Topic 12B

Question 1

Due process

Answer 1

used in US and UK common law to require that people only be convicted of crimes following the fair application of the laws of the land.

Ensures fairness thorugh procedural safeguards.

Question 2

Legal hold

Answer 2

refers to the fact that information that may be relevant to a court case must be preserved.

Information subject to legal hold might be defined by regulators or industry best practice, or there may be a litigation notice from law enforcement or lawyers pursuing a civil action.

This means that computer systems may be taken as evidence, with all the obvious disruption to a network that entails

Question 3

Data acquisition

Answer 3

is also complicated by the fact that it is more difficult to capture evidence from a digital crime scene than it is from a physical one.

Some evidence will be lost if the computer system is powered off; on the other hand, some evidence may be unobtainable until the system is powered off.

Question 4

order of volatility

Answer 4

The order in which volatile data should be recovered from various storage locations and devices after a security incident occurs.

Question 5

SOC best practice guide to evidence collection and archiving

Answer 5

1. SOC best practice guide to evidence collection and archiving
2. Contents of nonpersistent system memory (RAM), including routing table, ARP cache, process table, kernel statistics.

3.Data on persistent mass storage devices (HDDs, SSDs, and flash memory devices):

Partition and file system blocks, slack space, and free space.

System memory caches, such as swap space/virtual memory and hibernation files.

Temporary file caches, such as the browser cache.

User, application, and OS files and directories.

4.Remote logging and monitoring data.

5.Physical configuration and network topology.

6.Archival media and printed documents.

Question 6

Volatile

Answer 6

the data is lost when power is removed

Question 7

A system memory dump

Answer 7

creates an image file that can be analyzed to identify the processes that are running, the contents of temporary file systems, registry data, network connections, cryptographic keys, and more.

It can also be a means of accessing data that is encrypted when stored on a mass storage device.

Question 8

Nonvolatile storage includes

Answer 8

disk drives (HDDs), solid state drives (SSDs), firmware, other types of flash memory (USB thumb drives and memory cards), and optical media (CD, DVD, and Blu-ray).

This can also be referred to as device acquisition, meaning the SSD storage in a smartphone or media player.

Question 9

Live acquisition

Answer 9

this means copying the data while the host is still running.

This may capture more evidence or more data for analysis and reduce the impact on overall services, but the data on the actual disks will have changed,

Question 10

Static acquisition by shutting down the host

Answer 10

this runs the risk that the malware will detect the shutdown process and perform anti-forensics to try to remove traces of itself.

Question 11

Static acquisition by pulling the plug

Answer 11

this means disconnecting the power at the wall socket (not the hardware power-off button).

This is most likely to preserve the storage devices in a forensically clean state, but there is the risk of corrupting data.

Question 12

on a Linux host, the dd command

Answer 12

makes a copy of an input file (if=) to an output file (of=). In the following, sda is the fixed drive:

dd if=/dev/sda of=/mnt/usbstick/backup.img

Question 13

provenance

Answer 13

In digital forensics, being able to trace the source of evidence to a crime scene and show that it has not been tampered with.

Question 14

valid timeline

Answer 14

In digital forensics, a tool that shows the sequence of file system events within a source image in a graphical format.

Question 15

Once the target disk has been safely attached to the forensics workstation, data acquisition proceeds as follows:

Answer 15

A cryptographic hash of the disk media is made, using either the MD5 or SHA hashing function.

A bit-by-bit copy of the media is made using an imaging utility.

A second hash is then made of the image, which should match the original hash of the media.

A copy is made of the reference image, validated again by the checksum.
Analysis is performed on the copy.

Question 16

Tamper-evidence bags should have antistatic shielding to reduce the possibility of what?

Answer 16

data will be damaged or corrupted on the electronic media by electrostatic discharge (ESD).

Question 17

Chain of custody

Answer 17

documentation records where, when, and who collected the evidence, who subsequently handled it, and where it was stored. This establishes the integrity and proper handling of evidence.

Protects organizations from legal accusations involving tampering.

Question 18

Digital forensics reporting

Answer 18

summarizes the significant contents of the digital data and the conclusions from the investigator’s analysi

Question 19

strong ethical principles must guide forensics analysis:

Answer 19

Analysis must be performed without bias.

Analysis methods must be repeatable by third parties with access to the same evidence.

If a device used as evidence must be manipulated to facilitate analysis (disabling the lock feature of a mobile phone or preventing a remote wipe, for example), the reasons for doing so must be sound and the process of doing so must be recorded.

Question 20

E-discovery

Answer 20

is a means of filtering the relevant evidence produced from all the data gathered by a forensic examination and storing it in a database in a format such that it can be used as evidence in a trial

Question 21

Some of the functions of e-discovery suites are as follows:

Answer 21

Identify and de-duplicate files and metadata—many files on a computer system are “standard” installed files or copies of the same file. This reduces the volume of data

Search—allow investigators to locate files of interest to the case. As well as keyword search, software might support semantic search. Semantic search matches keywords if they correspond to a particular context

Tags—apply standardized keywords or labels to files and metadata to help organize the evidence

Security

Disclosure—an important part of trial procedure is that the same evidence be made available to both plaintiff and defendant