Title: Digital Forensics
Course: IN 2001 Principle of Information Assurance > Section: Module 12: Chapter 12

Digital Forensics
1. When the asset attacked is in the purview of the CISO, that executive is expected to understand how policies and laws require the matter to be managed. In order to protect the organization and to possibly assist law enforcement in the conduct of an investigation, they must act to document what happened and how. The investigation of what happened and how is digital forensics.
2. Digital forensics is based on the field of traditional forensics. Forensics is the coherent application of methodical investigatory techniques to present evidence of crimes in a court or court-like setting.
3. Digital forensics involves the preservation, identification, extraction, documentation, and interpretation of computer media for evidentiary and/or root cause analysis. Like traditional forensics, it follows clear, well-defined methodologies, but still tends to be as much art as science.
4. Evidentiary material (EM), also known as an item of potential evidentiary value, is any information that could potentially support the organization’s legal or policy-based case against a suspect.
5. Digital forensics can be used for two key purposes:
  - To investigate allegations of digital malfeasance.  A crime against or using digital media, computer technology or related components (computer as source or object of crime), is referred to as digital malfeasance
  - perform root cause analysis.  If the organization suspects an attack was successful, digital forensics can be used to examine the path and methodology used to gain unauthorized access, as well as to determine how pervasive and successful the attack was
6. Some investigations are undertaken by organizational personnel, while others require immediate involvement of law enforcement.
7. The organization must choose one of two approaches when employing digital forensics:

- Protect and forget.  This approach, also known as patch and proceed, focuses on the defense of the data and the systems that house, use and transmit it
- Apprehend and prosecute.  This approach, also known as pursue and prosecute, focuses on the identification and apprehension of responsible individuals, with additional attention on the collection and preservation of potential EM that might support administrative or criminal prosecution

The Digital Forensics Team
1. Most organizations cannot sustain a permanent digital forensics team.  Even so, there should be people in the information security group trained to understand and manage the forensics process.
2. This expertise can be obtained by sending staff members to a regional or national information security conference with a digital forensics track or to dedicated digital forensics training.

Affidavits and Search Warrants
1. An affidavit is sworn testimony that certain facts are in the possession of the investigating officer that they feel warrant the examination of specific items located at a specific place.  When an approving authority signs the affidavit or creates a synopsis form based on this document, it becomes a search warrant—or permission to search for EM at the specified location and/or to seize items to return to the investigator’s lab for examination.
2. In corporate environments, the names of these documents may change and in many cases may be verbal in nature, but the process should be the same.  Formal permission is obtained before an investigation occurs.

Digital Forensics Methodology
1. In digital forensics, all investigations follow the same basic methodology:

- Identify relevant items of evidentiary value (EM)
- Acquire (seize) the evidence without alteration or damage
- Take steps to assure that the evidence is at every step verifiably authentic and is unchanged from the time it was seized
- Analyze the data without risking modification or unauthorized access
- Report the findings to the proper authority
- In order to support the selection and implementation of a methodology, the organization may wish to seek legal advice or consult with local or state law enforcement.
- The affidavit or warrant authorizing a search action must specifically identify what items of evidence can be seized.
- The principal responsibility of the response team is to acquire the information without altering it.
- One of the most heated ongoing debates in digital forensics is the “to pull or not to pull” argument—that is, balancing the investigator’s need to acquire the EM without modifying it against the possible loss of information in volatile memory.  To “pull” means to pull the power cord on whatever computer technology is suspected of housing the EM.
- There are generally two methods of acquiring evidence from a system.  The first is the offline model, in which the investigator removes the power source and then uses a utility or special device to make a bit-stream sector-by-sector copy of the hard drives contained in the system.  In online or “live” data acquisition, investigators use network-based tools to acquire a protected copy of the information.
- The only real difference between the two methods is that the source system cannot be taken offline, and the tools must be sophisticated enough to avoid altering the system during the data acquisition.
- Note that the creation of a copy or image can take a substantial amount of time.
- Not all EM is on a suspect’s computer hard drive. A technically savvy attacker is more likely to store incriminating evidence on other digital media, such as removable drives, CDs, DVDs, flash drives, memory chips, sticks or on other computers accessed across the organization’s networks or via the Internet.
- Once the evidence is acquired, both the copy image and the original drive should be handled so as to avoid legal challenges based on authenticity and preservation of integrity.
- Chain of evidence or chain of custody is defined as the detailed documentation of the collection, storage, transfer and ownership of collected evidence from crime scene through its presentation in court.
- The copy or image is typically transferred to the laboratory for the next stage of authentication. The team must be able to demonstrate that any analyzed copy or image is a true and accurate replica of the source EM. This is accomplished by the use of cryptographic hash tools.
- The most complex part of an investigation is the analysis of the copy or image for potential EM. While the process can be performed manually using simple utilities, two industry leading applications dominate the market for digital forensics:
  - Guidance Software’s EnCase (Guidance software Website)
  - AccessData Forensics Tool Kit (FTK) (Accessdata Website)
  - Each of these tools is designed to support a law enforcement investigation and assist in the management of the entire case

Evidentiary Procedures
1. In information security, most operations focus on policies—those documents that provide managerial guidance for ongoing implementation and operations. In digital forensics, however, the focus is on procedures.
2. Strong procedures for the handling of potential evidentiary material can minimize the probability of an organization losing a legal challenge.
3. Organizations should develop specific procedures, along with guidance on the use of these procedures. The policy document should specify the following:
  - Who may conduct an investigation
  - Who may authorize an investigation
  - What affidavit-related documents are required
  - What search warrant-related documents are required
  - What digital media may be seized or taken offline
  - What methodology should be followed
  - What methods are required for chain of custody or chain of evidence
  - What format the final report should take and to whom it should it be given

4.    The policy document should be supported by a procedures manual, developed based on the documents discussed earlier, along with guidance from law enforcement or consultants.