Week 2 Flashcards

Question

Forensic Workstation: Hardware

Answer 1

Windows-based PC  Separate HDDs and/or SSDs for: ▪ Operating System ▪ Tools Storage ▪ Database Storage (tooldependent) ▪ Evidence storage ▪ May be part of a RAID array Write-blocker (internal or external)  High CPU processing speed with as many cores as feasible within budget  Graphical Processing Unit (GPU) of high capacity & speed to handle work overload & password cracking Capacity for more than one Monitor  At least 32-64 GB of RAM  Optional Equipment: ▪ Hot-swappable internal drive bays ▪ Imaging tray with cooling fan ▪ Physical locking mechanism ▪ External drive connections for SATA, IDE, etc. (TEST)

Answer 2

Often have slower processing speed & less storage capacity  Great for field triage or on-site applications  Often not as upgradable as desktop PCs  Can be custom built with many of the same specs as desktop PCs

Answer 3

Magnet Axiom & Axiom Cyber X-Ways Forensics OpenText Encase Forensic Cellebrite Blacklight

Answer 4

▪ ”All-in-one” approach ▪ Supports Windows, Mac, Linux, iOS, Android & more ▪ Training & certification available ▪ Cost for tool: ~$7,000 + yearly maintenance ~$3,000

Answer 5

Has free component called WinHex ▪ Robust tool that isn’t a system resource hog ▪ Training & Certification available ▪ Cost for tool: ~$1,750 + yearly maintenance ~$850

Answer 6

Once a major contributor, not used as often ▪ Training & certification available ▪ Cost for tool: ~$7,500 + yearly maintenance ~$3,500

Answer 7

Operates on both Windows & Mac platforms ▪ Specializes in Mac data acquisition & analysis ▪ Training & Certification available ▪ Cost for tool: ?

Answer 8

Autopsy by Basis Technology Sumuri Paladin Eric Zimmerman’s Tools RegRipper

Answer 9

Very capable tool for Windows & Android analysis ▪ Training & certification available ▪ Customizable plug-ins for those code-inclined ▪ Cost for tool: Free & Open Source

Answer 10

Bootable Linux tool with multiple applications ▪ Most often used: image creation on systems with nonremovable drives ▪ Has apps included to perform virtually all forensic needs

Answer 11

Suite of tools designed for triage & specific artifact analysis ▪ Available on GitHub

Answer 12

Command-line tool used to parse data & artifacts from Windows registry (to be discussed in detail later) ▪ Developed by Harlan Carvey: Author & IR Expert ▪ Routinely updated with plug-ins. Communitysupported

Answer 13

- Magnet Axiom(see previous) - Cellebrite Universal Forensic Extraction Device (UFED) & Physical Analyzer - Oxygen Forensics - XRY Xamine - Gray Key or Gray Shift

Answer 14

Used by law enforcement worldwide ▪ Android, iOS, GPS, Blackberry, Windows Phone, etc. support ▪ Constantly being developed, updated ▪ Training & certification available ▪ Cost for tool: ~$11,000 + yearly maintenance ~$7,500 ▪ Advanced capabilities cost over $20,000 more per yea

Answer 15

Used by law enforcement worldwide ▪ Android, iOS, GPS, Blackberry, Windows Phone, etc. support ▪ Training & certifications available ▪ Cost for tool: ~$7,000 + yearly maintenance ~$3,000

Answer 16

Acquisition & analysis tool ▪ Cost: ??

Answer 17

Law Enforcement Only Tool ▪ Tool is designed to bypass pass code security on iOS & Android Devices ▪ Supports full file system extraction after first unlock ▪ Limited data if before first unlock ▪ Unit is tied to LE agency & monitored via IP address ▪ Cost for tool: ~$10,000 and up + yearly maintenance at same cost... Annually!

Answer 18

Training in DF is extremely important!  Field is always changing & evolving ▪ Mobile forensics is the most prominent with this ▪ Operating systems upgraded regularly (phone & computer) ▪ Apple Mac OS is always changing ▪ Applications added & updated regularly ▪ Hardware advancements & improvements ▪ Tool-specific updates, improvements Training and/or certification in DF is done in two main ways ▪ Vendor-neutral ▪ Vendor Specific  Vendor-Neutral training focuses on competencies, concepts, methodologies & principles ▪ Generally offered as part of a DF organization or association. Does NOT equal “free”  Vendor-Specific training teaches participants how to use a specific DF tool for specific purposes

Answer 19

Certified Computer Forensic Examiner (CFCE) certification process 6+ month long process, peer-reviewed, coached

Answer 20

International Association of Computer Investigative Specialists

Answer 21

▪ International Association of Computer Investigative Specialists (IACIS) ▪ Capstone course: Basic Computer Forensic Examiner (BCFE) – 2 weeks ▪ Open to any member of IACIS (not LE restrictive) ▪ Comprehensive basic vendor-neutral training with basic equipment as part of tuition ($3,795) ▪ Upon completion, eligible to sit for Certified Computer Forensic Examiner (CFCE) certification process ▪ 6+ month long process, peer-reviewed, coached ▪ Also has 1 &2-week specialized courses SANS Institute ▪ Offers a library of courses for computer forensics, mobile device forensics, information security, incident response, network security, etc. ▪ Computer forensic certification is GIAC Certified Forensic Examiner (GCFE) ▪ Open to all in the field of information security, compliance, forensics, etc. ▪ Cost is HIGH - $5,000-$10,000 Vendor-Neutral Training Options (Cont.) ▪ International Society of Forensic Computer Examiners (ISFCE) ▪ Primary course & certification is the Certified Computer Examiner (CCE) ▪ Applicants can sit for the test without attending a class ▪ A “CCE Bootcamp” is also available at cost ▪ Open to all in the field of digital forensics ▪ Peer-reviewed, coached ▪ Re-certification mandatory to maintain National White Collar Crime Center (NW3C) ▪ Non-profit, partially government-funded ▪ Offers a library of courses for computer forensics, mobile device forensics, network forensics, online investigation, etc. ▪ Several computer and mobile-based forensic certifications ▪ Offers both LE-only & publicly available classes ▪ Online & in-person classes offered National Computer Forensic Institute (NCFI) ▪ Operated by the US Secret Service ▪ Goal is to train state & local LE on basics of computer forensics, mobile forensics & network forensics ▪ Must be LE & sponsored by local USSS office ▪ Free to LE. Class provides all software, hardware & training ▪ Basic Computer Evidence Response Training (BCERT) is capstone 5-week course given in Hoover, AL ▪ Not specifically vendor-neutral, but provides training for multiple vendor tools

Answer 22

Certified Computer Examiner Primary course & certification for ISFCE

Answer 23

International Society of Forensic Computer Examiners

Answer 24

Offered by most (if not all) DF tool vendors ▪ Goal is competency within a discipline working with a tool created by a specific vendor ▪ Some offer just training, while others offer both training & certification ▪ Highlights: ▪ EnCase Certified Examiner (EnCE) ▪ Magnet Certified Forensic Examiner (MCFE) ▪ Cellebrite Certified Mobile Examiner (CCME) ▪ Also Cellebrite Certified Operator & Physical Analyst (CCO, CCPA) ▪ X-Ways Forensics X-Pert