Instructor: Forensic procedures, in this lesson
we're going to talk about the basic forensic procedures.
And this is essentially going to be a four-step process.
Now, the first thing you need to know about forensics
is everything we do we use written procedures.
These written procedures
are going to ensure that personnel
handle forensics properly, effectively,
and in compliance with the required regulations.
This way we always follow what is written down
and we always do it the same way.
Now, as we go through our forensic procedures,
there are four main areas.
We have identification, collection, analysis and reporting.
In this lesson, we're going to talk about each one of those.
First, we're going to have identification.
This is going to ensure the scene is safe.
We have made sure we secure the scene
to prevent any evidence contamination
and we identify the scope of the evidence to be collected.
Now, when you think about this
especially in the digital forensics world,
I like to think about it
as if you're working for the police department.
They break down the door, they arrest the person
and what do you need to do?
Well, as you walk in the door,
the first thing you need to do
is make sure the scene is safe.
There's not a bad guy hiding in the other room
that's going to come out in hurt you
and try to stop you from collecting the evidence.
We want to make sure everything is safe there.
Then once we know everything is safe
we move on to the next step
which is making sure nobody contaminates our evidence.
We want to record the scene using video and photography
to make sure we know exactly what was there
before we touched anything.
And then we want to start identifying
the scope of the evidence to be collected.
If I go into a store as part of this investigation,
and they say "Hey, we're looking for this type of data."
Well, I need to start looking at
all the computer systems around there and say,
"Where can this type of data be hidden?"
Is it going to be on a tablet?
Is it going to be on a phone?
Is it going to be on a smart TV?
Is it going to be on a server?
And based on the type of data I'm looking for,
I'm going to scope my evidence collection
because a lot of times your warrant will tell you
exactly how large or how small the scope you have
and what you're allowed to collect.
And then we're going to move into collection.
Now, when we do collection,
we have to ensure that we have authorization
to collect the evidence.
Now, this might take the form of something like a warrant.
And then we're going to document improve the integrity
of the evidence as it's collected.
Now what this means is,
as I start collecting the information from the computer,
I'm not just going to take the hard drive
and throw it in a bag.
I need to actually do a bit by bit copy
of that hard drive
because all my analysis later on
is going to be done on the copy, not on the original.
Now I also need to make sure that that hard drive
is an exact match once I make the copy of it.
And I am going to take into evidence
to make sure that I have the original
so that if we ever need to go back
to the original for analysis
and make another copy, we could.
We also want to make sure we prove the integrity
to make sure I haven't changed any data on it
and nobody else has changed anything on it.
That's the idea here with collection.
Then we move into analysis.
So now that we have a copy
we are going to create a copy of this evidence.
And we're going to take that for analysis.
And we use repeatable methods and tools during the analysis.
Again, everything here is going to be written down.
We are going to use procedures
that tell us exactly what to do.
This is going to say step one,
do this, make a copy of the drive.
Step two, create a hash of the drive
to make sure you have integrity.
Step three, performing analysis on the drive using XYZ tool.
It'll tell you exactly what you need to do
as an analyst using a checklist
that can be repeatable and followed each and every time.
And then we got step four, which is reporting .
At the end of all of our analysis,
we need to create a report of the methods
and the tools that we used in our investigation.
And then we also need to present detailed findings
and conclusions based on that analysis.
If I was looking for child pornography on this hard drive
of the victim's computer I need to say,
"I found it, it was located here."
And here's how I prove it.
All the things I did, how I found it,
all the locations, all the files,
screenshots of it, all that kind of stuff
to put into the final report
to give to the judge and into the court
so that person can go to trial.
Again, you may be called to go into court
to testify based on what you have.
And based on your report that you're going to give
and the analysis you've done.
Now, this is really important to realize
because everything you do is going to come under question
once you get on that stand.
They're going to ask every method you've used,
any mistakes you possibly could have made.
They're going to try to find fault
with everything you could have done
because if they can find fault with anything you've done,
your evidence and everything you found from it,
can be thrown out of court
and that can get their client off.
Attorneys are paid a lot of money to help get their clients
off of these criminal charges.
And so if you're working in the criminal sector
as a forensic analyst
you need to be very careful
to do everything exactly right by the procedures.
This is going to bring us to the concept of a legal hold.
Now a legal hold is a process
that's designed to preserve
all the relevant information
when litigation is reasonably expected to occur.
Now, litigation is just a fancy word for lawsuit.
Essentially, if we think
what we're going to be dealing with in collecting
could end up in court one day
we need to make sure we don't destroy any evidence.
We need to collect it all and preserve it all.
Now, one of the biggest challenges
when you start dealing with this
is that you can actually have your computer
or server seized as evidence
inside of some kind of criminal conspiracy.
Let's say you ran a web hosting Company
and somebody bought storage space on your server.
And they put illegal files on there.
Whatever the bad content is.
Well, if the police want to take that evidence
they might take your server
that holds not just that person's stuff on it,
but also all of your other clients on it as well.
And that can go away for a long period of time
because of this legal hold.
The legal hold can actually take that computer server
as evidence for the entire duration of that trial,
which could be months or even years.
So this is something you have to think about
as an organization.
Do you have backups for your servers?
How quickly can you get them back online
Ii you have some kind of a evidence collection
that's going to happen?
Because that is something that you need
as part of your business continuity plan as well.
Now, another thing I recommend
when you're dealing with the law
is you should always have somebody
from your organization appointed as your liaison
and that person should have legal knowledge and expertise
so they can be the point of contact with law enforcement.
So when somebody comes in from law enforcement
and they want to start collecting evidence
you need to have somebody who can work with them.
This person is going to be your point of contact
between the forensics team,
which may be an outside company or law enforcement
and your sister team
which is your cyber security instant response team.
If you're dealing with a data breach for instance
is your company going to try to pursue legal action
against the person who broke into your systems?
If so, you're going to have a forensics team
from law enforcement coming in and collecting that evidence.
And so having this liaison who can be that single voice
and that single point of contact
can really make things work a lot better for you.
Now, the last thing we need
to talk about in this lesson is ethics.
Forensic analysts have to follow a code of ethics,
and there are three main points to this code of ethics
that you really do need to follow.
Otherwise, you're going to have a problem
when you get on the stand.
First, analysis must be performed without bias.
This means any conclusions or opinions that you form
should only be based on the direct evidence
that you've observed.
You shouldn't be thinking,
"Well, I don't like this person because X, Y, Z."
It's not based on their color,
their creed, their nationality,
what they look like or anything else.
It should only be based on the evidence you find.
In fact, it's much better for a forensic analyst
to be completely removed from the situation.
A lot of places that I've worked with before,
they have one set of people who collect the information
and another set that analyzes it.
So all they see is the data.
They don't know anything about the case up to that point
and that can help eliminate some of that bias.
The second thing
analyst methods have to be repeatable by third parties.
Now, what I mean is that if I take the exact same evidence
and I give it to somebody else,
they should get the same results
if they use the same methods you did.
And again, this is why it is so important
that you document every single thing you do
when you're doing your analysis.
For instance, when I do my analysis
I will write down the time, the action I took.
I click this button.
I ran this command, here was my results.
And I put a screenshot in there.
That way, anybody who comes behind me
can see exactly what I did,
when I did it, how I did it.
And if they run those same commands
they should get the same results.
If they don't
that could be reason to get your evidence thrown out.
And the third thing
is that evidence must not be changed or manipulated.
We never want to do analysis on the actual device itself.
Instead, we always want to do it on a copy when we can.
So if I'm taking evidence from a hard drive
I'm going to do a copy of that hard drive.
I'm going to run an integrity check
on both the drive and the source to make sure they match
such as a hash.
And if they do, I can then do my analysis on the copy.
That way I don't have the possibility
of modifying or changing the original.
And we'll talk about a lot of other things
of how we can make sure we don't modify the original
as we go through this section.
Now, here is a big warning for you.
If you're ever going to do this professionally
keep this in mind.
Defense attorneys will try to use any deviation
from your ethics or from your procedures
as a reason to dismiss your findings and analysis.
Remember these attorneys
get paid big dollars to be able to get their clients off.
That's their job.
They're trying to get that case thrown out.
And anytime they can get your evidence thrown out,
that is one less thing against their client.
And so they're going to do that.
They are going to go after you.
They're going to go after your credentials.
They're going to go after your methods.
They're going to go after your processes.
And you're going to have to defend all of that in court
to make sure your evidence can be admissible
and can stand up in court.
So at this point
we've gone through a lot of our process of acquiring things.
We've collected memory,
we've collected the disc image and we've hashed it.
But now we start doing all of our analysis.
Now a large portion of our investigation
is going to be trying to find that needle haystack.
And we're going to start figuring out
who touched what files at what time, for what purpose?
Now, as we start gathering all of that information
there should be a good way to present that information
as part of our analysis and our report.
How do you want to do that?
Well, one of the best ways is using a timeline.
Now, a timeline is a tool
that will show the sequence of file system events
within a story's image in a graphical format.
So I can give you a lot of different ways
to say here's all the different files I found,
when they were touched and who touched them.
I might put that in a spreadsheet.
I might put it in a word document.
But one of the best ways is to graphically depict it.
And that's what a timeline allows you to do.
Now, some of your tools will help you do this automatically.
For instance, here's an image from NCASE.
Notice on the left side of the screen,
we can see the file for our target disk
that we've been doing our analysis on.
On the right side, you'll see a timeline view
of all the files that were touched at a particular time.
For instance you can see here
every minute within this hour of this day.
And so we can see here highlighted in red,
that at the 19th minute,
all of those files were being touched.
Now, if you're on a server, this can be a lot of files.
And so it's really going to be important to say,
"We know bad thing X happened at this time
based on our SIEM data or our log data."
And once we go into that,
we can then correlate that
with the analysis that we're looking at,
especially if we're trying to track down an intruder.
Now in the forensic world,
this is important as well,
because if I'm trying to put a bad guy away
for something he did,
I need to prove he did it,
that he had means, motive, intent.
And one of the things that can help me is
if I know he was on this computer at this time
and this activity happened during that timeframe
that's going to be able to help me
create that evidence I need to punish that bad guy.
So once you start constructing your timeline
in this graphical format,
you'll also back it up with a written report.
Now, a lot of things have to go into this report.
And one of the things you're trying to aim
for as you're constructing this timeline and your report
is to answer a lot of different questions.
For instance, you might want to answer,
how was access to the system obtained?
Was it remotely, or was it locally?
Did they get somebody's password or did they steal it?
Were they able to break in using some kind of an exploit?
All of those are things you want to figure out.
What kind of tools may have been installed?
If he was a bad hacker
who hacked into your system over the internet,
did they install a Trojan?
Did they install some kind of remote access tool?
All those things are things you want to identify
as part of the analysis.
Then you also want to think about
what changes to the files were made?
And again, your analysis and your timeline
is going to help you here
because you be able to see
which files were touched at which particular time.
You also want to figure out what data has been retrieved.
Were are you the victim of a data exfiltration?
If so, you should see reading happening of those files
and then transmission over the network.
And again, all of that can be documented
as part of your timeline.
And finally was the data actually exfiltrated?
Just because somebody access the data,
doesn't mean they took it with them
when they left the network.
And so you need be able to prove that as well.
All of these are things you're going to do
as part of your analysis
as you're going through your timeline generation.
Now, many forensic tools can generate a timeline
based on the evidence you've been scanning and analyzing.
This can be done in lots of different tools.
For instance, I showed you the one for NCASE earlier.
You also can do this using the open source tool
the Sleuth Kit and its companion tool autopsy.
Here on the screen
you can see the timeline editor within autopsy.
Notice, it looks a little different than the way
we saw it inside of NCASE.
For this one, we can show what time unit we want.
Do we want to look at it as years, days or minutes?
How far out, or how far in do we want to zoom?
We can look at the event type.
Is it a base type or a subtype?
We can look at the description.
Is going to be short or long?
We can apply different filters
to only show a certain events.
For instance, show me all the files
that were PNG files that somebody had touched
which are graphic files.
I can then see a table view or a thumbnail view
of all the files that were touched there
in the bottom left.
On the right side,
I can see some data associated with the different files
that are being highlighted.
And up on the top right,
you can also see the counts, the details or list view
of all the things that have been touched.
Again, you can start playing with this tool
on your own because it is open source.
So you can feel free to download it,
load it up and try it out yourself.
Now, one of the questions I often get is,
what if your tool doesn't support
creating your own timeline?
Well, if that happens, you can create a sequence of events
within a spreadsheet to serve as your timeline.
Now, because this is a manual process,
it is more time intensive
and it takes more work on your part,
but it is still helpful to have some sort of a timeline
included in your report
so people can see exactly what happened
when and who did it.