1 IT Investigative Tools Tools and Services for the Forensic Auditor

2 Digital Crime Scene Investigation Problems with Digital Investigation Timing essential – electronic evidence volatile Auditor may violate rules of evidence NEVER work directly on the evidence Skills needed to recover deleted data or encrypted data

3 Digital Crime Scene Investigation Extract, process, interpret Work on the imaged data or “safe copy” Data extracted may be in binary form Process data to convert it to understandable form  Reverse-engineer to extract disk partition information, file systems, directories, files, etc  Software available for this purpose Interpret the data – search for key words, phrases, etc.

4 Digital Crime Scene Investigation Technology Magnetic disks contain data after deletion Overwritten data may still be salvaged Memory still contains data after switch-off Swap files and temporary files store data Most OS’s perform extensive logging (so do network routers)

5 Disk Geometry Track Sector Cylinder (Clusters are groups of Sectors)

6 Slack Space End of File Slack Space Last Cluster in a File

7 Illustration of Forensic Tools Forensic Software Tools are used for … Data imaging Data recovery Data integrity Data extraction Forensic Analysis Monitoring

8 Data Imaging EnCase Reduces internal investigation costs Platform independent Automated analysis saves time Supports electronic records audit Creates logical evidence files — eliminating need to capture entire hard drives

9 Data Recovery File Recovery with PC Inspector

10 Data Eradication Securely Erasing Files

11 Data Integrity MD5 Message Digest – a hashing algorithm used to generate a checksum Available online as freeware Any changes to file will change the checksum Use: Generate MD5 of system or critical files regularly Keep checksums in a secure place to compare against later if integrity is questioned

12 Data Integrity MD5 Using HashCalc

13 Data Integrity HandyBits EasyCrypto

14 Data Integrity Private Disk

15 Data Monitoring Tracking Log Files

16 Data Monitoring PC System Log

17 Security Software Log Entries

18

19 Free Log Tools

20 Audit Command Language (ACL) ACL is the market leader in computer- assisted audit technology and is an established forensics tool. Clientele includes … 70 percent of the Fortune 500 companies over two-thirds of the Global 500 the Big Four public accounting firms

21 Forensic Tools Audit Command Language ACL is a computer data extraction and analytical audit tool with audit capabilities … Statistics Duplicates and Gaps Stratify and Classify Sampling Benford Analysis

23

24

25

26

27 Forensic Tools: ACL Benford Analysis States that the leading digit in some numerical series follows an exponential distribution Applies to a wide variety of figures: financial results, electricity bills, street addresses, stock prices, population numbers, death rates, lengths of rivers

28

29

30

31 Data Monitoring Employee Internet Activity Spector captures employee web activity including keystrokes, , and snapshots to answer questions like: Which employees are spending the most time surfing web sites? Which employees chat the most? Who is sending the most s with attachments? Who is arriving to work late and leaving early? What are my employees searching for on the Internet?

32 Data Monitoring : Spector Recorded

33 Data Monitoring : Spector Recorded Web Surfing

34 Data Monitoring : Spector Recording Keystrokes

35 Data Monitoring : Spector Recorded Snapshots

36

37 Data Capture : Key Log Hardware KeyKatcher  Records chat, , internet & more  Is easier to use than parental control software  Identifies internet addresses  Uses no system resources  Works on all PC operating systems  Undetectable by software

38 index.dat files Contain all of the Web sites that you have ever visited. Every URL, every Web page, all of the that has been sent or received through Outlook or Outlook Express. On Windows 2000 and Windows XP there are several "index.dat" files in these locations: \Documents and Settings\ \Cookies\index.dat \Documents and Settings\ \Local Settings\History\History.IE5\index.dat \Documents and Settings\ \Local Settings\History\History.IE5\MSHist \index.dat \Documents and Settings\ \Local Settings\History\History.IE5\MSHist \index.dat \Documents and Settings\ \Local Internet Files\Content.IE5\index.dat These files cannot be deleted without special software!

39

40 Background Checks

41

42

43

44

45 ipconfig /all

46 ipconfig /displaydns

47 netstat -a

48

49 Eraser Private Disk HashCalc PC Inspector VeriSign HandyBits Encryption EnCase

50 Spector Stolen ID Search Abika Background Check Guide to Log Management ACFE Fraud Prevention Checkup NetWitness GASP Std V 7.0 Free Software Federal Guidelines for Searches

51 Florida Criminal Database Federal Bureau of Prisons