- In this lesson, 21.3,
we're gonna focus in on evidence handling.
Now cyber-related investigations can be triggered
by a whole variety of incidents.
Right, there could be an intrusion,
there could be insider activity, there could be extortion.
And if there's an incident that leads to an investigation,
well, we're gonna have to collect evidence.
Now, there are three types of investigations.
There's criminal, there's civil, and there's internal,
also referred to as administrative.
And here's the thing you wanna keep in mind.
In practice, it's really difficult for organizations
or for responders to identify the type of
and the impact of a cyber incident
until they've carried out an investigation.
Now evidence collection is the first step
in an investigation, and it's absolutely critical
that first responders are knowledgeable
about forensically-sound evidence collection and handling,
so they don't compromise an investigation.
And there's a good chance that a security practitioner
or an IT person will be the first responder.
You'll be the one that will be collecting evidence.
Later on, you'll bring in forensic experts if necessary,
but you'll be that first responder,
so you really wanna be knowledgeable
about forensically-sound evidence collection.
So digital evidence is any information or data of value
to an investigation that's stored on, received by,
or transmitted by an electronic or digital device.
Now there are two types of evidence,
direct evidence and circumstantial evidence.
Direct evidence supports the truth of an assertion directly,
you don't need any additional evidence or inference,
where circumstantial evidence relies on inference
to connect it to conclusion of fact.
So in the physical world, an example
of circumstantial evidence would be a fingerprint
at the scene of a crime.
Now eDiscovery, also called electronic discovery,
actually refers to the process in which digital data
is sought, located, secured, and searched with the intent
of using it as evidence in a civil or a criminal case.
Now a legal hold is an order that suspends the modification,
deletion, or destruction of any records or media.
So if something happened, right, there may be a legal hold
that's placed, you know, around a body of information
and systems that say you can't make any changes
to this, right, 'cause we wanna ensure
that we don't have any destruction of records or media.
That legal hold really is issued
to avoid evidence spoilation.
Evidence spoilation being the intentional, the reckless,
or the negligent withholding, hiding, altering, fabricating,
or destroying of evidence.
Now, the only people you're ever gonna hear use the term,
eDiscovery, are attorneys,
but it might show up in your exam.
So let's talk about evidence collection.
Collection of digital evidence is really the first step
in a forensic investigation.
Now evidence collection is gonna be governed
by two main rules, the admissibility of the evidence
and the weight of the evidence.
Admissibility of evidence refers
to whether the evidence can actually be used
in a court of law, and the weight of evidence
is all about the quality and the completeness
of the evidence.
And invariably, there's a lot of tension
between the response, the find and fix teams,
and the evidence collectors,
'cause you think back to earlier lessons,
we talked about incident and incident response,
and we get in and we detect the incident,
and we're confirming the incident,
we're containing the incident,
we're eradicating the incident,
we're recovering from the incident,
but if we have to do an investigation
and we need to collect evidence,
we have to do like, whoa, whoa, whoa, right?
We have to stop really early in that process
so that we can collect the evidence, you know,
before we go through some of the higher-level phases.
So, if you are going to collect evidence,
I want you to always assume evidence will be used
in a court of law and act accordingly.
Now the chance that it will actually be used
in a court of law is relatively small.
But here's the thing, if you don't act accordingly, right,
and you don't follow evidence collection rules,
if it needs to be in a court of law
and you haven't done it right,
it's gonna get thrown out and that's bad.
So here, there are evidence collection rules.
Preservation is key.
You're gonna act in the order of volatility.
I'll explain what that means in a sec.
You're gonna maintain an evidentiary chain,
also known as a chain of custody, for all evidence collected
during the investigation, and you need to be aware
that evidence may become public record.
And you wanna be very careful
about including any company confidential information, right,
in your evidence, unless it's necessary.
Obviously, if it's necessary, you're gonna include it,
but if it's not necessary, you don't want it
in your evidence because if it goes to court,
it will become public record.
Now the purpose of preserving digital evidence
is to maintain its integrity and its reliability,
ensuring that it can be used effectively
in a legal or an investigative context.
So how are ways that we could contaminate evidence?
Well, installing or running any diagnostic tools
or scanning software, removing files, making any changes
to the system, including logging a user out,
turning off a device prior to data acquisition,
or leaving a compromised system
or device unattended or unsecured.
You can see why there's gonna be tension, right,
between those who wanna fix the situation quickly
and those who wanna collect evidence.
Now the order of volatility refers to the acquisition
of evidence before it disappears, is overwritten,
or it's no longer useful.
And the goal, right, is to create a snapshot
of the environment as it existed at the time of,
or as close to, if possible, of the attack or the incident.
Now there are two types of data you wanna recognize,
persistent data and volatile data.
Persistent data is data that does not change,
and it's preserved when the device is turned off,
so when you unplug, un-power, or the battery runs out.
Volatile data is data that's easily degradable
and can be lost, right, when that device is turned off
or you don't have power anymore
or the battery finally runs out.
So let me give you examples of the order of volatility.
The first thing we might collect is memory, right?
Data in memory is the most volatile, right?
And that includes data that's in the CPU,
registers, caches, and in RAM
'cause we know what's ever in memory, right,
when we shut our system off or we run out of battery, right,
it's gone, and we also know things don't stay
in memory for very long.
Then we have virtual memory.
Virtual memory, also known as a swap file or a paging file,
it's a file that's stored on the system disk
that extends the amount of RAM
that's available to a computer.
But again, that can disappear fairly quickly
because virtual memory is swapped in and out, right,
as the processor needs to use that information.
Next would be log files.
The log files are written by our operating systems,
our applications, our databases, a whole host of other type
of software and operating systems and other devices.
We've already talked about how important log files are.
Now, log files are actually written to the media,
so they remain even when there's no more power, right,
either by battery or being plugged in.
But here's the thing about log files, right,
they are size-limited, right?
We don't let them just grow endlessly, right?
So they generally are size-limited and can be overwritten.
And then lastly, we get to some static data.
Right, now that's data files that are stored
on a disk drive are considered static,
and they remain there, right?
Until steps are taken to erase them
or until a disk drive fails.
Now this is inclusive of traditional hard drives,
flash drives, and solid state drives.
So if we think about this, as just an example,
we were at volatility, right?
If we needed all of this memory, virtual memory, log files,
and static data, this would be the order
that we wanna collect it in before it is overwritten,
no longer useful, or disappears.
So when we're thinking about our evidence, right,
we're gonna think about, we're gonna make a list
of everything we need, and then we're gonna order them
in the order of volatility.
Now, an evidentiary chain or a chain of custody
is a chronological documentation
that records the collection, the control, the transfer,
the analysis, and the disposition of evidence.
Why do we need an evidentiary chain or a chain of custody?
Because the evidentiary chain documentation,
which is that chronological documentation
that says who collected it, you know,
what everybody did with it, who controlled it,
when was it transferred, anything that was done
to analyze it, all of that has to be in that chain
because it demonstrates trust to the court
that the evidence has not been subject to any mishandling
or evidence spoilation.
You don't wanna get evidence that goes to court,
particularly, great evidence, and then have the judge say,
"Sorry, that evidence, gotta throw it out," right?
We can't trust it, it's not trustworthy.
Now, in court, witnesses can be called to testify
by either the defense or the prosecution,
and there are two type of witnesses.
There are factual witnesses and expert witnesses.
A factual witness is an individual who's knowledgeable
about the facts of the case
through direct participation or observation.
Now you might be called, if you were part
of an investigation, to be a factual witness.
An expert witness is a person who has knowledge
beyond that of an ordinary layperson, enabling him or her
to give testimony regarding an issue
that requires expertise to understand.
The experts can also give an opinion.
They don't always have to be fact-based.
If you were involved in a trial that had witnesses,
you may find that a forensic expert is called in to testify.
So we have factual witnesses and expert witnesses.
It's really important that you have a good understanding
of how to handle evidence for both the exam
and for your everyday security practice
'cause you never know when you're gonna be called on
to do that.
That, my friends, brings us to a three-second challenge.
Five challenge questions, three seconds each, let's do it.
The process of collecting, preserving, examining,
analyzing, and presenting evidence.
What is that called?
One, two, three.
That's in the aggregate referred to as forensics.
The quality and completeness of the evidence.
One, two, three.
That's gonna be the weight of the evidence.
Number three, the acquisition of evidence
before it disappears is overwritten or is no longer useful.
One, two, three.
And that's the order of volatility.
Number four, a document that establishes evidence integrity.
One, two, three.
That's gonna be your evidentiary chain
or your chain of custody.
And lastly, number five, intentional, reckless,
or negligent withholding, hiding, altering,
fabricating, or destroying of evidence.
What's the term we use to describe that?
One, two, three.
That's evidence spoilation.
Let's do a security-in-action,
so we can apply our knowledge about evidence collection.
The police department was called in
to investigate an IP theft crime.
The IT department claimed that they had solid evidence
that the criminal had logged into the system,
downloaded files, and emailed them to a competitor.
But much to their dismay, the law enforcement forensic team
declined to use their findings.
So my question to you is,
why would law enforcement not be able to use the evidence?
Okay, so the police are brought in
to investigate an IP theft crime.
We talked about IP before, IP being intellectual property.
The IT department said, "Oh man,
we got solid evidence," right?
"We can tell that a criminal logged into the system,
downloaded files, and then emailed them to a competitor.
We got 'em dead to rights."
And boy, were they bummed to hear, right?
When law enforcement said, "Hmm, sorry,
we can't use your findings," so why not?
That's my question to you.
Why would law enforcement not be able to use their evidence?
Go ahead and put me on pause, jot down some notes,
come back with some possible reasons.
Well, there are several possible reasons or explanations.
Could be suspicion that the evidence was contaminated,
it could be suspicion of evidence spoilation,
there could be fact that the evidentiary chain
was not maintained and that the credentials
and the independence of the evidence collectors
could be called into question.
So it could be, again,
that the evidence might've been contaminated.
the evidence might've been spoiled in some way,
and evidentiary chain was not maintained.
And if you don't have a good evidentiary chain,
you can't prove the two other ones about contamination
and spoilation, or not having it, the lack of.
And, you know, there are times
when the credentials and the independence
of the evidence collectors could be called into question,
so those are some possible reasons
why the police would decline to use that evidence
or use their findings.
So there you go, you've got your word cloud.
It's a fairly large one.
You know what to do, make sure you really can speak
to all of these terms and concepts before you move on.
Go back to the lesson if you need to, and when you're ready,
I'll be waiting for you at the next lesson.