>> Welcome back. There are times when we look at
an incident and we realize that
there was potentially a crime involved.
At that point, we have to shift
over to forensic investigations.
That is going to involve collecting and preserving
evidence in such a manner
that would be admissible in a court of law.
Now, not all incidents require forensics, but some do.
As part of our incident response plan and policy,
we have to know when to escalate an incident.
Now, there are seven steps in
the forensics investigation process,
and you need to make sure you
know the flow of these steps
for the test and what happens with each one.
One, identification two, preservation three,
collection four, examination,
five analysis, six,
presentation and seven decision.
Let's talk about these steps a bit more.
The first stage is identifying
that something is evidence.
Now, Locard's principle of
exchange says that when a crime is committed,
the attacker takes something
>> and leaves something behind.
>> What they leave behind can help
us identify aspects of them.
It could be fingerprints, digital signatures,
or it could be knowledge of information that suggests
who the attacker is or what their motivations were.
The next step is to preserve the evidence.
The most important job of
a first responder is preserve evidence.
We have to make sure it's collected in
a forensically sound manner and that there has
been no modification as part of the collection.
As soon as we identify that something is evidence,
we go right into preservation.
This is where we create the document
of the chain of custody.
This particular document is really
important and definitely could be on the test.
The chain of custody documents,
how evidence was collected,
how it was analyzed,
how it's transported, and how it was preserved.
We don't want anyone to be able to call into question
the preservation or integrity of the evidence.
Digital evidence can be manipulated so easily.
We want to make sure that the evidence is accounted
for and that there are no gaps in time.
Any documentation should always
include time offsets because it can
simply be a matter of minutes or seconds that
make the difference in the evidence being admissible.
Hashing algorithms are used to show the integrity of
the evidence and that the evidence has not been
modified during the investigation process.
Now the next phase is collection.
You want to minimize handling
and touching of the evidence.
Make sure you're not working on original drives.
When it comes to collecting the evidence
and then analyzing the evidence,
you want to make sure that you take a system image.
You don't ever want to work on
an original document or file,
you always want to copy.
You'll hash the original and hash
the copy that you're doing the investigation on.
We also have to work fast because
a lot of digital evidence is very volatile.
Something you need to know for the exam,
is that you need to collect from
the most volatile items
first and then the least volatile.
This means to work in this order.
CPU registers, Cache,
routing table, ARP cache,
process tables, RAM,
paging file and other temporary filing systems.
The paging file could also be called the swap
file and set aside on a hard drive
to act like an RAM in the event that
the systems need more RAM than available.
Hard-drive, remote logs and
monitoring data, and archive media.
Be prepared for a question that
might involve a drag and drop above
the above list and put it in
the correct order of most volatile first.
Examination gives you data,
analysis gives you information.
When I examine a disk for instance,
and remember, I would be working
from a copy of the disk, not the original.
I'm looking for data, I'm
recording what I see and documenting the facts.
But when I get to the analysis I take the data that
I've recorded and I look to get a larger picture.
I'm going to put the facts and the context.
Soon I'd put data through analysis and get information.
Once you've done your analysis
and you have your information,
you would then take it and
>> present the evidence in court.
>> You want to make sure that all these steps have been
performed in a forensically sound manner,
so when you present the evidence in court,
a judge will rule it to be admissible.
As a quick review,
when an event has a negative impact on the system,
then that event becomes an incident,
and how we respond to that event
is going to make or break us.
Just to review the incident response process.
It is preparation, identification,
containment, eradication,
and recovery, and then lessons learned.
Now, once an incident appears to
have criminal intent or criminal elements,
we then move into forensics,
where we follow the seven-step process of
forensic investigation: identification,
preservation, collection, examination,
analysis, presentation, and decision.
I want to stress that this is a very
high-level overview of this topic.
You can get more in-depth coverage
of forensics in another course.