-: The forensic investigation process.
So we've talked about some of the tools
and we've talked about some of the training.
But how do you conduct a forensic investigation?
Well, it really comes down to a seven step process.
First, you need to determine what you wanna find out.
So if we're dealing with an incident response,
we're dealing with somebody who may have
hacked our network and stolen
some of our top secret information,
we wanna figure out what we wanna find out,
which in this case might be, who did it
and where'd they take the data.
Then we need to determine the location
that we would need to find that information.
In a case of who did it, or what data was stolen,
we'd have to look at the servers,
so maybe that's where we wanna do
our forensic investigation on.
Third, we wanna document our plan.
So we're gonna say, okay, I'm gonna look at the server,
and based on any computer that's accessed the server,
I'm gonna then go check those machines.
And we'll kinda step our way through the process
going through that plan.
Next, we're gonna acquire and preserve the evidence needed.
In this case we're gonna take an image of the server,
in my example, and any other machines
that happened to have touched the server recently
that touched those files that are missing.
Then we're gonna perform an initial analysis.
This is kind of our triage.
Now that I have that disk image,
I can start running through and doing some basic analysis.
I can look at what files were changed
within the last 24 hours,
or between this date and that date.
I can look at these different registry settings,
whatever those things are.
And then the next step is conduct a deeper analysis.
Once I see something that looks a little fishy,
or looks a little off to me, I start digging in deep.
And in both of these steps,
you wanna log everything you're doing in your report
because at the end of this, you're gonna have to
produce a report saying what you did
so that if it goes to court or other things,
you're gonna have to be able to have
some third party guy come in and verify what you did.
And the last thing, you're gonna report on your findings.
And this is where the logging everything helps
because you're gonna have to know what you did,
when you did it, and how you did it,
so everybody else knows what you did too.
That's the basic seven steps
of a forensic investigation process.
Now, when you start doing that,
you start doing data collection,
you have to think about what's called
the order of volatility,
and this is our data collection priorities.
So, I'm gonna put on the hat
of a police officer at this point.
And we're gonna use that kiddie porn example
that we talked about earlier.
So we knock down the door,
and we find the guy at his computer.
And I push him away from the computer,
and I'm at the computer.
What should I collect on first?
Well, I wanna collect on things that are perishable,
and that can go away very quickly.
So what are those?
Well if you think about computers,
that's things like memory.
So things like CPU caches, registers,
running processes, and memory are very volatile.
If we unplug the machine, we lose all that data.
So we wanna collect that first.
Also while a computer's running, it's constantly
putting things into and out of memory.
So that can be lost very quickly.
So that's the first think we wanna capture
is anything in memory.
The second thing we wanna capture is network traffic,
because network traffic is constantly changing.
And, if we're connected to the network,
and say it was a remote attacker
that was just using this guy's computer as a patsy,
if we disconnect the network, we them lose that information.
So we have to think about that.
Then the third thing is, hard drives and USB drives.
These are what we consider persistent storage.
When I write to a hard drive it stays there
for a pretty good long period
unless someone issues a command to delete the information.
So that's our third priority.
And then our fourth and final priority
is things like optical media, backups, and printouts.
Now why is that?
Because those things last forever.
If I had a notebook where I printed out all of my pictures,
that's all evidence that's easy to collect,
it's harder to destroy than if I have it
all sitting in memory.
Then if I unplug the computer, it all goes away.
So these are the idea of order of volatility.
Most volatility, things that can go away quickly,
you wanna collect first, things that are least volatile,
you wanna collect last.
And you work through and collect all of that
during your investigation.
Now, what do you do if you find something
that you don't expect?
Let's put you back into your organizational construct.
You're an IT guy, you're doing an incident response.
And somebody said, "Hey, my computer's acting funky,"
you go over to the computer and you start going through it
and conducting an analysis.
And you think maybe it's malware.
So there's always this risk that you're gonna find something
you really didn't wanna find.
One of the cases I dealt with, somebody had put in
a trouble ticket for us, we went out,
we started looking at their computer,
and when we started looking at it,
we started finding out that the employee
was breaking our acceptable use policy.
So they were gambling at work.
That was against our policy.
Now I had to get management involved
and let them know about it.
Not as big of a deal,
but what if you find illegal activities?
I had another case where somebody was complaining
the computer wasn't working.
My technician went there to go help them,
and when they were helping them,
they found in their My Documents directory,
pictures of what appeared to be child pornography.
So at that point, we immediately stopped what we were doing.
We ended up getting law enforcement involved.
They had to take the person and restrain them,
while the digital forensic examiners,
came in, imaged the hard drive and went through all of it.
And that is when you see illegal activity,
you've gotta call the police.
There are requirements there
that you have to do that.
Now if it's somebody breaking the employee
acceptable use policy that's gonna be a managerial decision.
But either way, if you were the technician doing this,
I would stop what you're doing, contact your manager,
and get some guidance on where you should go from here.
(swishing and buzzing)