Introduction to Network Security Comptia Security+ Exam. Computer Forensics. Evidence. Domain 5 Computer Forensics

Transcription

1 Introduction to Network Security Comptia Security+ Exam Domain 5 Computer Forensics Computer Forensics Forensics relates to the application of scientific knowledge and method to legal problems Investigating and analyzing computer systems for evidence related to violation of laws Investigating and analyzing computer systems for organization policies compliance Investigating and analyzing computer systems for evidence of system compromise Incident response Evidence Documents, verbal statements and material objects relevant and admissible in a court of law Standard for Evidence Sufficient Convincing and measure up without question Competence Legally qualified and reliable Relevant Material to the case or have a bearing on the matter at hand 1

2 Rules Regarding Evidence Best evidence Court prefers original Duplicate may be accepted If the original has been destroyed Original cannot be subpoena Exclusionary evidence Not in violation of the Fourth Amendment Violation of Electronic Communication Privacy Act Hearsay evidence Second hand evidence Types of Evidence Direct evidence Knowledge of facts through five-senses No inference or presumptions Real (physical or associative) evidence Tangible objects Documentary evidence Records, print output Demonstrative evidence Show and tell Evidence Credibility is everything Acquiring Identifying Protecting Transporting Storage Chain of custody 2

3 Acquisition Do not use utilities on a compromised system Collecting evidence as soon as possible to prevent removal or tampering Photograph evidence before removal Computer in use Turn off or disconnect from the network? Issue: System is critical to operation Dump memory to another location Complete dump not available for 2GB+ or 4GB+ PAE systems New dump replacing old dump Registry entry to create keyboard memory dump Power down Image system Identification Properly marked and cataloged Labels must not be easily removed Logged each piece of evidence Identification Collector ID Date and time Location Reason Note damaged to evidence Protection To assure credibility evidence must be protected from Damage Electromagnetic, magnetic fields Mechanical Extreme temperature Humidity Water Vibration Tampering Compromised Use static-free protective gloves in handling Properly sealed and identified 3

4 Transportation Properly logging in or out of storage to ensuring chain of custody Who What When Why Proper packaging Secured packaging Anti-static bag Shock and vibration Storage In dedicated storage area Low and controlled traffic Restricted access Monitoring devices Entry log The Investigation (1) Take extreme caution to assure credibility Use check list do not skip any step Never examine the original evidence Photograph and remove one piece at a time Proper storage of magnetic media Log identification and physical properties Hard disk make, model, and type Drive geometry 4

5 The Investigation (2) Make multiple copy using sector imaging One to replace the drive if you don t want the owner to know that you removed the original One to sealed, marked, logged and stored with the original One to be used for file authentication One for analysis Lock drive to prevent changes Create drive message digest and save hash values Inventory all files on the system Document system date and time Chain of Custody Record each item collected as evidence Document name of evidence collector, date and time, description of evidence Put evidence in containers and tag the container with case number Document all message digests Properly secure evidence for transport to a secured storage facility Obtain signature from person who accepts evidence for storage Provide controls to prevent access to and eliminate compromise of evidence Securely transport evidence to court proceedings Forensic Disk Storage Analysis Free space May contain data from deleted files Files are not actually deleted Pointers in FAT or MFT are removed Slack space Data hidden after actual data in sectors 5

6 Forensic System Analysis Check Recycle Bin for deleted files Check web browser History files Address bar histories Cookies Temporary folders Check system temporary folders Check software temporary folders Search files for suspected strings Search for hidden files Search free space and slack space Search specific file types Check registry for Most Recently Used (MRU) list 6