Guide to Computer Forensics and Investigations Fourth Edition Unit 8 Investigations

Guide to Computer Forensics and Investigations2 Exploring the Role of in Investigations With the increase in scams and fraud attempts with phishing or spoofing –Investigators need to know how to examine and interpret the unique content of messages Phishing s are in HTML format –Which allows creating links to text on a Web page One of the most noteworthy scams was 419, or the Nigerian Scam Spoofing can be used to commit fraud

Guide to Computer Forensics and Investigations3 Exploring the Roles of the Client and Server in Send and receive in two environments –Internet –Controlled LAN, MAN, or WAN Client/server architecture –Server OS and software differs from those on the client side Protected accounts –Require usernames and passwords

Guide to Computer Forensics and Investigations4 Exploring the Roles of the Client and Server in (continued)

Guide to Computer Forensics and Investigations5 Exploring the Roles of the Client and Server in (continued) Name conventions –Corporate: –Public: –Everything belongs to the domain name Tracing corporate s is easier –Because accounts use standard names the administrator establishes

Guide to Computer Forensics and Investigations6 Investigating Crimes and Violations Similar to other types of investigations Goals –Find who is behind the crime –Collect the evidence –Present your findings –Build a case

Guide to Computer Forensics and Investigations7 Investigating Crimes and Violations (continued) Depend on the city, state, or country Examples of crimes involving s –Narcotics trafficking –Extortion –Sexual harassment –Child abductions and pornography

Guide to Computer Forensics and Investigations8 Examining Messages Access victim’s computer to recover the evidence Using the victim’s client –Find and copy evidence in the –Access protected or encrypted material –Print s Guide victim on the phone –Open and copy including headers Sometimes you will deal with deleted s

Guide to Computer Forensics and Investigations9 Examining Messages (continued) Copying an message –Before you start an investigation You need to copy and print the involved in the crime or policy violation –You might also want to forward the message as an attachment to another address With many GUI programs, you can copy an by dragging it to a storage medium –Or by saving it in a different location

Guide to Computer Forensics and Investigations10 Viewing Headers Learn how to find headers –GUI clients –Command-line clients –Web-based clients After you open headers, copy and paste them into a text document –So that you can read them with a text editor Headers contain useful information –Unique identifying numbers, IP address of sending server, and sending time

Guide to Computer Forensics and Investigations11 Viewing Headers (continued) Outlook –Open the Message Options dialog box –Copy headers –Paste them to any text editor Outlook Express –Open the message Properties dialog box –Select Message Source –Copy and paste the headers to any text editor

Guide to Computer Forensics and Investigations12 Viewing Headers (continued) Hotmail –Click Options, and then click the Mail Display Settings –Click the Advanced option button under Message Headers –Copy and paste headers Apple Mail –Click View from the menu, point to Message, and then click Long Header –Copy and paste headers

Guide to Computer Forensics and Investigations13 Viewing Headers (continued) Yahoo –Click Mail Options –Click General Preferences and Show All headers on incoming messages –Copy and paste headers

Guide to Computer Forensics and Investigations14 Examining Headers Gather supporting evidence and track suspect –Return path –Recipient’s address –Type of sending service –IP address of sending server –Name of the server –Unique message number –Date and time was sent –Attachment files information

Guide to Computer Forensics and Investigations15 Examining Headers (continued)

Guide to Computer Forensics and Investigations16 Examining Additional Files messages are saved on the client side or left at the server Microsoft Outlook uses.pst and.ost files Most programs also include an electronic address book In Web-based –Messages are displayed and saved as Web pages in the browser’s cache folders –Many Web-based providers also offer instant messaging (IM) services

Guide to Computer Forensics and Investigations17 Tracing an Message Contact the administrator responsible for the sending server Finding domain name’s point of contact – – – – Find suspect’s contact information Verify your findings by checking network logs against addresses

Guide to Computer Forensics and Investigations18 Understanding Servers Computer loaded with software that uses protocols for its services –And maintains logs you can examine and use in your investigation storage –Database –Flat file Logs –Default or manual –Continuous and circular

Guide to Computer Forensics and Investigations19 Understanding Servers (continued) Log information – content –Sending IP address –Receiving and reading date and time –System-specific information Contact suspect’s network administrator as soon as possible Servers can recover deleted s –Similar to deletion of files on a hard drive

Guide to Computer Forensics and Investigations20 Using Specialized Forensics Tools Tools include: –AccessData’s Forensic Toolkit (FTK) –ProDiscover Basic –FINAL –Sawmill-GroupWise –DBXtract –Fookes Aid4Mail and MailBag Assistant –Paraben Examiner –Ontrack Easy Recovery Repair –R-Tools R-Mail

Guide to Computer Forensics and Investigations21 Using Specialized Forensics Tools (continued) Tools allow you to find: – database files –Personal files –Offline storage files –Log files Advantage –Do not need to know how servers and clients work

Guide to Computer Forensics and Investigations22 Using AccessData FTK to Recover FTK –Can index data on a disk image or an entire drive for faster data retrieval –Filters and finds files specific to clients and servers To recover from Outlook and Outlook Express –AccessData integrated dtSearch dtSearch builds a b-tree index of all text data in a drive, an image file, or a group of files

Guide to Computer Forensics and Investigations23 s are very important. When anyone sends an or receives an they’ve received a piece of an evidentiary chain. The doesn’t necessarily get deleted when a user deletes it from their computer for several reasons. For one, it may exist on another mail server while in transition or while waiting to be downloaded by the receiver. At the very least, evidence that the passed through one or more mail servers is maintained in server logs. Second, the may exist on the receiver’s computer and third, it may exist in a backup anywhere along the line between the original sender and the ’s final destination. One should never assume that they have the only copy of an ..

Guide to Computer Forensics and Investigations24 Creating an archive of s is important. If one is diplomatic in their s and doesn’t have anything pejorative to conceal, then by deleting messages, one potentially places themselves in the position of appearing as if they were attempting to hide possible evidence. A lack of documentation, especially if another party has copies of s, can actually hurt oneself when embroiled in a heated court case. On the flipside, if the other side has attempted to hide or delete possible evidence, then by maintaining a copy of s, you’ll have the advantage.

Guide to Computer Forensics and Investigations25 In the corporate environment, maintaining one’s own servers is vital. The importance of such an act is fundamental in providing detailed mail logs as well as understanding what the mail logs record. When a corporation employs its own knowledgeable IT staff to oversee its own internal mail servers, the IT administration will know how best to make backups of the logs in order to maintain not only an evidentiary chain, but also the format of the logs and what is contained within them. This saves time and money in the event that the logs need to be inspected. Also, third party mail servers usually will not maintain lengthy backups as they have no need to. Important evidence may be deleted in a third-party mail server environment whereas, internal mail server administration would be more apt to maintain lengthy archives of mail records (including offsite archives).

Guide to Computer Forensics and Investigations26 Digital Identification is a very important consideration when sending and receiving sensitive corporate-related information. Digital IDs work by tagging an with a specific marker. If the structure or the body of the changes after it has been sent, the marker will fail a validation check. This would prove that an had been tampered with and at the very least will demonstrate that it is not in the same format as when it had left the sender’s mail client. Copyright