Assignment - Due December 2nd (Read project details; use Grading Rubic attached)

Final Paper

Csec 650

A. Describe your plan for processing the potential crime/incident scene. (30 points). Some of the items you will want to cover include:

Digital evidence is any evidence stored or transmitted in a digital form. As a lead forensic investigator it is imperative that careful steps are taken when identifying digital evidence. Digital data is considered tangible and accepted by US courts as physical data. Processing a criminal or incident scene must be executed systematically. The investigator must identify digital information or artifacts which can be utilized as evidence, collect, preserve and document all relevant evidence. Evidence must also be analyzed, organized and rebuilt or repeated to verify results are produced reliably.

Consistency assists in verifying work and enhancing reliability. It is imperative that State and Federal Rules of evidence are adhered to, and knowledge of latest rulings and directives on collecting, processing, storing, and admitting digital evidence is current.

The first and most important step is identifying the nature of the case, whether private or public sector. Determining the nature of the case dictates how the investigation would proceed, the rules for collecting evidence and the type of assets or resources needed for the investigation. Secondly, a search warrant should be obtained to ensure admissibility of evidence for prosecution by law if necessary. The warrant must include specific wording allowing for the seizure of all applicable devices and peripherals (Whitehead, n.d.).

Sources of evidence can include workstations, servers, database systems, mobile devices, call logs, printers or security systems such as CCTV and door access logs (Ernst & Young, 2013). “The collection phase is the first phase of this process to identify, label, record, and acquire data from the possible sources of relevant data, while following guidelines and procedures that preserve the integrity of the data” (CJCSM 6510.01B, 2012). There are two diverse categories of data that can be collected in a computer forensics investigation, volatile data and non-volatile data. Volatile data as its name suggests, is data which only exists when the system is powered on and erased once powered off like Random Access Memory (RAM), registry and caches. Non-volatile data is the opposite, where data exists when the system is powered on or off (Thipursian et al., 2014).

When capturing volatile information, the workstation should be located within the same LAN with the affected computer system. Tools such as ‘Cryptcat’ can be utilied in the forensic workstation to listen to the port of the Windows NT server. Create the trusted toolset optical drive in the Windows NT server and open the trusted console cmd.exe and use the following command:

Crytct<ip ddress>6543 –k key

To capture the data at the forensic workstation, we use the following command:

cryptct -1 –p 6543 –k key >> <filename>

Figure 2: Volatile data collection setup

Source: Reino, A., (2012)

The following table shows the Graphic User Interface tools, and their usage and outcome can be used in the computer forensic investigation.

Table 1: Volatile Data Forensic Tools and their usage and outcome

Source: Reino, A., (2012)

There are also a variety of other Windows-based tools to capture the volatile data such as:

HBGray’s FastDump – Local Physical memory acquisition.

HBGray’s F-Response – Remote physical memory acquisition

ipconfig – Collecting subject system details.

netusers and qusers – Identifying logged-in users

doskey/history – Collecting command history

netfile – Identifying the services and drivers

Lastly, collecting the clipboard content is also very important in a computer forensic investigation. It is better to collect evidence from a running machine as more evidence can be found from a machine in its volatile state.

To maintain proper evidence preservation and documentation, the following procedures should be followed sequentially:

1. Photograph the computer and scene

2. If the computer is off do not turn it on

3. If the computer is on photograph the screen

4. Collect live data - start with RAM image (Live Response locally or remotely via F-Response) and then collect other live data "as required" such as network connection state, logged on users, currently executing processes etc.

5. If hard disk encryption detected (using a tool like Zero-View) such as full disk encryption i.e. PGP Disk — collect "logical image" of hard disk using dd.exe, Helix - locally or remotely via F-Response

6. Unplug the power cord from the back of the tower - If the computer is a laptop and does not shut down when the cord is removed then remove the battery

7. Diagram and label all cords

8. Document all device model numbers and serial numbers

9. Disconnect all cords and devices

10. Check for HPA then image hard drives using a write blocker, Helix or a hardware imager

11. Package all components (using anti-static evidence bags)

12. Seize all additional storage media (create respective images and place original devices in anti-static evidence bags)

13. Keep all media away from magnets, radio transmitters and other potentially damaging elements Collect instruction manuals, documentation and notes

14. Document all steps used in the seizure (Thipursian et al., 2014).

It is important that a journal is kept documenting all activities of the investigation, the scene is secured, videos and still photographs are taken if necessary of relevant information, and if mandated a sketch of the incident or scene. Investigators should take notes to preserve the evidence and integrity of the investigation. It is imperative that notes give details accounts of the investigation for legal purposes or for reference during court proceedings. Investigators should also keep notes in case backtracking of the investigation is necessary. The investigators can also use those notes and information to determine the optimum approach to the forensics (King, 2006).

Documentation chain of custody involves each individual who comes in to contact with any evidence, signs for its possession. This allows for easy tracking of tangible evidence. Chain of custody ideally includes, the field location of the item, the method used to preserve the item, and the all the individuals who were a part of the chain of physical custody.

B. Discuss how your team will approach and process the database administrator’s computer considering the potential malware on her system.

Once the volatile data has been collected, non-volatile data can be captured through forensic imaging. Imaging is a process used to preserve original forms of data as evidence. This process is executed using tools such as EnCase, ProDiscover and FTK. A write blocker can be utilized to connect to the affected system and copy its drive contents to an alternate storage device. Forensic imaging copies all contents including metadata, hashes and timestamps. Forensic imaging will hash with MD5 or SHA-2 to ensure the integrity of digital evidence (Nelson, B., et al., 2008).

Data collection can be performed in both offline and online investigations. Live network traffic can be performed utilizing online investigation via ethereal or Wireshark tools. Firewall logs, antivirus logs, and domain controller logs will be collected for the investigation under the non-volatile data collection. Web server logs, Windows event logs, database logs, IDS logs and application logs will also be collected. All digital evidence collected must be documented in the chain of the custody log documentation. Chain of the custody log documentation is to maintain the integrity of the evidence from start to end of the investigation until the investigation report will be presented (Nelson, B., et al., 2008).

The disk must be imaged but by bit to access the entire volume and copy the original media, including the deleted files. After the disk is imaged, all data should be hashed to ensure the data is authentic and the integrity of the data is maintained throughout the investigation. It is imperative that the hash values are recorded in multiple locations with no modifications of the data from the moment of collection to the end of the investigation. Most tools help in achieving this by accessing the media in a read-only state (SANS, 2010). “Target System Hard drives, External Storage devices, and the Windows NT Server Hard drive must be acquired for the digital forensic investigation in this case. It is important to keep the source drive with the image as read-only permission when mounting the drive to avoid accidental modifications” (Craiger, 2004).

After collection of all available evidence, examination of the file system, Windows registry, Network and Database forensic examination, as follows:

NTFS is the New Technology File System and NTFS Disk is a file. MFT is the Master File Table which contains information about all files and disks, and it is also the first file in NTFS. The records in the MFT are also called metadata. Metadata is data about data (Nelson, B., et. al., 2008). There are two ways a file can be stored in MFT: resident and non-resident. A file which is less than 512 bytes can be accommodated in MFT as resident files and a file which is more than 512 bytes can be stored outside the MFT as non-resident files. When a file is deleted in Windows NT, the file will be renamed by OS and moved to the Recycle bin with a unique identity. OS stores information about the original path and original file name in info2 file. But if a file is deleted from the Recycle bin, then associated clusters are marked as available for new data. NTFS is more efficient than FAT, as it is faster in reclaiming its deleted space. NTFS disks are a data stream, which means they can be appended into another existing file.

W2K.Stream and Win2K.Team are viruses which were developed by using a data stream, and they were developed with the intention of altering the original data stream. As an investigator, we must be aware of the Windows file systems FAT and NTFS in depth (Nelson, B., et. al., 2008).

A registry is similar to a log file as it contains data which can be retrieved by an investigator, showing the last modification time of a file. Windows registry is an order of databases in a computer used by Microsoft in Windows 98, Windows CE, Windows NT and Windows 2000 to store a user or user application and hardware devices configuration, which is used as a reference point during execution of a program or processes (Windows, 2013). The common structure of the windows registry is divided into “Hives” which are:

· HKEY_CLASSES_ROOT: ensures that required programs are being executed.

· HKEY_CURRENT_USER: contains general information of a user that is currently logged into the system.

· HKEY_LOCAL_MACHINE: contains information about hardware, drives etc. of a system.

· HKEY_USERS: contains all information of users on a particular system.

· HKEY_CURRENT_CONFIG: stores information about the present configuration of the system.

The Windows registry consists of volatile and non-volatile information. This means an investigator must at least be familiar with each meaning and functionality of the hives, keys, data and values of a Window registry before undergoing any forensic investigation of a computer to obtain a successful forensic investigation report.

Autostart Location is a location in the registry where the applications are set to be launched without a user initiation. With this functionality malware has the ability of running based on pre-programming to auto start once a user utilizes specific commands.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Image File Execution Option is a Windows registry in which an attacker can use the key for redirection of an application original copy to its trojaned copy (Carvey, H., 2005). A forensics investigator can examine the autostart location to determine if the problem results from an action performed by a user, a malware or by an attacker within the organization.

Most Recent Used (MRU) List: MRU holds recent specific action taken by a user and keeps track of activities for future reference.

This hive can be examined to discover the lastwrite time of each command from the MRU allowing the investigator to analyze from the registry if it was user activity, a malware action or an attack that is affecting the organization.

C. Discuss how your team will approach and process the database server -- as this is the location for patient medical records

Through persistent examination of each value key, an investigator can identify removable USB storage devices and map them to the parented prefix.

Wireless SSIDs: According to (Carvey, H., 2005) SSIDs of wireless networks used on a computer can be found under HKEY_LOCAL_MACHINE\Software\microsoft\WZCSVC\Parameters\Interface. When navigating to key values, they contain sub keys which look like globally unique identifiers, which when opened, an investigator can navigate to the Active Settings which reveals each wireless SSID in the form of a binary data type. When right-clicked to modify, it reveals the SSIDs in plain written format. Though IP address and other network information can be found under HKEY_LOCAL_MACHINE\System\Current\ControlSet\Services\TCPIP\Interfaces\GUID.

The acquiring, collecting and analyzing of the events that take place in the network is referred to as network forensics. Sometimes it’s also known as packet forensics or packet mining. The basic objective of network forensics is the same, which is to collect information about the packets in the network traffic such as the mails, the queries, the browsing of the web content, etc., and keep this information at one source and carry out further inspection (Thipursian et al., 2014).

Network forensics can be applied in two main ways. The first one is security-related, where a network is monitored for suspicious traffic and any kind of intrusions. It is possible for the attacker to delete all the log files from an infected host, so in this situation the network-based evidence comes to play in the forensics analysis. The second application of network forensics is related to law enforcement, where the network traffic that has been captured could be worked on to collecting the files that have been transferred through the network, keyword search and analysis of human communication which was done through e-mails or other similar sessions. (Hunt, 2012)

Some very important and discreet information should be collected from a running machine, with the help of trusted tools such as:

· Process listings.

· Service listings.

· System information.

· Logged on and registered users.

· Network connections.

· Registry information.

· Binary dump of memory (7safe, 2013)

There are many different kinds of network forensics tools, each with different functions. Some are just packet sniffers and others deal with identification, fingerprinting, location, mapping, email communications, web services, etc. The table below lists some of the open-source tools that can be used for network forensics and their functionalities. (Hunt, 2012)

F: Filter & collect; L: Log analysis; R: Reassembly of data stream; C: Correlation of data; A: Application Layer view

Table 2: Network Forensic Tools

D. Discuss how you prepare your team to be expert witnesses or support any expert testimony court requirements.

Final Report The expert's written report includes:

• Basic case and evidence identification and dates.

• Conclusions and opinions.

• Reasons supporting conclusions and opinions.

• Rationale or interrelationship between conclusions and the supporting reasons for those opinions. Deposition: Sworn testimony before trial, usually given in an office or place of business.

Depositions are usually designed to accomplish specific objectives, such as:

1. Gathering information.

2. Uncovering weaknesses in testimony.

3. Locking the expert witness into a position.

4. Assessing the expert's ability as a witness (Thipursian et al., 2014).

Preparing the team for expert testimony involves reviewing the facts and evidence of the case. Knowledge of preparing reports, pretrial training documents and testimony in layman’s language to avoid ambiguity is imperative for expert witnesses. The team should organize their presentation of relevant material and utilize visuals for clarification; Graphs, charts, drawings, models and demonstrations can make expert testimony more interesting, understandable and effective (DNA Initiative, 2011).

It is important that team members giving expert testimony are personable, genuine and natural, portray a teaching ability, and are competent. They must also be believable, persuasive, and prepared.

References

7safe, (2013) “Good Practice Guide for Computer-Based Electronic Evidence”, Available at: http://www.7safe.com/electronic_evidence/ACPO_guidelines_computer_evidence.pdf, Accessed on 12th January 2014.

Carvey, H., (2005), “Windows Forensics and Incident Recovery”, Boston: Pearson Education Inc.

Case studies, PwC CybercrimeUS Center of Excellence, PricewaterhouseCoopers LLP, 2010, http://www.pwc.com/us/en/forensic-services/assets/cyber-crime-data-breach-case-studies.pdf

CJCSM 6510.01B, 2012, “Cyber Incident Handling Program”, Chairman of the Joint Chiefs of Staff Manual, J6.

DNA Initiative. (2011, September 8). Law 101: Legal Guide for the Forensic Expert. Retrieved from http://www.swgfast.org/Resources/111010-law101-full-course[1].pdf

Hunt, R., (2012), “New Developments In Network Forensics – Tools and Techniques”, New Zealand, IEEE, pp. 377 – 381.

Ernst & Young. (2013). Investigating a Data Breach: IT Forensic Services. Retrieved from http://www.ey.com/Publication/vwLUAssets/EY-Investigating-a-data-breach/$FILE/EY-Investigating-a-data-breach.pdf

Microsoft, (2013), “Windows Registry Information for Advanced Users” Available at https://support.microsoft.com/kb/256986, Accessed on 10th January 2014

Nelson, B., et. al., (2008), “Guide to Computer Forensics and Investigations”, 3rdedn, Massachusetts: Course Technology.

Reino, A. (2012), “Forensics of a Windows System”, Roche.

SANS, (2010), “Integrating Forensic Investigation Methodology into eDiscovery”, Available at: https://www.sans.org/reading-room/whitepapers/incident/integrating-forensic, Accessed on 13th January 2014.

Thipursian, E., Thogarcheti, S., Al Fahad, A., Gurjar, C., Mentsiev, A., & Mammuan, A. (2014, March 6). Computer Forensics Investigation – A Case Study - InfoSec Institute. Retrieved from http://resources.infosecinstitute.com/computer-forensics-investigation-case-study/

Whitehead, A. (n.d.). Computer Forensic: Seizing the Evidence. Retrieved from http://free-backup.info/computer-forensic-siezing-the-evidence.html