Tutor: Forensics Procedures. 2 2
In this lesson, 3 3
we are going to talk about the basic forensics procedures 4 4
and this is essentially going to be a four-step process. 5 5
Now, the first thing you need to know about forensics 6 6
is everything we do we use written procedures. 7 7
These written procedures are going to ensure 8 8
that personnel handle forensics properly, effectively 9 9
and in compliance with the required regulations. 10 10
This way, we always follow what is written down 11 11
and we always do it the same way. 12 12
Now, as we go through our forensic procedures, 13 13
there are four main areas. 14 14
We have identification, collection, analysis and reporting. 15 15
In this lesson, 16 16
we're going to talk about each one of those. 17 17
First, we're going to have identification. 18 18
This is going to ensure the scene is safe. 19 19
We have made sure we secure the scene 20 20
to prevent any evidence contamination 21 21
and we identify the scope of the evidence to be collected. 22 22
Now, when you think about this, 23 23
especially in the digital forensics world, 24 24
I like to think about it 25 25
as if you're working for the police department, 26 26
they break down the door, they arrest the person 27 27
and what do you need to do? 28 28
Well, as you walk in the door, 29 29
the first thing you need to do 30 30
is make sure the scene is safe. 31 31
There's not a bad guy hiding in the other room 32 32
that's going to come out and hurt you 33 33
and try to stop you from collecting the evidence. 34 34
We want to make sure everything is safe there. 35 35
Then once we know everything is safe, 36 36
we move on to the next step, 37 37
which is making sure nobody contaminates our evidence. 38 38
We want to record the scene using video and photography 39 39
to make sure we know exactly what was there, 40 40
before we touched anything 41 41
and then we want to start identifying 42 42
the scope of the evidence to be collected. 43 43
If I go into a store as part of this investigation 44 44
and they say, 45 45
"Hey, we're looking for this type of data," 46 46
well, I need to start looking 47 47
at all the computer systems around there 48 48
and say where can this type of data be hidden? 49 49
Is it going to be on a tablet? 50 50
Is it going to be on a phone? 51 51
Is it going to be on a smart TV? 52 52
Is it going to be on a server? 53 53
And based on the type of data I'm looking for, 54 54
I'm going to scope my evidence collection, 55 55
because a lot of times your warrant, 56 56
will tell you exactly how large 57 57
or how small the scope you have 58 58
and what you're allowed to collect. 59 59
And then we're going to move into collection. 60 60
Now, when we do collection, 61 61
we have to ensure that we have authorization 62 62
to collect the evidence. 63 63
Now, this might take the form of something like a warrant 64 64
and then we're going to document 65 65
and prove the integrity of the evidence as it's collected. 66 66
Now, what this means is 67 67
as I start collecting the information from the computer, 68 68
I'm not just going to take the hard drive 69 69
and throw it in a bag. 70 70
I need to actually do a bit by bit copy of that hard drive, 71 71
because all my analysis later on 72 72
is going to be done on the copy, not on the original. 73 73
Now, I also need to make sure 74 74
that that hard drive is an exact match, 75 75
once I make the copy of it 76 76
and I am going to take into evidence 77 77
to make sure that I have the original, 78 78
so that if we ever need to go back to the original 79 79
for analysis and make another copy, we could. 80 80
We also want to make sure we prove the integrity 81 81
to make sure I haven't changed any data on it 82 82
and nobody else has changed anything on it. 83 83
That's the idea here With collection. 84 84
Then we move into analysis. 85 85
So, now that we have a copy, 86 86
we are going to create a copy of this evidence 87 87
and we're going to take that for analysis. 88 88
And we use repeatable methods and tools during the analysis. 89 89
Again, everything here is going to be written down. 90 90
We are going to use procedures that tell us exactly what to do. 91 91
This is going to say, step one, do this, 92 92
make a copy of the drive. 93 93
Step two, create a hash of the drive 94 94
to make sure you have integrity. 95 95
Step three, form an analysis on the drive, 96 96
using X, Y, Z tool. 97 97
It'll tell you exactly what you need to do 98 98
as an analyst using a checklist that can be repeatable 99 99
and followed each and every time. 100 100
And then we got step four, which is reporting. 101 101
At the end of all of our analysis, 102 102
we need to create a report of the methods and the tools 103 103
that we used in our investigation. 104 104
And then we also need to present detailed findings 105 105
and conclusions based on that analysis. 106 106
If I was looking for child pornography on this hard drive 107 107
of the victim's computer, 108 108
I need to say I found it, 109 109
it was located here, and here's how I prove it. 110 110
All the things I did, how I found it, 111 111
all the locations, all the files, screenshots of it, 112 112
all that kind of stuff 113 113
to put into the final report to give to the judge 114 114
and into the court so that person can go to trial. 115 115
Again, as I said in the last lesson, 116 116
you may be called to go into court to testify, 117 117
based on what you have 118 118
and based on your report that you're going to give 119 119
and the analysis you've done. 120 120
Now, this is really important to realize, 121 121
because everything you do is going to come under question, 122 122
once you get on that stand. 123 123
They're going to ask every method you've used, 124 124
any mistakes you possibly could have made. 125 125
They're going to try to find fault 126 126
with everything you could have done, 127 127
because if they can find fault with anything you've done 128 128
your evidence and everything you found from it, 129 129
can be thrown out of court 130 130
and that can get their client off. 131 131
Attorneys are paid a lot of money 132 132
to help get their clients off of these criminal charges. 133 133
And so if you're working in the criminal sector 134 134
as a forensic analyst, 135 135
you need to be very careful to do everything exactly right 136 136
by the procedures. 137 137
This is going to bring us to the concept of a legal hold. 138 138
Now, a legal hold is a process 139 139
that's designed to preserve all the relevant information 140 140
when litigation is reasonably expected to occur. 141 141
Now, litigation is just a fancy word for lawsuit. 142 142
Essentially, 143 143
if we think what we are going to be dealing with 144 144
and collecting could end up in court one day, 145 145
we need to make sure we don't destroy any evidence. 146 146
We need to collect it all and preserve it all. 147 147
Now, one of the biggest challenges when you start dealing 148 148
with this is that you can actually have your computer 149 149
or server seized as evidence, 150 150
inside of some kind of criminal conspiracy. 151 151
Let's say you ran a web hosting company 152 152
and somebody bought storage space on your server 153 153
and they put illegal files on there, 154 154
whatever the bad content is. 155 155
Well, if the police want to take that evidence, 156 156
they might take your server 157 157
that holds not just that person's stuff on it, 158 158
but also all of your other clients on it as well. 159 159
And that can go away for a long period of time, 160 160
because of this legal hold. 161 161
The legal hold can actually take that computer 162 162
or server as evidence for the entire duration of that trial, 163 163
which could be months or even years. 164 164
So, this is something you have to think about 165 165
as an organization. 166 166
Do you have backups for your servers? 167 167
How quickly can you get them back online 168 168
if you have some kind of a evidence collection 169 169
that's going to happen because that is something that you need 170 170
as part of your business continuity plan as well. 171 171
Now, another thing I recommend 172 172
when you're dealing with the law 173 173
is you should always have somebody 174 174
from your organization appointed as your liaison. 175 175
And that person should have legal knowledge and expertise, 176 176
so they can be the point of contact with law enforcement. 177 177
So, when somebody comes in from law enforcement 178 178
and they want to start collecting evidence, 179 179
you need to have somebody who can work with them. 180 180
This person is going to be your point of contact, 181 181
between the forensics team, 182 182
which may be an outside company or law enforcement 183 183
and your CSIRT team, 184 184
which is your Cybersecurity Instant Response team. 185 185
If you're dealing with a data breach for instance, 186 186
is your company going to try to pursue legal action, 187 187
against the person who broke into your systems? 188 188
If so, you're going to have a forensics team 189 189
from law enforcement coming in and collecting that evidence. 190 190
And so having this liaison 191 191
who can be that single voice 192 192
and that single point of contact, 193 193
can really make things work a lot better for you. 194 194
Now, the last thing we need to talk about in this lesson 195 195
is ethics. 196 196
Forensic analysts have to follow a code of ethics 197 197
and there are three main points to this code of ethics 198 198
that you really do need to follow, 199 199
otherwise you're going to have a problem 200 200
when you get on the stand. 201 201
First, analysis must be performed without bias. 202 202
This means any conclusions or opinions that you form, 203 203
should only be based on the direct evidence 204 204
that you've observed. 205 205
You shouldn't be thinking, 206 206
well I don't like this person because X, Y, Z. 207 207
It's not based on their color, their creed, 208 208
their nationality, what they look like or anything else. 209 209
It should only be based on the evidence you find. 210 210
In fact, it's much better for a forensic analyst 211 211
to be completely removed from the situation. 212 212
A lot of places that I've worked with before, 213 213
they have one set of people who collect the information 214 214
and another set that analyzes it. 215 215
So, all they see is the data. 216 216
They don't know anything about the case up to that point 217 217
and that can help eliminate some of that bias. 218 218
The second thing, 219 219
analyst methods have to be repeatable by third parties. 220 220
Now, what I mean is that if I take the exact same evidence 221 221
and I give it to somebody else, 222 222
they should get the same result 223 223
if they use the same methods you did, 224 224
and again this is why it is so important 225 225
that you document every single thing you do 226 226
when you're doing your analysis. 227 227
For instance, when I do my analysis, 228 228
I will write down the time, the action I took, 229 229
I clicked this button, I ran this command, 230 230
here was my results and I put a screenshot in there. 231 231
That way, anybody who comes behind me, 232 232
can see exactly what I did, 233 233
when I did it, how I did it 234 234
and if they run those same commands, 235 235
they should get the same results. 236 236
If they don't 237 237
that could be reason to get your evidence thrown out. 238 238
And the third thing is that evidence must not be changed 239 239
or manipulated. 240 240
We never want to do analysis on the actual device itself. 241 241
Instead, we always want to do it on a copy when we can. 242 242
So, if I'm taking evidence from a hard drive, 243 243
I'm going to do a copy of that hard drive. 244 244
I'm going to run an integrity check on both the drive 245 245
and the source to make sure they match such as a hash. 246 246
And if they do, I can then do my analysis on the copy. 247 247
That way I don't have the possibility of modifying 248 248
or changing the original. 249 249
And we'll talk about a lot of other things 250 250
of how we can make sure we don't modify the original 251 251
as we go through this section. 252 252
Now, here is a big warning for you. 253 253
If you're ever going to do this professionally, 254 254
keep this in mind. 255 255
Defense attorneys will try to use any deviation 256 256
from your ethics or from your procedures 257 257
as a reason to dismiss your findings and analysis. 258 258
Remember, these attorneys get paid big dollars 259 259
to be able to get their clients off. 260 260
That's their job. 261 261
They're trying to get that case thrown out. 262 262
Anytime they can get your evidence thrown out 263 263
that is one less thing against their client. 264 264
And so they're going to do that. 265 265
They are going to go after you, 266 266
they're going to go after your credentials, 267 267
they're going to go after your methods, 268 268
they're going to go after your processes 269 269
and you're going to have to defend all of that in court 270 270
to make sure your evidence can be admissible 271 271
and can't stand up in court.