>> Forensics concepts.
The learning objectives for this lesson are to
explore the legal issues surrounding data forensics,
to define the forensics process,
and to describe data integrity and preservation.
Let's get started. First, we're
going go over the forensics process.
The first step is identification.
We're going to ensure that our crime scene is
secure so that we can prevent evidence contamination.
Then we're going to identify
the scope of evidence to be collected.
In an example, we've been asked to come over to
a workstation and an office
that has been suspected to be used in a crime.
The first thing we're going to make sure is
that no one can get access to
that workstation so that it's not turned off,
changes aren't being made, that type of thing.
Also, we want to see are any devices connected to
the computer or are
flash drives plugged in mobile devices.
All of this would be within our scope so that
we're sure that we're collecting everything.
Then the next step is collection.
We will make sure that the evidence is collected using
tools and methods that will survive legal scrutiny.
If this part isn't done correctly,
then everything else doesn't matter.
Because if it will not survive legal scrutiny,
then your case is going to get thrown out.
We move to analysis.
This is where we are creating
a forensics copy for us to do our analysis on.
We never do our analysis on the direct data.
We want to make sure we're using a copy for that.
Then we're going to use repeatable methods and tools.
This will also help us to survive legal scrutiny.
Then we will go to the reporting and presentations phase.
This is where we create a report of
all the methods and tools that we used and then we
present all the findings and
our conclusions. Chain of custody.
This is a critical part of any forensics analysis,
not just for computer or IT related.
This is a record of evidence
handling from the collection,
all the way through its presentation in court,
who touched it, who did anything with it.
Every detail is recorded.
Who interacted with the evidence and what they did,
it's a detailed report and
labeling of all evidence collected.
Strong physical controls should
be in place where evidence is stored.
You've heard stories of police evidence locker as
being not necessarily secured and because of that.
The evidence in there became
contaminated and cases where thrown out?
Same type of thing here.
We want to make sure that all of
our evidence is collected and then stored
in a safe way so that we
can maintain the chain of custody.
Data acquisition. This is the process of collecting
forensically clean copies of
all data so that we can use it as evidence.
We're going to work from the most
volatile to the least volatile.
The ISOC best practices say,
to start with the CPU registers and the cache memory,
this being the most volatile.
Then we go down to the contents of the system memory.
After that, we go to the data that's
our mass storage devices such as hard drives.
Then we will look at remote logging and monitoring data.
After that, we will move down to
the physical configuration and the network topology.
Then finally, we will move to the archival media because
this is the least volatile of all the evidence.
Cryptanalysis and steganalysis.
Cryptanalysis is the art of breaking encryption.
In certain situations, this may be
a requirement if collected data is encrypted.
Now, typically, this is going to be beyond
the scope of most companies' evidence response teams.
Even at the state level,
this is going to become a difficulty for law enforcement.
You've seen in the news, where
the FBI often has issues getting
into Apple iOS devices because of the encryption.
I cannot imagine very many times
for a corporation or a company issue
where this is going to become
something that you're expected to do.
Then steganalysis is concerned with
locating data that may be hidden within and other files.
We can often hide documents
inside of picture files using steganography.
We're going to use different tools and help to see if
the files that we've collected
are containing any other types of data.
This is something I can see that would be necessary
in almost anyone's investigation.
You would want to use tools that will
scan through the files to find
out if they're hiding any other pieces of information.
Forensics image versus forensics clone.
Both of these represent duplicates of
electronic media and they're done bit by bit.
An image can be used for analysis.
A clone is a working copy that is not preserved.
These terms are often used interchangeably,
but one thing to keep in mind is that the clone is
the one we're doing our work on
and it's not going to be preserved.
We will be making changes to that,
but we can figure out what we're looking for and
we always have the original
forensics image to go back to.
Evidence preservation.
Everything collected has to be labeled and
bagged and then sealed in tamper resistant bags.
If there is a possibility that
electrostatic discharge will damage different devices,
then those pieces of evidence
should be placed in anti-static shielded bags.
This would be especially important for sensitive drives,
sensitive devices,
sometimes even flash drives if
you're really concerned with what's on there.
Evidence should be stored in
secure facilities that are access control.
This is what I was referring to earlier,
that you need to have the evidence locked away.
Let's summarize. We went over
the forensics process and then the chain of evidence.
We also discussed the difference between
a forensics image and a forensic clone.
We discussed cryptanalysis and
steganalysis in the evidence preservation.
Let's do some example questions.
Question 1, this describes
the process of maintaining evidence from
collection to presenting it in court. Chain of custody.
Question 2, true or false.
Hard drive data should be collected before system memory.
False. System memory is
more volatile and should be collected first.
Question 3, true or false.
A forensics image isn't
preserved and is used for working.
False. A forensics clone
is a working copy that isn't preserved.
Finally, question 4,
this describes looking for
hidden data inside of other files.
Steganalysis. I hope this lesson was very
helpful for you and gave you
a good idea of the forensics process.
I'll see you in the next lesson.