Oftentimes, you may be looked at as a cybersecurity expert to perform forensic investigations.
This is the required standardization process and procedures to ensure integrity within the rule of law.
The rule of law dictates how we seize, acquire, analyze, and report any digital evidence within our
confines.
That means that you may be called to go to a crime scene and investigate different problems associated
with digital evidence.
The primary aim of seizure is to maintain the integrity of evidence by preventing any alterations from
both the purchase trader or the investigator.
We're not there to prove guilt or innocence.
We're there to identify specific digital evidence and analyze the evidence accordingly.
To do that, we need to seal off the investigative area.
We're going to put up crime tape if need be.
We're going to document everything.
We're going to take pictures of the screens on the computers and the electronic devices, how the cables
are connected to the laptop or desktop computer or any other electronic device.
Where are they getting power from?
Does it make sense that they're getting power from a USB?
Or maybe the wall outlet itself?
We're going to take pictures of digital media that may be external USB CDs, Blu rays, external hard
drives.
We're going to document everything, and we're not going to let anybody turn off the computer screen.
We're going to go through and thoroughly document the manufacturers, the model numbers, the serial
numbers.
All of that needs to be properly documented, photographed and sealed.
Before we go through with the process, we need to identify volatile memory.
We're going to use specialized equipment to hook into that computer and grab that volatile memory.
And then the non-volatile memory.
We're going to tag and label everything.
We're going to inventory it, and then we're going to bag it up and seal it.
When we go through the seizure process, we really need to be very, very OCD about everything that
we grab so that we can properly investigate it within the rule of law.
We're going to maintain the aspect of that digital evidence and make sure that it's not left in a car
in the middle of a Phoenix summer.
We need to avoid extreme temperatures.
We need to avoid rainfall.
We need to make sure that the the digital devices don't get too cold or too hot.
We need to make sure that everything is as we had it when we first arrived.
That means a very temperature neutral environment in which it sealed, documented, and ready to be
analyzed.
Preserving the integrity of the original evidence is critical throughout the entire process of the analyzation
of our digital media.
That means that we need to prepare a destination drive to take all the data from the original.
We're not going to investigate the original data drives or the original digital format that we grabbed
or seized.
That would be irresponsible.
Instead, we're going to do a bit for bit copy with fixed pattern over to the new medium, which we're
going to then utilize for investigation.
We're going to do a hash and make sure that it matches bit for bit on the existing media, from the
new media that we put it on.
We're going to prevent changes to the original using a right blocker.
We're going to make sure that even though we're logging in to the old hard drive, that we're not providing
any information over to that real original drive to change the format in any way, shape or form, we're
going to hash the original evidence, and then we're going to match that hash to the new evidence.
When we copy over the evidence, it's going to be on a bit for bit format.
Every little zero and one going from that original drive is going to go over to our new drive, and
we're going to verify the acquisition of that evidence by matching those two hashes to ensure that everything
is identical to the original, which allows for the analysis of with confidence of the original drive.
The analysis is the interpretation of the extracted data to determine if it's relevance to the case.
While the tools and commands for analysis may vary based on the operating or the file systems involved,
the core issues remain consistent and the same.
We need to identify the date and time of every documented log or evidence on that original drive.
Many times, crimes are perpetrated in a specific time frame by identifying the exact date and time
stamps of all the evidence that were called into question, we can accurately define whether or not
that data was relevant and on the drive at the time of the crime committed.
We're going to verify the time zone.
If I'm on the East Coast, and the time zone of my evidence is in Western time or Pacific time, there
is a problem.
We need to be able to extrapolate and identify that.
11 a.m. Pacific time is 2 p.m. Eastern time.
Where did the source of the the data come from?
Did it come from a thumb drive?
Did the thumb drive get accurately documented?
Are we talking about a thumb drive number one or thumb drive number ten?
What's the serial number of the thumb drive?
All that source information needs to be documented within the context of our investigation.
We need to name all the items.
If you have ten different thumb drives, a nomenclature model might be the best.
But if we're going to number it one through ten, we also need to Document, the serial number, the
make and model of the thumb drive, and any identifying factors that that thumb drive may have, both
physically and digitally.
We need to identify the item location.
Where did we find the thumb drive when we picked it up?
Was it inside the computer logged in already or was it in a desk drawer off to the side?
Was it sitting inside of a bookcase?
Item location can be important when it comes to the actual evidence in question.
If the evidence was acquired on a person, we need to document that it was on the person at the time
and not at the original crime scene.
Finally, we need a description, an accurate, detailed description of where the evidence is located.
Now that means both the logging evidence, which file it was in, or the physical location as in the
person's being.
Where did that evidence come from?
The description of the evidence is important when it comes to the digital investigation.
A chain of custody is a meticulous document recording and detailing the handling, collection, transportation,
and preservation of evidence throughout each stage of the analysis process.
We need to document every little nuance of the investigation when it comes to that specific evidence.
If it left somebody in custody and went into an evidence bag, that needs to be documented.
That evidence bag is then moved over to a central collection point that needs to be documented who it
went from to who it's going to, who put it away, what was the date, what was the time if it was checked
out?
That needs to be documented.
Every step of that evidence and its pathway from the moment that it leaves the person or the moment
it's picked up off the desk or the or the crime scene, needs to be documented in detail to every step
of the way, from the point of acquisition to the point of investigation, to the point of storage.
When it's put into place, we need to permanently identify every aspect of that documentation.
You can see here in the figure.
An example of a chain of custody documentation form.
A legal hold is an administrative procedure frequently employed by organizations during a digital forensics
Investigation.
If you work for an enterprise environment, you have no right to stop a legal hold from taking place.
Your only concern is that the legal hold is in place, and that you need to safeguard that information
to the best of your ability, whether that's storing it on a device or preventing its use.
We need to make sure that that legal hold maintains its validity.
The only people that can pull back a legal hold are your legal department or from the opposing counsel,
meaning the law enforcement agency that requested legal hold in the first place.
Your manager or director has no right or bearing to tell you that, hey, this legal hold has been lifted.
You can now destroy that information.
As a cybersecurity professional, legal holds must be lifted by lawyers and legal personnel or the legal
office.
It's implemented as a precaution in case of an external investigation or agency requires the evidence,
particularly if a legal violation has occurred.
As a cybersecurity professional, you need to understand that legal holds are something that we need
to hold sacred and secure within our enterprise environment.