© 2013 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. System Forensics, Investigation, and Response Chapter 7 Collecting, Seizing, and Protecting Evidence

Page 2 System Forensics, Investigation, and Response © 2013 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Learning Objective and Key Concepts Learning Objective  Examine the evidence life cycle. Key Concepts  Differences between data and evidence  Types of evidence  Chain of custody requirements  Collection, transportation, and storage of evidence

Page 3 System Forensics, Investigation, and Response © 2013 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. DISCOVER: CONCEPTS

Page 4 System Forensics, Investigation, and Response © 2013 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. 5 Rules of Evidence Admissibility Evidence must be admissible in court. Authenticity Evidence must relate to the incident. Completeness Evidence must be comprehensive. Reliability Evidence collected must be uncontaminated and consistent. Believability Evidence presented should be clearly understandable and believable by the jury.

Page 5 System Forensics, Investigation, and Response © 2013 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. DISCOVER: PROCESS

Page 6 System Forensics, Investigation, and Response © 2013 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Evidence Life Cycle Collect or seize evidence Transport evidence Protect or store evidence Analyze evidence

Page 7 System Forensics, Investigation, and Response © 2013 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Evidence Collection  Freeze the scene.  Comply with the five rules of evidence.  Minimize handling and corruption of original data.  Proceed from volatile to persistent evidence.  Don’t run any programs on the affected system.

Page 8 System Forensics, Investigation, and Response © 2013 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Evidence Collection (Continued)  Account for any changes and keep detailed logs of actions.  Do not exceed current knowledge.  Follow local security policy.  Be prepared to testify.  Ensure that actions are repeatable.

Page 9 System Forensics, Investigation, and Response © 2013 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Evidence Transport  Shut down computer  Document hardware configuration  Document all evidence handling  Pack evidence securely

Page 10 System Forensics, Investigation, and Response © 2013 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Evidence Transport (Continued)  Photograph or videotape the scene from premises to transport vehicle.  Photograph or videotape the scene from vehicle to lab.  Transport computer to a secure location.

Page 11 System Forensics, Investigation, and Response © 2013 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Evidence Protection and Storage  Keep evidence in possession or control at all times.  Document movement of evidence between investigators.  Secure evidence appropriately so that it can’t be tampered with or corrupted.  Mathematically authenticate data. (i.e., hash values)

Page 12 System Forensics, Investigation, and Response © 2013 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Evidence Analysis  Make a list of key search words.  Work on image copies, never originals.  Capture an image of the system that is as accurate as possible, such as bit-stream backup.  Evaluate Windows swap file, file slack, and unallocated space.

Page 13 System Forensics, Investigation, and Response © 2013 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Evidence Analysis (Continued)  Identify file, program, storage anomalies  Evaluate program functionality  Document findings Create a case  Retain copies of software used

Page 14 System Forensics, Investigation, and Response © 2013 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. DISCOVER: CONTEXTS

Page 15 System Forensics, Investigation, and Response © 2013 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Sources for Data of Potential Evidentiary Value Access logsData transmissionsData on hard disks and storage devicesData on mobile devices

Page 16 System Forensics, Investigation, and Response © 2013 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Locating Data in Access Logs  Manually review logs, or  Use a log analysis tool

Page 17 System Forensics, Investigation, and Response © 2013 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Locating Data in Transmissions  For backed up data: Mirror to removable media with validation by system administrator  For live data: Uses packet sniffer or packet capture tool

Page 18 System Forensics, Investigation, and Response © 2013 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Locating Data on Hard Disks and Storage Devices  Mirror to stable media  Use recovery software  Use data reconstruction software

Page 19 System Forensics, Investigation, and Response © 2013 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Technical Issues  Life span of data  Collecting data quickly  Collecting bit-level data  Obscured data  Anti-forensics

Page 20 System Forensics, Investigation, and Response © 2013 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Types of Potential Evidence  Logs  Windows swap files and file slack  Unallocated space and temporary files  s, word processing documents, and spreadsheets  Network data packets

Page 21 System Forensics, Investigation, and Response © 2013 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Summary  Differences between data and evidence, and valid and invalid data  The rules of evidence  Chain of custody requirements in evidence handling  Methods for collection or seizure, transport, protection and storage, and analysis of evidence