1. © 2013 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. System Forensics, Investigation, and Response Chapter 7 Collecting, Seizing, and Protecting Evidence

2. Page 2 System Forensics, Investigation, and Response © 2013 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Learning Objective and Key Concepts Learning Objective  Examine the evidence life cycle. Key Concepts  Differences between data and evidence  Types of evidence  Chain of custody requirements  Collection, transportation, and storage of evidence

3. Page 3 System Forensics, Investigation, and Response © 2013 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. DISCOVER: CONCEPTS

4. Page 4 System Forensics, Investigation, and Response © 2013 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. 5 Rules of Evidence Admissibility Evidence must be admissible in court. Authenticity Evidence must relate to the incident. Completeness Evidence must be comprehensive. Reliability Evidence collected must be uncontaminated and consistent. Believability Evidence presented should be clearly understandable and believable by the jury.

5. Page 5 System Forensics, Investigation, and Response © 2013 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. DISCOVER: PROCESS

6. Page 6 System Forensics, Investigation, and Response © 2013 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Evidence Life Cycle Collect or seize evidence Transport evidence Protect or store evidence Analyze evidence

7. Page 7 System Forensics, Investigation, and Response © 2013 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Evidence Collection  Freeze the scene.  Comply with the five rules of evidence.  Minimize handling and corruption of original data.  Proceed from volatile to persistent evidence.  Don’t run any programs on the affected system.

8. Page 8 System Forensics, Investigation, and Response © 2013 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Evidence Collection (Continued)  Account for any changes and keep detailed logs of actions.  Do not exceed current knowledge.  Follow local security policy.  Be prepared to testify.  Ensure that actions are repeatable.

9. Page 9 System Forensics, Investigation, and Response © 2013 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Evidence Transport  Shut down computer  Document hardware configuration  Document all evidence handling  Pack evidence securely

10. Page 10 System Forensics, Investigation, and Response © 2013 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Evidence Transport (Continued)  Photograph or videotape the scene from premises to transport vehicle.  Photograph or videotape the scene from vehicle to lab.  Transport computer to a secure location.

11. Page 11 System Forensics, Investigation, and Response © 2013 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Evidence Protection and Storage  Keep evidence in possession or control at all times.  Document movement of evidence between investigators.  Secure evidence appropriately so that it can’t be tampered with or corrupted.  Mathematically authenticate data. (i.e., hash values)

12. Page 12 System Forensics, Investigation, and Response © 2013 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Evidence Analysis  Make a list of key search words.  Work on image copies, never originals.  Capture an image of the system that is as accurate as possible, such as bit-stream backup.  Evaluate Windows swap file, file slack, and unallocated space.

13. Page 13 System Forensics, Investigation, and Response © 2013 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Evidence Analysis (Continued)  Identify file, program, storage anomalies  Evaluate program functionality  Document findings Create a case  Retain copies of software used

14. Page 14 System Forensics, Investigation, and Response © 2013 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. DISCOVER: CONTEXTS

15. Page 15 System Forensics, Investigation, and Response © 2013 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Sources for Data of Potential Evidentiary Value Access logsData transmissionsData on hard disks and storage devicesData on mobile devices

16. Page 16 System Forensics, Investigation, and Response © 2013 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Locating Data in Access Logs  Manually review logs, or  Use a log analysis tool

17. Page 17 System Forensics, Investigation, and Response © 2013 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Locating Data in Transmissions  For backed up data: Mirror to removable media with validation by system administrator  For live data: Uses packet sniffer or packet capture tool

18. Page 18 System Forensics, Investigation, and Response © 2013 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Locating Data on Hard Disks and Storage Devices  Mirror to stable media  Use recovery software  Use data reconstruction software

19. Page 19 System Forensics, Investigation, and Response © 2013 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Technical Issues  Life span of data  Collecting data quickly  Collecting bit-level data  Obscured data  Anti-forensics

20. Page 20 System Forensics, Investigation, and Response © 2013 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Types of Potential Evidence  Logs  Windows swap files and file slack  Unallocated space and temporary files  E-mails, word processing documents, and spreadsheets  Network data packets

21. Page 21 System Forensics, Investigation, and Response © 2013 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Summary  Differences between data and evidence, and valid and invalid data  The rules of evidence  Chain of custody requirements in evidence handling  Methods for collection or seizure, transport, protection and storage, and analysis of evidence