Introduction to Digital Forensics “You can have data without information, but you cannot have information without data.” -Daniel Keys Moran

Overview Syllabus Value of Cybersecurity Job Statistics and Titles Interesting Problems Nortel Case Study Intro. To Digital Forensics What is Digital Forensics? Goals of Digital Forensics Overview of the Digital Forensics Process Course Project Scenarios

Syllabus

Cybersecurity Job Outlook 3.5 million unfilled job openings by 2021 (worldwide) Cybercrime is predicted to cost 6 trillion dollars annually by 2021 (worldwide) Currently a 0% unemployment rate Average salary for a “Cybersecurity Professional” is $116,000 a year In 2017, 750,000+ people employed in cybersecurity within the U.S. In 2017, 350,000+ unfilled cybersecurity job within the U.S.

Cybersecurity Job Outlook 3.5 million unfilled job openings by 2021 Cybercrime is predicted to cost 6 trillion dollars annually by 2021 http://cyberseek.org/heatmap.html

Job Titles Related to this Course Chief Information Security Officer Computer Forensics Analyst Computer Forensics Examiner Cyber Investigator Digital Forensics Analyst Digital Forensics Examiner Digital Forensic Engineer Information Security Analyst

Case Studies BTK Serial Killer (https://precisioncomputerinvestigations.wordpress.com /2010/04/14/how-computer-forensics-solved-the-btk- killer-case/) Nortel (https://www.bcg.com/publications/2017/technology- digital-develop-cybersecurity-strategy-your-organization- existence-depends-it.aspx & http://business.financialpost.com/technology/nortel- hacked-to-pieces) The Computer that got Lost (http://burgessforensics.com/csi-computer-forensics- real-cases-from-burgess-forensics-12-the-case-of-the- computer-that-got-lost/) Mergers & Acquisitions (https://businesslawtoday.org/2017/09/the-importance- of-cybersecurity-due-diligence-in-ma-transactions/)

Introduction to Digital Forensics What is Digital Forensics? As decided by the first Digital Forensics Research Workshop in 2001, digital forensics is defined as “The use of scientifically derived and proven methods toward the preservation, collection, validation, identification, interpretation, documentation, and presentation of digital evidence derived from digital sources for the purpose of facilitating or furthering the reconstruction of events found to be criminal, or helping to anticipate unauthorized actions show to be disruptive to planned operations.”

Introduction to Digital Forensics What is Digital Forensics? Forensics can be considered an art and a science. The science of forensics combined with the art of investigation. Applying scientific method and deductive reasoning to data is the science, and interpreting the data to reconstruct events is an art.

Introduction to Digital Forensics Digital Forensics Examiner? In Forensic Discovery, Venema and Farmer argue an examiner acts more like a digital archaeologist and geologist than a traditional forensic examiner. “Digital archeology is about the direct effects from user activity, such as file contents, file access stamps, information from deleted files, and network flow logs. … Digital geology is about autonomous processes that users have no direct control over, such as the allocation and recycling of disk blocks, file ID numbers, memory pages or process ID numbers.

Introduction to Digital Forensics Goals of Digital Forensics: Find facts From these facts recreate the truth of an event

Introduction to Digital Forensics How do we figure out the truth? The truth of an event is established by discovering and exposing the remnants of the event which have been left on the system. These remnants are known as artifacts. Some artifacts may be evidence. Evidence is something used during a legal proceeding. Artifacts are traces left behind by activities and events. Artifacts may or may not be innocuous. Artifacts may or may not be material - able to be considered by the judge or jury to establish the truth or falsity of a fact or claim.

Introduction to Digital Forensics How do we figure out the truth? Every investigation has a hypothesis, “The user copied files to a USB”, “An unauthorized user gained root access”, etc. An examiner searches for artifacts which will indicate whether or not the hypothesis is valid. If it is a legal matter these artifacts are respectively called inculpatory and exculpatory evidence. Furthermore, since digital evidence is so easily manipulated, part of an examiner’s job is determining if the evidence is consistent with the processes and systems which purportedly generated it. This is called the evidence’s consistency and in some investigations assessing consistency is the examiner’s sole task.

Introduction to Digital Forensics Digital Forensics Process: Acquisition: collection of digital media to be examined. Analysis: the actual examination of the media Presentation: The process by which the examiner shares the results of this analysis. *Note: These steps are cyclical and many cycles may be necessary to complete a long running legal or incident response investigation.

Course Projects You will be tasked with the acquisition, analysis and presentation of information regarding the following scenarios: Attacker infiltrating a corporate network Employee exfiltrating sensitive data Computer user is suspected of performing illegal activities and potentially storing illegal data.

Suggested Supplemental Reading https://www.amazon.com/Incident-Response-Computer-Forensics-Third-ebook/dp/B00JFG7152 https://www.amazon.com/Art-Memory-Forensics-Detecting-Malware- ebook/dp/B00JUUZSQC/ref=sr_1_1?s=digital-text&ie=UTF8&qid=1514993139&sr=1- 1&keywords=art+of+memory+forensics https://www.amazon.com/Windows-Forensics-Dr-Philip- Polstra/dp/1535312432/ref=pd_bxgy_14_img_2?_encoding=UTF8&pd_rd_i=1535312432&pd_rd_r=RAMCJF V6WDTPXAWGPA3K&pd_rd_w=MilBL&pd_rd_wg=v3Gyv&psc=1&refRID=RAMCJFV6WDTPXAWGPA3K https://www.amazon.com/Digital-Forensics-Open-Source-Tools- ebook/dp/B004W7DO78/ref=sr_1_1?s=digital-text&ie=UTF8&qid=1514993191&sr=1- 1&keywords=forensics+open+source https://www.amazon.com/Practical-Forensic-Imaging-Securing-Evidence- ebook/dp/B01M0TQZRY/ref=sr_1_1?s=digital-text&ie=UTF8&qid=1514993397&sr=1- 1&keywords=forensics+linux+tools

Questions?