
or forensic examiner will apply “science” in his The degree of acceptance within the
or her work if that work is to be successful. relevant scientific community.

This scientific approach effectively ends the These four tests help us determine how we apply
debate because we are not, necessarily, referring reliable methods in the context of digital
to stereotypical scientists with PhDs, dressed in forensics. Certainly, if we wish digital forensics
white lab coats carrying out their duties in sterile to be considered scientifically valid, we must
clean-room laboratories as the definition of the show that our tools methods and techniques are
digital forensic practitioner. Rather, we are defensible, both from a technical and scientific
referring to individuals who exhibit integrity and perspective and from the perspective of the law.
competence in their investigative approach. They This is where constructs such as EEDI and DIPL
use defensible techniques and possess relevant are of significant value.
experience. In short, they are professionals who
use reliable methods of inquiry. Digital
forensics, then, takes its rightful place with the
other forensic sciences.

5
Copyright © 2003 Elsevier Advanced Technology
 IDENTIFICATION PRESERVATION COLLECTION EXAMINATION ANALYSIS PRESENTATION
Event/Crime Case
Preservation Preservation Preservation Documentation
Detection Management
Resolve Imaging Approved
Traceability Traceability Expert Testimony
Signature Technologies Methods
Approved Validation
Profile Detection Chain of Custody Statistical Clarification
Software Techniques
Anomalous Approved Filtering Mission Impact
Time Synch. Protocols
Detection Hardware Techniques Statement
Legal Pattern Recommended
Complaints Data Mining
Authority Matching Countermeasure
System Lossless Hidden Data Statistical
Timeline
Monitoring Compression Discovery Interpretation
Hidden Data
Audit Analysis Sampling Link
Extraction
Data
Spatial
Reduction
Recovery
Techniques

Figure 1- The DFRWS Digital Investigation Framework

Thus, we now have set the stage, both The DFRWS Framework classes contain key
scientifically and legally, for the introduction of elements that are under constant review by the
tools and techniques that allow us to bring digital digital forensics community. However, there is a
forensic science into the courtroom regardless of continuity between the classes that is important.
the complexity of the investigation or incident For example, we note that the Preservation class
being investigated. continues as an element of the Collection,
Examination and Analysis classes. This
indicates that preservation of evidence, as
characterized by case management, imaging
ESTABLISHING A PLATFORM technologies, chain of custody and time
FOR EEDI – AN INVESTIGATIVE synchronization, is an ongoing requirement
FRAMEWORK throughout the digital investigative process. Thus
preservation is “…a guarded principle across
The Digital Forensics Research Workshop ‘forensic’ categories3.” Traceability, likewise, is
(DFRWS) in the document cited earlier lays out a guarded principle, but not across all forensic
a framework for the digital investigative process. categories.
This framework, shown in Figure 1 above,
consists of six classes of tasks that the While space does not permit us to provide a
investigator must complete in the conduct of a detailed discussion of each of the elements of the
digital investigation. Within those six classes Framework, a description of the classes is
exist individual tasks called elements. At least important4.
one element in each class is required and in some
cases the investigator will apply multiple The Identification Class
elements to the investigation. The DFRWS
positions the tasks of the digital forensic The purpose of the identification class describes
examiner within the context of a digital the method by which the investigator is notified
investigation. In current practice that may or of a possible incident. Since about 50% of all
may not mean that the examiner and investigator reported incidents have benign explanations5,
are the same individual.

3
See footnote 1
4
The descriptions of DFRWS classes are taken from
“Structured Investigation of Digital Incidents in Complex
Computing Environments” PhD thesis (unpublished) by Peter
Stephenson, Oxford Brookes University, Oxford, UK
5
Author’s experience over 20 years of conducting incident
response
6
Copyright © 2003 Elsevier Advanced Technology
processing evidence in this class is critical to the data collection. The validity of techniques used
rest of the investigation. Likewise, as it is the in analysis of potential evidence impact directly
first step in the EEDI process, it is the only the validity of the conclusions drawn from the
primary evidence6 not corroborated directly by evidence and the credibility of the evidence
other primary evidence. Therefore, a more chain constructed therefrom. The Analysis Class
significant amount of secondary evidence is contains, and is dependent upon, the Preservation
needed to validate the existence of an actual Class and the Traceability element of the
event. Examination Class.

The Preservation Class The various elements of the Analysis Class refer
to the means by which a forensic examiner or
investigator might develop a set of conclusions
The Preservation Class deals with those elements regarding evidence presented from the other five
that relate to the management of items of classes. As with all elements of the Framework
evidence. The DFRWS describes this class as a clear understanding of the applicable process is
“…a guarded principle across ‘forensic’ required. Wherever possible, adherence to
categories.” The requirement for proper evidence standard tools, technologies and techniques is
handing is basic to the digital investigative critical.
process as it relates to legal actions.
Finally, when mapping this class to the DIPL or
The Collection Class when performing model checking, we are
concerned solely with the process, not the results
The Collection Class is concerned with the of the analysis or the detailing of the contents of
specific methods and products used by the evidentiary items.
investigator and forensic examiner to acquire
evidence in a digital environment. As has been The Link element is the key element used to
noted, the Preservation Class continues as an form a chain of evidence. It is related to
element of this Class. With the exception of the traceability and, as such, is a required element.
Legal Authority element, the elements of this
class are largely technical. The Presentation Class

The Examination Class This class refers to the tools and techniques used
to present the conclusions of the investigator and
The Examination Class deals with the tools and the digital forensic examiner to a court of
techniques used to examine evidence. It is enquiry or other finder of fact. Each of these
concerned with evidence discovery and techniques has its own elements and a discussion
extraction rather than the conclusions to be of expert witnessing is beyond the scope of this
drawn from the evidence (Analysis Class). thesis. However, for our purposes we will
While the Collection Class deals with gross stipulate that the EEDI process emphasizes the
procedures to collect data that may contain use of timelines as an embodiment of the
evidence (such as imaging of computer media), Clarification element of this class.
the Examination Class is concerned with the
examination of that data and the identification SOME IMPORTANT EEDI
and extraction of possible evidence from it. Note DEFINITIONS
that the Preservation Class continues to be
pervasive in this class.
Before we continue, we need to define some key
EEDI concepts. These definitions are taken from
The Analysis Class the writer’s PhD thesis (see footnote 4).

The Analysis Class refers to those elements that Definition 1: Primary evidence
are involved in the analysis of evidence
collected, identified and extracted from a gross
Primary evidence is evidence that is corroborated
6 by other pieces of primary evidence and, in turn,
The concepts of primary and secondary evidence are
discussed later corroborates additional primary evidence in a
7
Copyright © 2003 Elsevier Advanced Technology
chain of evidence. Primary evidence makes up from computer devices, networks and media. By
the evidence chain in a digital investigation. “approved” we mean those tools and techniques
Primary evidence may, in turn, be corroborated generally accepted by the discipline and the
additionally by secondary evidence. In special courts where collected evidence will be
circumstances, such as the first piece of evidence presented.
in a chain, sufficiently clear and obvious
evidence (such as evidence that a computer has Definition 5: Digital forensic
been the victim of an attack) may be considered
primary evidence if it is corroborated by a correlation
significant body of secondary evidence and, in
turn, corroborates other primary evidence. The comparison of evidentiary information from
a variety of sources with the objective of
discovering information that stands alone, in
Definition 2: Secondary evidence concert with other information, or corroborates
or is corroborated by other evidentiary
Secondary evidence is evidence that is not, itself, information.
corroborated but may serve to corroborate
primary evidence. Secondary evidence rarely
stands alone credibly since it does not have Definition 6: Digital forensic
anything to support it directly. Secondary normalization
evidence may be circumstantial, for example.
The presence of secondary evidence in sufficient The combining of evidentiary data of the same
quantity and of sufficient quality may, however, type from different sources with different
serve to tell a compelling story of how a series of vocabularies into a single, integrated
digital events occurred. terminology that can be used effectively in the
correlation process.
These first two definitions lead to the First Rule
of End-to-End forensic digital analysis: Definition 7: Digital forensic
Primary evidence should be deconfliction
corroborated by at least one other
piece of relevant primary evidence to The combining of multiple reportings of the
be considered a valid part of the same evidentiary event by the same or different
evidence chain. Evidence that does reporting sources, into a single, reported,
not fit this description, but does serve normalized evidentiary event.
to corroborate some other piece of
evidence without itself being Definition 8: Digital forensic data
corroborated, is considered to be fusion
secondary evidence.
The process by which all of the available
evidentiary data is analyzed and correlated into a
single consistent representational model such as
Definition 3: Forensic digital analysis a timeline.

Forensic digital analysis refers to the use of the

techniques of digital forensic science to perform THE EEDI PROCESS
analysis of digital events or data, whether on
computer networks or on computer media. The End-to-End Digital Investigation process is
a collection of generalized steps to be taken in
Definition 4: Forensic digital evidence conjunction with the DFRWS Framework.
collection While the Framework gives a roadmap for
addressing those issues comprising a formal
The use of approved tools and techniques by investigation, the EEDI process provides a set of
trained technicians to obtain digital evidence steps the investigator must perform in order to

8
Copyright © 2003 Elsevier Advanced Technology
preserve, collect, examine and analyze digital some sort. That compromise may include
evidence. unauthorized disclosure or modification of a
system or its data or destruction of the system or
Here, we present that collection of steps and its data. An incident becomes a crime when a
some top level descriptions. Space does not law or laws is/are violated.
permit us more detail, however, the following
should be ample to explain the approach and the As soon as possible, in the context of an
basic methods used to translate the DFRWS incident, collecting evidence from all possible
Framework into a practical investigative process. locations where it may reside must begin. The
methods vary according to the type of evidence
We apply the EEDI process to each class of the (forensic, logs, indirect, traditionally developed,
Framework as appropriate. Note that this etc.). It is important to emphasize that EEDI is
application of process is not slavish in that we do concerned not only with digital evidence.
not map, one-for-one, process onto framework. Gathering witness information should be
Rather, we apply the Framework to the process accomplished as early in the evidence collection
in the context of ensuring that we do not miss process as possible. Witness impressions and
important elements of the investigation as information play a crucial role in determining the
defined by the Framework. The Framework, steps the forensic examiner must take to uncover
then, does not represent a series of investigative digital evidence.
steps. Instead, it represents critical elements of
the digital investigation. EEDI represents the Critical in this process are:
application of process to those elements.
• Images of effected computers
The basic End-to-End process consists of: • Logs of intermediate devices,
especially those on the Internet
• Collecting evidence • Logs of effected computers
• Analysis of individual events • Logs and data from intrusion
• Preliminary correlation detection systems, firewalls, etc.
• Event normalizing
• Event deconfliction
• Second level correlation (consider Analysis of Individual Events
both normalized and non-
normalized events) An alert or incident is made up of one or more
• Timeline analysis individual events. These events may be
• Chain of evidence construction duplicates reported in different logs from
• Corroboration (consider only non- different devices. These events and duplications
normalized events) have value both as they appear and “normalized”
(see below). The first analysis effort should be
Collecting Evidence to examine these isolated events and assess what
value they may have to the overall investigation
The collection of evidence in a computer security and how they may tie into each other.
incident is very time sensitive. When an event
occurs we have the first warning of a potential Preliminary Correlation
incident. An event may not be, by itself,
particularly noteworthy. However, taken in the The first correlation step is to examine the
context of other events, it may become extremely individual events and see how they may correlate
important. From the forensic perspective we into a chain of evidence. The main purpose is to
want to consider all relevant events whether they understand in broad terms what happened, what
appear to have been tied to an incident or not. systems or devices were involved and when the
From the definitive point of view, then, events events occurred.
are the most granular elements (at the “atomic”
level) of an incident.

An incident is defined as a collection of events

that lead to, or could lead to, a compromise of
9
Copyright © 2003 Elsevier Advanced Technology
Event Normalizing Corroboration

There may be some events that are reported from In this stage we attempt to corroborate each
multiple sources using different syntaxes. piece of evidence and each event in our chain
During part of the analysis (timeline analysis for with other, independent, evidence or events. For
example) these duplications must be eliminated. this we use the non-correlated event data as well
This process is known as normalizing. EEDI as any other evidence developed either digitally
uses, eventually, both normalized and non- or traditionally. The best evidence is that which
normalized events. has been developed digitally and corroborated
through traditional investigation or vice versa.
Event Deconfliction The final evidence chain consists of primary
evidence corroborated by additional secondary
evidence. This chain will consist of both digital
Sometimes events are reported multiple times and traditional evidence.
from the same source. An example is a denial of
service attack where multiple packets are The overall EEDI process does not differ
directed against a target and each one is reported materially between an investigation and an event
by a reporting resource. The EEDI process post mortem.
should not count each of those packets as a
separate event. The process of viewing the
packets as a single event instead of multiple TOOLS AND TECHNIQUES USED
events is called deconfliction. WITHIN EEDI

Second Level Correlation Implementation of EEDI in very complex digital

environments requires some basic tools and
This is just an extension of earlier correlation techniques not common in other investigation
efforts. However, at this point views of various types. Some of these tools and techniques are in
events have been refined through normalization use in other types of investigations such as
or deconfliction. complex cases of fraud. We describe, briefly, a
few of those tools and techniques.

Timeline Analysis
Determining if an Attack Actually
In this step normalized and deconflicted events Occurred
are used to build a timeline. This is an iterative
process and should be updated constantly as the As mentioned earlier, a significant proportion of
investigation continues to develop new evidence. apparent attacks are, simply, anomalous network
The entire event analysis, correlation, or computer events. Often, the Identification
deconfliction and timeline analysis is iterative. class will present such an event as “security-
relevant” (for example, signature resolution,
anomalous detection and certain types of system
Chain of Evidence Construction monitoring can give false positives resulting in a
reported event).
Once there is a preliminary timeline of events,
the process of developing a coherent chain of While there are a number of ways to investigate
evidence begins. Ideally each link in the chain, the actual nature of such a report, there is one
supported by one or more pieces of evidence, way that, often, can act as an important “sanity
will lead to the next link. That rarely happens in check”. It is important to note that this, and
large-scale network traces, however, because other EEDI techniques, should never be taken in
there often are gaps in the evidence-gathering isolation. No result of a single test is absolute.
process due to lack of logs or other missing The need for corroboration is critical. That
event data. criticality is nowhere as important as it is in the
Identification class because making a wrong
determination at that point in the investigation
creates a series of investigative steps that

10
Copyright © 2003 Elsevier Advanced Technology
proceed from a false premise: that an attack pre-attack activities, there is a probability of
occurred when it actually did not. intent. As in all EEDI techniques, it is important
to corroborate this finding with secondary
This technique involves taking deconflicted and evidence.
normalized data for all security-relevant events
from some point in time preceding the incident Determining if a Source Address Has
and mapping them onto a standard spreadsheet
on a day-by-day basis. Thus, the investigator has Been Spoofed
a sheet where for each day there are some
number of occurrences of each event, recorded A clever attacker will attempt to obfuscate his or
by all reporting sources and fully her true location by impersonating, or “spoofing”
normalized/deconflicted to present the simplest a different source IP address from his or her
picture of events over time. actual address. This requires one of two things.
The first possibility is that the attacker locates an
The second step is to graph this spreadsheet. IP address somewhere on the Internet (or within
Note the peaks of pre-incident events. the enterprise if the attack is internal to the
Investigate those events and determine if there is organization) that is not in current use. The
a benign (from the security perspective) attacker configures his or her computer for that
explanation for them. If the investigator can address. Of course, this usually means that, due
provide plausible explanations for all pre- to the nature of Internet routing, not data will
incident events of consequence, there probably return to the attacker, but this technique usually
was no attack. Again, be sure to corroborate this is used for “one-way” attacks such as planting
finding using other investigative techniques. Trojan horses.

The second method requires that the attacker

Determining Premeditation disable the computer with the legitimate address
before assuming that address for his or her
In most criminal laws the element of intent is computer. In both cases it is likely that the
important in determining if the law has been actual location of the attacker is a different
violated. This technique, to help determine number of hops from the victim than is the
intent, is an extension of that for determining if location of the spoofed address.
an attack has taken place. There is an important
caveat here, however. Not all intentional attacks Researchers at the University of Michigan and
exhibit pre-incident activity. In these cases both Cal. Tech. have developed a technique for
techniques (determining premeditation and determining the probability that an address is
determining the existence of an attack) are, of being spoofed.7 The technique is as follows:
course, invalid.
• Extract the final TTL from the packet
To determine intent, take the same graph header – call it T
prepared in the technique of determining if an • Extract the source address from that
attack occurred. Examine the peaks for two packet – call it S
important characteristics: the nature of the event • Infer the initial TTL from the type of
and the source of the event. The nature of the packet, standards, etc. (remembering
event should represent a logical event preceding that a packet can be crafted with a
an attack. Examples include probes, port scans different TTL than the standard) – call
and other reconnaissance activities. that To
• Calculate the hop count (Hc) by Hc =
The source of the event is more difficult because
To – T
source addresses are easy to spoof. We address
• Perform a trace route (try several to
spoofing in the next topic. The pre-incident
ensure that you have a good average
events should be traceable to the same source or
group of sources in the case of a cooperative
attack (one where more than a single source
7
participates in the attack). If the investigator can “Hop-Count Filtering: An Effective Defense Against
achieve the goal of identifying a common source Spoofed Traffic”, Jin, Chang, Haining Wang, Kang G. Shin,
or set of common sources and a set of logical U Michigan & CalTech

11
Copyright © 2003 Elsevier Advanced Technology
 number of hops) to S to get the stored The Digital Investigation Process
hop count, Hs Language (DIPL)
• If Hc ≠ Hs you may have a spoofed
packet.
DIPL is a formal process language, loosely
derived from LISP, that allows the
Knowing that the packet may be spoofed is, at
characterization of an investigation in formal
least, a great time saver. If the real address is not
terms. Without going into the language in detail,
in use, of course, your attempt to traceroute will
we may describe it as formal (mathematically
end in failure and the rest of the technique
provable), list-oriented and built upon its own
becomes unnecessary.
syntax and vocabulary. It is not a computer
language and does not contain such constructs as
Using Link Analysis looping or if-then-else. Figure 2 shows a very
brief example of a listing.
Link analysis is a technique borrowed from
complex fraud investigations. Powerful link (ManageCase
analyzers such as I28 are able to collect such (Initiator
important data as IP address pairs and search for (RealName ‘Peter Stephenson’)
correlations between them. We will not expound )
(CaseName ‘Case123’)
upon the specifics of the techniques here, but
(BeginTime 21:05 1 Jan 1998)
briefly, the idea is to use link analysis to infer )
solutions to holes in the chain of evidence. (TraceAuthority
(ApprovedSoftware
It is not uncommon for a back trace on a (Tool
complex network such as the Internet to result in (ProgramName ‘SafeBack’)
points where no evidence is obviously available. (VersionNumber ‘3.0’)
Examples are sites without logs, situations where )
(Citation
addresses have been spoofed and instances (CaseName ‘joe v volcano’)
where evidence is, at best, murky and difficult or )
impossible to corroborate. )
)
What is required to use link analysis effectively
to infer solutions to these problems is a very Figure 2 – An Example of a DIPL Listing
comprehensive set of IP address pairs from as
many locations in the verified chain of evidence
In this example we show that the investigator
as possible. Sources for these address pairs are
(Peter Stephenson) has opened his case notes for
intrusion detection systems, host logs, firewall
Case Number 123 on 1 January 1998 at 21:05.
logs, router routing tables and sniffer traces.
He then established that the tool being used was
SafeBack version 3.0 and that it had been court
The link analyzer looks for associations in these
challenged in a case called joe v. volcano. The
address pairs, one pair with another, and reports
language actually is capable of far more complex
the associations allowing the investigator to infer
representations and is acceptably rich for the
individual routes within the suspected attack
purpose of characterizing the investigative
path. While it is true that inference is not
process fully.
evidence, inference does, often, provide
substantial leads that, when followed, may result
in hard evidence or, at least, corroboration of
other evidence. SUMMARY

The EEDI process offers a comprehensive

approach to complex digital investigations. Its
primary benefit is its ability to allow an
investigator to use and document a scientific
approach, consistent with the Daubert tests, to
solve, document and present a complex digital
8
http://www.i2inc.com/ investigation. Additionally, it lends itself to
12
Copyright © 2003 Elsevier Advanced Technology
future enhancements such as case modeling and
simulation.

Author Bio:

Peter Stephenson, Executive Director of the

International Institute for Digital Forensic
Studies, is a writer, consultant, researcher and
lecturer in information protection and forensics
on large-scale computer networks. He has
spoken extensively on digital forensics and
security, and has written or contributed to 14
books and several hundred articles in major
national and international trade publications. He
has lectured and delivered consulting
engagements for the past 17 years in eleven
countries plus the United States.

He may be reached at:

[email protected].

13
Copyright © 2003 Elsevier Advanced Technology