In this lesson,
we will cover digital forensic procedures.
Digital forensics is a systematic process of investigating
and analyzing digital devices and data
to uncover evidence for legal purposes,
often in the context of criminal investigations
or legal disputes.
Whenever you are performing digital forensics,
you must always adhere
to your organization's well-defined written procedures
to ensure that you are properly handling
your forensics correctly, efficiently,
and in accordance with the required regulation.
This approach helps to ensure
that you are always utilizing consistent
and established protocols.
Digital forensic procedures
are broken down and categorized into four main phases,
identification, collection, analysis, and reporting.
First, we have identification.
The identification step
focuses on ensuring the safety of the scene,
securing it to prevent any evidence contamination,
and determining the scope of the evidence to be collected.
Let's pretend you're working with law enforcement
as a digital forensic examiner or data collection expert.
You receive a call to enter a home to respond to a crime,
but you know that this house
may be a potentially dangerous environment
since the threat actor may still be inside the building.
So now your initial priority
is to first secure the scene to ensure your safety
and the safety of others with the help of the police.
And then once the scene is properly secured,
you can proceed to work to preserve the evidence
from any kind of contamination,
and then you can take videos
or photographs of the crime scene
to document where everything was
when you arrived on the scene.
At the same time,
also need to begin to identify the scope of the evidence
that you will need to collect
by gaining a good understanding
of where the relevant data might be stored,
such as on a tablet, smartphone, smart TV, or a server
based on the nature of the data specified in the warrant.
Second, we have the collection phase.
Once we have identified
what information needs to be collected,
we can begin our collection phase.
When it comes to collection,
it is imperative that you have the proper authorization
before you begin collecting any potential evidence.
If you are working with law enforcement,
this authorization will come in the form of a warrant
signed by a judge.
But if you're working in a large enterprise environment
while conducting an internal investigation,
you may need authorization from the CIO, CSO, CEO,
or other high-level executive
before attempting any evidence collection.
When it comes to evidence collection, you need to ensure
you follow the proper acquisition procedures
for your organization,
including following the order of volatility
and preserving the chain of custody.
Order of volatility is a systematic approach
in digital forensics
that dictates the sequence in which data sources
should be collected and preserved
based on their susceptibility to modification or loss.
General principles is to start with your collection efforts
with the most volatile resources
and work towards the least volatile resources
in order to minimize data loss
and maintain evidentiary integrity.
Now, the typical order of volatility
involves five main steps
according to the NIST Special Publication 800-86.
First, you must collect data from the system's memory,
including the processor's cache and system's RAM.
Second, we need to capture data from the system state,
such as the system and network configurations,
active user sessions, and any data that can be attained
without altering the state of the system.
Third, we need to collect data from your storage devices,
such as hard drives, solid-state devices,
and other non-volatile data storages.
Fourth, we need to capture network traffic and logs,
including data that can help us
reconstruct any network-related activities
or network events.
Fifth, we need to collect remotely stored archive data,
including backups, cloud storage,
external devices, and printouts.
As you can see, our whole goal here
is to collect the things that change fastest first
and then move into the more static
or less frequently changed items like your offsite backups.
When data's collected and acquired,
you must ensure that the chain of custody is maintained.
The chain of custody is a documented and verifiable record
that tracks the handling, transfer,
and preservation of digital evidence
from the moment that it's collected
until it is presented in a court of law.
Now, maintaining a secure and unbroken chain of custody
is essential to demonstrate the integrity
and admissibility of evidence.
Any time someone handles the evidence,
from their initial collector to a forensic analysis,
investigator, or other legal professional,
they must carefully document their actions
and any changes in the evidence custody status.
This meticulous record-keeping
ensures that the evidence remains untainted
and can withstand scrutiny during legal proceedings
that will ultimately contribute
to a credible and robust case
against a threat actor being charged
with some type of cyber crime.
When you collect your evidence,
it should be collected using processes
like disk imaging and file carving.
Disk imaging involves creating a bit-by-bit
or logical copy of a storage device,
preserving its entire content,
including deleted files and unallocated space.
Disk imaging ensures
that the original data remains untouched
and allows forensic analysts
to work with an exact duplicate of the device
for the analysis.
File carving, on the other hand,
focuses on extracting files and data fragments
from storage media without relying on the file system.
File carving is particularly useful
when file metadata is missing or corrupted.
Both techniques can serve as a critical role
in preserving evidence and providing forensic experts
the data they need to conduct a thorough investigation
while maintaining the original integrity
of the evidence source.
The third phase is the analysis phase.
Once we have confirmed,
forensically sound copy of the evidence available,
our forensic analysts
can employ repeatable methods and tools
for the examination of the evidence.
This rigorous process
involves systematically scrutinizing the data
to uncover relevant information,
such as potential signs of criminal activity,
hidden files, timestamps, and user interactions.
Analysts follow strict procedures and documented protocols
to ensure consistency and objectivity in their findings.
By adhering to these established practices,
digital forensic experts
can derive valuable insights from the evidence
to help unravel complex cases and provide crucial support
for any potential legal proceedings.
The fourth and final step of the process
is known as reporting.
Now, after the forensic analyst
completes their analysis of the evidence,
they must present a document
that describes their methods and tools
that they used in their investigation,
any actions that they performed during analysis,
their detailed findings,
and their final conclusions about the investigation
in their final report.
This report serves as crucial evidence
in legal proceedings and trials,
and the forensic analysts must be prepared
to testify in court about their findings.
This is another reason why it's essential
to adhere to strict procedures
when conducting digital forensics,
because you may be asked to defend your work
against potential challenges by a defense attorney.
Now, another important concept to understand
is a legal hold.
When litigation is reasonably expected,
your organization will be forced to implement a legal hold.
A legal hold is a formal notification
that instructs employees
to preserve all potentially relevant electronic data,
documents, and records.
Legal hold ensures that no evidence is tampered with,
deleted, or lost,
as any alteration or destruction of relevant data
can lead to severe legal consequences.
This process essentially freezes the state
of electronic information
to safeguard it for future use
in an upcoming legal proceeding.
When a legal hold is issued,
you must ensure that preservation practices
are used to protect the systems
and potential evidence that they contain.
Preservation involves taking proactive steps
to maintain and protect electronic evidence
in its original state, including ensuring that the data
is not overwritten, deleted, or modified inadvertently.
Preservation measures may include making backup copies
of electronic records, isolating critical systems,
and implementing access controls
to prevent any unauthorized alterations.
The goal of preservation
is to maintain the evidentiary integrity
of the electronic information,
which is essential for building a strong case
or responding to legal requests.
Finally, we have e-discovery.
E-discovery, or electronic discovery,
is the process of identifying, collecting,
and producing electronically stored information
during potential legal proceedings.
E-discovery encompasses searching through fast volumes
of electronic data to locate relevant evidence,
analyzing it, and presenting it
in a format suitable for litigation.
E-discovery tools and techniques are employed
to efficiently sift through emails, documents,
databases, and other digital records.
Effective e-discovery practices
are essential for legal teams
to meet their disclosure obligations
and navigate the complexities of modern litigation,
where electronic data often plays a central role.
Now, if all of this sounds like it has potential
to have issues arise that could cause legal issues
for you or your organization, you are right.
In most cases, your organization
should opt to appoint a liaison
with legal knowledge and expertise
to help facilitate communication and cooperation
with law enforcement and forensic teams
to ensure you stay on the right side of the law.
This liaison can serve as a point of contact
for interactions and ensuring a smoother process.
And often, this person is someone who is a lawyer
or works with your organization's in-house general counsel
to keep your organization on the right side of the law.
Finally, let's quickly talk about ethical considerations
that are important to think about
in the field of digital forensics.
Your organization's forensic analysts
must adhere to a code of ethics
that emphasizes three key principles,
avoiding bias, repeatable actions,
and the preservation of evidence.
All of your analysis must always be performed
without any kind of bias or prejudice.
Any conclusions you draw should be solely based
on the evidence that you're analyzing.
You should never have your own thoughts like,
"Well, I don't like this person because of X, Y, and Z."
Your investigation cannot be based on their color,
their creed, their nationality,
their sexual orientation, their political beliefs,
what they look like, or anything else like that.
It should be based only on the evidence.
Personally, I have found that it is best practice
to use a forensic analyst
who is completely removed from the situation
to avoid any kind of potential bias.
For example, in some places that I worked,
we would have one set of people
who collect information called digital media collectors
and another set that analyzes it
called the digital forensic examiners.
Under this model, the forensic analysts
only have the data to rely on
since they don't know the victim or attacker's name
or anything else about the case up to that point,
and that can help minimize and eliminate some of that bias.
Also, all of your analysis must utilize repeatable processes
that anyone else can perform
and get the exact same results that you did.
This is why documenting all of your actions
in a final report is so important,
because proper documentation of methods
ensures that others can reproduce the same results
using the same techniques.
Now, what I mean is that if I take the exact same evidence
and give it to somebody else,
they should be able to get the same results
if they use the same methods that you did.
For example, when I do my forensic analysis,
I will write down the time, the actions that I took,
and the results of those actions.
For example, on February 2nd, 2024, at 10:23,
I entered the command "netstat -ano"
at the command prompt of the Windows 10 system.
I received a list of active network connections
on that machine, and I noticed a connection
to a potentially malicious server
with an IP address of 66.55.44.33.
In addition to this, I might also include a screenshot
of the netstat results.
This way, anyone who might be asked to double check my work
can see what I did, when I did it,
how I did it, and what results I received.
It is almost critically important
that any evidence you collect
is not changed or manipulated.
When I talk about evidence here,
I am talking about both the device itself,
like a hard disk of a laptop,
and the files or data recovered from that device.
For example, I am starting to perform a forensic analysis
on your laptop.
I should not start running commands on your laptop
since that could change the contents of your swap file
and potentially other files of your hard drive.
So, I should first image that drive,
then conduct my analysis on the disk image of that drive
instead of the original drive
to prevent any modifications or alterations
of any potential evidence located on that hard drive.
So remember, digital forensics is a systematic approach
of investigating and analyzing digital devices and data
to uncover evidence for legal purposes.
Digital forensic procedures
are broken down and categorized in four main phases,
identification, collection, analysis, and reporting.
You should always ensure that you follow a code of ethics
that emphasizes three key principles,
avoiding bias, repeatable actions,
and the preservation of the evidence.
If you begin to have any deviations
from these ethical standards and procedures,
a good defense attorney
will be able to discredit your findings in court,
which could lead to the evidence you collected
being inadmissible in court,
and the threat actor will be able
to get away with their crimes without any prosecution.
So remember, always follow the proper procedures
when collecting and analyzing evidence
so that justice can be upheld
even if your work undergoes rigorous scrutiny
during a legal proceeding.