Often times you may be looked at as
a cybersecurity expert to perform forensic investigations.
This is the required standardization process and procedures
to ensure integrity within the rule of law.
The rule of law dictates how we seize, acquire,
analyze and report any digital evidence within our confines.
That means that you may be called to go to a
crime scene and investigate different
problems associated with digital evidence.
The primary aim of seizure is to maintain the integrity of evidence
by preventing any alterations from both the purchaser or the investigator.
We're not there to prove guilt or innocence,
we're there to identify specific digital evidence
and analyze the evidence accordingly to do that.
We need to seal off the investigative area. We're going to put up crime tape.
If we need be, we're going to document everything,
we're going to take pictures of the screens on the computers and the
electronic devices,
how the cables are connected to the laptop
or desktop computer or any other electronic device.
Where are they getting power from?
Does it make sense that they're getting power from
a USB or maybe with the wall outlet itself?
We're going to take pictures of digital media that may be external USB cds, blu rays,
external hard drives.
We're going to document everything and we're not going
to let anybody turn off the computer screen.
We're going to go through
thoroughly document the manufacturers, the model numbers, the serial numbers,
all of that needs to be properly documented, photographed and sealed.
Before we go through with the process, we need to identify volatile memory.
We're going to use specialized equipment to hook into the computer and grab that
volatile memory and then the non volatile
memory we're gonna tag and label everything.
We're gonna inventory it and then we're gonna bag it up and seal it.
When we go through the seizure process, we really need to be very,
very O CD about everything that we grab so that
we can properly investigate it within the rule of law.
We're going to maintain the aspect of that digital evidence and make sure that
it's not left in a hard car in the middle of a Phoenix summer.
We need to avoid extreme temperature.
We need to avoid rainfall.
We need to make sure that the digital devices don't get too cold or too hot.
We need to make sure that everything is as we had it when we first arrive,
that means a very temperature neutral environment in which it's sealed,
documented and ready to be analyzed.
Preserving the integrity of the original evidence is critical throughout
the entire process of the analyzation of our digital media.
That means that we need to prepare a destination drive
to take all the data from the original.
We're not going to investigate the original data drives or
the original digital format that we grabbed or seized,
that would be irresponsible.
Instead,
we're going to do a bit for bit copy with fixed pattern over
to the new medium which we're going to then utilize for investigation.
We're going to do a hash and make sure that it matches bit for
bit on the existing media from the new medium that we put it on.
We're going to prevent changes to the original using a right locker.
We're going to make sure that even though
we're logging into the old hard drive that we're
not providing any information over to that real original
drive to change the format in any way,
shape or form.
We're going to hash the original evidence and then we're
going to match that hash to the new evidence.
When we copy over the evidence,
it's going to be on a bit for bit format every little zero
and one going from that original drive is going to go over to our
new drive and we're going to verify the acquisition of that evidence by
matching those two hashes to ensure that everything is identical to the original,
which allows for the analysis with confidence of the original drive.
The analysis is the interpretation of the extracted data
to determine if its relevance to the case.
While the tools and commands for analysis may vary
based on the operating or the file systems involved.
The core issues remain consistent and the same.
We need to identify the date and time of
every documented log or evidence on that original drive.
Many times crimes are perpetrated in a specific time frame by identifying the exact
date and time stamps of all the evidence that were called into question.
We can accurately define whether or not that data was relevant.
And on the drive at the time of the crime committed,
we're gonna verify the time zone.
If I'm on the east coast and the time zone
of my evidence is in western time or pacific time,
there is a problem.
We need to be able to extrapolate and identify
that 11 a.m. pacific time is 2 p.m. eastern time.
Where did the source of the data the data come from? Did it come from a thumb drive?
Did the thumb drive get accurately documented?
Are we talking about a thumb drive number one or thumb drive number 10?
What's the serial number of the thumb drive?
All that source information needs to be
documented within the context of our investigation.
We need to name all the items.
If you have 10 different thumb drives, a nomenclature model might be the best.
But if we're going to number it one through 10,
we also need to document the serial number,
the make and model of the thumb drive and any identifying factors that,
that thumb drive may have both physically and digitally.
We need to identify the item location.
Where did we find the thumb drive when we picked it up?
Was it inside the computer logged in already or was it in a desk drawer off to the side?
Was it sitting outside of a bookcase item location can be important when it comes to
the actual evidence in question.
If the evidence was acquired on a person,
we need to document that it was on the person
at the time and not at the original crime scene.
Finally, we need a description, an accurate
detailed description of where the evidence is located.
Now, that means both the logging evidence,
which file it was in or the physical location as in the person's being.
Where did that evidence come from?
The description of the evidence is important
when it comes to the digital investigation.
A chain of custody is a meticulous document recording and detailing the handling,
collection, transportation and preservation of evidence.
Throughout each stage of the analysis process,
we need to document every little nuance of the
investigation when it comes to that specific evidence.
If it left somebody's custody and went into
an evidence bag that needs to be documented,
that evidence bag is then moved over to a central collection point
that needs to be documented, who went from, to who it's going to who put it away,
what was the date.
What was the time if it was checked out that needs to be documented
every step of that evidence in
its pathway from the moment that it leaves the person or the moment it's picked,
step off the desk or the or the crime
scene needs to be documented in detail to every step
of the way from the point of acquisition to
the point of investigation to the point of storage.
When it's put into place,
we need to permanently identify every aspect of that
documentation you can see here in the figure,
an example of a chain of custody documentation form.
A legal hold is an administrative procedure frequently
employed by organizations during a digital forensics investigation.
If you work for an enterprise environment,
you have no right to stop a legal hold from taking place.
Your only concern is that the legal hold is
in place and that you need to safeguard that information
to the best of your ability,
whether that's storing it on a device or preventing its use.
We need to make sure that that legal hold maintained its validity.
The only people that can pull back a legal hold
are your legal department or from the opposing counsel,
meaning the law enforcement agency that requested legal hold in the first place.
Your manager or director has no right or bearing to tell you that, hey,
this legal hold has been lifted.
You can now destroy that information
as a cybersecurity professional legal holds must be
lifted by lawyers and legal personnel or the legal
office is implemented as a precaution in case
of external investigation or agency requires the evidence,
particularly if a legal violation has occurred.
As a cybersecurity professional,
you need to understand that legal holds are something that we
need to hold sacred and secure within our enterprise environment.