Blade forensic data recovery download

ptg11539634

ptg11539634

Digital Archaeology

ptg11539634

This page intentionally left blank

ptg11539634

Digital Archaeology Th e ArT A n d Sc i e n c e o f

di g i TA l fo r e n S i c S

Michael W. Graves

Upper Saddle River, NJ • Boston • Indianapolis • San Francisco

New York • Toronto • Montreal • London • Munich • Paris • Madrid

Capetown • Sydney • Tokyo • Singapore • Mexico City

ptg11539634

Editor-in-Chief Bernard Goodwin

Development Editor Michael Thurston

Managing Editor John Fuller

Project Editor Elizabeth Ryan

Copy Editor Teresa Wilson

Indexer Infodex Indexing, Inc.

Proofreader Carol Lallier

Editorial Assistant Michelle Housley

Cover Designer Chuti Prasertsith

Compositor Graphic World, Inc.

Many of the designations used by manufacturers and sellers to distinguish their products are claimed as trademarks. Where those designations appear in this book, and the publisher was aware of a trademark claim, the designations have been printed with initial capital letters or in all capitals.

The author and publisher have taken care in the preparation of this book, but make no expressed or implied warranty of any kind and assume no responsibility for errors or omissions. No liability is assumed for incidental or consequential damages in connection with or arising out of the use of the information or programs contained herein.

The publisher offers excellent discounts on this book when ordered in quantity for bulk purchases or special sales, which may include electronic versions and/or custom covers and content particular to your business, training goals, marketing focus, and branding interests. For more information, please contact:

U.S. Corporate and Government Sales (800) 382-3419 corpsales@pearsontechgroup.com

For sales outside the United States, please contact:

International Sales international@pearsoned.com

Visit us on the Web: informit.com/aw

Library of Congress Cataloging-in-Publication Data Graves, Michael W.

Digital archaeology : the art and science of digital forensics / Michael W. Graves, MSDIM.—First Edition. pages cm

Includes bibliographical references and index. ISBN 978-0-321-80390-0 (pbk. : alk. paper) 1. Computer crimes—Investigation. 2. Forensic sciences—Data processing. I.

Title. HV8079.C65G7293 2013 363.250285—dc23

2013020221 Copyright © 2014 Pearson Education, Inc.

All rights reserved. Printed in the United States of America. This publication is protected by copyright, and permission must be obtained from the publisher prior to any prohibited reproduction, storage in a retrieval system, or transmission in any form or by any means, electronic, mechanical, photocopying, recording, or likewise. To obtain permission to use material from this work, please submit a written request to Pearson Education, Inc., Permissions Department, One Lake Street, Upper Saddle River, New Jersey 07458, or you may fax your request to (201) 236-3290.

ISBN-13: 978-0-321-80390-0 ISBN-10: 0-321-80390-6 Text printed in the United States on recycled paper at Edwards Brothers Malloy in Ann Arbor, Michigan. First printing, August 2013

ptg11539634

I guess I’m just a regular guy after all. In spite of the fact that my daughter’s assignment to draw a picture of one of her parents consisted of a silhouette of my head against a computer monitor—despite the fact that I learned that my son got a blue ribbon in marksmanship by seeing the award hanging on the wall—even though my wife had to remind me twice of anniversaries and dozens of times about birthdays—my family always stuck with me. This book is for them.

ptg11539634

This page intentionally left blank

ptg11539634

vii

co nTe nT S

Preface xiii

About the Author xxi

1 The Anatomy of a Digital Investigation 1 A Basic Model for Investigators 2

Understanding the Scope of the Investigation 8

Identifying the Stakeholders 12

The Art of Documentation 13

Chapter Review 21

Chapter Exercises 21

References 22

2 Laws Affecting Forensic Investigations 23 Constitutional Implications of Forensic Investigation 24

The Right to Privacy 29

The Expert Witness 31

Chapter Review 32

Chapter Exercises 32

References 33

ptg11539634

viii

3 Search Warrants and Subpoenas 35 Distinguishing between Warrants and Subpoenas 36

What Is a Search and When Is It Legal? 37

Basic Elements of Obtaining a Warrant 40

The Plain View Doctrine 43

The Warrantless Search 44

Subpoenas 50

Chapter Review 51

Chapter Exercises 52

References 52

4 Legislated Privacy Concerns 55 General Privacy 56

Financial Legislation 59

Privacy in Health Care and Education 62

Privileged Information 64

Chapter Review 67

Chapter Exercises 68

References 68

5 The Admissibility of Evidence 71 What Makes Evidence Admissible? 71

Keeping Evidence Authentic 76

Defining the Scope of the Search 84

When the Constitution Doesn’t Apply 84

Chapter Review 89

Chapter Exercises 89

References 89

6 First Response and the Digital Investigator 91 Forensics and Computer Science 91

Controlling the Scene of the Crime 96

Handling Evidence 100

Chapter Review 109

Chapter Exercises 109

References 110

Contents

ptg11539634

ix

7 Data Acquisition 111 Order of Volatility 112

Memory and Running Processes 112

Acquiring Media 121

Chapter Review 128

Chapter Exercises 128

References 129

8 Finding Lost Files 131 File Recovery 131

The Deleted File 141

Data Carving 145

Chapter Review 149

Chapter Exercises 150

References 150

9 Document Analysis 151 File Identification 151

Understanding Metadata 157

Mining the Temporary Files 172

Identifying Alternate Hiding Places of Data 176

Chapter Review 183

Chapter Exercises 183

References 183

10 E-mail Forensics 185 E-mail Technology 185

Information Stores 191

The Anatomy of an E-mail 196

An Approach to E-mail Analysis 203

Chapter Review 210

Chapter Exercises 211

References 211

Contents

ptg11539634

x

Contents

11 Web Forensics 213 Internet Addresses 213

Web Browsers 215

Web Servers 233

Proxy Servers 238

Chapter Review 244

Chapter Exercises 244

References 245

12 Searching the Network 247 An Eagle’s Eye View 247

Initial Response 248

Proactive Collection of Evidence 250

Post-Incident Collection of Evidence 262

Router and Switch Forensics 268

Chapter Review 275

Chapter Exercises 275

References 276

13 Excavating a Cloud 277 What Is Cloud Computing? 277

Shaping the Cloud 279

The Implications of Cloud Forensics 284

On Virtualization 291

Constitutional Issues 300

Chapter Review 303

Chapter Exercises 304

References 304

14 Mobile Device Forensics 307 Challenges of Mobile Device Forensics 307

How Cell Phones Work 308

Data Storage on Cell Phones 313

Acquisition and Storage 317

Legal Aspects of Mobile Device Forensics 322

ptg11539634

xi

Contents

Chapter Review 324

Chapter Exercises 325

References 325

15 Fighting Antiforensics 327 Artifact Destruction 328

Hiding Data on the System 336

Covert Data 347

Chapter Review 354

Chapter Exercises 355

References 355

16 Litigation and Electronic Discovery 357 What Is E-Discovery? 358

A Roadmap of E-Discovery 358

Conclusion 377

Chapter Review 377

Chapter Exercises 377

References 378

17 Case Management and Report Writing 379 Managing a Case 379

Writing Reports 389

Chapter Review 393

Chapter Exercises 394

References 394

18 Tools of the Digital Investigator 395 Software Tools 395

Working with “Court-Approved” Tools 410

Hardware Tools 413

Nontechnical Tools 418

Chapter Review 421

Chapter Exercises 422

References 422

ptg11539634

xii

Contents

19 Building a Forensic Workstation 423 What Is a Forensic Workstation? 424

Commercially Available Forensic Workstations 425

Building a Forensic Workstation From Scratch 429

Chapter Review 440

Chapter Exercises 440

References 440

20 Licensing and Certification 441 Digital Forensic Certification 441

Vendor-Neutral Certification Programs 442

Vendor-Specific Certification Programs 449

Digital Forensic Licensing Requirements 452

Chapter Review 454

Chapter Exercises 454

References 454

21 The Business of Digital Forensics 457 Starting a New Forensics Organization 458

Maintaining the Organization 466

Generating Revenue 478

Organizational Certification 481

Chapter Review 483

Chapter Exercises 483

References 483

A Chapter Review Answers 485

B Sample Forms 505

Glossary 511

Index 521

ptg11539634

xiii

Pr e fAc e

In performing an investigation that explores the use of computers or digital data, one is basically embarking on an archaeological expedition. To extract useful artifacts (information, in our case), one must be exceedingly careful in how one approaches the site. The similarities between a digital investigation and an archaeo- logical excavation are much closer than you might imagine. Data, like physical arti- facts, gets dropped into the oddest places. The effects of time and environment are just as damaging, if not more so, to digital artifacts as they are physical mementos.

Wh y Th i S Bo o k ?

Archaeologists are fully aware that, due to the passage of time, there are things they can never recover. The skin that once covered a skeleton long buried in the desert can never be found and analyzed. Likewise, data that was once stored in active memory on a computer can’t be recovered once the computer is switched off. However, in each example, it is possible to uncover evidence that both existed. When you first begin a digital investigation, you are undertaking a modern archaeological dig. Just like the shards of broken pots tell the anthropologist a lot about the culture that once used the vessel, the data you dig out of the computer can tell you volumes about the people who used the system.

This book takes the concepts of archaeology and applies them to computer science. It is a tutorial on how to investigate a computer system to find evidence of a crime or other misbehavior, and to make sure that evidence will stand up in

ptg11539634

xiv

Preface

court. While there are numerous other books that cover the whys and wherefores of digital forensics, this one will go into some detail on how to accomplish the task.

We’ve all watched the TV programs where the good guys figure out everything the bad guys did just from examining a piece of hair. (Is this why the bad guys are always called “hairballs”?) In modern-day investigations, the role of the computer plays as big a part as the star witness in many cases. In fact, the computer often is the star witness. Many cases have been solved or settled on the basis of what trained professionals were able to discover while examining electronic evidence (e-evidence).

However, the courts take a dim view on just anybody digging around in some- body else’s computers. They generally insist that legal process be followed, and that only a trained professional attempt the examination. The extraction and analysis of e-evidence is all part of what we call computer forensics. So what is forensics? The word itself originated from the Latin word forum, which described a place where people could assemble publicly and discuss matters of interest to the community. In that context, the word was derived from the strict rules of presentation applied to such discussions. In the context of this book, the word best means application of sci- ence or technology to the collection of evidence for the purpose of establishing facts. The vast majority of references specify that forensic science is targeted at criminal inves- tigation. However, in the real world, digital investigations are commonly used in civil cases and within organizations to identify members engaged in illicit activities.

A crime scene investigator might have DNA from samples of hair found at the scene analyzed to prove that a specific individual was on the scene at least once. Chemical analysis of soil can identify a geographical origin. The process of com- puter forensics is a series of steps by which professionals can prove the following:

• Data exists. • Data once existed. • Data originated from a specific source. • A particular individual either created or had access to the data in question. • The data is relevant to the case. • The data has not changed in any way from acquisition to analysis.

While it is not always necessary to prove all of the above statements are true, in order to secure a case it is best if as many as possible can be locked down. Even when all of the above are proven, a slick lawyer can always point out the fact that e-evidence is almost always circumstantial and press for reasons why the investigation team has presented insufficient corroborating evidence to demonstrate relevance or authentic- ity. (Both of these terms will be discussed in greater detail in the course of this book.) Even if you can prove beyond a shadow of a doubt that Tammy Sue created the letter

ptg11539634

xv

Preface

you found on Billy Bob’s computer, can you prove that Billy Bob actually acquired the letter illegally? Probably not—which is why, as an expert witness, you don’t even try. You simply collect the evidence and state the facts. The more incriminating evidence that you can find, the better the chances are that your side wins the battle.

Wh o Wi l l Be n e f iT f r o m Th i S Bo o k ?

This book is primarily targeted at the reader who is preparing for a career as a professional investigator. It will not server as a legal tome for the prosecutor but will provide the background needed to efficiently and accurately collect evidence that a prosecutor can use. It will also prove handy to the IT professional who is occasionally called upon to perform e-investigations.

In addition, while the book’s primary goal is not to show people how to hide their tracks, understanding the processes discussed in this book can help an indi- vidual or organization prepare for a hostile demand for the delivery of electronic information (e-discovery). Properly identifying the bits on your computer can go a long way in preparing a defensible stance. If you know the garbage they are likely to find, you can be ready with an explanation. Foreknowledge also stops you from making the legally indefensible mistake of deliberately destroying evidence in advance of e-discovery. Such bad behavior doesn’t just result in a slap on the wrist. It can result in fines ranging into the millions (or even billions) of dollars.

Wh o Wi l l noT Be n e f iT f ro m Th i S Bo o k ?

Before attempting to fully understand this book, a wise reader will already have fulfilled a few prerequisites. He or she already knows a computer inside and out. Swapping out hard disks is second nature, and she finds it easier to work from the command prompt than a GUI. And he doesn’t have to ask what a GUI is. Operat- ing systems and file systems aren’t a foreign language. Opening a registry editor doesn’t induce spasms of panic, and most of all, exploring new areas of technology is a form of entertainment—not a nightmare.

There will be terms used in this book that I assume the reader already knows from previous experience or learning, because they are more relevant to general computer technology than to digital forensics. While it is not necessary to be a networking guru, it is certainly essential that you have a firm understanding of the concepts of networking, including principles of TCP/IP, network hardware, and communications.

ptg11539634

xvi

Preface

hoW Th i S Bo o k iS or gA n i z e d

The book starts out by introducing the reader to various things that must be clear before an investigation is ever initiated. The key differences between civil and criminal investigations are covered. What are the rules of the game? What laws affect us? Tools of the trade and minimum levels of training are a topic of discussion. What are the basic procedures of performing a computer forensic investigation?

From there on, the book describes tools and techniques that the average inves- tigator will use on a day-in, day-out basis. The chapters are set up in approximately the order that the tasks will be accomplished in the real world. Finally, some of the humdrum aspects of the profession are discussed. Documentation, certification, and business aspects of digital forensics aren’t that much fun. But they are neces- sary aspects of the profession.

Un d e r STA n d i n g Th e Bo o k’S fo r m AT

In order to present information in an orderly fashion, this book follows a scheme that will help the reader learn the material more quickly:

• Bold: A new term that will appear in the glossary • Italics: A definition • Monospace type: Code or commands to be typed into the computer • Command Syntax:

copy {filename.doc} {PATH:\newfile.doc} is the syntax used in the text to represent the command copy novel.doc c:\temp\docs\ novel.doc. Brackets will not be used at the command prompt.

• Sidebars: Anecdotes or examples that relate to the current text

Th e ne e d fo r Pro f e S S i o n A l S

Sadly enough, this is a litigious world we live in. If you run a business, chances get bet- ter every day that you will find the need to sue someone—or will be on the wrong end of the need. Some people want to retain a rosy outlook on life and go into computer forensics because they think it is a way to bring the bad guys to justice. I’m delighted to report that sometimes, they are actually right. Just don’t forget that the other side always has their team of professionals ready to refute everything you say or write. That’s why so many computer investigators are needed.

ptg11539634

xvii

Preface

A sign of how strong the field is can be seen in the Great Recession of 2008. When nearly six million people in regular walks of life all lost their jobs, open- ings couldn’t be filled for practitioners in the black arts of digital forensics. To top things off, scanning a listing of job offerings showed the lowest offering salary (that was stated) at $46,000 per year. The vast majority of starting salaries listed ranged from the high fifties to the mid-sixties per year. And this was starting salary.

With recent laws such as Sarbanes-Oxley and the new Federal Rules of Civil Procedure, along with venerable old laws like HIPAA and Gramm-Leach-Bliley, putting more pressure on business, health, and nonprofit organizations, it is a certain bet that the number of investigators needed will only increase. The key to getting one of these jobs is training and certification. And compliance has become a huge issue for many organizations.

ce rTi f i c ATi o n Pro g r A m S fo r fo r e n S i c S Pro f e S S i o n A l S

As of this writing, there are several certification programs dedicated specifically to forensic investigation of digital data sources. In order to impress a potential client with your qualifications, it is not only necessary to demonstrate your competence with digital forensic tools, but you must also show that you have a satisfactory knowledge of operating systems, networks, and computer hardware. The follow- ing list is by no means comprehensive, but offers a glimpse of what the industry offers. In addition to certification programs, a number of colleges have begun to offer computer forensics as a degree program, including a handful that offers mas- ter’s degree programs in the subject.

ge n e r i c fo r e n S i c S ce rTi f i c ATi o n S

• Certified Computer Examiner (CCE): International Society of Forensic Computer Examiners

• Certified Electronic Evidence Collection Specialist (CEECS): International Association of Computer Investigative Specialists (offered only to law enforcement officials)

• Certified Forensic Computer Examiner (CFCE): International Association of Computer Investigative Specialists

• Certified Information Systems Security Professional (CISSP): (ISC)2 • Global Information Assurance Certification (GIAC) Certified Forensic Analyst • GIAC Certified Forensic Examiner

ptg11539634

xviii

Preface

Ve n d o r-SPe c i f i c fo r e n S i c S ce rTi f i c ATi o n S

• AccessData Certified Examiner (ACE): Certification of proficiency with the AccessData Forensics Toolkit

• EnCase Certified Examiner: Guidance Software • Paraben: Various certificates of completion

no n fo r e n S i c ce rTi f i c ATi o n S

• Microsoft Certified Systems Engineer (MCSE): Microsoft certification of professional excellence in managing Microsoft servers

• Cisco Certified Network Engineer (CCNE): Proof of mastery of Cisco router and switch management

• A1: Vendor-neutral certification of expertise in computer hardware instal- lation and maintenance offered by the Computing Technology Industry Association (CompTIA)

• Network1: Vendor-neutral certification of expertise in network infrastruc- ture and administration offered by CompTIA

A Pe r S o n A l noTe o n ce rTi f i c ATi o n Pro g r A m S

Many years ago, I earned my daily bread in a completely different field. I sold com- puter hardware and systems to businesses and schools. As it was, the company for which I worked was unwilling to hire telephone support staff to assist customers with hardware issues. Instead, they expected the sales staff to field support calls. I got very good at that task. So much so that my boss started dispatching me to per- form actual repairs any time the service call was close enough to justify the travel.

I discovered that I liked repairing computers a whole lot more than I did sell- ing them. So I started distributing my resume to a variety of potential employers— and didn’t get a single response. On a whim, I self-studied for the A1 certification from CompTIA, took the exams, and passed with flying colors. As soon as I had those letters behind my name, I started circulating my resume again and got three invitations to interview on the first pass. Of those, I was offered a position that paid approximately 35% more than I earned in my best year as a sales rep. For me, that was a very powerful lesson on the value of certification. Getting a master of science in digital investigation management hasn’t hurt either.

ptg11539634

xix

Ac k n oW l e d g m e nT S

A book of this nature is not the product of a single individual. I get my name on the cover because it was my idea and I did most of the writing—on the first go-around, anyway. However, there are some people who might go completely unnoticed for their patience, knowledge, skill, and understanding if I don’t point them out.

First of all, I would like to thank Robert J. Sherman for his help in mobile phone technology. Okay, to be precise, he didn’t just help . . . he wrote the whole chapter on mobile device forensics. He is an expert in this field, and my knowledge pales in comparison. So in the face of a lot of begging and pleading, along with promises of fame and fortune (sorry, bud . . . this is all the fame and fortune you’re likely to get out of this deal), he caved and agreed to help me. In the end, he turned out an excellent chapter. So if, after reading that chapter, you wonder why it reads so much better than the rest of the book, now you know.

Next, I’d like to give credit to two amazing reviewers whose comments turned a marginal first draft into a profoundly better final manuscript. Jay Light- foot and Ruth Watson both provided chapter-by-chapter comments on my first effort, suggesting numerous improvements in both structure and content. With- out those reviews, I don’t think this book would be as good as it is (however good that may be).

Naturally, I’m saving the best for last. My publisher actually made me complete the book! What’s with that? Michelle Housley, Michael Thurston, and Bernard Goodwin at Addison-Wesley all refused to give up hope on either me or the proj- ect (although I’m sure there were times it was tempting) and got me through that inevitable mid-book crisis where I felt I couldn’t possibly write another page with- out insanity setting in. This book is proof that I was wrong about the former, but I cannot with certainty attest to the latter.

Michael W. Graves April, 2013

Preface

ptg11539634

This page intentionally left blank

ptg11539634

xxi

ABo UT Th e AUTh o r

Michael W. Graves has worked as an IT professional for more than 15 years—as a network specialist, a security analyst, and most recently as a forensic analyst. He holds a master of science in digital investigation from Champlain College, where he spent several semesters as an adjunct professor of computer science. His pub- lications include a number of certification manuals for several of the CompTIA certifications, as well as two novels. When not poking around in computers or writing books, he carts around an 8x10 view camera and makes black-and-white landscape photographs with a nod toward the F64 school of photography.

ptg11539634

This page intentionally left blank

ptg11539634

1

1 This chapter will deal with the structural aspects that are common to most, if not all, digital investigations. Most current texts on the subject refer to a common investiga- tion model, although there is some disagreement on how many components make up the model. This book will use a six-part model, which will be covered in more detail later in this chapter.

It is essential to understand at the outset precisely what the scope of the investi- gation entails. The type of investigation dictates the level of authorization required. Generally, there are three types of investigation. Internal investigations are spon- sored by an organization. They generally start out as a deep, dark secret that the company doesn’t want getting out. Therefore, courts and state and federal agencies are rarely involved at the outset. The other two types—civil and criminal—both require involvement by the courts, but on different levels.

There will never be an investigation that does not have multiple stakeholders. In all court cases, there is the plaintiff and the defendant. In civil cases, these are the two litigants asking the courts to settle a dispute. In criminal cases, the defendant is the person accused of a crime and the plaintiff is the one making the accusation, which will always be some level of government authority. In addi- tion to these obvious players, there are those on the sidelines whose interests must be considered. Lawyers will almost always be involved, and in cases that are likely to end up in court, be assured that the judge will take an active interest.

With people’s finances, freedom, or even lives at stake, the necessity for accu- rate and thorough reporting cannot be emphasized enough. It is so critically

Th e An ATo m y o f A Di g iTA l

in v e sTi gATi o n

ptg11539634

ChApTer 1 The AnATomy of A DigiTAl invesTigATion

2

important that the subject of documentation will be discussed several times and in several places in this book. This chapter will start the reader off with the basics of good documentation.

Please be aware that this chapter deals only with the process of investigation. In Chapters 2 and 3, there will be detailed discussions of the various legal issues that the digital investigator must face on a daily basis. Consider the legal issues to be the glue that binds the model, but not the actual model. You can perform any number of investigations with no regard for the law. The results will be very revealing, but useless. Failure to be aware of legal aspects will cause the most per- fectly executed investigation to fall apart the instant the case is picked up by the legal team.

A BA s i C mo D e l fo r in v e sTi gATo r s

Today’s teaching methods require everything to be broken down into a simplified structure that you can put into a diagram. Computer investigations are no differ- ent. Even though there will probably never be any two cases that are identical, they should always be processed in accordance with a standard investigative model. Kruse and Heiser (2001) laid out the basic computer investigation model in their book entitled Computer Forensics: Incident Response Essentials. Their model was a four-part model with the following steps:

• Assess • Acquire • Analyze • Report

As shown in Figure 1.1, the four steps are further broken down into more gran- ular levels that represent processes that occur within each step. A more thorough study expands the model to six steps, as follows:

• Identification/assessment • Collection/acquisition • Preservation • Examination • Analysis • Reporting

ptg11539634

A BAsiC moDel for invesTigATors

3

The six-step model (Casey 2001) as seen in Figure 1.1 emphasizes the impor- tance (and process) of preserving the data. It also distinguishes between the pro- cess of examination and analysis, whereas Kruse and Heiser considered them to be two parts of a single process. Experience has shown that acquisition and preserva- tion are not the same, and while it might be an easy enough procedure to extract and examine data, accurate analysis is as much an art as it is a science.

From a management standpoint, each of these steps must be carefully moni- tored. Through a process of careful documentation of the history of each case, the various processes can be constantly reassessed for efficiency and reliability. When it becomes necessary, knowing what works and what doesn’t allows the observant manager to tweak the steps in order to improve organizational effectiveness.

Figure 1.1 emphasizes just how detailed these seemingly simple steps can actu- ally be. The assessment phase alone has a multitude of steps involving people, hardware, environment factors, political implications, and jurisdiction. Acquisi- tion of evidence cannot begin until all potential sources of evidentiary material

Figure 1.1 The steps of a digital investigation

ASSESS

ACQUIRE

Dictates Authority Required

Policies and Laws

Identify Evidence

Investigation Type

Collect Data

Identify Necessary Tools

Create Forensic and Archive Copies

ANALYZE Static DataLive Data Network Data

REPORT PrepareCollect Present

Written Permissions

Subpoena

Warrant

Identify Roles

Criminal

Civil

Internal

ptg11539634

ChApTer 1 The AnATomy of A DigiTAl invesTigATion

4

are identified, collected, inventoried, and catalogued. All of this must be done according to strict legal guidelines, or any subsequent investigation will be a waste of time. Legal and internal regulations regarding privacy must be followed at all times, or any information collected will not be admissible as evidence should the case ever make its way to court. In the case of internal investigations, adherence to corporate guidelines will generally be sufficient.

iD e nTi f i C ATi o n /As s e s s m e nT

Before beginning any investigation, the general rules of engagement must be estab- lished in advance and from the very start be strictly followed. Those rules can be very different between criminal and civil cases. It is essential that the investigator know what regulations apply to a specific investigation in order to not damage or destroy a case by failure to abide, either flagrantly or inadvertently.

In a criminal investigation, it is almost always necessary to obtain a warrant before seizing systems, media, or storage devices. In order to obtain that warrant, the investigating entity must provide a judge sufficient evidence that a crime has been committed, is about to be committed, or is in the process of commission. The specific type of information sought by the investigation must be identified; general fishing expeditions are never approved by a reputable judge—at least not for the purpose of issuing warrants.

Civil cases have more lenient guidelines. Internal investigations sponsored by an organization can be even more lenient. Federal guidelines regarding inva- sion of privacy are not as strictly enforced on civilian investigators looking into civil infractions as they are on agents of a government—state, federal, or local— who are investigating criminal complaints. Internal investigations can be made even easier when employees or members have signed a statement outlining an organization’s policies and guidelines.

No case should be accepted by an investigator directly. An executive-level deci- sion, based on a set of predefined guidelines (to be discussed later), must be made on whether to accept or decline each individual case presented to the organiza- tion. While it falls upon a law enforcement agency to accept any case assigned that involves violation of state or federal statutes, a private organization can refuse to accept cases for a variety of reasons. The organization’s leadership must indentify the criteria for case acceptance and stick to those criteria. It does the company’s reputation no good to be associated with a pedophile after publicly stating that its motives are to defend the community.

Make a list of all legal documentation that will be required. Warrants will be required in criminal cases. Court orders or subpoenas will be needed in civil

ptg11539634

A BAsiC moDel for invesTigATors

5

matters. Signed agreements outlining the scope of the investigation should be required in all internal investigations.

Once the ground rules are established, it is time to identify potential sources of evidence. The obvious place to look is on the local system, including hard disk drives, removable media that might be lying about, printers, digital cameras, and so forth. Less obvious sources of information might be PDAs, external hard disks or optical drives, and even system RAM if the data processing systems are still running when the incident is reported. Knowing in advance what must be acquired can prevent the investigator from making critical errors during the pro- cess of acquisition.

Co l l e C Ti o n /AC q u i s iTi o n

This is the most technical part of the investigation and can also be the most criti- cal time for making errors. If the case under scrutiny should ever come to trial, the investigator presenting the case must be able to prove the following:

• The data is authentic. • The copy of the data used for analysis is reliable. • The data was not modified during acquisition or analysis (chain of custody). • The tools used to analyze the data are valid tools. • Sufficient evidence, both incriminating and exculpatory, has been acquired

and analyzed to support the proffered conclusion.

• The conclusions drawn are consistent with the data collected and analyzed. • People involved in the collection and analysis of the data are properly trained

and qualified to do their job.

This doesn’t sound easy, and it isn’t. Details on how to assure that all of these requirements are met are covered in greater detail in later chapters. For now, suffice it to say that it is essential that they be fulfilled.

pr e s e rvATi o n

A cardinal rule of digital investigation is that the original data must never be touched. For many years, the standard rule has been that a forensically sound copy of the original be made and that the examination and analysis of data be performed on the forensic copy. In terms of nonvolatile media, such as hard disks, removable media, and optical disks, this is still the rule. Devices should always be

ptg11539634

ChApTer 1 The AnATomy of A DigiTAl invesTigATion

6

mounted as read-only in order to assure that no data is modified or overwritten during the process of mounting the device. Hard disk duplicators are designed specifically for this purpose, and in Windows systems, a simple modification of the registry allows USB devices to mount read-only.

Legal issues might arise if there is any possibility that media used to store images may have been contaminated. Be aware of that possibility and either have new media available for collection or be certain that previously used media has been forensically wiped.

In many cases, it becomes essential that copies of data be acquired through a process of live acquisition. This is the case when it becomes necessary to cap- ture the contents of memory from a running system, to acquire log files from network devices that cannot be brought down, or to archive information from network servers or storage appliances that defy the making of a forensic copy. If it is not possible, for any reason, to create a forensically sound copy, it is essential that the investigator document the reasons such a copy could not be made and record as accurately as possible the state of the evidentiary source before and after acquisition.

Storage of preserved information becomes part of the chain of custody process, and care must be taken that all data and devices collected during this phase are properly documented and tracked. Be able to verify that there was never a possibility for evidence to become tainted through outside tampering, corrup- tion, or improper procedure.

ex A m i n ATi o n

The process of examining data increases in scope and complexity every year. Whereas 1.44MB floppy disks were once the repository for stolen and illicit data, investigators these days are presented with flash drives the size of key fobs that hold 64 or more gigabytes of data and hard disks that store in excess of a terabyte. To make matters worse, the data is not likely to sit on a porch swing in plain view for anyone to see. Investigators will find it necessary to look for evidence in unal- located space left behind by deleted files. Hidden partitions, slack space, and even registry entries are capable of hiding large quantities of data. Steganography can hide documents inside of an image or music file. So essentially, the investigator is given an archive the size of the Chicago Public Library and asked to find a hand- written note on the back of a napkin tucked somewhere inside of a book.

Data carving tools and methods of looking for evidentiary material have evolved, and depending on the nature of the case, the investigator’s tool kit will require having several utilities. For criminal cases requiring forensically sound

ptg11539634

A BAsiC moDel for invesTigATors

7

presentation, it is critical that the tools used to examine data be those consid- ered valid by the courts. There are a few commercially available software suites approved for evidentiary use. Among these are Encase by Guidance Software and the Forensics Tool Kit (FTK) from Access Data Corporation. A suite of tools running on Linux that is not “officially” sanctioned but is generally considered acceptable by most courts is The Sleuth Kit, designed by Brian Carrier.

Keeping up with technical innovations in the industry is most critical in this area. As new technology emerges, new tools will be needed to examine the accu- mulated data it creates. The organization that follows the cutting edge of technol- ogy will always be two steps behind those that help develop it. The balancing act comes when management must defend the use of a new tool to which the courts and lawyers have not yet been exposed. Be prepared to defend the tool along with the conclusions it helped you formulate.