Digital Forensics

There are times that we have to dig in to figure out what's going on on our systems. We're going to have to do a lot of investigation. Sometimes we're going to have to do a digital forensics. Digital forensics takes this to the next level. It's the same type of investigations we would do for other incidents, but maybe this is around some sort of criminal behavior and we need to collect the evidence correctly.

What Digital Forensics Is

Digital forensics is the practice of analyzing and preserving electronic data. Most of the time when we hear this term digital forensics, it's really related to criminal activity, that we're collecting data and analyzing data in reference to some sort of criminal activity, like somebody hacking your network.

During this process, we're going to collect evidence. Evidence is facts or information indicating a belief is valid or true. So essentially what we're going to be doing is trying to find all these artifacts, all these items out there that are showing that somebody did in fact break into our network and carry out this criminal behavior. So we're going to be collecting evidence for that.

We could be collecting evidence for maybe some sort of root cause analysis. Maybe we're doing it for some sort of internal investigation. Maybe it's for some litigation, some sort of legal action. So much of what we're going to cover and look into is really going to be as if we're complying to some sort of investigation, that maybe we're working with some sort of local law authority to collect evidence for this investigation.

A Litigation Scenario

Let's come up with a little scenario here. Let's say there was an employee who was fired, and now they're coming back and they're suing the company for discrimination, that they felt like they were discriminated against, and so they're taking it to the court system.

One thing that their lawyers might do is, first of all, ask for a legal hold, or a litigation hold. The thing is that we have a lot of dynamic systems. There's email systems, there's instant messaging systems, there's files, there's databases, there's archives. We've got these different systems out there. Some of them are more dynamic than others, but they're changing over time. So they don't want certain information to be deleted or removed or moved around. So what they need to do is preserve that evidence. So one thing that their lawyers might do is ask for a legal hold on certain information with that company.

They're also probably going to ask for some sort of e-discovery. The E just means electronic, so let's ignore that and just talk about what a discovery is. A discovery is when you have to pull documents and submit them to the courts and the legal system as evidence, and it will prove one way or another — either proven that the company did things wrong or right, and prove whether this discrimination happened or not. So what we're going to do is pull evidence of that, and we're going to have to do it whether it's paper or electronic.

Well, in this case right here we're talking about e-discovery. So, since we're mainly talking about technology, we might have to go into email, or like I say, instant messaging, or files, or database, or archives, or backups. We're going to have to go into these sources and pull certain data.

The Forensics Process

Since this data is going to be submitted to the court systems, we need to make sure that we go through the digital forensics process accurately, so that way we don't run into any legal issues during this process. So we're going to somehow identify what data it is that we need to pull and be able to store. We're going to acquire that, go through the process of acquiring that. We need to preserve that data. We would then analyze that data, and then we turn it into some sort of report.