Instructor: Data acquisition. 2 2
In this lesson, 3 3
we're going to talk about how you start acquiring evidence. 4 4
This involves data acquisition, 5 5
which is the method and tools used 6 6
to create a forensically sound copy of the data 7 7
from a source device, such as system memory or a hard disk. 8 8
Now, when you deal with acquisition, 9 9
the first question you have to ask 10 10
is do I have the right to search 11 11
or seize this thing legally? 12 12
This is an important question 13 13
because in your organization 14 14
not all the devices are owned by the company. 15 15
If it's owned by the company, 16 16
yeah, you have rights to go ahead and collect on it 17 17
because you work for the company and they want you to. 18 18
But what if you allow bring-your-own-device? 19 19
If you allow bring-your-own-device in your organization, 20 20
these policies can complicate data acquisition 21 21
because you may not legally be able to search 22 22
or seize that device 23 23
because you don't own it, the employee does. 24 24
And so, you have to make sure 25 25
that any evidence you're gathering 26 26
you have permission to gather, 27 27
otherwise that search could be inadmissible. 28 28
Another thing that makes data acquisition 29 29
very complicated is that when you get to a crime scene 30 30
you're not just dealing with the physical world, 31 31
you're dealing with the digital world. 32 32
And so, when I come into a room 33 33
and I see that the lights are on and a computer is on, 34 34
how am I going to collect the data off that computer? 35 35
Am I going to shut it down? 36 36
Am I going to power it off? 37 37
Am I going to collect it when it's powered on? 38 38
All of these are valid options, 39 39
and each one has drawbacks and benefits 40 40
depending on what you're trying to collect. 41 41
But for now, I just want you to keep in mind 42 42
the fact that when you're dealing with a digital crime scene 43 43
as opposed to just a physical one 44 44
there is some evidence that could be lost 45 45
when you turn off a computer or shut it down. 46 46
And so, you need to make sure you understand 47 47
what you're going to do 48 48
and the procedures you're going to do with. 49 49
Now, this brings us to the idea that some of this data 50 50
can only be collected when the system is on 51 51
and some of this data can only be collected 52 52
once the system is shut down 53 53
or you suddenly remove the power. 54 54
Now, an analyst 55 55
always has to think about the order of volatility 56 56
when they collect their evidence. 57 57
You should have learned about the order of volatility 58 58
back in A+ and back in Security+. 59 59
So the rest of this lesson should be a review, 60 60
but if it's been a while, 61 61
let's go ahead and cover it anyway. 62 62
First, we always want to collect anything that is short term, 63 63
anything that is highly volatile. 64 64
So if you start thinking about things like CPU registers 65 65
and cache memory, 66 66
that is very small amounts of memory inside those processors 67 67
and so it's getting changed very frequently 68 68
so you want to be able to collect that as soon as possible. 69 69
Then, we move on to the other volatile memory, 70 70
which is things like system memory, 71 71
routing tables, ARP caches, process tables, 72 72
temporary swap files, and things like that. 73 73
All of those are things that are volatile 74 74
and are changing quite rapidly 75 75
but not nearly as quickly as a CPU register or cache memory. 76 76
Then we move onto the data 77 77
that's on persistent mass storage. 78 78
Now, in the old days, we would just say the hard drive, 79 79
but nowadays we just say mass storage 80 80
because this includes our hard drives, 81 81
our solid state drives, and our flash drives. 82 82
All of these are persistent mass storage 83 83
because they will retain the information 84 84
when you take away power, unlike memory, 85 85
but it does still change quite often 86 86
as long as the computer is on 87 87
and people are writing or reading to that disc. 88 88
Then we're going to go ahead 89 89
and collect the things that are remotely logged, 90 90
things like our seam and any other kind of monitoring data. 91 91
This is important because, 92 92
while it is not on the system you're analyzing, 93 93
it was already remotely logged somewhere else, 94 94
that other place somewhere else 95 95
is still being read and written to 96 96
over and over again by other systems 97 97
and so it could modify some data 98 98
so we want to collect that as well. 99 99
After that, we want to get anything that's physical. 100 100
This is the physical configuration 101 101
and network topology and things of that nature. 102 102
So if I go into the network 103 103
and I start looking at the way it's wired 104 104
and I say, "Okay, this computer was talking to this switch, 105 105
which talks to this router," 106 106
and I can start mapping that out 107 107
and collecting that information. 108 108
After that, we're going to collect archival media. 109 109
Now what is that? 110 110
It's things like backup tapes and offsite storage, 111 111
things that are written to once 112 112
and then they aren't touched again. 113 113
For instance, you might write something 114 114
to a CD-R or a DVD-R. 115 115
Once it's written to that disc, 116 116
it's going to maintain that data on it 117 117
until you destroy the disc 118 118
and so it is our lowest priority of collection 119 119
but still something we want to collect at the end of the day. 120 120
Now, one piece of warning that I want to give you 121 121
is something that a lot of junior analysts 122 122
will neglect to think about. 123 123
When you're dealing with the Windows registry, 124 124
a lot of people think about the Windows registry 125 125
as being on the hard disk, 126 126
and while most of the Windows registry 127 127
is stored on the hard disk 128 128
there are some key areas like the HKLM\Hardware hive 129 129
that only store themselves in memory. 130 130
So you want to analyze that registry part 131 131
using a memory dump instead. 132 132
When I analyze the registry, 133 133
I usually do it via a memory dump first, 134 134
and then I can go back 135 135
and do it off the hard drive afterwards. 136 136
That way, anything that was missed in memory 137 137
might get caught by the hard drive 138 138
and I can see both things. 139 139
When you're dealing with things 140 140
like the \Hardware hive, 141 141
it's really important to capture that 142 142
because that is going to record every single disc 143 143
that has been connected or taken out of that computer. 144 144
If I use a thumb drive in that computer, 145 145
it's going to be logged in that hardware hive. 146 146
So that would tell me as an analyst 147 147
that I need to start looking for that thumb drive 148 148
or that flash drive 149 149
so I can find the data 150 150
that was written off from this computer. 151 151
And so that's one of the reasons 152 152
why that's really important to think about.