Are collecting and preserving evidence.
The investigator must have proper
authority and experience to start the collection of the evidence.
We've already mentioned that.
They should have permission, they should have authority to search.
Prior to initiating the collection, they must follow and gather details about the
evidence, the jurisdiction, chain of custody, details of the equipment
containing the evidence, structure type and size, location, type of device model.
This stuff may need to be identified in a search warrant.
One of the things you want to remember about a search warrant, though, is you
describe with reasonable particularity what you're looking for.
Not including, but not limited to statements are great because otherwise you
can get an objection based on the list of items to be seized if something doesn't
follow an exact description of what you're looking for in the search warrant.
Okay, powered status, network status,
backups, necessary to take the server down, measure the business impact, and
then always have the approval of authorities and local management.
Are collecting physical evidence.
Are collecting electronic devices or any other media found at the crime scene.
Again, your initial system targeted system is just ground zero.
Anything that information can commingle with is suspect as well.
To preserve the integrity of physical
evidence, all the pieces of evidence should be collected and handled carefully.
That means proper packaging, shielding
from temperature, humidity, extremes, electromagnetic interference.
Physical evidence includes removable media, cables, publications, all computer
equipment, including peripherals, items taken from the trash, miscellaneous items.
Again, the system itself is just the focal point.
All your peripheral devices should be seized as well.
Tag all objects identified as evidence.
Mention all the required details on the
tag, time, date, incident responders, name, and control number.
Dealing with powered on computers.
If a computer is powered on and the screen
is viewable, photograph the screen, document the running programs.
If a portable computer wakes up, record the date and time at which it occurs, take
a photograph of the screen, document a brief explanation of all running programs.
If it's on and the monitor shows a screen
saver, move the mouse slowly without pressing any mouse button.
Do not press any buttons.
Then photograph and document the programs.
After collecting all your volatile data, turn off the devices.
Volatile data acquisition can be interactive.
It can also be just trading RAMDA.
For portable computers, press down the
power switch for five seconds to force the power off.
Thirty seconds might actually get it to boot back up again.
For portable computers, also remove the battery and unplug the power cord from the
wall socket to ensure that it's powered off.
If the computer is switched off, leave it off.
There's no reason to turn it on.
Dealing with powered off computers, pretty straightforward.
It's powered off, leave it off.
At this point in the investigation, do not
change the state of any electronic devices or equipment.
If it's switched off, leave it off.
It's switched off and the display is blank.
Turn the monitor on. We just saw that in the previous slide.
Move the mouse slowly, observe the changes from a blank screen to
another screen, note the changes, take a picture of the screen.
No changes. Take a picture of the screen.
A gain, if it's switched on, the display is blank, move the mouse slightly.
Screen does not change after moving the mouse slightly.
Don't press any keys and photograph the screen.
Network computers.
With network computers, you want to
prevent any external access to destroyed data.
Unplug the network cable from the router
and modem in order to prevent any further attacks.
Photograph all devices connected to the
victim's computer, particularly the router and the modem from several angles.
If any devices like a printer or scanner
are present, take photographs of those devices.
If the computer is turned off, leave it in that state.
If it's on, follow the steps for powered
on, see the previous two slides, and unplug all cords and devices connected
to the computer and label them for identification.
You photograph everything, you document everything.
Dealing with open files and startup files.
When malware attacks a computer system, they may create some auto start entries in
the startup folder to run the malware program on an ongoing basis.
So ensure that it always starts up.
The investigator can get information from
the files, specifically, any recently created documents in the startup or system
32 folders in Windows or your RC local file in Linux.
You want to document the date and time of files.
When you see recent entries, search for unusual MAC times, give
priority to recent times amp, recent timestamps.
Here we go.
Examine the open files for sensitive data like passwords or images.
Use the DIR command for Windows for directory listing or the LS command to
locate the actual access times in those files and folders.
In a nutshell, you're looking for
timestamps that don't match the surrounding files.
Any recently dated files are suspicious
since they might have been recently modified.
The operating system shutdown procedure,
this is dependent on the scenario on the case.
If there's a risk of data being deleted or lost, page files being cleared, things
like that, you're going to want to pull the power cord from the system directly.
If it's a laptop, you want to remove the battery.
If it's a situation where you need to do a graceful shutdown where you don't want to
corrupt open files, things like that, critical application server, whatever,
you're going to want to follow the proper operating system shutdown procedure.
This can get a little bit confusing on how you proceed.
A lot of times we're taught to pull the
power cord, shut the system down immediately.
That's only if there is any imminent danger.
You suspect that the system is being remotely accessed, things are being wiped,
page files being cleared, shredded utilities, things like that.
It freezes the system.
But shutting down a system unexpectedly,
and I know this from recent experience, I corrupted a hard drive recently for the
first time in years by doing a hard power down.
I'm wishing I would have done a little bit more graceful shutdown.
But you always run the risk at an abrupt
power disruption of corrupting open files and causing a system instability.
The operating system shutdown procedure in a Windows operating system is click the
Windows button, click the power button, select the shutdown option.
In Mac OS X, click the Apple icon, select the shutdown option.
In a Linux and Linux, that depends.
It could be from a terminal window.
You can right click on the desktop, select the terminal option.
There's a knit zero, which has always been my favorite, sync, sync, halt, etc.
You can also enter...
Set the console to root mode,
enter the user ID, press Enter, then type sync, halt to shut down the system.
Again, you might have to have root access to do that.