- In this lesson, 21.4,
we're gonna talk about forensics examination.
Digital forensics is the application of science
to the identification, collection, examination,
and analysis of data that we're gonna refer to as evidence
while preserving the integrity of the information.
Now, I wanna caution you
that forensics work is really complex,
and it should be conducted only by trained investigators
and digital forensic professionals.
It's also an absolutely fascinating field.
So if you like this area of investigation
your next certification maybe will be on digital forensics.
But for this exam and in general,
security operations personnel are not expected
to be forensic specialists.
But you should be familiar with the terminology
and with basic operation because you might be expected
to manage and or participate in an investigation.
And of course, you'll probably be an evidence collector.
So the more you understand
about the backend digital forensics process,
the better evidence collector you're going to be.
So let's take a look at the digital forensics process.
It starts with evidence collection, right,
which is what we talked about in the last lesson.
Then there'll be data acquisition,
examination, analysis and reporting.
That's all gonna be done by our forensic experts.
Then that forensic expert may be called upon
to testify, if necessary, if it actually goes to court.
And then lastly, we'll have archiving,
which is archiving both the evidence
as well as any data we acquired
as part of the forensic examination.
So let's look at digital forensics categories
'cause it's not just one category because it's digital.
There's computer, there's memory, there's software,
there's network, there's multimedia, there's mobile,
and there's cloud.
Now, computer digital forensics would be examination
and analysis of digital devices, right,
such as computers, laptops, servers, storage, and media.
Memory is the examination and the analysis
of volatile memory or RAM
and any associated caches or registers.
Software is the examination and analysis
of software source code or binary code.
The network would be the examination and analysis
of network traffic and data packets,
as well as audit, event, and security logs.
Multimedia is examination and the analysis
of digital images, videos, and audio recording.
Mobile is the examination analysis of smartphones
and tablets and other mobile devices,
which can get really complicated by the fact
that so many of those devices now are secured
by biometrics and encryption.
And then cloud forensics is the examination and the analysis
of digital evidence that is stored in cloud environments
such as cloud storage or in a software
as a service platform.
And each of these different categories really require
kinda almost a different skillset
but certainly a different set of tools.
But let's look at some general tools.
We have memory imaging tools, a write blocker,
a bit stream image, and a clone.
A memory image tool is used to acquire or dump.
That's the term when we're extracting memory.
You'll hear the term dumping memory.
Dump short-term volatile data,
which is RAM or virtual memory.
A write blocker is going to be used
to intercept any inadvertent drive writes.
A bit stream image is when we're going to make an image
or a copy that's a bit-by-bit copy of the source material
that preserves all of the latent data
in addition to the file and directory structure.
A clone is an exact copy of an entire physical hard drive,
including all active and residual data
and unallocated or slack space.
Now, you can put a clone into a computer
and it will boot right up
as if it had the original drive in it.
But if you are making copies,
we want to be able to ensure the integrity, right,
of the media, the copy, that you're actually examining.
So we use checksums. Checksums are very much like a hash.
A checksum is a single value derived
from a block of digital data for the purpose
of detecting errors that may have been introduced
during the transmission or storage.
Again, checksums are a lot like a hash or a message digest
as they're used to verify data integrity.
The difference is they use a simpler algorithm,
and they're smaller than the type of hashes
we've talked about previously.
But we would take a checksum of the original media,
a checksum of the cloned media,
and then a checksum of the examined media.
And ultimately, they should all match,
and that will tell us that there's been no errors
or changes introduced.
So next, let's do some file recovery terminology.
Cluster, slack space, unallocated or free space,
and then metadata.
A cluster is going to be a fixed-length block
of disk space that's indexed in the file allocation table
or the equivalent.
Now, clusters could be 4K clusters 8K clusters,
16K clusters, right?
And they're just blocks
is the way you wanna think about them.
Now, slack space is the space between the end of a file
and the end of a cluster.
Now, slack space can contain data or RAM
or segments of deleted files.
So let me show you how that would work.
So let's say I have three clusters,
and these are all 4K clusters.
And I go to write a file or I delete a file
that was in there, right, across those clusters.
And then I go to write a new file.
Now, these were all 4K clusters, so we've got 4, 8, 12.
I go to write a new cluster, let's say, that is 10K.
So it writes all through that cluster
and it writes all through the second cluster,
but it only writes through half of the third cluster.
Why? Because it was only 10K and I have 12K.
So what's left there?
Sorry, this is in yellow. It might be hard to read.
But what's left there is the original data
that we thought we deleted but now has not been overwritten.
And that space is referred to as slack space.
And it can contain data from RAM,
maybe used by virtual memory,
or it can contain segments of deleted files.
Let's clear that up for you.
Next we have unallocated or free space.
Unallocated space are clusters
that are not allocated to a file.
Now, clusters can also contain deleted file fragments.
And carving is the process by which deleted files
or fragments are recovered.
And then lastly, we have metadata.
So metadata is really just data about data,
and we'll talk more about metadata in another lesson.
Now, after the relevant information has been extracted
the forensic analyst can study and draw conclusions.
Now, a key component of the analysis
is gonna be correlating data from multiple sources.
But here's something I really wanna stress to you,
and that's why it's bolded.
In digital forensics,
the absence of evidence doesn't necessarily mean
that nothing happened.
It could mean that either we didn't collect the evidence
during the evidence collection time
or we just didn't have the evidence to begin with.
So maybe what we really needed were log files,
but we weren't logging.
The answer might have been in those log files,
but if we didn't collect the log files,
you know, or create the log files,
then we don't have them to work with.
So in digital forensics,
the absence of evidence doesn't necessarily mean
that nothing happened.
Now, analysis may also lead to additional data collection,
examination, and further analysis.
And then we get to the reporting out phase.
Now, reporting is the process of preparing
and presenting the information from the analysis phase.
The report should always be written
with the audience in mind.
That's really true for any report.
All conclusions must be substantiated.
And if an event has more than one plausible explanation,
both should be presented or they all should be presented.
And if the evidence is incomplete,
it may be possible to only present findings
and not present a conclusion.
And then at the end of the forensic investigation, right,
we're going to retain that data
using the process of archiving.
So throughout the retention period,
all original data and related media, documents,
and ancillary items should be secured.
So we're talking about this data that we collected, right,
the evidence we collected, plus anything else
that we created during the forensic investigation.
Now, evidence retention parameters are required to ensure
that the evidence is available when needed.
We might not go to court for two or three or four years.
But they should also consider the costs involved
so evidence isn't retained indefinitely.
And for that, you wanna consult legal counsel.
And at end of life,
all evidence and findings must be securely disposed of.
And that my friends, brings us to a three-second challenge.
Five challenge questions, three seconds each. Let's do it.
It's a bit by bit copy of source material
that preserves all latent data.
1, 2, 3.
That's a bit stream image.
Number two, the process of dumping RAM.
1, 2, 3.
And that's memory imaging.
Number three,
the tool used to intercept inadvertent drive writes.
1, 2, 3.
And that's a write blocker.
Number four, the space between the end of a file
and the end of a cluster.
1, 2, 3.
And that's gonna be your slack space.
And lastly, number five, data about data
that I said we'd talk more about later.
1, 2, 3.
And that's metadata.
That brings us to a security in action
so we can apply our knowledge.
And this one's about data acquisition.
The CFO's workstation is infected with ransomware,
and very critical files have been encrypted.
This appears to have been a targeted attack.
Now, the FBI has been alerted.
I guess they're probably pretty busy
because they've asked your organization
to collect, acquire, and preserve the evidence.
And they'll do the examination and the analysis.
That's an unusual request.
Usually you would just do the collection,
they would do the rest.
But in this case, they're asking you
to collect, acquire, and preserve.
So what I wanna know from you is what are you gonna do
to comply with the FBI's request?
And it was the CFO's workstation, it has ransomware.
The FBI has said, "Can you guys collect, acquire,
and preserve evidence?"
So put me on pause, write up an action checklist,
then come on back.
Well, first and foremost, when we're collecting,
we're gonna maintain an evidentiary chain documentation.
Absolutely, we don't want any question
about the evidence we're collecting.
We need to identify the relevant data sources, right?
That could be the drive, that could be logs,
that could be memory.
But we're gonna identify what those relevant data sources
are gonna be for our evidence.
And then we're gonna acquire that data
in the order of volatility.
And we wanna really make sure
that we're protecting that evidence from contamination.
Then we're gonna assign the acquisition or the extraction
of evidence to knowledgeable professionals,
either someone internal or external.
And we're gonna require the use of forensically sound memory
and hard drive acquisition tools.
And we're gonna make sure
that they've documented the tools that they're using
and that they document absolutely everything they do,
right, absolutely everything.
Every command that's written, every action they take,
needs to be documented.
And since you're gonna be examining a hard drive,
we wanna require the checksum of a hard drive
both pre and post imaging.
Of course, it's all gonna be documented
because we don't want there to be any question
of evidence spoilation that anything's been tampered with
and anything's not the original.
Be able to create this action checklist
and then execute on it.
You know what that is, right, that's security in action.
There's your word cloud. It's quite a bit here.
Maybe a lot of unfamiliar terms, so take your time, right?
Go through it all, make sure you understand
all of these terms, all of these concepts.
If not, go back to the lesson again.
And then when you're ready, head on over to the next lesson.
I'll be waiting for you right there.