-: During an incident response,
we often need to collect evidence of that cyber attack
for further analysis.
For example, if your main server has been infected
with some kind of malware as part of an attack,
you'd want to get that cleared up
and get that server back online as quickly as possible
to minimize the disruption to your operations.
But if you do that, you may erase the evidence of the attack
and that would make it impossible to figure out who did it.
Now to overcome this challenge,
we often use digital forensic collection techniques
to make forensic images of the data on those servers
and we use that as evidence for later analysis.
By doing that, it allows your incident response team
to help get your server back online as quickly as possible
and resume operations, but also maintain that evidence.
Now, your incident response team may need that evidence
because they may be working with law enforcement.
And if you're doing that,
you're probably trying to seek criminal prosecution
for the attacker who broke into your systems.
Now, as part of your data collection
and evidence collection efforts,
you're going to do a lot of different things.
For example, you're going to capture
and hash the system images.
This means you're going to use a tool like FTK Imager
to make an exact copy of that server's hard drive
and then hash it to make sure it doesn't change
while you're analyzing it.
Then you're going to analyze the data you collected
using software tools.
You're going to use forensic tools,
things like FTK, the Forensic Toolkit, or EnCase.
Then you're going to have to capture
screenshots of the machine.
What was the machine looking like
when you arrived on the scene?
You want to capture pictures of that
so you know exactly what it looked like.
You might go back and look at your network traffic logs
and captures and go and review all of that
and see how they moved throughout the network
as you're trying to trace back the attack.
If you think somebody was physically on your property,
you may want to capture video
from the closed circuit TV system.
As you're collecting all this data and evidence,
you want to consider the order of volatility,
which means which order do things get modified by quickest.
The quickest thing that gets modified
is the cache inside the processor,
then the memory, then the swap files,
then the hard drives, right?
And you think about which one is going to get changed first.
When you do that,
you have to collect things based on that order as well.
And anything on the victim machine can be modified
if there's a bad guy on that machine, right?
And so we want to collect the evidence
as quickly as possible.
Then we want to take statements
from witnesses and administrators.
What did they see?
What made them think there was an incident?
Maybe there was somebody who said,
"Hey, my computer all of a sudden
the mouse started jumping all over the screen."
That's something you need to collect the information from
and figure out why it did that.
Then we want to review our licensing and documentation
and figure out do we have the proper license
for all of our systems?
And do we understand how they work?
And are they working the way they were designed
based on the documentation?
And then of course,
we're going to track our man hours and our expenses,
because at the end of this incident response,
someone's going to say, "How much did it cost us?"
If you look at most data breaches in the US,
large companies are suffering millions and millions
of dollars of losses in the cost of these data breaches,
both in the response efforts to it,
as well as the value of the data that's lost.
Now, in the next lesson,
I'm going to show you how a forensic disk image
is actually created during an incident response.
For the Security+ exam,
no one is going to ask you to conduct this operation,
but it's going to give you a taste of digital forensics
and see if the idea of being
a digital forensics examiner interests you.
If it does, you may want to download
and play with some forensic tools like Forensic Toolkit
that I'm going to use in the next lesson or EnCase.
Data acquisition.
We're going to talk about how you start acquiring evidence.
This involves data acquisition,
which is the method and tools used to create
a forensically sound copy of the data from a source device,
such as system memory or a hard disk.
Now, when you deal with acquisition,
the first question you have to ask is,
do I have the right to search or seize this thing legally?
This is an important question because in your organization,
not all the devices are owned by the company.
If it's owned by the company,
yeah, you have rights to go ahead and collect on it
because you work for the company and they want you to.
But what if you allow bring your own device?
If you allow bring your own device in your organization,
these policies can complicate data acquisition
because you may not legally be able to search
or seize that device because you don't own it.
The employee does.
And so you have to make sure
that any evidence you're gathering,
you have permission to gather.
Otherwise, that search could be inadmissible.
Another thing that makes data acquisition very complicated
is that when you get to a crime scene,
you're not just dealing with the physical world.
You're dealing with the digital world.
And so when I come into a room
and I see that the lights are on and a computer is on,
how am I going to collect the data off that computer?
Am I going to shut it down?
Am I going to power it off?
Am I going to collect it when it's powered on?
All of these are valid options
and each one has drawbacks and benefits
depending on what you're trying to collect.
But for now, I just want you to keep in mind the fact
that when you're dealing with the digital crime scene,
as opposed to just a physical one,
there is some evidence that could be lost
when you turn off a computer or shut it down.
And so you need to make sure you understand
what you're going to do
and the procedures you're going to deal with.
Now, this brings us to the idea
that some of this data can only be collected
when the system is on.
And some of this data can only be collected
once a system is shut down or you suddenly remove the power.
Now, an analyst always has to think
about the order of volatility
when they collect their evidence.
First, we always want to collect anything that is short term,
anything that is highly volatile.
So if you start thinking about things
like CPU registers and cache memory,
that is very small amounts of memory
inside those processors
and so it's getting changed very frequently
so you want to be able to collect that as soon as possible.
Then we move on to the other volatile memory,
which is things like system memory, routing tables,
AARP caches, process tables, temporary swap files,
and things like that.
All of those are things that are volatile
and are changing quite rapidly,
but not nearly as quickly as a CPU register or cache memory.
Then we move on to the data
that's on persistent mass storage.
Now in the old days, we would just say the hard drive.
But nowadays, we just say mass storage
because this includes our hard drives,
our solid state drives, and our flash drives.
All of these are persistent mass storage
because they will retain the information
when you take away power, unlike memory,
but it does still change quite often
as long as the computer is on
and people are writing or reading to that disk.
Then we're going to go ahead and collect the things
that are remotely logged,
things like our SIEM and monitoring data.
This is important because while it is not
on the system you're analyzing,
it was already remotely logged somewhere else.
That other place somewhere else
is still being read and written to over and over again
by other systems and so it could modify some data
so we want to collect that as well.
After that, we want to get anything that's physical.
This is the physical configuration
and network topology and things of that nature.
So if I go into the network
and I start looking at the way it's wired and I say,
"Okay, this computer was talking to this switch,
which talks to this router,"
and I can start mapping that out
and collecting that information.
After that, we're going to collect archival media.
Now, what is that?
It's things like backup tapes and offsite storage,
things that are written to once
and then they aren't touched again.
For instance, you might write something to a CDR or DVR.
Once it's written to that disk,
it's going to maintain that data on it
until you destroy the disk.
And so it is our lowest priority of collection,
but still something we want to collect at the end of the day.
Now, one piece of warning that I want to give you
is something that a lot of junior analysts
will neglect to think about.
When you're dealing with the Windows Registry,
a lot of people think about the Windows Registry
as being on the hard disk.
And while most of the Windows Registry
is stored on the hard disk,
there are some key areas like the HKLM\Hardware hive
that only store themselves in memory.
So you want to analyze that registry part
using a memory dump instead.
When I analyze the registry,
I usually do it via memory dump first,
and then I can go back
and do it off the hard drive afterwards.
That way, anything that was missed in memory
might get caught by the hard drive
and I could see both things.
When you're dealing with things
like the slash hardware hive,
it's really important to capture that
because that is going to record every single disk
that has been connected or taken out of that computer.
If I used a thumb drive in that computer,
it's going to be logged in that hardware hive.
So that would tell me as an analyst
that I need to start looking for that thumb drive
or that flash drive so I can find the data
that was written off from this computer.
And so that's one of the reasons
why that's really important to think about.