BY�K.SATHYA�AP/CT-UG�KONGU ENGINEERING COLLEGE��

CYBER FORENSICS AND SECURITY MANAGEMENT

PROCESSING CRIME AND INCIDENT SCENES

IDENTIFYING DIGITAL EVIDENCE

• Digital evidence
• Can be any information stored or transmitted in digital form
• U.S. courts accept digital evidence as physical evidence
• Digital data is a tangible object
• Some require that all digital evidence be printed out to be presented in court

UNDERSTANDING RULES OF EVIDENCE

• Consistent practices help verify your work and enhance your credibility
• Comply with your state’s rules of evidence or with the Federal Rules of Evidence
• Evidence admitted in a criminal case can be used in a civil suit, and vice versa
• Keep current on the latest rulings and directives on collecting, processing, storing, and admitting digital evidence

UNDERSTANDING RULES OF EVIDENCE

• Business-record exception
• Allows “records of regularly conducted activity,” such as business memos, reports, records, or data compilations
• Generally, computer records are considered admissible if they qualify as a business record
• Computer records are usually divided into:
• Computer-generated records
• Computer-stored records

​

UNDERSTANDING RULES OF EVIDENCE

• Computer records must be shown to be authentic and trustworthy
• To be admitted into court
• Computer-generated records are considered authentic
• If the program that created the output is functioning correctly
• Collecting evidence according to the proper steps of evidence control helps ensure that the computer evidence is authentic

UNDERSTANDING RULES OF EVIDENCE

• When attorneys challenge digital evidence
• Often they raise the issue of whether computer-generated records were altered
• Or damaged after they were created
• One test to prove that computer-stored records are authentic is to demonstrate that a specific person created the records
• The author of a Microsoft Word document can be identified by using file metadata

FTK DEMO

• In "File Category", click the Documents button
• Select the document in the lower pane
• "View files in native format" shows the text typed into the Word document
• "View files in filtered text format" shows the metadata, such as the registered owner of the program

UNDERSTANDING RULES OF EVIDENCE

• The process of establishing digital evidence’s trustworthiness originated with written documents and the best evidence rule
• Best evidence rule states:
• To prove the content of a written document, recording, or photograph, ordinarily the original writing, recording, or photograph is required

UNDERSTANDING RULES OF EVIDENCE

• Federal Rules of Evidence
• Allow a duplicate instead of originals when it is "produced by the same impression as the original … by mechanical or electronic re- recording … or by other equivalent techniques which accurately reproduce the original."
• As long as bit-stream copies of data are created and maintained properly
• The copies can be admitted in court, although they aren’t considered best evidence

WHEN A COPY IS ALL YOU HAVE

• If the hard drive crashes after you make the copy
• If removing the original computers is not possible, because it would cause harm to a business or its owner, who might be an innocent bystander
• Steve Jackson Games was harmed in this manner when the Secret Service seized all computers because BBS users placed evidence of a crime on them
• The company sued and won (link Ch 5a)

COLLECTING EVIDENCE IN PRIVATE-SECTOR INCIDENT SCENES

• Private-sector organizations include:
• Businesses and government agencies that aren’t involved in law enforcement
• Agencies must comply with state public disclosure and federal Freedom of Information Act (FOIA) laws
• And make certain documents available as public records
• FOIA allows citizens to request copies of public documents created by federal agencies

COLLECTING EVIDENCE IN PRIVATE-SECTOR INCIDENT SCENES

• A special category of private-sector businesses includes ISPs and other communication companies
• ISPs can investigate computer abuse committed by their employees, but not by customers
• Except for activities that are deemed to create an emergency situation
• Investigating and controlling computer incident scenes in the corporate environment
• Much easier than in the criminal environment
• Incident scene is often a workplace

COLLECTING EVIDENCE IN PRIVATE-SECTOR INCIDENT SCENES

• Typically, businesses have inventory databases of computer hardware and software
• Help identify the computer forensics tools needed to analyze a policy violation
• And the best way to conduct the analysis
• Corporate policy statement about misuse of computing assets
• Allows corporate investigators to conduct covert surveillance with little or no cause
• And access company systems without a warrant

COLLECTING EVIDENCE IN PRIVATE-SECTOR INCIDENT SCENES

• Companies should display a warning banner or publish a policy, or both
• Stating that they reserve the right to inspect computing assets at will
• Corporate investigators should know under what circumstances they can examine an employee’s computer
• Every organization must have a well-defined process describing when an investigation can be initiated

COLLECTING EVIDENCE IN PRIVATE-SECTOR INCIDENT SCENES

• If a corporate investigator finds that an employee is committing or has committed a crime
• Employer can file a criminal complaint with the police
• Employers are usually interested in enforcing company policy
• Not seeking out and prosecuting employees
• Corporate investigators are, therefore, primarily concerned with protecting company assets

COLLECTING EVIDENCE IN PRIVATE-SECTOR INCIDENT SCENES

• If you discover evidence of a crime during a company policy investigation
• Determine whether the incident meets the elements of criminal law
• Inform management of the incident
• Stop your investigation to make sure you don’t violate Fourth Amendment restrictions on obtaining evidence
• Work with the corporate attorney to write an affidavit confirming your findings

BECOMING AN AGENT OF LAW ENFORCEMENT

• If law enforcement officers ask you to find more information, you are at legal risk
• Don’t do any further investigation until you receive a subpoena or court order

PROCESSING LAW ENFORCEMENT CRIME SCENES

• You must be familiar with criminal rules of search and seizure
• You should also understand how a search warrant works and what to do when you process one
• Law enforcement officer may search for and seize criminal evidence only with probable cause
• Facts or circumstances that lead a reasonable person to believe a crime has been committed or is about to be committed

PROCESSING LAW ENFORCEMENT CRIME SCENES

• With probable cause, a police officer can obtain a search warrant from a judge
• That authorizes a search and seizure of specific evidence related to the criminal complaint
• The Fourth Amendment states that only warrants “particularly describing the place to be searched, and the persons or things to be seized” can be issued

UNDERSTANDING CONCEPTS AND TERMS USED IN WARRANTS

• Innocent information
• Unrelated information
• Often included with the evidence you’re trying to recover
• Judges often issue a limiting phrase to the warrant
• Allows the police to separate innocent information from evidence

UNDERSTANDING CONCEPTS AND TERMS USED IN WARRANTS

• Plain view doctrine
• Objects falling in plain view of an officer who has the right to be in position to have that view
• Are subject to seizure without a warrant and may be introduced in evidence
• “Knock and announce”
• With few exceptions, warrants require that officers knock and announce their identity
• When executing a warrant

​

PREPARING FOR A SEARCH

• Preparing for a computer search and seizure
• Probably the most important step in computing investigations
• To perform these tasks
• You might need to get answers from the victim and an informant
• Who could be a police detective assigned to the case, a law enforcement witness, or a manager or coworker of the person of interest to the investigation

IDENTIFYING THE NATURE OF THE CASE

• When you’re assigned a computing investigation case
• Start by identifying the nature of the case
• Including whether it involves the private or public sector
• The nature of the case dictates how you proceed
• And what types of assets or resources you need to use in the investigation

IDENTIFYING THE TYPE OF COMPUTING SYSTEM

• For law enforcement
• This step might be difficult because the crime scene isn’t controlled
• If you can identify the computing system
• Estimate the size of the drive on the suspect’s computer
• And how many computers to process at the scene
• Determine which OSs and hardware are involved

DETERMINING WHETHER YOU CAN SEIZE A COMPUTER

• The type of case and location of the evidence
• Determine whether you can remove computers
• Law enforcement investigators need a warrant to remove computers from a crime scene
• And transport them to a lab
• If removing the computers will irreparably harm a business
• The computers should not be taken offsite

​

DETERMINING WHETHER YOU CAN SEIZE A COMPUTER

• An additional complication is files stored offsite that are accessed remotely
• If you aren’t allowed to take the computers to your lab
• Determine the resources you need to acquire digital evidence and which tools can speed data acquisition

​

OBTAINING A DETAILED DESCRIPTION OF THE LOCATION

• Get as much information as you can
• Identify potential hazards
• Interact with your HAZMAT team
• HAZMAT guidelines
• A HAZMAT technician may need to acquire the image, following your instructions
• You may need to put the target drive in a special HAZMAT bag
• HAZMAT technician can decontaminate the bag
• Check for high temperatures

USING ADDITIONAL TECHNICAL EXPERTISE

• Look for specialists
• OSs
• RAID servers
• Databases
• Finding the right person can be a challenge
• Educate specialists in investigative techniques
• Prevent evidence damage

PREPARING THE INVESTIGATION TEAM

• Review facts, plans, and objectives with the investigation team you have assembled
• Goals of scene processing
• Collect evidence
• Secure evidence
• Slow response can cause digital evidence to be lost

SECURING A COMPUTER INCIDENT OR CRIME SCENE

• Goals
• Preserve the evidence
• Keep information confidential
• Define a secure perimeter
• Use yellow barrier tape
• Legal authority: keep unnecessary people out but don’t obstruct justice or fail to comply with police officers
• Professional curiosity can destroy evidence
• Involves police officers and other professionals who aren’t part of the crime scene processing team

SEIZING DIGITAL EVIDENCE AT THE SCENE

• Law enforcement can seize evidence
• With a proper warrant
• Corporate investigators rarely can seize evidence
• When seizing computer evidence in criminal investigations
• Follow U.S. DoJ standards for seizing digital data
• Civil investigations follow same rules
• Require less documentation though
• Consult with your attorney for extra guidelines

PREPARING TO ACQUIRE DIGITAL EVIDENCE

• The evidence you acquire at the scene depends on the nature of the case
• And the alleged crime or violation
• Ask your supervisor or senior forensics examiner in your organization the following questions:
• Do you need to take the entire computer and all peripherals and media in the immediate area?
• How are you going to protect the computer and media while transporting them to your lab?
• Is the computer powered on when you arrive?

PREPARING TO ACQUIRE DIGITAL EVIDENCE (CONTINUED)

• Ask your supervisor or senior forensics examiner in your organization the following questions (continued):
• Is the suspect you’re investigating in the immediate area of the computer?
• Is it possible the suspect damaged or destroyed the computer, peripherals, or media?
• Will you have to separate the suspect from the computer?

PROCESSING AN INCIDENT OR CRIME SCENE

• Guidelines
• Keep a journal to document your activities
• Secure the scene
• Be professional and courteous with onlookers
• Remove people who are not part of the investigation
• Take video and still recordings of the area around the computer
• Pay attention to details
• Sketch the incident or crime scene
• Check computers as soon as possible

HANDLING A RUNNING COMPUTER

• Old rule: pull the plug
• Don’t cut electrical power to a running system unless it’s an older Windows 9x or MS-DOS system
• Perform a live acquisition if possible
• When shutting down Win XP or later, or Linux/Unix, perform a normal shutdown, to preserve log files
• Save data from current applications as safely as possible
• Record all active windows or shell sessions
• Photograph the screen

HANDLING A RUNNING COMPUTER

• Make notes of everything you do when copying data from a live suspect computer
• Save open files to an external hard drive or a network share
• If that is not possible, save them with new names
• Close applications and shut down the computer

PROCESSING AN INCIDENT OR CRIME SCENE (CONTINUED)

• Guidelines (continued)
• Bag and tag the evidence, following these steps:
• Assign one person to collect and log all evidence
• Tag all evidence you collect with the current date and time, serial numbers or unique features, make and model, and the name of the person who collected it
• Maintain two separate logs of collected evidence
• Maintain constant control of the collected evidence and the crime or incident scene

PROCESSING AN INCIDENT OR CRIME SCENE (CONTINUED)

• Guidelines (continued)
• Look for information related to the investigation
• Passwords, passphrases, PINs, bank accounts
• Look at papers, in drawers, in trash cans
• Collect documentation and media related to the investigation
• Hardware, software, backup media, documentation, manuals

PROCESSING DATA CENTERS WITH RAID SYSTEMS

• Sparse acquisition
• Technique for extracting evidence from large systems
• Extracts only data related to evidence for your case from allocated files
• And minimizes how much data you need to analyze
• Drawback of this technique
• It doesn’t recover data in free or slack space

USING A TECHNICAL ADVISOR

• Technical advisor
• Can help you list the tools you need to process the incident or crime scene
• Person guiding you about where to locate data and helping you extract log records
• Or other evidence from large RAID servers
• Can help create the search warrant by itemizing what you need for the warrant

TECHNICAL ADVISOR RESPONSIBILITIES

• Know aspects of the seized system
• Direct investigator handling sensitive material
• Help secure the scene
• Help document the planning strategy for search and seizure
• Conduct ad hoc trainings
• Document activities
• Help conduct the search and seizure

DOCUMENTING EVIDENCE IN THE LAB

• Record your activities and findings as you work
• Maintain a journal to record the steps you take as you process evidence
• Goal is to be able to reproduce the same results
• When you or another investigator repeat the steps you took to collect evidence
• A journal serves as a reference that documents the methods you used to process digital evidence

PROCESSING AND HANDLING DIGITAL EVIDENCE

• Maintain the integrity of digital evidence in the lab
• As you do when collecting it in the field
• Steps to create image files:
• Copy all image files to a large drive
• Start your forensics tool to analyze the evidence
• Run an MD5 or SHA-1 hashing algorithm on the image files to get a digital hash
• Secure the original media in an evidence locker