(13) Cloud, Container, and Virtual Forensics Flashcards
How do Cloud and other virtual forensics differ from other types of investigations?
Compared to other types of investigations, with cloud providers, contracts with providers need to be taken into question.
In addition, legal recourse with the vendor needs to be considered.
The data that the company needs and if it is available through methods that you or your organization has control of.
The vendor will need to be worked with if the data is not in company control
Describe the procedural differences in virtual forensics vs traditional
With virtual forensics, it is less complex because virtual machines can be copied over to the forensics environment without the need for physical cataloguing of computer components, etc.
Also consider how to respond if the virtualization platform itself is being attacked.
Also remember to think about the separation of virtual machines in the virtualized environment compared to the apps running under the containerization engine
What considerations need to be made when it comes to containerized technology in terms of filesystems and internal lots?
In terms of internal lots and filesystem artifacts, they are temporary for the most part. They communicate over software defined networks that change all the time.
They take brought online, taken offline, moved, security settings change, etc.
The data that is to be captured needs to be carefully considered as well as the methods to capture said data.
What are the first three steps of Forensics procedures?
The first three steps are
- Decide what it is you are trying to find out
- Outline where on the system that the types of data that would help someone answer questions from the step discussed above.
- Document the plan and go over it again
What are the remaining 4 steps of Forensics procedures?
- Get the evidence and preserve it.
- Analyze the data and document everything you do, what you discover and questions that you need to answer
- Use the original analysis to further guide where you go forward, review where the original analysis leads, and look for the answers to any questions you have formed
- Report what you found to the powers that be
What is the order of volatility?
The order of volatility is as follows:
- CPU cache, registers, RAM
- Traffic on the network
- Disk Drives
- Backups, optical media and printouts
What do you need to do if you discover something outside the scope of the investigation?
You need to report it to the proper authorities whatever it is, be it something illegal down to violating a minor company policy
How does a legal hold typically happen?
A legal hold typically happens when the orgs lawyers get notice from another company’s lawyers.
It could identify specific information or simply provide info about the litigation involving names, dates, or other details that can help identify which data to preserve.
If data is requested that the company typically is about to destroy, then IT needs to have procedures in place to preserve that data
Describe data integrity during an investigation
During an investigation, data integrity is very important. Forensic duplication cannot change the source drive or device, so write blockers need to be used.
Multiple copies of data need to be kept as well and the original drive needs to be retained as evidence
What Linux Utility is commonly used to clone drives?
The Linux dd utility is often used. It clones a drive in RAW Format, a bit by bit format, it provides a number of useful operators that will help make sure thart imagine is done quickly and correctly
How is block size set in dd?
In dd, block size is set with the bs flag and is defined in bytes. dd uses a 512 byte block size, which is smaller than the block size of most modern disks. Use larger block sizes using commands such as bs = 64k
What does the if operator do in dd?
The if operator sets the input file
What does the of operator do in dd?
The of operator sets the output file
What is very critical to remember with dd?
With dd, it is critical to remember to verify the input and output locations for the dd command, this is where write blockers can save the day!
Describe the criticality of the chain of custody process?
Chain of custody cannot be overstated, you must have a full record of what happened with data, when it occurred, when devices were transferred, handled, accessed, etc.
A third party may need to be in the room to validate the claims made
