forensics tries to reconstruct and explain activities and events - PowerPoint PPT Presentation

forensics tries to reconstruct and explain activities and events ● their actors and participants – causes – consequences – individual forensic procedures ● in the best case can only provide parts of the puzzle – for the whole picture/story ● they need to be put in the right sequence – interpreted in broader context – the legal ramifications of forensic investigation it is important to ● make sure that forensic material cannot be changed (tampered) – after being acquired ● and that this can be proved – therefore we need a well defined procedure(s) ● 2 21.12.2018. 2015- 2017 (c) P.Pale: Računalna forenzika - Procedures

• police (court) forensics ▪ have their required, mandatory procedures ▪ scope defined by law • this course teaches generic/general forensics ▪ applicable in industry • therefore it is not based on procedures defined by any law(s) 3 21.12.2018. 2015- 2017 (c) P.Pale: Računalna forenzika - Procedures

• reconnaissance of the target system • planning the evidence acquisition • acquisition of evidence material • storing and guarding the material • analysis of the material • reporting • But! ▪ before the beginning ▪ acquire/define the questions you need to give answers to ◦ in written form 4 21.12.2018. 2015- 2017 (c) P.Pale: Računalna forenzika - Procedures

• what is it all about – what are we invetigating ▪ disaster, attack, problems , suspicion… • define the scope of the system – what are we going to observe/analyse ▪ computer/device, cluster, system, data, organization, public … • enumerate/list components ▪ servers, workstations, portable devices, phones, other equipment connected with IT components • interview actors and stakeholders ▪ operators, managers, management, users, partners … • gather the documentation ▪ communication system’s blueprints ▪ logic blueprints of information system 5 21.12.2018. 2015- 2017 (c) P.Pale: Računalna forenzika - Procedures

• gather as many as possible information ▪ about the subject of investigation • passive gathering • interviews ▪ users ▪ operates ▪ authorized persons ▪ everybody involved • find out ▪ which network resources are used ▪ which communication systems ◦ mail servers ◦ social networks ◦ … 6 21.12.2018. 2015- 2017 (c) P.Pale: Računalna forenzika - Procedures

• identify target device/program/data • if this is not possible, than enumerate/list : ▪ computers: servers, users’ ▪ handheld devices ▪ communication equipment ▪ other • identify other target devices • identify other targed data • determine which devices can be turned off • define the sequence of acquisition • ensure the legitimacy of the procedure, authority, support 7 21.12.2018. 2015- 2017 (c) P.Pale: Računalna forenzika - Procedures

• remove all persons from the • physically protect physical space except forensics the objects • do not touch anything ▪ for transport • take photos of the scene ▪ for storage ▪ record (in written) ▪ prepare instructions everything that seems important for transport • take photos and document • label every object how things were connected uniquely • seize devices ▪ the very object • take cables too , if they are special ▪ and its packaging ▪ power supplies • prepare all necessary • take media documentation for • do not forget printed documents takeover of evidence ▪ hand written, reminders etc. ▪ and acquire all signatures 8 21.12.2018. 2015- 2017 (c) P.Pale: Računalna forenzika - Procedures

• do not turn off devices which are turned on gasite ▪ du not turn on those which are turned off • communication devices which have wireless communication put in Faraday bags • look around the devices ▪ take all gadgets which could be part of the device • if you have to turn the device off ▪ first take the photo of the screen ▪ make a list of active applications, visited web sites, … ◦ if it can be done safely!!! ▪ capture the RAM ▪ take the battery out from portable devices • when detaching cables ▪ label them, make sketches ▪ and take photos 9 21.12.2018. 2015- 2017 (c) P.Pale: Računalna forenzika - Procedures

• storage and protection must be according to law • keep separate inventory of stored materials • copy everything that can be copied ▪ analysis should not be done on original evidence material • access to stored evidence material must be under strict surveillance ▪ this pertains to investigator’s notes and reports ▪ keep the access log to stored material • take special care about parts of devices that can be detached ▪ each part should be separately labeled and logged 10 21.12.2018. 2015- 2017 (c) P.Pale: Računalna forenzika - Procedures

• acquire the order for analysis ▪ what are we looking for? ▪ which questions do we need to answer? • perform the forensic analysis ▪ but on copies of data • keep precise log ▪ what was investigated ▪ why ▪ who performed investigation ▪ how , with what ▪ what did they find ◦ data ◦ conclusions • prepare data for report 11 21.12.2018. 2015- 2017 (c) P.Pale: Računalna forenzika - Procedures

• question or hypothesis • the object (which material ) will be analyzed • which method • Investigation • which tools • Expert • Date • when (from – to) • Place • results • ID of analysis • …. • conclusion/finding • next step - proposal 12 21.12.2018. 2015- 2017 (c) P.Pale: Računalna forenzika - Procedures

• who (all) will receive reports & what are their questions • separate report for different recipients ▪ based on gathered documentation and ▪ results of analyses • Important! Forensic expert is not the judge. Does not define the responsibility. ▪ but merely states facts & offers expert interpretation ▪ in ideal case, the forensic expert merely answers the questions • take care about the level of confidentiality ▪ mark confidentiality in appropriate manner • get ready for oral presentation of findings and or ▪ questions ▪ counter-arguments Keep detailed log about given answers 13 21.12.2018. 2015- 2017 (c) P.Pale: Računalna forenzika - Procedures

• Case description • Broader assignment ▪ order/warrant • Expert opinion ▪ answer to question #1 ▪ answer to question # 2 ▪ … ▪ answer to question # N • the report is result of your entire work • Argumentation • others do not seee te rest ▪ by each question ▪ short • any other expert should understand it • Findings od analyses • and reach same conclusions ▪ results ▪ by each question/analysis • Forensic team ▪ their competences • Methods od work • Addenda 14 21.12.2018. 2015- 2017 (c) P.Pale: Računalna forenzika - Procedures

• when you are sure there will be no more investigation ▪ return all evidence material ▪ archive all documentation ◦ lists ◦ minutes ◦ logs ◦ reports ▪ in special cases – destroy all work materials ◦ and have the proof you did it 15 21.12.2018. 2015- 2017 (c) P.Pale: Računalna forenzika - Procedures