Scribd
Upload
78 views

Semi Final Lecture Part2

The document discusses digital forensic processes and models, including the Kruse and Heiser, Yale University, and Rodney McKemmish models. It also discusses the five-step model of the Philippine National Police Anti-Cybercrime Group. The document outlines steps for digital investigative planning and types of investigative personnel. It discusses challenges of digital investigations and the importance of training first responders. The document provides guidance on securing digital crime scenes and acquiring volatile and non-volatile data from powered on and powered off devices, including creating forensic images and dumping physical memory.

Uploaded by

anna cariza
Copyright
© © All Rights Reserved
Available Formats
Download as PDF, TXT or read online on Scribd
78 views

Semi Final Lecture Part2

The document discusses digital forensic processes and models, including the Kruse and Heiser, Yale University, and Rodney McKemmish models. It also discusses the five-step model of the Philippine National Police Anti-Cybercrime Group. The document outlines steps for digital investigative planning and types of investigative personnel. It discusses challenges of digital investigations and the importance of training first responders. The document provides guidance on securing digital crime scenes and acquiring volatile and non-volatile data from powered on and powered off devices, including creating forensic images and dumping physical memory.

Uploaded by

anna cariza
Copyright
© © All Rights Reserved
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 72

DIGITAL FORENSIC

PROCESS
1. Kruse And Heiser Model
Acquire-Authentication-Analysis
2. Yale University Model
Preliminary Investigation-Planning-Recognition-
Preservation, Collection, and Documentation-
Classification, Comparison, and Individualization
3. Rodney McKemmish Model
Identification-Preservation-Analyze-Presentation
4. The five-step model of the Philippine National Police
Anti-Cybercrime Group
Step 1. Identification
Step 2. Data Acquisition
Step 3. Examination/Analysis
Step 4. Reporting/Documentation
Step 5. Court Presentation
DIGITAL INVESTIGATIVE PLANNING
a. Pre-search Activities
b. Intelligence Gathering
c. Assembling Investigation
d. Planning the Search
INVESTIGATIVE PERSONNEL
1. General Lead Investigator
(Team Leader)
2. Searchers (Seizing officer)
3. Seizure Officer
4. Exhibits Officer
(Evidence Custodian)
5. Photographer
6. Digital Investigator
7. Scene Security Team
World has become increasingly interconnected
Robustness and redundancy

Not security and traceability


Complexity and
uncertainty of digital
investigations
Training of the
first responder
are critical

INCIDENT
RESPONSE
Collaboration between
the prosecutor and
forensic examiner is
necessary in prosecuting
cybercrimes.
Digital evidence poses unique
challenges to the investigation
process. Each step must be
precise to ensure the probative
value of potential digital
evidence.
•UK examiners adhere with the Association of Chief Police Officers
(ACPO) guidelines:

• Action by agents should not change data held on a


computer or storage media

• When necessary to access original data held on a computer


or on storage media, the person accessing must be
competent.

• The person in charge of the investigation has overall


responsibility
• An audit trial or other record of all
processes applied to computer-based
electronic evidence should be created
and preserved.

• The person in charge of the investigation


(has overall responsibility for ensuring
that principles are adhered to.
•Live Response Forensic

•acquisition of computer data while the


computer is powered on
•The main purpose of the collection is to
preserve volatile evidence that will further the
investigation.
Live data
collection is
not without
risk
Collecting evidence according to the
proper steps of evidence control
helps ensure that the computer
evidence is authentic
Message Digest 5 (MD5)
and Secure Hash
Algorithm (SHA-1) tools
use complex algorithms.
• Is there reason to believe volatile data contains
information critical to the investigation?
• Can the live response be run in an ideal manner
• Is the number of affected systems large?
• Is there risk that forensic duplications will take an
excessive amount of time?
• Are there legal or other considerations that make
it wise to preserve as much data as possible?
Dead-box Forensic
the acquisition of computer
data when the computer is
powered off.
The hard drive will be removed
and attached first to the write
block device before connecting it
to the forensic computer
workstation.
Forensic Investigation Steps

• Acquisition

• Identification

• Evaluation

• Presentation
1. Acquisition - is the first
step in the forensic
process and is critical to
ensure the integrity of the
evidence.
2. Identification - this phase
determines the context in
which the evidence was
found.
3. Evaluation - refers to the
interpretation and
reconstruction of the
digital crime scene.
4. Presentation - is the final
stage that involves
reporting data pertinent to
the case to the prosecutor
and eventually, must
prepare to testify in court.
First Responders are
Responsible for the
Acquisition Step
• Which evidence was obtained?

• Which individual or individuals retrieved the


evidence?

• Where the evidence was gathered?

• When was the evidence was collected?

• How was the evidence acquired?


Digital forensic investigator must
carefully choose the forensic tool to
be used in the digital examination.
It must be able to perform various
tasks depending on the need of the
case.
1. The system time and date, including the
time zone
2. Operating system version information
3. General system information, such as
memory capacity, hard drives, and
mounted file systems
4. List of services and programs configured
to automatically start
5. List of tasks scheduled to automatically
run at given times or intervals
6. List of local user accounts and group
membership
7. Network interface details, including IP
and MAC addresses
Forensic image
Identification and
collection must be
done in a

VERY SYSTEMATIC
MANNER
Coordinated
and structured
approach
DOCUMENTI
NG
THE SCENE
Powered “Off”
Computers
• Do not turn the power on

• Immediately secure all


electronic devices

• Ensure that no unauthorized


person has access to any
electronic devices

• Remove all persons from the


search/crime scene

• Ensure that the condition of any


electronic device is not altered.
First responders must
secure and take control of
the scene both physically
and electronically
COLLEGE OF CRIMINOLOGY AND CRIMINAL JUSTICE
Calayan Educational Foundation, Inc.

Powered “ON” Computers


• Look and listen for indications that the
computer is powered on.

• Check the display screen for signs that


digital evidence is being destroyed.

• Look for indications that the computer is


being accessed from a remote computer or
device.

• Take note of all cameras or Web cameras


(Web cams) and determine if they are
active
1 10
2 9
6
3 5 8
7
4
If the responder detects excessive
hard drive activity suggesting the
drive is being wiped, consider
terminating the wiping program if
possible, or removing power from
the computer to prevent further
damage.
6GB
RAM

6 ft
High
1. Configuration information
2. Typed commands
3. Passwords
4. Encryption keys
5. Unencrypted data
6. IP addresses
7. Internet history
8. Chat conversations
9. Emails
10. Malware
Image hard
drive
Source: Mr. OVIE L. CARROL
Director, US Department of Justice Computer Crime and Intellectual Property Section (CCIPS)
1. Plug-in the “LIVE
RESPONSE TOOL”
thumb drive to the
computer, then open
the live response folder
2. Click the AccessData
FTK imager icon to
launch the program
3. Click the
capture
memory
button
Or click the file toolbar
and select the capture
memory
4. Select where the
RAM will be saved
in your Flash drive
or externa drive by
clicking the
browse button
5. Choose where
RAM will be saved.

Select Make New


Folder
6. Type the folder
name

Click OK
7. The destination
path of the RAM
has been selected

Default filename is
memdump.mem

Click capture
memory
8. The progress bar
will show the
amount of RAM
being dumped

After successfully
capturing memory,
click close
Source: MR. OVIE L. CARROL
Director, US Department of Justice Computer Crime and Intellectual Property Section (CCIPS)
1. Click the EDD
icon to launch
the program
2. Click “I accept”
3. EDD will scan the
computer and
report if
encryption was
detected
Source: Mr. Ovie L. Carrol
Director, US Department of Justice Computer Crime and Intellectual Property Section (CCIPS)
1. Plug-in the “LIVE
RESPONSE TOOL”
thumb drive to the
computer, then open
the live response folder
2. Click the AcceData
FTK imager icon to
launch the program
3. Click the icon for
create disk
image
4. Select logical
drive

Then click next


5. Click the drop-
down button
and select the
encrypted drive

Click finish
8. Click add
8. Select E01
9. Type the
necessary
information

Then click next


10. Choose where to
save the
contents of the
encrypted
container

then click finish


11. Click start
12. You will see the
progress bar and
after
completion, a
notification of
imaged
successfully will
be seen.

Then click close


13. After the imaging
process, the FTK
imager will
generate a report
and indicating the
hash value

You might also like