DUE Thursday 10/10/2013 12 noon

csec650_05.pdf

Home >Computer Science homework help >DUE Thursday 10/10/2013 12 noon

UMUC Cybercrime Investigation and Digital Forensics CSEC650

Contents Topic 1: Scenario ............................................................................................................................. 2

Scenario: Embezzlement Leads to E-Discovery .......................................................................... 2 Topic 2: Module Introduction ........................................................................................................... 4 Topic 3: Electronic Discovery .......................................................................................................... 5

The E-Discovery Process ............................................................................................................ 5 Forensic Techniques .................................................................................................................... 7 Forensic Toolkits .......................................................................................................................... 8 Which Toolkit Would You Use? ................................................................................................... 9 Felicia Favreau Versus SharKapital........................................................................................... 10

Topic 4: Admissibility of Digital Evidence ...................................................................................... 11 Conundrum in the Courtroom .................................................................................................... 11 Essential Concepts .................................................................................................................... 12 Obtaining a Search Warrant ...................................................................................................... 13 The Plain View Doctrine ............................................................................................................. 14 Activity: Legal Challenges to Admissibility ................................................................................. 15

Topic 5: Report Writing for Forensic Examiners ............................................................................ 17 Writing a Good Digital Forensic Report ..................................................................................... 17 Analyzing a Digital Forensic Report ........................................................................................... 18 Expert Witnesses and Their Credentials ................................................................................... 22

Topic 6: Legal Challenges ............................................................................................................. 24 Presenting Evidence and Testimony in Court ............................................................................ 24

Topic 7: Activity.............................................................................................................................. 26 Activity: Fraud Detector! ............................................................................................................. 26

Topic 8: Summary.......................................................................................................................... 29 Glossary ......................................................................................................................................... 30

UMUC Cybercrime Investigation and Digital Forensics CSEC650

Topic 1: Scenario

Scenario: Embezzlement Leads to E-Discovery

Digital Evidence Presentation CSEC650—Module 5

Embezzlement Leads to E-Discovery During the annual financial audit for brokerage giant SharKapital, the company's accounting firm discovered a large embezzlement scheme. This immediately placed SharKapital's management at the center of civil and criminal lawsuits. As blame shifts from the Chief Executive Officer (CEO) to the Board of Directors, the company's legal department launches an urgent investigation, or electronic discovery (e-discovery), process. This process is used to collect and present digital forensic evidence that can implicate the guilty and clear the innocent. Scenario The Case Headlines are breaking around the world as SharKapital's reputation comes under scrutiny. While most of their high-end clients are refusing to talk to the media, billionaire Felicia Favreau refuses to hide her contempt for the way she claims SharKapital has "mismanaged her funds." Wall Street Salutes Blair Overton Blair Overton, the CEO of SharKapital, has completed 20 years in the industry and is named this year's "Wall Street Czar." Wall Street's biggest and brightest fund managers salute this financial genius for his leadership skills and financial acumen, which transformed SharKapital from a small regional player into a global conglomerate. Overton's ability to negotiate the turbulent stock markets helped SharKapital stay afloat while his rivals drowned in chaos brought on by global competition and the economic downturn. Felicia Favreau Creates Her Peanut Empire "The Favreau family's climb out of poverty has been a rewarding experience," states Heiress Felicia Favreau, whose father sold used cars in Detroit just to keep food on the table. Then one summer, her father's luck turned around after he won the state lottery and started his own motor oil factory. His eldest daughter, Felicia, diversified their business by going into producing the world's finest peanut oil. "We survived on peanuts then, and now we live off them," laughs Favreau. Miss Favreau invests heavily through SharKapital and is greatly disappointed that all her money might now be lost to fraudulent management.

UMUC Cybercrime Investigation and Digital Forensics CSEC650

The Meeting A meeting is in progress at SharKapital Headquarters, New York City. In the meeting are the CIO, Stanley Fox, the CFO, Markus Bingham, and the Public Relations Manager, Linda Garnett. A transcript of their conversation is reproduced here. Stanley: Our CEO, Blair Overton, has been charged with embezzling $120 million over a 10-year period through a complex series of fraudulent electronic financial transactions. Markus: Overton borrowed the funds to finance his short-selling of premier stocks. We had no idea because he had our junior accountants on his payroll. I never saw these entries. Linda: That's the same Overton whom Wall Street experts called a "financial genius" last year? Obviously, this means a massive financial crisis for the company and the markets. Markus: Yes. Despite our years of success, it's clear we'll have to declare bankruptcy now. Stanley: While Overton will face criminal charges from the District Attorney's office, SharKapital's board is facing a civil lawsuit from one of our top clients—Felicia Favreau. Linda: Felicia has filed a negligence case against the board. I've asked our legal department to launch an e-discovery process immediately to obtain evidence of our innocence. Corporate Legal Department SharKapital's corporate legal department must begin the e-discovery process. E-discovery is an investigation that corporations or private organizations conduct to obtain digital forensic evidence in cases of insider trading, accounting fraud, or industrial espionage. It is mostly used for civil litigation and not for criminal cases. Law enforcement agencies are minimally involved, and corporate legal departments initiate and manage the e-discovery process by hiring private forensic investigators. Forensic Investigators SharKapital hires Richman and Stern, LLC, a medium-sized digital forensic investigation firm. This forensic firm will investigate the embezzlement scheme over the next four months by image-analyzing 200 or more computers and mobile devices.

After they locate the evidence, some of the forensic experts from Richman and Stern, LLC will be deposed and will serve as expert scientific witnesses. The experts will also prepare written forensic reports to present in court to validate the evidence they are presenting.

UMUC Cybercrime Investigation and Digital Forensics CSEC650

Topic 2: Module Introduction

Cybersecurity professionals working in the field of digital forensics are often required to present evidence at legal proceedings such as hearings, depositions, and trials. They may even be called as expert witnesses, so it is essential that they know how to write forensic reports and also how to prepare digital evidence for presentation in a courtroom. This module deals with the presentation of digital evidence in the event of litigation. There are two types of cases for which forensic experts are called to collect evidence: civil and criminal. This module discusses the e-discovery process, what it entails, and how it should be performed in a civil case. The module also covers the admissibility of evidence in criminal cases. It specifically looks at the steps, precautions, and procedures necessary to ensure that digital evidence can be given full consideration by a judge and jury. In addition, the module analyzes common legal methods that attorneys and judges can use to dismiss digital evidence or have it deemed inadmissible.

UMUC Cybercrime Investigation and Digital Forensics CSEC650

Topic 3: Electronic Discovery

The E-Discovery Process

Introduction As most business transactions and reports consist of Electronically Stored Information (ESI), e-discovery is commonly employed to collect evidence in civil litigation. When a civil case reaches the discovery phase, both parties launch an e-discovery process to gather and analyze digital evidence. Data stored on computers and mobile devices are acquired, examined, and analyzed. Reports are then compiled. Based on the relevance and value of the evidence acquired, legal teams determine the arguments they will present in court. The term "e-discovery" is traditionally used in civil litigation, while the term "computer forensic investigation" is used in criminal matters. However, the actual forensic processes are nearly identical in both types of investigation. Steps Step 1: Manage Data Companies are required to follow the Sarbanes-Oxley Act and Internal Revenue Service requirements for managing their financial and tax accounting data in digital and paper formats. Company data must be managed in an up-to-date inventory, and managers must know where the data are located: on-site, at corporate headquarters, or at an off- site storage location. For medium-sized and large companies, this is not a simple task because of the large volume of data they generate and retain. Step 2: Collect Data Investigators must determine which company resources they need to include in their investigation. For example, if a company's servers are attacked, which servers should be examined? Investigators must consult various personnel in the company who know how the data are stored and transferred. Often, the data being collected can amount to hundreds of gigabytes, even for a small case. If the organization manages its data efficiently, collecting the data will be simplified. Step 3: Process Data Records that are duplicated, outdated, or irrelevant to a case must be pointed out to management. Such records can then be destroyed through appropriate procedures to reduce the mass of data to the most relevant case-related information. Records important to the investigation must be forensically preserved. Investigators must consult with the IT department, which plays a critical role in this step of the e-discovery process. Step 4: Review Data The attorneys review the processed data to select evidence that will build and support their case in court. Evidence can include source documents, contracts, correspondence between parties, and balance sheets. This is a vital part of the investigation, and the quality of the data that were processed will have a direct impact on how the case develops. After e-discovery, the examiner must preserve the data in a secure manner in case it has to be retrieved and presented in court.

UMUC Cybercrime Investigation and Digital Forensics CSEC650

Step 5: Present Data Lawyers may refer to the Federal Rules of Civil Procedure as their primary legal guide and evolving case law as their secondary legal guide when presenting evidence in court. Forensic investigators can organize the evidence neatly and efficiently to help make the lawyers' arguments convincing and persuasive. Forensic investigators might also be asked to take the stand as expert witnesses. Lawyers and witnesses must adequately prepare for anything that might occur during the course of presenting digital files to a judge or jury in courtroom hearings. Activity Question: The world's largest fashion publication, F-Tonic, has discovered that several corporate spies are working at their subsidiary offices. F-Tonic's CEO believes these spies have been planted by their biggest rival, Radical Runway. However, before F-Tonic can fire these spies and take Radical Runway to court, it needs solid evidence. As part of the e-discovery process, F-Tonic's legal department and forensic consultants carry out these five tasks. Arrange the tasks in the correct sequence required to carry out an e-discovery investigation. a. Isolate the computers used by the spies. b. Testify in court about Radical Runway's espionage plan. c. Image the hard drives of the isolated computers. d. Identify the e-mails the spies sent to Radical Runway. e. Refer to the list of files located at the subsidiary offices. Correct Answer: The correct sequence of tasks is e, a, c, d, b. Feedback: F-Tonic's legal department and forensic consultants would carry out the five tasks in this order: refer to the list of files located at the subsidiary offices, isolate the computers used by the spies, image the hard drives of the isolated computers, identify the e-mails the spies sent to Radical Runway, and testify in court about Radical Runway's espionage plan.

UMUC Cybercrime Investigation and Digital Forensics CSEC650

Topic 3: Electronic Discovery

Forensic Techniques

When collecting data during the e-discovery process, a forensic examiner uses a wide range of techniques to extract all possible evidence that supports the investigation.

Searching Keywords With input from the client and the client's lawyers, the forensic examiner draws up a list of 50 to 300 keywords. For example, in the SharKapital case, the possible keywords could include the name of the CEO, as well as the names of the CEO's relatives, known business associates, and suspected co-conspirators. These keywords can be mapped to documents, e-mails, and instant messages.

Searching E-Mails After the forensic investigator obtains a suspected employee's password, he or she searches the suspect's computer for e-mails sent and received on particular dates. Through such a narrow but deep search, the examiner identifies the key people with whom the employee was communicating, such as co-conspirators and financial supporters. E-mail searches can also be used to identify critical dates of activities and appointments by acquiring calendar and contact information.

Recovering Deleted Files Most computer forensic tools can recover deleted files or fragments of deleted files. To use these tools effectively, the forensic examiner must understand how files are stored and deleted on a computer's hard drive. The File Allocation Table (FAT) is a good resource to check for files that may have been deleted. This tells the examiner whether the user erased critical evidence.

Viewing Slack Space Operating systems create space clusters on a hard drive in which files can be stored. Some files are smaller than the cluster size allocated to them, and as a result, there is unutilized or "slack" space in the cluster. Slack spaces often contain useful forensic artifacts, such as data fragments from files that have been deleted. Viewing slack space is another technique for obtaining deleted evidence.

Identifying Files User- or custodian-specific files include documents, spreadsheets, and presentation files that were created, accessed, or modified by a specific user, such as the party of interest in the case. By using forensic tools, the examiner can identify each file's owner or custodian name, as well as the modified, accessed, and created (MAC) timestamps.

UMUC Cybercrime Investigation and Digital Forensics CSEC650

Topic 3: Electronic Discovery

Forensic Toolkits

A forensic examiner can select forensic software appropriate for the techniques he or she is using. Often, forensic software is bundled up in toolkits to allow a forensic examiner to perform various functions while collecting evidence. While some forensic toolkits are little more than a collection of useful utilities, most toolkits are tightly integrated and have advanced user interfaces.

EnCase® Forensic EnCase® Forensic, by Guidance Software, is an industry-standard digital forensic tool. It captures data from a wide variety of digital machines such as servers, workstations, and mobile phones. This software uses an advanced search functionality to retrieve data from the disk level, generates reports, and preserves the integrity of the evidence in a court-approved format.

Forensic Toolkit® Forensic Toolkit® (FTK) is used by companies in the private sectors and by law enforcement and government agencies worldwide. It runs on Windows operating systems and is considered the industry standard in cracking and decrypting passwords from e-mails and chats. Created by AccessData, FTK also streamlines keyword searches to locate data accurately.

The Sleuth Kit The Sleuth Kit (TSK), developed by leading computer forensic researcher Brian Carrier, allows a forensic examiner to run a series of UNIX or Windows commands on a live hard drive to analyze it. By adding a Graphic User Interface (GUI) called Autopsy Forensic Browser to TSK, examiners can organize files in the system by date, type, and case. Examiners can also verify the integrity of any media images created for an investigation.

KazForensics Kazeon's KazForensics has a built-in chain of custody for Electronically Stored Information (ESI). This feature allows examiners to maintain the data integrity of documents and e-mails during a forensic examination. Its auditable workflow allows the transparent and accurate forensic process to be verified in a court of law.

UMUC Cybercrime Investigation and Digital Forensics CSEC650

Topic 3: Electronic Discovery

Which Toolkit Would You Use?

Question: As a forensic examiner, you need to examine a live computer that runs on a Linux platform. Which toolkit will be most useful in allowing you to search the computer's hard drive and organize files based on their type: JPEG, documents, and HTML? a. Forensic Toolkit b. The Sleuth Kit c. KazForensics d. EnCase® Forensic Correct Answer: Option b Feedback: The Sleuth Kit (TSK) allows forensic examiners to perform live searches on Linux-based systems and sorts files on the hard drive by type, date, or case.

UMUC Cybercrime Investigation and Digital Forensics CSEC650

Topic 3: Electronic Discovery

Felicia Favreau Versus SharKapital

The forensic teams employed by Felicia Favreau and SharKapital conducted their separate e-discovery processes. Felicia Favreau's digital forensics team did not work with the best evidence. As a result, they tampered with the original evidence. When they needed to recheck a particular deleted file, they were not able to return to the original evidence. SharKapital's digital forensic consultants did not use the best evidence. When they presented their testimony in court, there were discrepancies in the evidence they found and the conclusions they reached. As a result, the judge dismissed the evidence from both sides and declared a mistrial. The other fallout of Blair Overton's embezzlement is the criminal case between the State of New York v. Blair Overton.

UMUC Cybercrime Investigation and Digital Forensics CSEC650

Topic 4: Admissibility of Digital Evidence

Conundrum in the Courtroom

The SharKapital trial is in progress at the New York State Supreme Court. The District Attorney (DA) of New York State has filed criminal charges against SharKapital's CEO, Blair Overton. The prosecution and Overton's legal team have presented their evidence during the trial. The judge rules on the admissibility of evidence presented by both sides. Judge's Ruling The evidence presented by the DA was procured without a proper search warrant, and as a result cannot be considered by the jury in this case. Since the key evidence is found to be inadmissible, this court finds in favor of the defendant Blair Overton. Case dismissed. District Attorney, Craig Holton When our digital forensics team searched Mr. Overton's holiday home on Long Island, they discovered e-mails saved in encrypted folders on his home computer. There were several e-mails exchanged between Mr. Overton and SharKapital's clients, giving evidence of insider trading. However, all this evidence was considered inadmissible in court due to the fact that the search warrant was not obtained in the proper manner. Blair Overton's Lawyer We were not aware of any e-mails between Mr. Overton and SharKapital's clients, as the search warrant issued by the court allowed forensic teams to search only Mr. Blair Overton's Manhattan residence, not his home on Long Island. Therefore, we asked the judge to declare a mistrial due to incomplete evidence. Because the opposing counsel's team violated the search warrant, Blair Overton has escaped paying court costs to the State of New York and also avoided a jail sentence. Loopholes in the Evidence The first problem with the evidence was the fact that the key evidence was procured without a proper search warrant. Besides the key evidence's being found inadmissible, there were other problems with the criminal investigation. There was a significant difference between the total number of hard drives reported by the defendant's forensic team and the total number of hard drives listed by the New York Police Department's (NYPD). This discrepancy showed up on the chain-of-custody form attached to the best evidence. Though the forensic team claims they used reliable forensic tools to obtain evidence from all the devices they were asked to search, some of the tools gave a number of false positive results.

UMUC Cybercrime Investigation and Digital Forensics CSEC650

Topic 4: Admissibility of Digital Evidence

Essential Concepts

For computer forensic evidence to be accepted in a court of law, it must meet two criteria in equal measure: admissibility and sufficiency. Admissibility A judge deems a piece of evidence admissible if the evidence satisfies these conditions:

It is relevant to the case being tried.

It has been procured when in plain view or using a search warrant.

It has been preserved with an updated chain of custody. If the evidence cannot be considered by a judge or jury, then the investigator will have wasted time and effort in preparing it. Furthermore, a guilty or liable party might escape punishment if incriminating evidence is inadmissible. Sufficiency A judge or jury deems that a piece of evidence is sufficient if they find it to be believable and persuasive based on lawyers' arguments and expert witnesses' testimony. In short, they must decide whether the evidence is authentic, accurate, and complete. The evidence is authentic if it is demonstrated to have come from the claimed sources— for instance, the suspect's computer, smartphone, or server. The evidence is accurate if it tells a consistent story beyond a reasonable doubt. The evidence is complete if it tells only one story, and there are no other stories that the evidence could also tell that might have a bearing on this specific hearing. Checklist To ensure that the evidence they present is convincing and admissible, forensic investigators must do the following: 1. Use computer media that are considered sterile. This means that the media should

be new and free from malware. 2. Maintain the integrity of the original media. This ensures that the digital evidence is

an exact and forensically sound copy of the original evidence. 3. Correctly label, mark, and control all reports or printouts that are generated during

the course of the forensic examination. This is required especially if reports are sent to other parties, even if they are not included in the final forensic report.

UMUC Cybercrime Investigation and Digital Forensics CSEC650

Topic 4: Admissibility of Digital Evidence

Obtaining a Search Warrant

During Blair Overton v. State of New York, evidence located on the CEO's home computer was disregarded because it was not procured using a proper search warrant. Christina Polanski, Police Detective According to the Fourth Amendment to the U.S. Constitution, no citizen's person or property can be unreasonably searched or seized. However, if a citizen's person or property is considered possible evidence in a case, a law enforcement officer can request a search warrant. I asked Judge Zonuka for a search warrant that allows my team to search and seize Mr. Blair Overton's home computer at his Manhattan residence. A search warrant can be issued by a magistrate or judge only after he or she is convinced of three things: a high probability of a crime being committed; evidence related to the crime still exists; and the evidence most likely exists in the location that is to be searched. Phoebe Zonuka, Civil Court Judge I agree that Blair Overton is a reasonable suspect in this case and that he might have committed a crime. I'm issuing a search warrant that allows the police to search his Manhattan residence for specific files and folders related to financial transactions. Once a search warrant is granted, law enforcement agents are permitted to search all places specified in the search warrant, such as an individual's house, apartment, office, vehicle, storage shed, or person. Mark Shapiro, Police Officer Despite carrying a search warrant, the evidence I procured was considered flawed. There were two main reasons: 1. There was a flaw in how the search warrant was executed. 2. The evidence obtained was not clearly specified in the search warrant. Once during an investigation, I obtained evidence from a location that was not specified in the search warrant, so the evidence was inadmissible. Another time, I had specifically named the type of computer system that could be seized in the search warrant. However, I seized a different computer, and the judge would not admit it as evidence.

UMUC Cybercrime Investigation and Digital Forensics CSEC650

Topic 4: Admissibility of Digital Evidence

The Plain View Doctrine

There is an exemption to the rules and restrictions relating to search warrants, known as the plain view doctrine. As it stands today, officers are allowed to seize information that might be related to the investigation if it is in plain view. When this situation occurs, particular care must be taken to document all aspects of the seizure properly. Otherwise, there is a risk that months or years later, a judge will decide that the evidence is inadmissible. Plain view is a restricted but controversial doctrine.

UMUC Cybercrime Investigation and Digital Forensics CSEC650

Topic 4: Admissibility of Digital Evidence

Activity: Legal Challenges to Admissibility

After losing the Blair Overton case, the lawyers in the DA's office have decided to take a refresher course on the Fourth Amendment. Step 1 The district attorney's office is prosecuting 19-year-old Tamara on a single charge of identity theft because she allegedly stole her college roommate's identity to obtain a credit card. Tamara also has a previous conviction for driving under the influence of alcohol. Question: Should the judge consider Tamara's DUI conviction as admissible evidence in this case? a. The judge should not consider Tamara's DUI conviction as evidence. However, the

judge may permit the DA to include it in opening and closing remarks because it relates to the legal concept of recidivism.

b. The judge should pay attention to Tamara's DUI conviction because it attests to her character. Prior criminal convictions are important when judging a defendant.

Correct Answer: Option a Feedback: A defendant's prior criminal history is relevant only if it relates directly to the current charges. Step 2 In a case involving drug trafficking, various witnesses have been summoned to court to testify against the accused party. A key witness for the prosecution tells the court that her teenage daughter told her that she had bought crystal methamphetamine from the defendant on three different occasions. The defense counsel asks the judge to dismiss this statement from the court's record, but the judge allows the jury to consider this testimony. Question: Do you think the judge should admit this testimony? a. This testimony should be regarded as inadmissible because it is hearsay and does

not represent direct evidence in the case against the defendant. b. The judge has the authority to admit hearsay as evidence if he or she believes that it

is reliable. Correct Answer: Option b Feedback: Testimony from a reliable source that sheds light on the case can be admitted for jury consideration as testimony given under oath.

UMUC Cybercrime Investigation and Digital Forensics CSEC650

Step 3 The prosecution presents expert testimony from a recognized digital forensic examiner about a key piece of evidence, but misplaces the chain-of-custody form attached to the evidence. Question: Should the judge consider the testimony admissible? a. If scientific testimony is given by a recognized forensic expert, then the absence of a

chain-of-custody form will not diminish the admissibility or weight of the evidence. b. Information on the chain-of-custody form is critical to proving that the evidence is

authentic, accurate, and complete. Testimony is not a substitute for properly managed evidence.

Correct Answer: Option b Feedback: Without a supporting chain-of-custody form, the admissibility and weight of the evidence and testimony can be considered suspect and therefore inadmissible. Step 4 While writing a speeding ticket, a highway patrol officer overhears the driver confirming a drug delivery on his cell phone. The officer orders the defendant to drop the cell phone outside the car and then scrolls through the phone's text messages, where the officer finds information on many drug deals. Question: Should the judge consider the evidence found in the cell phone admissible in court? a. Yes, the judge should consider the evidence found in the cell phone admissible in

court because the officer had every right to overhear the driver's phone conversation, seize the cell phone in plain view, and view the text messages if he felt the driver was committing a felony.

b. No, the judge should not consider the evidence found in the cell phone admissible in court. The officer had no right to view the text messages or search the cell phone of a private citizen without a search warrant.

Reference: Supreme Court of Wisconsin. 2010. State of Wisconsin v. Carroll. Supreme Court of Wisconsin. Retrieved from http://www.wicourts.gov/sc/opinion/DisplayDocument.pdf?content=pdf&seqNo=46694

Correct Answer: Option b Feedback: After listening to the driver's conversation in plain view, the officer was justified in seizing the cell phone. However, the officer was not justified in viewing the text messages without a search warrant. Therefore, the judge should dismiss the evidence found in the cell phone.

UMUC Cybercrime Investigation and Digital Forensics CSEC650

Topic 5: Report Writing for Forensic Examiners

Writing a Good Digital Forensic Report

The final products that a forensic examiner presents in court include a formal written report and, if required, his or her expert forensic testimony. This written report is one of the key factors that a judge will use to evaluate the admissibility of the evidence. A high-quality digital forensic report should do these things: 1. Prove that the chain of custody was followed 2. Contain no prejudice or bias 3. Identify the underlying assumptions clearly 4. End with a concise conclusion based on the examiner's findings 5. Include necessary exhibits, appendices, and related information 6. Display good report-writing skills

UMUC Cybercrime Investigation and Digital Forensics CSEC650

Topic 5: Report Writing for Forensic Examiners

Analyzing a Digital Forensic Report

Introduction Here is a digital forensic report prepared by forensic investigator and law enforcement officer Brad Garnett. The report presents Garnett's analysis of a stolen laptop. Read and review the report, and then answer the questions in the Workspace tab. Reference: Adapted from Garnett, B. (2010, August 25). Intro to Report Writing for Digital Forensics. The

SANS™ Institute. Retrieved from http://computer-forensics.sans.org/blog/2010/08/25/intro-report-writing-

digital-forensics

Digital Forensics Report Overview/Case Summary On September 5, 2011, John Doe contacted my office in regards to imaging a stolen laptop computer running Windows® XP Professional that had been recovered. Doe is requesting a forensic examination to see what company documents may have been stolen by the suspect(s) and is requesting a full forensic examination and report for possible criminal charges & civil litigation. Forensic Acquisition and Exam Preparation 1. On September 7, 2011, I began the forensic acquisition/imaging process of the

stolen laptop. Prior to imaging the stolen laptop, I photographed the laptop, documenting any identifiers—such as, make, model, and serial number, unique markings, or visible damage while maintaining Chain of Custody.

2. Using a sterile storage media (examination medium) that had been previously forensically wiped and verified by this examiner (MD5 hash value: ed6be165b631918f3cca01eccad378dd) using the FTK tool version 4.0. The MD5 hash value for the examination medium yielded the same MD5 hash value as the previous forensic wipes to sterilize this media.

3. At this point, I removed the hard drive from the stolen laptop and connected it to my hardware write-blocker, which is running the most recent firmware and has been verified by this examiner. After connecting the hardware write blocker to the suspect's hard drive, I connected the hardware write-blocker via USB 2.0 to my forensic examination machine to begin the forensic imaging process.

Findings and Report (Forensic Analysis) 1. After completing the forensic acquisition of the stolen laptop, I began analyzing the

forensic image of the stolen laptop with forensic tools.

2. I used the following tools for forensic analysis, which are licensed to this examiner:

Guidance® Software's EnCase® 8.1

SANS Investigative Forensic Toolkit (SIFT) Version 2.0

Internet Evidence Finder v3.3

RegRipper by Harlan Carvey

Microsoft Excel 2007

UMUC Cybercrime Investigation and Digital Forensics CSEC650

3. A review of the Internet history using Internet Evidence Finder, the following data was recovered from sector 117004, which shows a Facebook email between John Doe and Jane Doe. Further analysis shows that a John Doe logged into his Google Mail account.

4. I found two clear sets of fingerprints on the laptop and sent them to the police detectives so that they could identify a match for both prints.

Workspace Question 01: Report Excerpt Using a sterile storage media (examination medium) that had been previously forensically wiped and verified by this examiner (MD5 hash value: ed6be165b631918f3cca01eccad378dd) using the FTK tool version 4.0. The MD5 hash value for the examination medium yielded the same MD5 hash value as previous forensic wipes to sterilize this media. Read this excerpt from the report. Does it clearly identify and detail the assumptions of the case? a. No, this excerpt deals with the gathering of evidence. b. No, this excerpt deals with the forensic analysis. c. Yes, this excerpt gives the reader a clear understanding of the assumptions. d. Yes, this is a well-prepared set of assumptions in the case.

Correct Answer: Option b Feedback: This excerpt is part of the forensic analysis section of the report and does not have anything to do with the identified and detailed assumptions of the case. The assumptions of the case are located in the report's overview. Question 02: Report Excerpt On September 5, 2011, John Doe contacted my office in regards to imaging a stolen laptop computer running Windows® XP Professional that had been recovered. Doe is requesting a forensic examination to see what company documents may have been stolen by the suspect(s) and is requesting a full forensic examination and report for possible criminal charges and civil litigation. Does this excerpt sufficiently introduce the case investigated in this report? a. Yes, it is sufficiently detailed. b. Yes, but it could use more details. c. No, it is more of a conclusion than an introduction. d. No, it is not clearly written. Correct Answer: Option b Feedback: Additional details—such the type of content stored on the laptop or the date of the theft—would help the reader of this report get a clearer picture of the case more quickly.

UMUC Cybercrime Investigation and Digital Forensics CSEC650

Question 03: Report Excerpt I used the following tools for forensic analysis, which are licensed to this examiner:

Guidance® Software's EnCase® 8.1

SANS Investigative Forensic Toolkit (SIFT) Version 2.0

Internet Evidence Finder v3.3

RegRipper by Harlan Carvey

Microsoft Excel 2007 How do you think this component of the report could be enhanced? a. By identifying the computer on which these software tools were installed b. By including additional details about what each tool was used for c. By performing both the above tasks d. None of the above; the report is fine as is Correct Answer: Option c Feedback: The reader of this report would benefit from knowing which computer was used and what each tool was used for. Question 04: Report Excerpt A review of the Internet browsing history using Internet Evidence Finder allowed the following data to be recovered from sector 117004. The data show a Facebook email between John Doe and Jane Doe. Further analysis shows that a John Doe logged into his Google Mail account. What information could be added to this section of the report? a. An executive summary b. Information about the forensic examiner c. A more detailed description of what sector 117004 is d. A glossary of terms Correct Answer: Option c Feedback: A more detailed description of the sector from which data were acquired should be included in every forensic examiner's report. However, more information is needed, as there could be multiple hard drives or partitions on the computer.

UMUC Cybercrime Investigation and Digital Forensics CSEC650

Question 05: Report Excerpt After completing the forensic acquisition of the stolen laptop, I began analyzing the forensic image of the stolen laptop with forensic tools. Which section of the report is necessary to substantiate the examiner's findings? a. Forensic Analysis b. Introduction c. Supporting Exhibits d. Findings Correct Answer: Option a Feedback for the Correct Answer: The forensic analysis section is considered by the examiner as the basis of his or her evidence and would be viewed by a judge and/or jury as the most persuasive section of the report. Feedback for the Incorrect Answer: While supporting exhibits are an important part of the report they help substantiate and detail the forensic analysis section which is the most important section of the report to substantiate the forensic examiner's findings. Review While using the laptop, the suspect managed to delete a number of files related to a project that John Doe was working on. Based on the forensic procedures performed and results of those procedures, this examiner finds that Jane Doe was a hacker who befriended the victim through a social networking site and launched a cross-site scripting (XSS) attack to learn the victim's login and password credentials. It can be reasonably assumed that Jane Doe stole the confidential data from John Doe's laptop. Thoroughness is extremely important because any indication of bias is likely to cause issues during legal proceedings. Therefore, it is essential to be thorough and objective when conducting a forensic investigation. Further Challenges While creating a digital forensic report for a recovered stolen laptop, consider these additional questions:

What other forensic tools could you use for better and faster results?

What other evidence should you look for that will directly or indirectly lead you to identifying the suspect?

Would you carry out any additional forensic analysis steps that are not mentioned in the report?

UMUC Cybercrime Investigation and Digital Forensics CSEC650

Topic 6: Legal Challenges

Expert Witnesses and Their Credentials

Often, forensic examiners are hired as expert witnesses to provide scientific testimony in court. Expert Witnesses In most cases, lawyers for the plaintiff and the defendant are in charge of hiring the different expert witnesses to supplement their legal arguments. A transcript between two lawyers is given below. Lawyer 1: I have a new client, Code-C, who is suing hacker, Joel Michika, for breaking into their new gaming portal's database. Lawyer 1: I'm just going into the conference room to interview expert witnesses who can testify on our behalf. Lawyer 2: Choose carefully, as these witnesses will cost you around $500 an hour. Witness Qualifications Not everyone has the qualifications, expertise, or experience to be deemed an expert witness by the judge. Expert witnesses are expected to have exceptional technical knowledge and expertise that will help the judge and jury make their decisions. Courts recognize expert witnesses based on these criteria: 1. Years of relevant industry work experience 2. Professional qualifications 3. Academic qualifications such as a Ph.D. or other advanced degree 4. Research experience 5. Ability to provide unbiased opinions Daubert Guidelines The Daubert guidelines were established as a result of the landmark 1993 case Daubert v. Merrell Dow Pharmaceuticals, Inc., to determine the legality of scientific testimony admitted into U.S. courts. These guidelines question the subject of the evidence, the techniques used to extract the evidence, and the view of peers in the scientific community. A judge has the power to dismiss expert scientific testimony if it does not meet the Daubert guidelines.

UMUC Cybercrime Investigation and Digital Forensics CSEC650

Witness Selection Here are three potential expert witnesses who can help Code-C's Legal Department present a strong case. Which of the following expert witnesses would be the best choice to join Code-C's legal team in suing the accused hacker? a. Expert Witness 1: Sofia Vantim

I have 10 years of experience with the U.S. Secret Service's Electronic Crimes Division. I graduated with a bachelor's degree in computer science and a master's degree in cybersecurity. At present, I own a digital forensic consulting firm.

b. Expert Witness 2: Azim Kuber I have seven years of work experience in a large digital forensic firm, and have served as an expert witness for Washington, D.C., law firms on eight cases involving digital evidence. I have a Ph.D. in forensic science and am currently teaching digital forensic research at Tech University.

c. Expert Witness 3: Denise Dokomo I don't have a professional degree in forensics, but I do have 22 years of government and private-sector experience in digital forensics. Though I am currently retired, I am a certified computer examiner.

Correct Answers: Options a and b Feedback: Sofia has extensive work experience and good academic credentials, and she is currently active in the industry. Azim has considerable work experience, excellent academic credentials, significant expert witness experience, and a current research- oriented academic position in digital forensics. While Denise has extensive work experience, her lack of academic credentials and current practitioner experience might be perceived as weaknesses in her overall expert witness profile.

UMUC Cybercrime Investigation and Digital Forensics CSEC650

Topic 6: Legal Challenges

Presenting Evidence and Testimony in Court

Besides meeting admissibility criteria, evidence gathered through the e-discovery process must also follow the Federal Rules of Civil Procedure. These rules were amended in 2006 to include electronic evidence, and they require all parties to pay attention to ESI handling procedures early on or face penalties. Forensic examiners, too, must maintain detailed and accurate documentation as well as Chain of Custody during the collection process. Otherwise, the review and presentation of evidence will be flawed and inadmissible. The steps of the e-discovery process below will help you understand how a forensic examiner prepares documentation at each step. Manage Data This includes organizational policies and technical capabilities about:

Record retention

Safeguarding information

Data back-ups

Data security

Contractual relationships with third parties Collect Data While collecting data, the forensic examiner notes the off-site locations where data are stored and backed up, and finds out how remote users access this data. The examiner should maintain this information:

The initial written request made for obtaining the remote evidence

Copies of all search authorizations granted by competent authorities

The Chain of Custody for each piece of evidence

Details on the steps taken to recover all evidence, image it, and analyze it Process Data While processing data, the forensic examiner can follow these best practices:

Include relevant additional information, such as the network architecture, the list of users of the systems, relevant data retention policies, and agreements signed by the users.

Describe the operating system, its version, and current patches and security updates installed on it.

List changes made to the network architecture or the system configurations.

Describe any issues faced during the examination, as well as actions taken to overcome the issues.

UMUC Cybercrime Investigation and Digital Forensics CSEC650

Review Data This includes technical measures about having the right tools to review information about:

Access to data on a need to know basis

Correct access rights for individual users

Proper configuration of IT systems

Thorough enterprise wide security plan Present Data Before presenting data in court, the forensic examiner can take notes when consulting with the case law enforcement officer or with counsel. In the notes, the examiner should include dates, times, descriptions, and results of actions taken, which will eventually be a part of the examiner's final written forensic report.

UMUC Cybercrime Investigation and Digital Forensics CSEC650

Topic 7: Activity

Activity: Fraud Detector!

It's time to play Fraud Detector! Fraud Detector is a game in which you are a forensic examiner investigating a case of financial fraud. Read the case, and then answer the nine questions in any order. The questions will test your understanding of the e-discovery process and the concept of admissibility. At the end of the game, you will receive a score. So start thinking like a forensic examiner, and make sure your answers are spot-on! The Case Bianca Brown, a sales manager for a publishing house, teamed up with an executive in the company's Purchasing Department and opened fictitious vendor accounts. Together, they purchased imaginary items and paid the fictitious vendors over a period of six months. When the company was audited, a loss of $425,000 was reported. The company's legal counsel has retained your services to conduct an e-discovery investigation and find evidence to support the civil case against Bianca and her associate. Question 1: E-Discovery Step 2 In Step 2 of the e-discovery process, which of these tasks will be your focus? a. Processing data b. Collecting data c. Managing data d. Reviewing data Correct Answer: Option b Feedback: As a forensic investigator, you will need to work with legal counsel to understand the organization's data retention policy and make a list of the types of data you will need to investigate this case. Question 2: Financial Fraud In a financial fraud investigation, what type of records will you collect? a. Personnel timesheets b. Employee résumés c. Balance sheets d. Marketing material Correct Answers: Option a and c Feedback: Personal timesheets might be useful in a financial fraud where employees are over reporting their hours worked or doing an evaluation of overtime pay. Balance sheet

UMUC Cybercrime Investigation and Digital Forensics CSEC650

information is at the core of financial frauds because many of these types of investigations involve the accurate reporting of accounting information. Question 3: Collect Data To collect the data you need, what information should you ask for? a. Location of information system files b. What files are stored off-site c. Mechanism for transferring files off-site d. Location of legal documents Correct Answers: Options a and b Feedback: Knowing the location of all information system files and what digital data are stored off- site should be your primary focus in a digital forensic investigation. Question 4: E-Discovery Step 3 In Step 3 of the e-discovery process, which of these tasks will be your focus? a. Processing data b. Collecting data c. Managing data d. Reviewing data Correct Answer: Option a Feedback: Processing data is Step 3 of the e-discovery process. This includes using deadbox or livebox tools to analyze and examine all relevant digital devices. Question 5: Process Data While processing data, which of these tasks should you perform? a. Image important digital artifacts b. Destroy unrelated paper documents c. Collect digital files from multiple devices d. Interview the main suspect Correct Answers: Options a and c Feedback: First, you should collect digital files from relevant devices. Then you will need to immediately create an image of all the evidence you want to examine. It is unethical for a forensic investigator to destroy data. It is usually the law enforcement officers who interview suspects. Question 6: E-Discovery Step 5 In Step 5 of the e-discovery process, which of these tasks will be your focus? a. Processing data b. Collecting data c. Presenting data d. Reviewing data

UMUC Cybercrime Investigation and Digital Forensics CSEC650

Correct Answer: Option c Feedback: At the end of the e-discovery process, you will present your final written forensic report. Question 7: Admissibility On what legal basis can a judge question the admissibility of evidence? a. Defendant's prior record b. Expertise of the witness c. Relevance to the case d. Evidence procurement procedures Correct Answers: Options b, c, and d Feedback: The expertise of the witness, the relevance of the evidence, and the procedures used to obtain the evidence are all factors that determine admissibility. The defendant's prior criminal record cannot be used to taint the evidence presented in a new case. Question 8: Courtroom Besides the final forensic report, what else might you be expected to present in the courtroom? a. The complete evidence b. Courtroom testimony c. Chain of Custody d. Analytical tools Correct Answers: Options b and c Feedback: You may be called upon by counsel to give expert scientific testimony in court. You must present the best evidence, not the complete evidence, updated with a Chain of Custody form to support your testimony. The analytical tools you use will stay in the laboratory and are not required in the courtroom. Question 9: Admissibility Criteria Which of these criteria determine whether evidence presented in court is admissible in a criminal case? a. Relevancy b. Accuracy c. Authenticity d. Completeness Correct Answers: Options a, b, c, and d Feedback: For evidence to be admissible, it should be relevant to the case, authentic, accurate, and complete. Additionally, it should be procured when in plain view or under a search warrant.

UMUC Cybercrime Investigation and Digital Forensics CSEC650

Topic 8: Summary

We have come to the end of Module 5. The key concepts covered in this module are listed below.

Civil cases are investigated using an e-discovery process that has five steps: manage, collect, process, review, and present data.

Digital forensic examiners must proceed carefully through each step of e- discovery, and at the end, they must present a formal written forensic report in legal proceedings, such as hearings, depositions, and trials.

Additionally, digital examiners may be called as expert witnesses, so it is essential that they understand how to prepare digital evidence for presentation in a courtroom.

Evidence must meet the criteria of admissibility and weight. Admissibility means that the evidence is relevant, authentic, accurate, and complete. It also means that the evidence was procured legally, either when in plain view or under a search warrant.

UMUC Cybercrime Investigation and Digital Forensics CSEC650

Glossary

Term Definition

Admissibility Admissibility is a legal standard applied to all evidence presented in a court of law. For evidence to be considered admissible, it must be relevant, authentic, accurate, and complete. It must also be procured either when in plain view or under a search warrant.

Chain-of-Custody Form

A chain-of-custody form shows how any kind of evidence has been captured, analyzed, tracked, and protected on its way to a court of law.

E-Discovery E-discovery, or electronic discovery, is a process of investigation used to locate and analyze evidence in a civil case. The process has five steps that include managing, collecting, processing, reviewing, and presenting data.

Electronically Stored Information

Electronically Stored Information (ESI) is a term used for any information that is stored in an electronic format.

Exculpatory Evidence Evidence is considered exculpatory if it legally exonerates a defendant of alleged criminal activities.

Federal Rules of Civil Procedure

The Federal Rules of Civil Procedure (FRCP) stipulate what evidence can be accessed and how it must be presented in a federal district court for all civil litigation. For instance, FRCP 37 allows judges to dismiss evidence not backed by a warrant.

File Allocation Table The File Allocation Table (FAT) is a tracking mechanism that runs on the hard disk of a Windows operating system. It is used to describe the various locations of a file on the hard disk.

Forensic Toolkit Forensic Toolkit (FTK) is a deadbox forensic tool created by AccessData that is used by government agencies to decrypt passwords.

Hash Value A hash value is derived by using a hash algorithm to compare electronic files and filter out duplicates. For instance, the MD5 hash value, which has a 16-bit value, is used to check data integrity.

Inculpatory Evidence Evidence is considered inculpatory if it legally proves that an alleged guilty party has committed the crime in question.

KazForensics KazForensics is a forensic toolkit that is used to fingerprint ESI documents, audit ESI systems, and validate ESI evidence through a Chain of Custody.

Plain View Plain view is a legal doctrine that allows an officer of the law to search and seize a person or evidence, without a warrant, if the officer is rightfully in a position to observe criminal activity.

Recidivism Recidivism is the tendency of convicted criminals to repeat their criminal behavior.

UMUC Cybercrime Investigation and Digital Forensics CSEC650

Term Definition

Slack Space Slack spaces are empty spaces on a hard drive cluster. These spaces often contain useful forensic artifacts such as data from files that have been deleted.

System Hive The Windows XP startup registry is divided into multiple system hives that store registry data such as security and software loaded on the computer.

The Sleuth Kit The Sleuth Kit (TSK) is an open source digital forensic tool developed by leading computer forensic researcher Brian Carrier. It allows a forensic examiner to run a series of UNIX commands to analyze a hard drive or other computer media.