Narrator: Digital forensic analysts. 2 2
As a cybersecurity analyst, there is a variety of tasks 3 3
that you're going to need to perform 4 4
during and after an incident to ensure forensic analysts 5 5
will be able to do their jobs effectively. 6 6
One of the jobs that a cybersecurity analyst 7 7
may graduate into is that of a forensic analyst as well. 8 8
Now, you might be called upon to perform 9 9
a variety of forensic activities as part 10 10
of your incident analysis and threat hunting. 11 11
And so in this lesson, we are going to focus 12 12
on the role of a digital forensic analyst. 13 13
Now, when we talk about digital forensics, 14 14
we are talking about the process 15 15
of gathering and submitting computer evidence to trial, 16 16
and then interpreting that evidence 17 17
by providing expert analysis. 18 18
A forensic analyst has many different job titles, 19 19
depending on where they work. 20 20
You might hear them called a forensic computer examiner, 21 21
or a digital forensic examiner, 22 22
or a computer forensic detective. 23 23
All of these are valid names, 24 24
as well as many others you may come across. 25 25
Now, what exactly does a forensic analyst do? 26 26
Well, they're going to use specialized tools and skills 27 27
to recover information from computer systems 28 28
from memory and from storage. 29 29
Now, the reason they have to do this is because 30 30
unlike evidence that you could see with the naked eye, 31 31
all of this digital stuff can't be seen, 32 32
and so you have to be able to collect it 33 33
and then analyze it and produce that as a report 34 34
that can then be used in court. 35 35
Because if I just give you a hard drive, 36 36
that doesn't tell you anything, 37 37
it's what's inside the hard drive that's really important. 38 38
We use forensics, and digital forensics specifically, 39 39
to be able to pull out the information we need 40 40
from that hard drive and present it in court. 41 41
Now, one of the things that a forensic examiner may do 42 42
is they may serve as an expert witness. 43 43
Now, this is again because that information 44 44
has to be extracted from the hard drive. 45 45
It needs to be extracted from memory. 46 46
It has to be extracted from the network or from the system. 47 47
And based on that, your expert analysis 48 48
of what you found and the process you used 49 49
is going to be called upon in court 50 50
if you're dealing with a criminal case. 51 51
For example, I once served as an expert witness 52 52
for one of these cases. 53 53
There was a case where somebody was suing a hotel, 54 54
saying that they hurt themself on the property. 55 55
Now, they made a claim of how badly they were hurt 56 56
and were trying to get a very big payout 57 57
from this insurance company for the hotel. 58 58
But we found video evidence showing that this person 59 59
wasn't actually hurt, and I used my technical skills, 60 60
as an analyst, to be able to get the information 61 61
from the video, perform the analysis, 62 62
and provide that as a written report to the court. 63 63
Based on that, they were able to use that evidence 64 64
with other evidence and be able to get 65 65
the verdict they were looking for. 66 66
If you are a forensic analyst, 67 67
you may be asked to fill a lot of different roles. 68 68
For example, you may be asked to help plan 69 69
IT systems and processes. 70 70
This way, we know that those systems and processes 71 71
are set up ahead of time to be able to collect evidence 72 72
if needed during a cybersecurity incident. 73 73
Additionally, an analyst may be asked to help investigate 74 74
or reconstruct an incident. 75 75
Something bad happened to your network 76 76
and they want to figure out what happened. 77 77
Well, an analyst has that detective skill 78 78
in the technical domain to help 79 79
piece those things back together. 80 80
Another thing you might be asked to do 81 81
is to help investigate if a crime has occurred. 82 82
By going through the systems, 83 83
you can determine if something bad really happened 84 84
and if that thing was a crime. 85 85
For example, if you work for the police, 86 86
you might be called in and search a computer 87 87
to see if there's evidence of child pornography, 88 88
because that would be a crime. 89 89
You'd be able to determine if you found that evidence, 90 90
and if so, that means a crime has been committed 91 91
and that person's going to go to jail. 92 92
Another thing an analyst might help do 93 93
is to collect and protect evidence. 94 94
As you're going through these systems 95 95
and collecting information, you need to also make sure 96 96
you're validating the information as it's being collected, 97 97
and protect it to make sure it doesn't get changed 98 98
after you've collected it. 99 99
All of this is important to an analyst. 100 100
Another thing an analyst might help do 101 101
is to determine if data was exposed. 102 102
So maybe you want to know, 103 103
has your company been the victim of a data breach? 104 104
You suspect you might have been, but you're not sure. 105 105
Well, if you call in a forensic analyst, 106 106
they can go through your systems 107 107
and determine if your database was accessed 108 108
and if those files were extracted. 109 109
That's something that can help you 110 110
figure out if the data was exposed. 111 111
Or you might work for a forensic tool company 112 112
and you have to develop tools and processes for those. 113 113
All of that can be done by a forensic analyst, 114 114
and they'll help out with those 115 115
to make sure they're meeting the industry's needs. 116 116
And finally, a forensic analyst might be called on 117 117
to support ongoing audits. 118 118
Now, this is because audits 119 119
are essentially evidence collection as well, 120 120
and so you can go through the auditing process 121 121
and help people go through the different processes 122 122
and records, and make sure everything 123 123
is being kept up to date and has not been tampered with. 124 124
Having a forensic analyst help with audits 125 125
is really important, especially if you're in 126 126
a highly regulated field. 127 127
For example, if you fall under Sarbanes-Oxley, or HIPAA, 128 128
or something like that, and you're going to have regulators 129 129
come and audit you, it does help to have a forensic analyst 130 130
on staff who can help them go through your information 131 131
and verify that everything has maintained integrity 132 132
and has not been tampered with.