Course Title: Computer Forensic Specialist: Procedures & Response

Transcription

1 Cmputer Frensic Specialist Curse Title: Cmputer Frensic Specialist: Prcedures & Respnse Page 1 f 12 Prcedures & Respnse Cpyright by EC-Cuncil Press All Rights Reserved. Reprductin is Strictly Prhibited.

2 Cmputer Frensic Specialist Curse Descriptin The Cmputer Frensic Series by EC-Cuncil prvides the knwledge and skills t identify, track, and prsecute the cyber-criminal. The series is cmprised f five bks cvering a brad base f tpics in Cmputer Hacking Frensic Investigatin, designed t expse the reader t the prcess f detecting attacks and cllecting evidence in a frensically sund manner with the intent t reprt crime and prevent the future attacks. Learners are intrduced t advanced techniques in cmputer investigatin and analysis with interest in generating the ptential legal evidence. This and the ther fur bks prvide preparatin t identify evidence in cmputer related crime and abuse cases as well as track the intrusive hacker's path thrugh a client system. The series and accmpanying labs help prepare the security student r prfessinal t prfile an intruder's ftprint and gather all necessary infrmatin and evidence t supprt prsecutin in a curt f law. The first bk in the Cmputer Frensics series is Investigatin Prcedures and Respnse. Cverage includes a basic understanding f the imprtance f cmputer frensics, hw t set up a secure lab, the prcess fr frensic investigatin including first respnder respnsibilities, and hw t handle varius incidents and infrmatin n the varius reprts used by the cmputer frensic investigatrs. Certificate Inf Cmputer Frensic Specialist: Prcedures and Respnse Wh Shuld Attend This curse will significantly benefit plice and ther law enfrcement persnnel, defense and military persnnel, e-business security prfessinals, systems administratrs, legal prfessinals, banking, insurance and ther prfessinals, gvernment agencies and IT managers. Curse Duratin 2 days (9:00AM 5:00PM) CPE/ECE Qualificatin 16 ECE Credits awarded fr attendance (1 fr each classrm hur) Suggested Retail: $799 USD Page 2 f 12 Prcedures & Respnse Cpyright by EC-Cuncil Press All Rights Reserved. Reprductin is Strictly Prhibited.

3 Cmputer Frensic Specialist Required Curseware: Visit and click n Training Wrkshps fr rdering details. What s included? Physical Curseware 1 year Access T EC-Cuncil Student LMS fr Practical Labs (if applicable), testing, and Certificate Curse + Supplement Cst: See the Training Wrkshps sectin at fr current pricing infrmatin. Related Certificates: Cmputer Frensic Specialist: Strage Device & Operating Systems Cmputer Frensic Specialist: Netwrk Intrusin & Cybercrime Cmputer Frensic Specialist: Data and Image Files Cmputer Frensic Specialist: Wireless Netwrks and Devices Page 3 f 12 Prcedures & Respnse Cpyright by EC-Cuncil Press All Rights Reserved. Reprductin is Strictly Prhibited.

4 Cmputer Frensic Specialist Curse Briefing 1. Cmputer Frensics in Tday's wrld Chapter Brief: Cmputer frensic investigatin determines the value f evidence at the crime scene and the related evidence that is held. The functins f frensic scientists include prper analysis f the physical evidence, prviding expert testimny in curt, and furnishing training in prper recgnitin, cllectin and preservatin f the physical evidence The field f cmputer investigatins and frensics is still in its develping stages. It plays a majr rle in tracking the cyber criminals. This chapter will intrduce yu t cmputer frensics in tday s wrld. It discusses abut varius crimes prevailing, need fr cmputer frensics, frensic readiness planning, Enterprise Thery f Investigatin (ETI), and sme f the mst imprtant prblems and cncerns that are faced by frensic investigatrs tday. 2. Cmputer Frensics Lab Chapter Brief: A Cmputer Frensics Lab is a designated lcatin fr cnducting cmputer based investigatin n the cllected evidences. It is ttally an efficient cmputer frensics platfrm which is able t investigate any cyber crime events. In cmputer frensics lab, the investigatr analyzes media, audi, intrusin, and any type f cyber crime events btained frm the crime scene. This chapter describes the requirements f a frensic investigatin, such as the lab and the ffice. The lab is an imprtant part f any frensic investigatin. It lists ut varius cmplex and minute details, such as determining the physical layut f the lab, envirnmental cnditins, and the lighting. It als highlights the imprtance f acquiring certificatin fr an investigatr. It shwcases the need fr a frensic wrkstatin and the benchmark t select the best pssible frensic wrkstatin. It lists ut the duties f the lab manager and staff, s that they help in smth running f an investigatin rather than being a hurdle. 3. Cmputer Investigatin Prcess Chapter Brief: Securing the cmputer evidence is the prcess by which all infrmatin held n a cmputer is retrieved in rder t aid an investigatin. Investigatin prcess helps yu t perfrm apprpriate analysis f the incident r crime that tk place. This chapter describes the different stages invlved in perfrming the investigatin prcess. It deals with hw t prepare fr the investigatin, hw t cllect, analyze, manage the case, hw the investigatin is dne, the rle f an expert witness, and hw the reprts shuld be presented in the curtrm. It prvides a list f service prviders fr cmputer frensics. Page 4 f 12 Prcedures & Respnse Cpyright by EC-Cuncil Press All Rights Reserved. Reprductin is Strictly Prhibited.

5 Cmputer Frensic Specialist 4. First Respnder Prcedures Chapter Brief: First respnder refers t the persn wh first arrives at the crime scene and accesses the victim s system nce the incident has been reprted. He/she may be a netwrk/system administratr, law enfrcement fficer, r investigatin fficer. The rle f a system administratr is imprtant in ensuring all aspects f the netwrk security and maintenance. He/she als plays a vital rle in the incident f a cmputer used in a security incident r illegal act. Under n circumstances shuld anyne, except the frensic analysts, make any attempts t restre r recver the infrmatin frm any cmputer system r device that hlds electrnic infrmatin. This chapter describes the first respnder prcedure which deals with the rle f the first respnder, cllecting and preserving the electrnic evidence frm the target cmputer system when an incident is reprted. 5. Incident Handling Chapter Brief: Until a few years ag, the need fr an incident respnse team within every rganizatin was never given a serius thught. Since there is a lack f trained prfessinals wh can respnd t incidents and minimize the effects, rganizatins are pting fr in-huse incident respnse teams. After cmpleting this chapter, ne can gain in-depth understanding the incident, types f incidents, incident reprting, incident respnse, incident handling, basic prcedures in handling incidents, varius CSIRTs present in the wrld, and mre. 6. Investigative Reprts Chapter Brief: This chapter will familiarize yu with cmputer frensic reprt which prvides detailed infrmatin n cmplete frensics investigatin prcess. It can be prepared by the cmputer frensic investigatr. This chapter explains hw cmputer frensic investigatr cllects the cmplete infrmatin invlved in the case, investigates them, and prepares the final reprt. It can be used t cmmunicate the results f the frensic investigatin. It can be used nt nly t present the facts but als t cmmunicate expert pinin. This chapter als highlights the tpics such as, need f an investigative reprt, reprt specificatins, reprt classificatin, layut f an investigative reprt, and guidelines fr writing a reprt, best practices fr investigatrs, writing reprt using FTK, etc. Page 5 f 12 Prcedures & Respnse Cpyright by EC-Cuncil Press All Rights Reserved. Reprductin is Strictly Prhibited.

6 Cmputer Frensic Specialist Curse Outline Chapter 1: Cmputer Frensics in Tday's wrld Intrductin t Cmputer Frensics in Tday s Wrld Cmputer Frensics Evlutin f Cmputer Frensics Frensic Science Cmputer Frensics Frensic Readiness Cyber Crime Cyber Crime Investigatins Cyber Crime Investigatins: Rle f Digital Evidence Cyber Crime Investigatins: Understanding Crprate Investigatins Apprach t Frensic Investigatin: A Case Study When an Advcate Cntacts the Frensic Investigatr, He Specifies Hw t Apprach the Crime Scene Why and When d yu Use Cmputer Frensics Enterprise Thery f Investigatin (ETI) Legal Issues Reprting the Results Reprting the Results Chapter 2: Cmputer Frensics Lab Intrductin t the Cmputer Frensic Lab Planning fr a Frensics Lab Budget Allcatin fr a Frensics Lab Physical Security Needs f a Frensic Lab Structural Design Cnsideratins Physical Security Recmmendatins fr a Frensic Lab Basic Requirements Wrkstatin Security Fire Safety Fire-Suppressin Systems Evidence Lcker Recmmendatins Checking the Security f a Frensic Lab Page 6 f 12 Prcedures & Respnse Cpyright by EC-Cuncil Press All Rights Reserved. Reprductin is Strictly Prhibited.

7 Cmputer Frensic Specialist Wrk Area f a Cmputer Frensic Lab Wrk Area Cnfiguratin General Cnfiguratin f a Frensic Lab Equipment Required in a Frensic Lab Frensic Wrkstatins Electrical Needs Cmmunicatins Basic Wrkstatin Requirements in a Frensic Lab Recmmended Hardware Peripherals Maintaining Operating System and Applicatin Inventries Cmmn Terms Required Frensic Tls Strage Bags Remte Chargers Write Blck Prtectin Devices Data Acquisitin Tls Frensic Archive and Restre Devices Mbile Frensic Laptps Frensic Wrkstatins Imaging Wrkstatins Sftware Investigatins at a Cmputer Frensic Lab Prcedures at a Cmputer Frensic Lab Data Destructin Industry Standards Chapter 3: Cmputer Investigatin Prcess Intrductin t Cmputer Investigatin Investigating Cmputer Crime Plicy and Prcedure Develpment Investigating a Cmpany Plicy Vilatin Implementing and Enfrcing Cmpany Plicy Plicy Vilatin Case Example Befre Starting the Investigatin Build a Frensics Wrkstatin Building the Investigatin Team Peple Invlved in Cmputer Frensics Page 7 f 12 Prcedures & Respnse Cpyright by EC-Cuncil Press All Rights Reserved. Reprductin is Strictly Prhibited.

8 Cmputer Frensic Specialist Legal Cnsideratins Investigating Methdlgy Evaluating the Case Warning Banners Cllecting the Evidence Obtaining a Search Warrant Search Warrant Purview Preparing fr Searches Searches Withut a Warrant Perfrming a Preliminary Assessment First Respnder Examining and Cllecting Evidence Acquiring the Subject Evidence Methds f Cllecting Evidence Securing the Cmputer Evidence Prcessing Lcatin Assessment Chain-f-Evidence Frm Examining the Digital Evidence Understanding Bit-Stream Cpies Imaging Making a Bit-Stream Cpy Using MS-DOS Acquiring a Bit-Stream Cpy f a Flppy Disk Using Image Making a Bit-Stream Cpy f Evidence Using Image Write Prtectin Evidence Assessment Evidence Examinatin Analysis f Extracted Data Time-Frame Analysis Data-Hiding Analysis Applicatin and File Analysis Ownership and Pssessin Dcumenting and Reprting The Final Reprt Sample Reprt Expert Witness Testifying in the Curt Rm Page 8 f 12 Prcedures & Respnse Cpyright by EC-Cuncil Press All Rights Reserved. Reprductin is Strictly Prhibited.

9 Cmputer Frensic Specialist Clsing the Case Chapter 4: First Respnder Prcedures Electrnic Evidence First Respnder Rle f the First Respnder Electrnic Devices: Types and Cllecting Ptential Evidence First Respnder Tlkit Creating a First Respnder Tlkit Evidence Cllecting Tls and Equipment First Respnse Basics Incident Respnse: Different Situatins Securing and Evaluating Electrnic Crime Scene Securing and Evaluating Electrnic Crime Scene: A Check-list Securing the Crime Scene Warrant fr Search and Seizure Planning the Search and Seizure Initial Search f the Scene Health and Safety Issues Cnducting Preliminary Interviews Cnducting Initial Interviews Witness Statement Checklist Questins t ask When Client Calls the Frensic Investigatr Dcumenting the Electrnic Crime Scene Cllecting and Preserving Electrnic Evidence Cllecting and Preserving Electrnic Evidence : Order f Vlatility Cllecting and Preserving Electrnic Evidence : Dealing with Pwered OFF Cmputers at Seizure Time Cllecting and Preserving Electrnic Evidence: Dealing with Pwered ON Cmputers Cllecting and Preserving Electrnic Evidence: Dealing with Netwrked Cmputer Cllecting and Preserving Electrnic Evidence : Dealing with Open Files and Startup Files Cllecting and Preserving Electrnic Evidence : Operating System Shutdwn Prcedure Cllecting and Preserving Electrnic Evidence :Cmputers and Servers Cllecting and Preserving Electrnic Evidence :Preserving Electrnic Evidence Cllecting and Preserving Electrnic Evidence :Seizing Prtable Cmputers Packaging and Transprting Electrnic Evidence Chain f Custdy Page 9 f 12 Prcedures & Respnse Cpyright by EC-Cuncil Press All Rights Reserved. Reprductin is Strictly Prhibited.

10 Cmputer Frensic Specialist Reprting the Crime Scene First Respnder Cmmn Mistakes Chapter 5: Incident Handling Intrductin t Incident Handling Types f Incidents Security Incidents Categry f Incidents Categry f Incidents: Lw Level Categry f Incidents: Mid Level Categry f Incidents: High Level Issues in Present Security Scenari Hw t Identify an Incident Hw t Prevent an Incident Defining the Relatinship Between Incident Respnse, Incident Handling, and Incident Management Incident Management Incident Management: Threat Analysis and Assessment Incident Management: Vulnerability Analysis Incident Management: Estimating Cst f an Incident Incident Management: Change Cntrl Incident Reprting Incident Respnse Incident Handling Incident Handling: Preparatin Incident Handling: Identificatin Incident Handling: Cntainment Incident Handling: Eradicatin Incident Handling: Recvery Incident Handling: Fllw-up Incident Handling: Educatin, Training, and Awareness Pst-Incident Reprt CSIRT Incident Handling: Prcedural and Technical Cuntermeasures Incident Handling: Vulnerability Resurces Types f Incidents and Levels f Supprt Incident-Specific Prcedures Page 10 f 12 Prcedures & Respnse Cpyright by EC-Cuncil Press All Rights Reserved. Reprductin is Strictly Prhibited.

11 Cmputer Frensic Specialist Steps a CSIRT Uses t Handle Cases US-CERT Incident Reprting System Examples f CSIRTs Steps fr Creating a CSIRT Step 1: Obtain Management Supprt and Buy-in Step 2: Determine the CSIRT Develpment Strategic Plan Step 3: Gather Relevant Infrmatin Step 4: Design yur CSIRT Visin Step 5: Cmmunicate the CSIRT Visin Step 6: Begin CSIRT Implementatin Step 7: Annunce the CSIRT Wrld CERTs Chapter 6: Investigative Reprts Intrductin t Investigative Reprts Cmputer Frensic Reprt Investigative Reprt Template Reprt Specificatins Reprt Classificatin Verbal Frmal Reprt Verbal Infrmal Reprt Written Frmal Reprt Written Infrmal Reprt Layut f an Investigative Reprt Layut f an Investigative Reprt: Numbering Decimal Numbering Structure Legal-Sequential Numbering Structure Guidelines fr Writing a Reprt Use f Supprting Material Imprtance f Cnsistency Salient Features f a Gd Reprt Imprtant Aspects f a Gd Reprt Investigative Reprt Frmat Attachments and Appendices Including Metadata Signature Analysis Page 11 f 12 Prcedures & Respnse Cpyright by EC-Cuncil Press All Rights Reserved. Reprductin is Strictly Prhibited.

12 Cmputer Frensic Specialist Sample Frensic Reprt Sample Investigative Reprt Cllecting Evidence Cllecting Physical and Demnstrative Evidence Cllecting Testimnial Evidence Ds and Dn ts f Frensic Cmputer Investigatins Case Reprt Writing and Dcumentatin Creating a Reprt t Attach t the Media Analysis Wrksheet Best Practices fr Investigatrs Writing a Reprt Using FTK Analyzing with FTK Lcating Encrypted Files with FTK Viewing Encrypted Files Searching with FTK Creating a Bkmark fr Investigatin Findings Reviewing Case Findings in FTK Viewing Selected Items Running the FTK Reprt Wizard Page 12 f 12 Prcedures & Respnse Cpyright by EC-Cuncil Press All Rights Reserved. Reprductin is Strictly Prhibited.