Guide to Computer Forensics

and Investigations
Sixth Edition

Chapter 1
Understanding The Digital Forensics Profession
and Investigations

1
 Objectives

• Describe the field of digital forensics

• Explain how to prepare computer investigations and summarize the difference
between public-sector and private-sector investigations
• Explain the importance of maintaining professional conduct
• Describe how to prepare a digital forensics investigation by taking a systematic
approach
• Describe procedures for private-sector digital investigations
• Explain requirements for data recovery workstations and software
• Summarize how to conduct an investigation, including critiquing a case

© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for 2
classroom use.
 An Overview of Digital Forensics (1 of 3)
• Digital forensics
• The application of computer science and investigative procedures for a legal purpose
involving
- the analysis of digital evidence after proper search authority,
- chain of custody,
- validation with mathematics,
- use of validated tools,
- repeatability,
- reporting, and
- possible expert presentation.

• In October 2012, an ISO standard for digital forensics was ratified - ISO 27037
Information technology - Security techniques

© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for 3
classroom use.
Digital Forensics and Other Related
Disciplines (1 of 3)

© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for 4
classroom use.
 Digital Forensics and Other Related
Disciplines (2 of 3)

• Vulnerability/threat assessment and risk management

• Tests and verifies the integrity of stand-alone workstations and network servers
• Network intrusion detection and incident response
• Detects intruder attacks by using automated tools and monitoring network firewall
logs
• Digital investigations
• Manages investigations and conducts forensics analysis of systems suspected of
containing evidence

© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for 5
classroom use.
 Preparing for Digital Investigations (1 of 3)

• Digital investigations fall into two categories:

• Public-sector investigations
• Private-sector investigations

© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for 6
classroom use.
Preparing for Digital Investigations (2 of 3)

© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for 7
classroom use.
 Preparing for Digital Investigations (3 of 3)

• Public-sector investigations involve government agencies responsible for

criminal investigations and prosecution
• Fourth Amendment to the U.S. Constitution
• Restrict government search and seizure
• The Department of Justice (DOJ) updates information on computer search and
seizure regularly
• Private-sector investigations focus more on policy violations

© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for 8
classroom use.
 Understanding Law Enforcement Agency
Investigations
• When conducting public-sector investigations, you must understand laws on
computer-related crimes including:
• Standard legal processes
• Guidelines on search and seizure
• How to build a criminal case
• The Computer Fraud and Abuse Act was passed in 1986
• Specific state laws were generally developed later

© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for 9
classroom use.
 Understanding Private-Sector
Investigations (1 of 8)
• Private-sector investigations involve private companies and lawyers who
address company policy violations and litigation disputes
• Example: wrongful termination
• Businesses strive to minimize or eliminate litigation
• Private-sector crimes can involve:
• E-mail harassment, falsification of data, gender and age discrimination,
embezzlement, sabotage, and industrial espionage

© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for 10
classroom use.
 Understanding Private-Sector
Investigations (2 of 8)
• Businesses can reduce the risk of litigation by publishing and maintaining
policies that employees find easy to read and follow
• Most important policies define rules for using the company’s computers and
networks
• Known as an “Acceptable use policy”
• Line of authority - states who has the legal right to initiate an investigation,
who can take possession of evidence, and who can have access to evidence

© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for 11
classroom use.
 Understanding Private-Sector
Investigations (3 of 8)
• Business can avoid litigation by displaying a warning banner on computer
screens
• Informs end users that the organization reserves the right to inspect computer
systems and network traffic at will

© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for 12
classroom use.
Understanding Private-Sector
Investigations (4 of 8)

© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for 13
classroom use.
 Understanding Private-Sector
Investigations (5 of 8)
• Sample text that can be used in internal warning banners:
• Use of this system and network is for official business only
• Systems and networks are subject to monitoring at any time by the owner
• Using this system implies consent to monitoring by the owner
• Unauthorized or illegal users of this system or network will be subject to discipline or
prosecution

© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for 14
classroom use.
 Understanding Private-Sector
Investigations (6 of 8)
• Businesses are advised to specify an authorized requester who has the power
to initiate investigations
• Examples of groups with authority
• Corporate security investigations
• Corporate ethics office
• Corporate equal employment opportunity office
• Internal auditing
• The general counsel or legal department

© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for 15
classroom use.
 Understanding Private-Sector
Investigations (7 of 8)
• During private investigations, you search for evidence to support allegations of
violations of a company’s rules or an attack on its assets
• Three types of situations are common:
• Abuse or misuse of computing assets
• E-mail abuse
• Internet abuse
• A private-sector investigator’s job is to minimize risk to the company

© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for 16
classroom use.
 Understanding Private-Sector
Investigations (8 of 8)
• The distinction between personal and company computer property can be
difficult with cell phones, smartphones, personal notebooks, and tablet
computers
• Bring your own device (BYOD) environment
• Some companies state that if you connect a personal device to the business network,
it falls under the same rules as company property

© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for 17
classroom use.
 Preparing a Digital Forensics Investigation

• The role of digital forensics professional is to gather evidence to prove that a

suspect committed a crime or violated a company policy
• Collect evidence that can be offered in court or at a corporate inquiry
• Investigate the suspect’s computer
• Preserve the evidence on a different computer
• Chain of custody
• Route the evidence takes from the time you find it until the case is closed or goes to
court

© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for 18
classroom use.
 An Overview of a Computer Crime

• Computers can contain information that helps law enforcement determine:

• Chain of events leading to a crime
• Evidence that can lead to a conviction
• Law enforcement officers should follow proper procedure when acquiring the
evidence
• Digital evidence can be easily altered by an overeager investigator
• A potential challenge: information on hard disks might be password protected,
so forensics tools may need to be used in your investigation

© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for 19
classroom use.
 An Overview of a Company Policy
Violation
• Employees misusing resources can cost companies millions of dollars
• Misuse includes:
• Surfing the Internet
• Sending personal e-mails
• Using company computers for personal tasks

© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for 20
classroom use.
 Taking a Systematic Approach (1 of 2)
• Steps for problem solving
• Make an initial assessment about the type of case you are investigating
• Determine a preliminary design or approach to the case
• Create a detailed checklist
• Determine the resources you need
• Obtain and copy an evidence drive

• Steps for problem solving (cont’d)

• Identify the risks
• Mitigate or minimize the risks
• Test the design
• Analyze and recover the digital evidence
• Investigate the data you recover
• Complete the case report
• Critique the case

© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for 21
classroom use.
 Assessing the Case

• Systematically outline the case details

• Situation
• Nature of the case
• Specifics of the case
• Type of evidence
• Known disk format
• Location of evidence
• Based on these details, you can determine the case requirements

© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for 22
classroom use.
 Planning Your Investigation

• A basic investigation plan should include the following activities:

• Acquire the evidence
• Complete an evidence form and establish a chain of custody
• Transport the evidence to a computer forensics lab
• Secure evidence in an approved secure container

• A basic investigation plan (cont’d):

• Prepare your forensics workstation
• Retrieve the evidence from the secure container
• Make a forensic copy of the evidence
• Return the evidence to the secure container
• Process the copied evidence with computer forensics tools

© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for 23
classroom use.
 Procedures for Private-Sector High-Tech
Investigations
• As an investigator, you need to develop formal procedures and informal
checklists
• To cover all issues important to high-tech investigations
• Ensures that correct techniques are used in an investigation

© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for 24
classroom use.
 Employee Termination Cases

• The majority of investigative work for termination cases involves employee

abuse of corporate assets
• Incidents that create a hostile work environment are the predominant types of
cases investigated
• Viewing pornography in the workplace
• Sending inappropriate e-mails
• Organizations must have appropriate policies in place

© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for 25
classroom use.
 Internet Abuse Investigations

• To conduct an investigation you need:

• Organization’s Internet proxy server logs
• Suspect computer’s IP address
• Suspect computer’s disk drive
• Your preferred computer forensics analysis tool

• Recommended steps
• Use standard forensic analysis techniques and procedures
• Use appropriate tools to extract all Web page URL information
• Contact the network firewall administrator and request a proxy server log
• Compare the data recovered from forensic analysis to the proxy server log
• Continue analyzing the computer’s disk drive data

© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for 26
classroom use.
 E-mail Abuse Investigations

• To conduct an investigation you need:

• An electronic copy of the offending e-mail that contains message header data
• If available, e-mail server log records
• For e-mail systems that store users’ messages on a central server, access to the server
• Access to the computer so that you can perform a forensic analysis on it
• Your preferred computer forensics analysis tool

• Recommended steps
• Use the standard forensic analysis techniques
• Obtain an electronic copy of the suspect’s and victim’s e-mail folder or data
• For Web-based e-mail investigations, use tools such as FTK’s Internet Keyword Search
option to extract all related e-mail address information
• Examine header data of all messages of interest to the investigation

© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for 27
classroom use.
 Attorney-Client Privilege Investigations

• Under attorney-client privilege (ACP) rules for an attorney

• You must keep all findings confidential
• Many attorneys like to have printouts of the data you have recovered
• You need to persuade and educate many attorneys on how digital evidence can be
viewed electronically
• You can also encounter problems if you find data in the form of binary files

© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for 28
classroom use.
 Industrial Espionage Investigations (1 of 5)

• All suspected industrial espionage cases should be treated as criminal

investigations
• Staff needed
• Digital investigator who is responsible for disk forensic examinations
• Technology specialist who is knowledgeable of the suspected compromised technical
data
• Network specialist who can perform log analysis and set up network sniffers
• Threat assessment specialist (typically an attorney)

© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for 29
classroom use.
 Industrial Espionage Investigations (2 of 5)

• Guidelines when initiating an investigation

• Determine whether this investigation involves a possible industrial espionage incident
• Consult with corporate attorneys and upper management
• Determine what information is needed to substantiate the allegation
• Generate a list of keywords for disk forensics and sniffer monitoring
• List and collect resources for the investigation

© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for 30
classroom use.
 Industrial Espionage Investigations (3 of 5)

• Guidelines (cont’d)
• Determine the goal and scope of the investigation
• Initiate investigation after approval from management
• Planning considerations
• Examine all e-mails of suspected employees
• Search Internet newsgroups or message boards
• Initiate physical surveillance
• Examine facility physical access logs for sensitive areas

© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for 31
classroom use.
 Industrial Espionage Investigations (4 of 5)

• Planning considerations (cont’d)

• Determine suspect location in relation to the vulnerable asset
• Study the suspect’s work habits
• Collect all incoming and outgoing phone logs
• Steps to conducting an industrial espionage case
• Gather all personnel assigned to the investigation and brief them on the plan
• Gather resources to conduct the investigation

© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for 32
classroom use.
 Industrial Espionage Investigations (5 of 5)

• Steps (cont’d)
• Place surveillance systems at key locations
• Discreetly gather any additional evidence
• Collect all log data from networks and e-mail servers
• Report regularly to management and corporate attorneys
• Review the investigation’s scope with management and corporate attorneys

© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for 33
classroom use.
 Interviews and Interrogations in High-Tech
Investigations (1 of 2)
• Becoming a skilled interviewer and interrogator can take many years of
experience
• Interview
• Usually conducted to collect information from a witness or suspect
- About specific facts related to an investigation

• Interrogation
• Process of trying to get a suspect to confess
• Role as a digital investigator
• To instruct the investigator conducting the interview on what questions to ask
- And what the answers should be
• Ingredients for a successful interview or interrogation
• Being patient throughout the session
• Repeating or rephrasing questions to zero in on specific facts from a reluctant witness
or suspect
• Being tenacious
© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for 34
classroom use.
 Understanding Data Recovery
Workstations and Software
• Investigations are conducted on a computer forensics lab (or data-recovery lab)
• In data recovery, the customer or your company just wants the data back
• Computer forensics workstation
• A specially configured PC
• Loaded with additional forensics software
• To avoid altering the evidence, use:
• Write-blockers devices
- Enable you to boot to Windows without writing data to the evidence drive

© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for 35
classroom use.
 Setting Up Your Workstation for Digital
Forensics (1 of 2)
• Basic requirements
• A workstation running Windows 7 or later
• A write-blocker device
• Digital forensics acquisition tool
• Digital forensics analysis tool
• Target drive to receive the source or suspect disk data
• Spare PATA or SATA ports
• USB ports

© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for 36
classroom use.
 Setting Up your Workstation for Digital
Forensics (2 of 2)
• Additional useful items
• Network interface card (NIC)
• Extra USB ports
• FireWire 400/800 ports
• SCSI card
• Disk editor tool
• Text editor tool
• Graphics viewer program
• Other specialized viewing tools

© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for 37
classroom use.
 Conducting an Investigation
• Gather resources identified in investigation plan
• Items needed
• Original storage media
• Evidence custody form
• Evidence container for the storage media
• Bit-stream imaging tool
• Forensic workstation to copy and examine your evidence
• Securable evidence locker, cabinet, or safe

© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for 38
classroom use.
 Gathering the Evidence

• Avoid damaging the evidence

• Steps
• Meet the IT manager to interview him
• Fill out the evidence form, have the IT manager sign
• Place the evidence in a secure container
• Carry the evidence to the computer forensics lab
• Complete the evidence custody form
• Secure evidence by locking the container

© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for 39
classroom use.
 Understanding Bit-Stream Copies (1 of 2)

• Bit-stream copy
• Bit-by-bit copy of the original storage medium
• Exact copy of the original disk
• Different from a simple backup copy
- Backup software only copy known files
- Backup software cannot copy deleted files, e-mail messages or recover file fragments

• Bit-stream image
• File containing the bit-stream copy of all data on a disk or partition
• Also known as “image” or “image file”
• Copy image file to a target disk that matches the original disk’s manufacturer,
size and model

© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for 40
classroom use.
Understanding Bit-stream Copies (2 of 2)

© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for 41
classroom use.
 Acquiring an Image of Evidence Media

• First rule of computer forensics

• Preserve the original evidence
• Conduct your analysis only on a copy of the data
• Several vendors provide MS-DOS, Linux, and Windows acquisition tools
• Windows tools require a write-blocking device when acquiring data from FAT or NTFS
file systems

© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for 42
classroom use.
 Analyzing Your Digital Evidence (1 of 8)

• Your job is to recover data from:

• Deleted files
• File fragments
• Complete files
• Deleted files linger on the disk until new data is saved on the same physical
location
• Tools can be used to retrieve deleted files
• Autopsy

© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for 43
classroom use.
 Analyzing Your Digital Evidence (2 of 8)

• Steps to analyze a USB drive

• Start Autopsy
• Create a new case
• Type the case name
• Select the working folder
• Steps to add source data
• Select data source type
• Select image file
• Keep the default settings in the Configure Ingest Modules window

© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for 44
classroom use.
 Analyzing Your Digital Evidence (3 of 8)

• Steps to display the contents of the acquired data

• Click to expand Views, File Types, By Extension, and Documents
• Select file to display
• Click Tag and Comment
• Click the New Tag Name button
• Analyze the data
• Search for information related to the complaint
• Data analysis can be most time-consuming task

© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for 45
classroom use.
Analyzing Your Digital Evidence (4 of 8)

© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for 46
classroom use.
 Analyzing Your Digital Evidence (5 of 8)

• With Autopsy you can:

• Search for keywords of interest in the case
• Display the results in a search results window
• Click each file in the search results window and examine its content in the data area
• Export the data to a folder of your choice
• Search for specific filenames
• Generate a report of your activities
• Additional features of Autopsy
• Display binary (nonprintable) data in the Content Viewer

© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for 47
classroom use.
Analyzing Your Digital Evidence (6 of 8)

© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for 48
classroom use.
Analyzing Your Digital Evidence (7 of 8)

© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for 49
classroom use.
Analyzing Your Digital Evidence (8 of 8)

© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for 50
classroom use.
 Completing the Case (1 of 2)

• You need to produce a final report

• State what you did and what you found
• Include Autopsy report to document your work
• Repeatable findings
• Repeat the steps and produce the same result
• If required, use a report template
• Report should show conclusive evidence
• Suspect did or did not commit a crime or violate a company policy

© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for 51
classroom use.
 Completing the Case (2 of 2)

• Keep a written journal of everything you do

• Your notes can be used in court
• Answer the six Ws:
• Who, what, when, where, why, and how
• You must also explain computer and network processes
• Autopsy Report Generator
• Can generate reports in different styles: plain text, HTML and Excel

© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for 52
classroom use.
 Critiquing the Case

• Ask yourself the following questions:

• How could you improve your performance in the case?
• Did you expect the results you found? Did the case develop in ways you did not
expect?
• Was the documentation as thorough as it could have been?
• What feedback has been received from the requesting source?
• Did you discover any new problems? If so, what are they?
• Did you use new techniques during the case or during research?

© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for 53
classroom use.
 The End

© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for 54
classroom use.