9 - 4: Forensic Techniques Flashcards
Four main types of investigations
1) Operational/Administrative 2) Criminal Investigations 3) Civil Investigations 4) Regulatory
Operational investigations
Investigate issues in technology services/performance
Criminal investigations
Intended to investigate criminal activity
Civil investigations
Non-criminal legal offenses involving a dispute between two parties
Regulatory investigations
Carried out by government or other regulatory bodies
Interrogations
When an interview subject withdraws consent, is only for law enforcement
Types of evidence
1) Real evidence 2) Documentary evidence 3) Testimonial evidence
Real evidence
Tangible items
Documentary evidence
Information in written or digital form, including logs
Documentary evidence rules
1) must be authenticated, attested to its legitimacy 2) best evidence 3) parole evidence
Best evidence rule
Original documents are always superior
Parole evidence rule
The court assumes a written agreement between to parties to be the only agreement and no verbal agreement is legally binding
Testimonial evidence
A statement written or said under oath
Direct evidence
Witness recounts what they observed
Testimonial evidence types
1) Direct evidence 2) Expert Opinion
Expert opinion
The court recognizes an authority in a field to interpret information
Hearsay
Evidence based on what one person told another, not admissible
Goal of digital forensics
Collect, preserve, analyze, and interpret digital evidence
Volatility
The permanence or likelihood to change a piece of evidence has
Order of volatility
1) Network traffic 2) Memory Contents 3) System and process data 4) Files 5) Logs 6) Archived Records
Time offsets
Difference in timestamps between data evidence
First rule of investigation
NEVER alter data captured
Forensic file reading
1) Create an image of the physical media 2) use a write-blocker/forensic disk controller to prevent any data editing or creation
Tamper-proofing
Sealed bags for physical media, hashing for digital
File carving
Technique for combing through unallocated disk space to find deleted files
Bulk extractor
A command-line file carving tool
WinHex
A file carving tool that allows accessing binary file data
Disc acquisition
Create an image of a disk for forensic review
Common forensics tools
Autopsy, EnCase, and FTK (Forensics toolkit)
Forensic workstation
Needs a lot of RAM, high-end CPU, lots of disk storage
Live analysis
Retrieves volatile data components
Memory dump
A technique for dumping RAM to forensic storage
Sysinternals
A Windows-only forensics tool
AccessEnum
Access enumerator, a forensic tool showing what users and groups have what permissions
Swap files/page files
Temporary files that contain portions of memory at a point-in-time while memory is being written
Autoruns
A utility showing what programs or scripts run at system boot
Process Explorer
A hierarchical diagram of Windows programs showing what processes have activated other processes
TCPView
Shows all active network connections to or from your system
Linux password storage
Passwords are kept on a file with a one-way hash
Shadow password file
A separate file where Linux password hashes are stored
Secure hashing requires avoiding ____
Collision
Dictionary attack
Tries English words as passwords first
Rainbow Table attack
attempts pre-computed hashes
Hybrid attack
Uses variations in spelling and characters while guessing passwords
Ethernet networks
Send electrical signals over copper wire
Wireless networks
Emit radio waves over the air
Fiber-optic networks
Light pulses sent over glass
Major uses of software forensics
1) resolve intellectual property disputes 2) identify malware origins
Embedded devices
Special-purpose computers within smart devices. Typically cloud connected
Chain of custody
A documented trail of who has owned what evidence
3 Major steps of legal electronic discovery
1) Preservation 2) Collection 3) Production
Preservation
A legal hold is issued notifying electronic records must be kept for a certain timeframe
Preservation includes stopping:
Any process that automatically destroys data
Collection
Once legal has decided to pursue litigation, cybersecurity teams may be required to assist with finding data
Production
Legal provides collected electronic evidence to the other party
Metasploit
The most commonly used exploitation tool
shasum
A hashing tool available in a forensic toolkit
dd
A disk imaging tool
