All right, so forensics, good stuff.
Digital evidence.
We've already talked about data states.
Digital evidence is just ones and zeros.
But its formal definition, digital evidence is defined as any information of
probative value either stored or transmitted in digital form.
Fantastic. Stored or transmitted, well, that'd be
data at rest, data in transit or in motion, and of course, in use in memory.
Lots of information to be had from a memory dump.
We're going to be revisiting some terms we've established earlier in the course.
Volatile, non volatility, primary, secondary, post mortem in real time.
Digital evidence is circumstantial and fragile in nature.
It's ones and zeros.
They're easy to flip.
And again, they're circumstantial.
We see a connection from Bob's IP.
It doesn't necessarily mean that's Bob's machine.
It could be a compromise trojanized box.
Somebody could be spoofing an IP address using active sniffing on the same network.
It looks like this is occurring, but may not, in fact.
It is very circumstantial.
It's very easy to flip ones and zeros and
really leave no evidence that they've been altered.
Transient, fragile, volatile, all terms
that pretty accurately describe digital data.
Really, forensics is about capturing it in
an authentic state and preserving it for review.
One of the biggest considerations here is quick acquisition, capturing the data.
There's an order of volatility that we're...
I don't think we have a dedicated slide for it in this course here.
We're definitely talking about it in CHFI.
I'm in CHFI mode right now.
Orders of volatility is describe the collection order.
What's most likely to go away first, what's most likely to go away last?
Things like memory contents, registers,
cash, all the way down to archival and network configuration information.
There's something called low card's exchange principle
that states anyone or anything entering a crime scene takes something of the scene
with them and leaves something of themselves behind when they leave.
All right, so if you think of a physical
crime scene, let's say that you've got a killing, somebody gets
stabbed with a knife and you got blood spatters everywhere.
So you as the forensic investigator
entering that crime scene, you're probably going to drop hair strands or DNA or dead
skin cells or something that's going to taint that scene.
So you wear booties and suits and all that make that not happen?
Minimize that, but you're potentially tampering or interfering with the scene.
Same thing in digital investigations.
Just by interacting with the system,
you're going to leave a digital footprint on the system.
Now, on the other hand, when you leave the crime scene, you may take some evidence
with you, blood spatters, things like that.
When you exit a system, there may be information that's taken with you.
The analogy breaks down there because in forensics, we're really more concerned
with the impact we have on the system we're investigating, right?
The tampering with the evidence.
We do our best to minimize the footprint on the system.
Just the acquisition process can leave a footprint.
But once we've created a forensic copy, then we can use that forensics copy for
repeated analysis and not worry about taining the original.
We're going to talk about that here in just a few minutes.
Types of digital evidence.
Volatile is data that's lost as soon as the device is powered off.
Examples would be system time, logged on users, open files, network information,
process information, process report, clipboard, and so forth.
Anything that remains resident in memory, RAM.
Non volatility would be disk or the storage.
Permanent data stored on secondary storage
devices, hard disk memory cards, including hidden files, Slack space, swap space,
index data files, unallocated clusters, unused partitions, etc.
Anything that does not require electrical current to maintain the data.
Remember, RAM is volatile, that's data in use.
Disks drives are non volatility, that's data at rest.
Of course, we just got done talking about a couple of modules that dealt with
network monitoring that would be the data in transit.
Log files are also an example of network
monitoring, even though that is data at rest. All right, so this can be applied
live interactively with the system, or you can dump that volatile data in the form of
a RAM capture, and then you can parse the RAM capture.
You'll be doing that in the lab.
Very cool.
You'll also be analyzing non volatility as
well, but it's not about picking apart a RAM capture, it's just cool.
All right, sources of potential evidence.
User created files.
Some of this implies intent.
User created files are created by some user activity.
There's some intent, there's some motive,
there's some initiation or initiative there.
Address books, database files, media documents, internet bookmarks, etc.
Shows purpose and intent.
User knowingly created these files.
On the other end of the spectrum, you have
computer created files that may be created without the user's knowledge.
Backup files, log files, configurations, printer spools, cookies, swap files,
system files, history files, temporary files.
User protected files.
By the way, the computer created files is
usually where the perpetrator or the criminal makes the mistakes.
They don't realize that all this activity is recorded somewhere.
They don't do appropriate covering of tracks.
There's something there of evidential value that the computer has created that
is just unknown to the attacker and they don't know to clear.
User protected files.
This really shows intent.
Anything that is encrypted, password
protected, purposely hidden, or using a steganography is automatically interesting
because it shows an intent to hide the data and evade detection.
Compressed and misnamed, absolutely.
Misnamed files where you've got the improper file extension that doesn't match
the file header information, that looks especially suspicious.
Since you're attempting to mislead the investigator, you're trying to open a PDF
file that's not a PDF at all, it happens to be a JPEG.
You can actually see that quite easily
just by looking at the hex signature of the header.
We call that files extension mismatches.
Some of your forensics tools will do that right out of the gates.
You're going to have a lab on autopsy,
which does do an ingest looking for file extension mismatches.
All right, sources of potential evidence.
A lemon trim, boiled trim, trim cocktail.
You've got hard drives, thumb drives, memory cards, smart cards, dongls,
biometric scanner, answering machines, digital camera surveillance,
RAM, volatile storage, anything with the storage device.
There used to be a lot more of a variety
of external storage devices than we have these days.
Most everything these days is a thumb drive or an external drive.
Sd cards, things like that have gone away.
They're fixed in mobile devices.
You have compact flash cards for cameras and that thing.
But pretty much everything is in a flash format these days.
Although that hasn't always been the case.
Back in the iOmaga heyday, we had zip
drives and jazz drives and ribs and clicks, a lot of different form factors.
You had to be sure that you had the media
and the devices to actually read that information.
There's a lot of converters as well for
this thing, especially around SD cards or SIM cards.
There's a lot of USB interfaces for that.
Anyway, these are all potential sources of evidence.
Thumb drives, probably the most common.
You can also prove or disprove if a thumb
drive has actually been installed in a specific system.
That's a lot of fun just looking at the registry footprints.
Again, come back for CHFI for the full story on registry analysis.
Our rules of evidence.
Digital evidence collection must be
governed by five basic rules to make it admissible in a court of law.
It needs to be understandable, clear and understandable to the judges or the
decision maker, jury, sighting board, and so forth.
Needs to be admissible.
Evidence must be related to the fact being proved.
It needs to be authentic, real, and appropriately related to the incident.
It needs to be reliable.
There must be no doubt about the
authenticity or veracity of the evidence, and it must be complete.
It must prove the attacker's actions or his or her innocence.
Now, the burden of proof is different in civil versus criminal.
In criminal, it's beyond a reasonable doubt.
In civil, it's based on preponderance of
the evidence, which is an elegant term that means more likely than not.
Burden of proof is higher in criminal.
Again, the burden is on the prosecution to prove beyond a reasonable doubt.
You need enough evidence to stack up to prove beyond a reasonable doubt.
You need to get it admitted, which means it needs to be collected properly.
If you've ever watched any courtroom drama
or movie, you've seen the scenario where there's motions to suppress evidence, or
there's objections to search warrants and so forth.
Be sure that you cross your T's and dot
your I's in the collection process, follow proper procedure.
Always configure start and complete a chain of custody.
Any laps in chain of custody goes right out the window.
So be sure you're following procedure and
that it's documented that you followed procedure to get admissible.
The best
evidence rule states that the court only allows the original evidence of a document
photograph or recording at the trial other than a copy.
Copies will be allowed if the primary is not available.
The reason here is there's duplication, there's modifying of the original.
If you've got the original, there's no chance for alteration.
Copies can be altered.
The duplicate can be accepted as evidence
if the court finds the property's reasons for submitting the duplicate to be
genuine, and that's like lost due to fire or flood, in possession of a third party,
just flat out unavailable for a verifiable reason.
The principle underlying the best evidence rule.
The original evidence is considered to be best evidence.
Fantastic. All right, so best evidence, original.
You also have real evidence, direct evidence, and a bunch of other
subcategories which we get into a little bit more in CHFI.
We're going to keep it lighter weight here for our CCT discussion.
The Federal Rules of Evidence.
Okay, this all has to be defined and documented somewhere.
Here in the United States, we follow a
civil or tort law system that's based on previous interpretations of laws.
The laws get written, they're read and
interpreted as they're written, but then they're also subject to reinterpretation.
We have precedence being set where
decisions are different, the outcome is different, that establish the precedent.
The interpretation of the documentation can actually change over time.
You want as formal a definition as
possible because each side is going to argue their point one or the other.
This stuff all needs to be defined somewhere.
Federal rules of evidence are laid out to
secure fairness in administration, elimination, and unjustifiable expense and
delay, growth and development of law and evidence to the end that truth may be
ascertained, and proceedings justly determined.
Excellent definition.
In a nutshell, they're going to lay out
specifics on what evidence is, how it can be collected, definitions like originals
versus copies, writings, photographs, and so forth.
There's a lot of definition there.
Now, again, in CHFI, we can do that a
little bit more to keep it lightweight and categorical in CCT.
All right, scientific working group on digital evidence.
Standards and procedures are a good thing
in any forensic investigation, incident response, in anything.
Standards, and I've said it before and I'll say it again, give you a repeatable
set of steps that give you repeatable results every time.
They're developed over time to optimize the results.
The idea here is if we follow it
consistently, we'll get consistent results.
I hate to keep harping on that, but it's really, really important.
The scientific working group on digital evidence or Swig D, puts out various
principles on evidence handling and standards and criteria.
This gets everybody on the same page on how digital evidence is handled.
Let's just take a quick visit
to the Swiggy website just to point out some of these procedural
documents. All
right, so my forensic students, a lot of
times the question comes up and they say, Okay, you've been pounding on us about
this necessity for procedure and documentation.
Where do we get that if we don't have it?
Well, the answer to that is you work on
templates and best practices that have been developed by other development bodies
that are like Swiggy, and you create your own internal process.
These documents, for example, if you wanted a best practice for digital
evidence acquisition from cloud service providers, here you go.
It gives you reference templates, and
they're more or less white papers on the subject at hand.
Really useful stuff.
You don't have to reinvent the wheel, you
have to adopt the wheel that somebody else has developed.
Great stuff.
Report formats, things like that follow suit.
The principles, the standards and criteria.
These are generally overview statements.
All agencies that seize or examine digital
evidence must maintain an appropriate standard operating procedure document.
All elements of the agency's policies and
procedures concerning digital evidence must be clearly set forth in the SOP
document, which must be issued under the agency's management authority.
This is like a security policy.
We talked about these at the beginning of the course.
Security policies are brief, high level overview statements.
It's pretty tough to confuse or
misunderstand what they're telling us here.
You got to have procedures.
Everything should follow procedure.
You should write them up.
Everybody follows it.
Must be issued under the agent's management authority.
But how exactly are we doing that?
The specifics on that, that's actually procedural.
These statements specify a need, and then how you actually implement that, again, is
the supporting standard operating procedures.
Couple of other reaffirmations.
Procedures must be generally accepted in
the field or supported by data gathered and recorded in a scientific manner.
Again, that's the Daubert principle and the Friah standard.
There's also the Association of Chief
Police Officers Principles of Digital Evidence.
Principle number one, no action taken by law enforcement
agencies or other agents should change data held on a computer or storage media,
which may be subsequently relied upon in court.
That means don't tamper with the evidence.
Again, even the collection process can leave an impact on the evidence.
Just by running a tool in a live system,
you're going to change an execution history.
You might modify a registry object, something like that.
Also, you might trigger a malware script or a shredded script to delete data.
You're always very careful about how you interact with the system.
Again, CHFI, we talk about a lot of different ways to do that.
Principle 2, in exceptional circumstances, where a person finds it necessary to
access original data, they must be confident to do so.
That is huge.
Number 1, you minimize your footprint on the system.
Number 2, never ever attempt anything you're not trained for.
That gets thrown out as
quickly as no chain of custody or not included in a search warrant.
All opposing counsel has to do is cast
doubt on the abilities of whoever collected it.
Then immediately the reliability of that evidence is brought into question.
An audit trail or other record of all processes applied to
the computer based electronic evidence should be created and preserved.
You need to document everything you do.
An independent third party should be able
to examine those processes and achieve the same result.
Principle number 4, the person in charge of the institution has overall
responsibility for ensuring that the law and these principles are adhered to.
Again, brief principles but extremely relevant ACPO.
Now, if you're taking a CHFI exam, you get
a couple of questions on that, just saying.
You may get one or two on your CCT exam.