16-1 Flashcards
the electronic evidence as evidence that can be collected the electronic form of a criminal defense was determined by what council/convention
The council of Europe convention on cybercrime also called the Budapest convention on cybercrime or simple the Budapest convention
The EU has 5 principles that establish a basis fo all dealings with electronic evidence
data integrity audit trail specialist support appropriate training legality
Written by Scientific Working Group on Digital Evidence (SWEDGE) the Model Standard Operation Procedures for Computer Forensics state there are 4 steps of examination
Visual inspection
forensics duplication
media examination
evidence return
The purpose of the __________ is just to verify the type of evidence, its condition, and relevant info to conduct the ecamination.
visual inspection
the process of duplicating the media before examination
forensics duplication
the actual forensics testing of the application
media examination
exhibits are returned to the appropriate location
evidence returemn
US Secret Service Forensics Guidelines
Secure scene
preserve evidence
determine if you can seize equipment
avoid accessing files. If off Leave off
if on, do not search computer
if the PC is destroying evidence, then turn off
determine if special legal considerations apply
one of the most important guidelines is to ___________ the computer as little as possible
touch
you can make a forensic copy such as
access datas forensics toolkit
guidance software encase, PassMark software forensics
or with free tools on linux
with the FBI the first repsonder preserves the state of the the computer at the time if the incident by making a backup copy of any
logs
damaged / altered files
files left by the intruder
make sure to document specific losses suffered due to the attack to include
labor cost spent in response
cost of lost equipment
value of data stolen
lost revenue
computer evidence can include
logs portable storage devices emails storage capable devices cell phones
tools used to retrieve and review the index.dat file
index. dat file
index. dat viewer
index. dat analyzer
you have to turn logging on or other will be nothing in the following logs
security application system forward events application and services
