Module 8: Forensic Analysis and Incident Response Flashcards
What is computer forensics
A methodical way of gathering evidence from computing equipment and storage devices that can be presented in a court of law
What are the computer forensic methodologies basic activities
- Preservation (preserve the integrity of the original evidence)
- Identification (Identify the evidence and its location)
- Extraction (Extract the data from the evidence; the data may be volatile)
- Interpretation (Interpret what the forensic examiner has found)
- Documentation (COC form and documents relating to the evidence analysis)
TRUE or FALSE: The evidence acquired from computers is fragile and can be erased or altered
TRUE
TRUE or FALSE: Computer forensic tools and methodologies are major components of an organization’s disaster recovery preparedness
TRUE
TRUE or FALSE: One of the main objectives of computer forensics is to extract, copy, and document the computer and related materials in such a way that it can be presented as evidence in a court of law
FALSE
A forensic examiner needs to recover, analyze, and preserve computer and related materials
How does forensic analysis help in an incident
Determining the exact cause
Sometimes there are multiple incidents on a network or different incidents involving computers, forensic analysis can help sort out the incidents by doing what
Generate a timeline
When Ashland does her job for legal why is she doing it
Because forensic analysis saves organizations from legal liabilities and lawsuits
Also she is a glutton for punishment but EC Council doesn’t care about that, if you want to pass use the above answer
When using forensic analysis of the affected system how does it help
Or why are we getting Manuel Garcia’s laptop shipped to Savannah to have forensic analysis look at it for that cracked software
Forensic analysis helps in determining the nature of incidents and the impact of the incident
What are the objectives of forensic readiness
- Maximizing an environment’s ability to collect credible digital evidence
- Minimizing the cost forensics during an incident response
What happens when a company has a lack of forensic readiness
- Loss of clients by damaging the organization’s reputation
- System downtime
- Data manipulation, deletion, and theft
What are the different types of forensics
- Disk forensics (data stored on physical storage media)
- Network forensics (sniffing the network traffic)
- E-mail forensics (Studying the source and content of an email)
- Internet forensics (Analysis of various web applications)
- Source code forensics (Determining the software ownership and copyright issues)
What is a computer forensic investigator
A person who handles the investigation process.
They must have a general knowledge of computer hardware & software, be able to protect the digital evidence, and be properly certified
Who are some of the people involved in computer forensics according to EC Council
- Attorney
- Photographer
- Incident Responder
- Decision Maker
- Incident Analyzer
- Evidence Examiner/Investigator
- Evidence Documenter
- Evidence Manager
- Expert Witness
What is the forensics process
- Preparation (Building a forensic strategy)
- Collection (Gather any evidence associated with the incident)
- Examination (Processing large amounts of collected data)
- Analysis (Data has be analyzed to draw conclusions in support of the case)
- Reporting
What is digital evidence
Any information of probative value that is either stored or transmitted in a digital form
TRUE or FALSE: Collection and preservation of digital evidence is easy
FALSE
It is difficult because digital evidence is fragile in nature and can be altered or erased without a trace
What are characteristics of the digital evidence
- Admissible (Related to the face being proven)
- Authentic (Evidence must be real and related to the incident)
- Complete (The evidence must show the complete picture)
- Reliable (Evidence must not cast any doubt)
- Believable (Evidence must be clear and understandable)
What are the electronic evidence that can be collected
- Data Files (Desktops/laptops/servers)
- Backup Tapes (System-wide backups/Disaster recovery backups/Personal backups)
- Other Media Sources (Hard Drives/Portable media/Tape archives)
TRUE or FALSE: You need to record the extent of the system’s clock drift when collecting electronic evidence
TRUE
If you are at a crime scene and the computer is turned off what does that mean for the data
The data which is not saved can be lost permanently
After an incident, if a user writes some data to the system what happens to the data/evidence
It may overwrite the crime evidence
TRUE or FALSE: Digital evidence isn’t circumstantial
FALSE
It makes it difficult to forensics investigator to differentiate the system’s activity
TRUE or FALSE: A forensic policy should outline things to do if information is exposed accidentally
TRUE
Which document helps in protecting evidence from physical or logical damage
Chain-of-Custody
Who is responsible for examining the evidence acquired and separating the useful evidence
Evidence Examiner/Investigator
