module 18 - resources.thepowerlms.com
TRANSCRIPT
EXPLAINING DIGITAL FORENSICS
Module 18
EXPLAIN KEY ASPECTS OF DIGITAL FORENSICS DOCUMENTATION
Topic 18A
4.5 Explain the key aspects of digital forensics
SYLLABUS OBJECTIVES COVERED
Collecting evidence from computer systems to a standard that will be accepted in a court of law
Evidence, documentation, and admissibilityLatent evidenceCollection must be documented
Due process
Legal hold – evidence in court must be preserved
Chain of custodyIntegrity and proper handling of evidence from collection, to analysis, to storage, and finally to presentation
KEY ASPECTS OF DIGITAL FORENSICS
Summarizes contents of the digital data
Conclusions from the investigator's analysis
Professional ethicsAnalysis must be performed without biasAnalysis methods must be repeatable
Evidence must not be changed or manipulated
DIGITAL FORENSICS REPORTS
Means of filtering and storing the Electronically Stored Information (ESI) found in forensics
Processes includeIdentify and de-duplicate files and metadataSearch
Tags Security Disclosure
E-DISCOVERY
VideoRecord all actionsLog/video steps taken
Witness interviewsInformal statementsAvoid leading questionsFormal questioning
VIDEO AND WITNESS INTERVIEWS
TIMELINES
Sequence of events
Time stampsOS/file system methods for recording time
Correct synchronization of local time source
Time offsetCoordinated Universal Time (UTC)Local time
Date/time settings tamperingScreenshot: Autopsy - the Sleuth Kit(sleuthkit.org/autopsy.)
Collect data from network logging servers
Packet capturesRetrospective Network Analysis (RNA)
Record collection methods to establish provenance
EVENT LOGS AND NETWORK TRAFFIC
Re-examine logs for signs of intrusion
CounterintelligenceAnalyze adversary tactics, techniques, and procedures (TTP)Develop better control configurations
Strategic intelligenceInform risk management and security control provisioning to build mature cybersecurity capabilities
STRATEGIC INTELLIGENCE AND COUNTERINTELLIGENCE
EXPLAIN KEY ASPECTS OF DIGITAL FORENSICS EVIDENCE ACQUISITION
Topic 18B
4.1 Given a scenario, use the appropriate tool to assess organizational security
4.5 Explain the key aspects of digital forensics
SYLLABUS OBJECTIVES COVERED
DATA ACQUISITION AND ORDER OF VOLATILITY
Legal seizure and search of devicesComputer on/off state – shutdown or powered off (“frozen”)Order of volatility
1. CPU registers and cache memory 2. Non-persistent system memory (RAM)3. Data on persistent storage
Partition data and file system artefactsCached system memory data (pagefiles and hibernation files)Temporary file cachesUser, application, and OS files and directories
4. Remote logging and monitoring data5. Physical configuration and network topology6. Archival media
EnCase Forensic and The Forensic Toolkit (FTK)Commercial case management and evidence acquisition and analysis
The Sleuth Kit/AutopsyOpen-source case management and evidence acquisition and analysis
WinHex Forensic recovery and analysis of binary data
The Volatility Framework System memory analysis
DIGITAL FORENSICS SOFTWARE
SYSTEM MEMORY ACQUISITION
Evidence recovery from non-persistent memory
Contents of temporary file systems, registry data, network connections, cryptographic keys, …
Live acquisitionPre-install kernel driver
Crash dumpRecover from fixed disk
Hibernation and page fileRecover from fixed disk
Screenshot: Volatility Frameworkvolatilityfoundation.org.)
DISK IMAGE ACQUISITION
Non-volatile storage media and devicesAcquisition types
Live acquisitionStatic acquisition by shutting down the hostStatic acquisition by pulling the plug
Imaging utilitiesForensic software suites and file formatsdd
ProvenanceRecord process of evidence acquisitionUse a write blocker
Data acquisition with integrity and non-repudiationCryptographic hashing and checksumsTake hashes of source device, reference image, and copy of image for analysis
Preservation of evidenceSecure tamper-evident baggingProtection against electrostatic discharge (ESD)Chain of custody
Secure storage facility
PRESERVATION AND INTEGRITY OF EVIDENCE
ACQUISITION OF OTHER DATANetwork - SIEM
CacheFile system cache (temporary files)Hardware cache
Artifacts and data recoveryWindows Alternate Data Streams (ADS)File caches (prefetch and Amcache)Slack space and file carving
SnapshotAcquisition of VM disk images
Firmware
Right to audit clauses
Limited opportunities for recovery of ephemeral imagesAbility to snapshot instancesRecover log and monitoring data
Complex chain of custody issues
Complex regulatory/jurisdiction issues
Data breach notification laws
DIGITAL FORENSICS FOR CLOUD
SUMMARYModule 18
Follow these guidelines for supporting forensics investigations:• Develop or adopt a consistent process for incident responders to handle andpreserve forensic data:
• Consider the order of volatility and potential loss of evidence if a host is shut
down or powered off.• Record evidence collection using video and interview witnesses to
gatherstatements.• Deploy tools, such as WinHex, Autopsy, or FTK Imager, that can capture
andvalidate evidence from persistent and nonpersistent media.• Establish a method for recovering forensic data from a CSP.• Document evidence using a chain of custody.
• Be aware of the potential for forensic evidence as a source of strategic intelligenceand counterintelligence.