Forensic Process

When we're collecting evidence, it's important that we do it in a correct way. Digital forensics is just that process of collecting digital evidence. There have been many times when evidence has been thrown out — evidence that would prove some sort of guilt of a criminal — but it's been thrown out because the evidence hasn't been collected correctly. So it's critically important that we collect things in a proper way.

Identification

It starts out with just identifying what it is that we are going to collect. Sometimes we're going to collect evidence not really knowing exactly what we're looking for, where other times we might be directed exactly what we need to collect and hand over to the court system. We call this e-discovery. When they do an e-discovery, they outline exactly what it is that you need to collect and turn over.

What we're identifying is what artifacts we need to collect. Artifacts are data or information that provides insight into the past. Essentially, what we're going to do is collect a bunch of artifacts, which gives us insight into what happened, and then look in those artifacts to determine what is the evidence that we need to pull out that supports whatever it is that we're trying to support. Artifacts could be any of those things that we're already monitoring for, so this could be as simple as just going and collecting those things that we've been monitoring for, or it could be in other forms.

Acquisition

The next step is that we need to go and acquire it. Acquire just means to obtain or take possession of. There's lots of different sources that we might be acquiring this from. For instance, maybe we have a log aggregator and we can do a lot just through that log aggregator. Or we may need to go to specific data sources — computers, equipment, mobile phones, different devices out there — to pull data from. As I mentioned, we could be pulling certain log information, so there's a lot of different devices like firewalls, servers, applications, or anything that we were logging for or monitoring, that this could be the items that we are looking for and pulling data from. Another thing that we monitor for is indicators of compromise, so these are some things also that we could be looking for.

Essentially we're looking for anything that gives evidence to who, what, when, where, why. And if it's some sort of intrusion and we're trying to figure out what has happened, what the adversary has done, maybe we use the method of tactics, techniques and procedures. Or there's also an actual methodology to look at intrusions, and that's the Diamond Model of Intrusion Analysis.

We need to be really careful with how we collect data. For instance, let's just say we're collecting a glass that has a fingerprint on it. If we were to touch that glass, there's two things that could happen. Number one is we get our fingerprint on there, which we don't want. And number two, it would also smudge this fingerprint. In both cases, this could be a problem.

Order of Volatility

Another problem with collecting data is the idea of volatility. If we're collecting data from a laptop, there is data on this laptop that could go away with time. There's this order of volatility. There are some things like RAM that are highly volatile — once you turn that computer off, you're going to lose it. There's things like email; email is a dynamic system, and the emails that are in somebody's inbox change constantly. People delete stuff, they add stuff, or new stuff comes in. We also have files; files also are fairly dynamic. Backups are not as dynamic, but they could go away after a certain amount of time. Archives are usually kept much longer and considered probably the least volatile out of all of these, but still, we delete archives on occasion.

So we need to think about collecting things in the order. We need to collect the more volatile first, and then we can go and have a little more time to collect the non-volatile. So we need to do things like memory snapshots first. We need to clone disks and do disk imaging to grab a capture of that data so that way we preserve that data. And there are specific forensic tools that do these specific types of data collecting.

Preservation

Once we've collected the data, we need to preserve that data. Preserving just means maintaining the original state, or maintaining integrity. In fact, you might see a lot of different terms when it relates to preservation: evidence preservation, data preservation, data integrity, integrity preservation. There's quite a few different terms associated with preserving this data, preserving this evidence.

Many times we have to keep duplicates of this information. For instance, one of the first jobs I had, I had to copy legal documents so that way there could be multiple copies of this. And so this is one thing that we might have to do, is go through preserving and duplicating this data.

When we're duplicating this data, we need to be careful about timestamps. If you copy things wrong, then what it does when it creates a copy is they'll have a new creation date. And so using things like those tools to grab information and making disk images and that type of stuff preserves the timestamps, and that's one of the important parts of preserving the data, because that's a data piece there — understanding when something was created. So once again, this is where we have certain tools and techniques that we need to use to preserve those timestamps and preserve that data.

We'll also have to figure out some way to securely store that data. Also, when we collect data, we want to make sure that nothing else tampers with that data, so storing it in a secure way really helps us make sure that no one is going to tamper with that. One way to make sure that the integrity has been maintained is by grabbing a hash of something. A hash is like a fingerprint. You're going to take data, create a hash out of it, and now you store that hash in another location. So if you ever need to verify that the data is still intact, you can create another hash out of it and compare it to the original hash and make sure nothing has changed.

Chain of Custody

Now let's say that there has been an issue with collecting the data or analyzing the data. Maybe a fingerprint does get smudged somewhere along the way, or another fingerprint gets added. Well, this is a problem with the collection and storage of this, and so what we need to do is put in some practices to understand where this evidence has gone and whether it has been tampered with. So this is where we need to maintain a chain of custody.

Chain of custody is understanding who handled it and when they handled it. During the chain of custody, what we're going to do is record who discovered it, who collected it, who has primary responsibility over it, how it was handled — the time, place and personnel, all the details of the handling of it — and who physically had access to it while it was stored. Anything to make sure that we maintain an integrity of the evidence.

Analysis

At that point we're going to get into analysis, which just means examining methodically. I look at analysis as having two different parts. One is to render the information down. We've collected all of these artifacts; it's a ton of information that we probably have collected, and we need to render it down into what actually matters — so what is the evidence out of that. The next thing is then we need to examine the evidence and draw some sort of conclusion: what is the meaning of that evidence.

Getting back to our non-digital example of a fingerprint, with the analysis of a fingerprint we might determine that this fingerprint means that a certain person was tied to the scene of the crime. They're just tied to the scene of the crime. That doesn't mean they committed the crime, but they were there. So maybe that's where we then further our investigation. So it is an element of evidence that is important to us, but it might not prove exactly what we were thinking.

One type of analysis that we might perform is cryptanalysis. That's when we take something that's been encrypted and try to figure out how to decrypt it to figure out what it is. We also have steganalysis. Steganalysis is when we take a message that's hidden and try to reverse it into what the message actually is, or whatever the data is. It's a little different than cryptanalysis, where we're taking something that's been encrypted; instead we're taking a message that's hidden.

Reporting and Tools

Then what we do is we assemble it all into a report. We might need to turn this evidence over to the legal system, or we might be doing it as part of an internal investigation, but we're going to create some sort of report of what our findings are.

Now there are a lot of tools that we can use to do this: file carving tools, binary analysis tools, and there's different anal Anis tools and imaging tools, hashing utilities. There's also live collecting and postmortem tools. There's a lot of different tools that are associated with digital forensics.