1. Presented by Steve Abrams, M.S. Charleston, SC / Long Island, NY
SCALI Annual Seminar
May 8, 2004
Computer Forensics 101
Essential Knowledge for
21st Century Investigators
with Case Studies
Presented by Steve Abrams, M.S.
Abrams Computer Forensics
Charleston, SC / Long Island, NY
(866) *

2. What is Computer Forensics ?
The search for, and the collection of, evidence from computer systems in a standardized and well-documented manner to maintain its admissibility and probative value in a legal proceeding.

3. Computer Forensics is not “Hacking”
Never use “Spy-ware”
Never “hack” a password
Never login to an account unauthorized
(without a warrant or court order)
Keystroke loggers no longer legal
All of these violations are now (usually) a felony. The law is in flux, beware!

4. Computer Forensics is not “Hacking”
Stick to the evidence left on the hard drive, and you should be on safe legal ground. Provided you have proper consent to search the hard drive.

5. Component Steps of Computer Forensics
Make a Forensic Image
Create Indexes and setup “case”
Look for evidence within the image
Generate Report (CD-ROM / Written)

6. Component Steps of Computer Forensics
Make a Forensic Image
Requires Extensive Knowledge of Computer Hardware and Software, Especially Operating Systems and File Systems.
Requires Special “Forensics” Hardware and Software
Requires Knowledge of Proper Evidence Handling.
In Most States Requires a P.I. License, and Consent to Search the Computer.

7. Consent Who Can Consent to a Search Get it in Writing
(Spouse, Parent, Business Owner)
Get it in Writing
(Boilerplate Affidavits)

8. Affidavit of _______________________
STATE OF SOUTH CAROLINA ) )
COUNTY OF _______________ )
Affidavit of _______________________
Consent given to search a personal computer.
  PERSONALLY appeared before me the undersigned who duly sworn and says as follows:
1.     My Name is _______________________________________. I reside
at _____________________________________________________
2.  I have hired Steven M. Abrams, M.S., P.I., to conduct a computer forensics examination of a hard drive from a personal computer, which is in my possession.
3.     I have consented to a search by Mr. Abrams of all data contained on the hard drive.
4.     I attest that the computer hard drive which I have consented to have searched is marital property; to which I have had unfettered access.
5.     I acknowledge that I have been informed that state and federal law requires Mr. Abrams to notify law enforcement authorities of any suspected child pornography or evidence of criminal activity found on a computer during his examination.

9. Component Steps of Computer Forensics
Make a Forensic Image
Rule #1 – Never Alter the Evidence Media in the Process of making a Forensic Image.
This necessitates special hardware and software.

10. Component Steps of Computer Forensics
Create Indexes and setup “case”
Access Data Forensic Toolkit (FTK)
Based on the dtSearch Engine, requires an index step which can take several hours or days to complete. After which keyword / expression searches are instantaneous.

11. Component Steps of Computer Forensics
Create Indexes and setup “case”
Access Data Forensic Toolkit (FTK)
Implements “Hashing” which allows standard system software and duplicate files to be safely ignored, and dangerous files (e.g. Child Porn) to be identified automatically.
FTK Hashing is Based on the Known File Filter (KFF) Engine.

12. Hashing
A hash value (or simply hash), also called a message digest, is a number generated from a string of text. The hash is substantially smaller than the text itself, and is generated by a formula in such a way that it is extremely unlikely that some other text will produce the same hash value. In Computer Forensics, hashes are used to uniquely identify a specific file. The hash value generated from a file becomes its “digital fingerprint”. MD5 and SHA are the two most common hash algorithms used in computer forensics.

13. Hashing
Hash codes can be used to quickly match files found during your investigations to lists of “Known Files” maintained by the Federal Government and Federal Law Enforcement Agencies.
These “Known Files” can include innocent files, such as components of MS Windows and “off the shelf” application software, that can safely be ignored by your investigations.
These “Known Files” can also include contraband files, such as child pornography and hacker tools, that should be highlighted by your investigations.

14. Component Steps of Computer Forensics
Look for evidence within the image
View Graphics, s, Documents, etc.
Keyword Searches
Bookmark relevant material for inclusion into report
Good investigation skills needed, must interview the client to get background material needed to focus the CF investigation.

15. Component Steps of Computer Forensics
Generate CF Report
Usually in HTML format
Can be printed or on CD-ROM
Basis for Investigation Report, Affidavits, Deposition and Testimony.
CF Report often supplemented with other investigation methods (Online Databases, / Phone Interviews)

16. Demonstrate Steps of a Computer Forensics Examination
Live FTK Demo
Demonstrate Steps of a Computer Forensics Examination

17. Case Histories

18. Case Histories Domestic Relations

19. Case Histories Domestic Relations
Pornography Adultery Financial Assets

20. Case Histories Wiretap / E.C.P.A.

21. Case Histories Financial Crimes