Instructor: Chain of Custody. 2 2
Now, this is a term that came 3 3
out long before we had computers 4 4
and long before we had digital forensics. 5 5
But the same principle is going to apply here 6 6
inside digital forensics, too. 7 7
Because digital forensics produces evidence for us, 8 8
and evidence has to maintain a chain of custody. 9 9
When I talk about a chain of custody, 10 10
this is the record of evidence history from collection, 11 11
to presentation in court, all the way through to disposal. 12 12
Everything we do with that piece 13 13
of evidence, from birth to death, has to be covered. 14 14
Now, if you're like most of us, 15 15
you've probably seen TV shows 16 16
or movies where a police officer goes 17 17
into a scene and they find the smoking gun 18 18
and they want to collect that as evidence. 19 19
They pick up the gun using their pants. 20 20
They don't get their fingerprints on it 21 21
'cause they don't want to contaminate the evidence, right? 22 22
And they put it into an evidence bag. 23 23
Now, on that bag, they will end 24 24
up signing their name to show evidence was started 25 25
at this point. 26 26
"I collected this gun at this time from this place," 27 27
and that's what they'll write on the bag. 28 28
Well, that's the whole idea here 29 29
when we start dealing with the chain of custody, 30 30
and it's the same thing for us in the computer world. 31 31
For instance, if you're working 32 32
for law enforcement and they went 33 33
into a suspect's home and collected their computer, 34 34
they're going to bag it and tag it 35 35
and collect that as evidence, the physical machine. 36 36
And then you're going to take that hard drive 37 37
and start doing the analysis of the data on the hard drive. 38 38
And when you take that hard drive from the evidence 39 39
you have to log that you have that hard drive now 40 40
because every place that hard drive goes 41 41
and every place that computer goes that was collected 42 42
as evidence has to be logged as it goes from place to place. 43 43
Now, if you're dealing with something sensitive, 44 44
like a hard drive or some kind of a circuit board 45 45
or a solid state device or something like that, 46 46
you want to put it into a specialized evidence bag, 47 47
not the big brown paper bag I just showed you. 48 48
These specialized evidence bags are used 49 49
for electronic media to ensure that they cannot 50 50
be damaged or corrupted by electrostatic discharge. 51 51
Now, another type of specialized bag you might see is 52 52
what's called a Faraday bag. 53 53
Normally, if we're taking something like a cell phone 54 54
or something that has a radio chip in it, 55 55
we will put it in an evidence bag and then put 56 56
that evidence bag inside the Faraday bag 57 57
to block any external signals from getting in. 58 58
I wouldn't want somebody sending a remote wipe 59 59
of their cell phone when I have their phone in custody 60 60
and I haven't taken it for evidence yet. 61 61
So that's the idea of a Faraday bag as well. 62 62
Now, when we deal with criminal cases 63 63
or internal security audits, these things can take a long 64 64
long time, sometimes months or years to resolve. 65 65
And the entire time this is happening, we have to hold 66 66
onto this evidence and keep track of it, 67 67
and we need to know where it is. 68 68
So we need to make sure we identify it, we bag it, 69 69
we seal it, we label it, and we know exactly where it is 70 70
at all times. 71 71
Now, one of the reasons I bring up this lengthy period 72 72
of time is that you have to be careful to take care 73 73
of the information that you're collecting 74 74
and the evidence you're collecting. 75 75
For example, if IFC has a bunch of backup tapes as evidence, 76 76
that is magnetic media and I need to protect it 77 77
to make sure it doesn't fail over time or become corrupted 78 78
based on where we store it. 79 79
I actually have a sad example of this 80 80
of storing information incorrectly. 81 81
When I was a child, my father and mother had filmed me 82 82
as a baby. 83 83
You know, baby videos, and they put this on VHS tapes. 84 84
Well, those VHS tapes are made 85 85
out of essentially the same stuff 86 86
as a backup tape for a computer. 87 87
They didn't store it properly. 88 88
And so when we tried to watch it about 20 years later, 89 89
what happened was it jammed up the VCR and ate the tape. 90 90
And so we can't watch that baby footage anymore. 91 91
If that happened in a court case, 92 92
that case could actually get thrown out of court. 93 93
And some court cases do go on 10, 15, 20 years 94 94
or the person goes to jail, 95 95
and they go on appeal time and time again. 96 96
And it may be something that was a life sentence 97 97
for instance, and now they can get out 98 98
because the evidence got corrupted. 99 99
So you need to make sure you're taking care 100 100
of this and think about humidity and temperature 101 101
and where all this stuff is going to be stored securely. 102 102
Now the other problem with evidence is 103 103
that it can become a lot of information, right? 104 104
The amount of evidence collected can become extremely large. 105 105
If you think about some 106 106
of the big white collar crimes like Enron or WorldCom 107 107
that happened in the early 2000s. 108 108
They had boxes and boxes and boxes 109 109
of paperwork and files and hard drives and everything else, 110 110
and all of that has to be stored someplace. 111 111
So you need to make sure you have an adequate place 112 112
to do it that is safe and secure. 113 113
Also, when you're dealing with large amounts of information, 114 114
you need a way to organize it 115 115
so you can identify what it is. 116 116
If you get called up to court and they say, 117 117
"Hey, I need the evidence on John Smith's trial 118 118
and I need this particular piece 119 119
of evidence that you collected," you now need 120 120
to be able to find it in this mountain of stuff. 121 121
And so one of the ways we do this is by having metadata, 122 122
which is data about the data. 123 123
This is a way for you to self-describe the information 124 124
that's contained in it with some kind of a code 125 125
or some kind of a system. 126 126
Now, one of the things I like to include 127 127
on all my evidence is a proper label of what it is, 128 128
a short description of what is inside of it 129 129
and why it's important to me, 130 130
and then some kind of a date, 131 131
such as year, year, year, dash month, month 132 132
dash day, day, colon, hour, hour, colon, minute, minute. 133 133
So, for example, when I filmed this video 134 134
it was 2020 July 12th at 9:45 at night. 135 135
And you can tell that based on 136 136
that time, date, code that I would have. 137 137
And so if I was collecting this as evidence, 138 138
I would attach that time, date, code so I'd know 139 139
when I collected that evidence. 140 140
The final thing we need to think 141 141
about when we store evidence is where are we 142 142
going to store it that is safe and secure. 143 143
So in addition to things like temperature 144 144
and humidity and moisture and all of that, 145 145
we also want to make sure it's secure 146 146
from somebody trying to steal the evidence. 147 147
Again, I'm sure you've seen all the movies 148 148
where the bad guys go 149 149
into the police station to destroy the evidence 150 150
and they break into the evidence lock-up 151 151
and they take the drive and they corrupt it, 152 152
and now the bad guy is going to get out on the street. 153 153
We don't want that to happen. 154 154
So when you're dealing with law enforcement, 155 155
they're going to have secure places to lock it up. 156 156
If you're dealing with employees and insider threats, 157 157
you need to have a secure place to lock up 158 158
your information as well. 159 159
So these are things you need to think about 160 160
as an organization and if you're working 161 161
in the forensic world where you're going to store 162 162
all this information, and remember to keep a record of it 163 163
from cradle to death because that's your chain of custody.