4.5 Digital Forensics

Question 1

Define legal hold

Answer 1

A legal notice requiring preservation of specific data until a specific date or until notified that it is no longer required

Question 2

Admissibility of digital evidence

Answer 2

All digital evidence must be collected and secured against tampering per local laws to ensure it can be used in court proceedings

Question 3

Chain of custody

Answer 3

Documentation including any access to the data and what was done after it was collected to ensure that it has not be altered

Question 4

For chain of custody, how can one ensure that the data has not been altered?

Answer 4

By using hashing

Question 5

Time stamps

Answer 5

It is important to know what time zone was used by the system for file data. For example, FAT file system used local time zone set on device and NTFS uses GMT

Question 6

Time offsets

Answer 6

Sometimes there are time offset settings for different things that are configured in the OS. One must check this to know what different time stamps really mean

Question 7

How is order of volatility relevant to digital data collection for forensics?

Answer 7

Data may not be preserved very long, depending on the component it is stored by. So data collection must start with the most volatile data.

Question 8

Order of Volatility (4)

Answer 8

1. CPU - registers, cache
2. Router tables, ARP cache, process tables, and anything stored in system memory
3. Temporary files
4. Hard drives, configuration data

Question 9

How to preserve disk data?

Answer 9

Must make a bit-for-bit exact copy of the drive that is write-protected

Question 10

How to preserve memory data?

Answer 10

Use a third-party tool that provide a memory dump to more permanent storage

Question 11

How to preserve swap/page file

Answer 11

Swap/page files are created to add virtual memory that is actually stored on disk and must be included when doing the memory dump

Question 12

OS information that must be preserved but will be lost when generating an image of the drive (4)

Answer 12

1. Logged-in users
2. Open ports
3. Running processes
4. Any attached devices

Question 13

Preserving data from mobile devices

Answer 13

Can connect via USB to create an image of the device

Question 14

Firmware data for forensics

Answer 14

Accessing the firmware of a device can indicate if it was compromised and allowed an attack

Question 15

How is VM data preserved?

Answer 15

Snapshot

Question 16

Define cache relative to forensics (3)

Answer 16

1. Many applications & components store temporary data in a cache
2. May be very volatile or not volatile
3. Must be sure to preserve any cache information

Question 17

Define network data gathering for forensics

Answer 17

Various network data can be gathered from devices, such as connections and packet captures, depending on the type of device

Question 18

Define artifacts relative to forensics

Answer 18

Artifacts are bits and pieces of data in miscellaneous places

Question 19

How does use of cloud-based services complicate gathering forensic data? (3)

Answer 19

1. Don’t have physical access to or possession of the data
2. Rules and regulations may be different from your local rules & regulations depending on where the data is actually stored
3. Access to this might be denied if it is stored in a different country

Question 20

Define right to audit clause and its importance

Answer 20

When initiating relationship with cloud service provider, the terms and conditions of allowing access to audit the data should be defined prior to utilizing the service

Question 21

Define relevance of data breach notification laws

Answer 21

Depending on where data is stored, or the locale of the people who provided it, data breach notification laws/requirements may be very different

Question 22

Define relevance of checksums in forensics

Answer 22

A way to verify data transmitted via network wasn’t altered during transmission. Not designed to replace hashing, but offers a simple integrity check

Question 23

Define provenance

Answer 23

The original source of the data

Question 24

Considerations for preservation of data (3)

Answer 24

1. Must be an exact copy of the data
2. Powering off a system could destroy some data
3. If drive is encrypted, it must be accessed from the live system and not removed

Question 25

Define e-Discovery

Answer 25

Gathering (not analyzing or altering) information requested by authorities and providing it to them

Question 26

Define data recovery

Answer 26

Recovering data that was deleted or from a physically damaged storage device

Question 27

2 ways to provide non-repudiation relative to forensics

Answer 27

1. MAC - message authentication code that is privately known by communicating parties
2. Digital signatures

Question 28

Define strategic intelligence

Answer 28

Gathering information about a specific target with specific goal in mind

Question 29

Define strategic counter-intelligence

Answer 29

Gathering information about a source performing strategic intelligence on you