Hello, and welcome back to Computer Forensics Bootcamp. In this module, we're going to talk about the forensic methodology and investigations. The investigative process. The first thing we want to do is we want to do some case preparation. What case preparation is, is we're going to gather information before we even start up our computer. Before the start of our forensic examination, the first things we do is to try to define what type of case we are looking at. To do that, we're going to need to answer some basic questions. First and foremost, what is this case about? Is this a larceny case? Is this a robbery case? Is this an intellectual property theft? What type of case are looking at? The next thing we're going to talk about is, what evidence can we expect to recover? What crime do we think or violation do we think was committed and what type of evidence do we expect to find on this particular computer that we're examining? The next question we may want a answer is where most likely will this evidence be located on the computer itself within the file system? To do that, we're going to have to know a little bit about where computers store certain data as a default location and we're going to talk about that throughout this course. The next thing we have to think about is what are our legal restrictions? Is there a limitation on the scope of our search warrant or on the scope of our search authority? Or is this a special case where we may be dealing with something that is proprietary property or privileged information? The next question we're going to want to answer is, who is involved in this and what is their role? Are they a suspect? Are they a victim? Are they a witness? These will help us determine what we're going to do and how we're going to formulate our search strategies. Commonly, there are four phases in the investigative process. We have our collection and storage, our preservation, our analysis and testing, and our reporting and testifying. Criminal investigations. If you're doing a criminal investigation, this deals with offenses against the state. Somebody broke some sort of law, whether it's state, federal, local. In these cases, a court must authorize the search warrant, and we must abide by the rules of evidence. We have to keep these in mind. I'm going to talk about legal issues throughout this course. Each investigative model is going to have to follow the procedures of their particular jurisdiction, their particular court system. A civil investigation. This covers a lot of things that are not covered by criminal law. It could be a violation of contract, it could be a civil lawsuit, it could be a custody dispute, a divorce, or any other type of civil case. Usually, with civil cases, there is a financial aspect. Nobody's going to go to jail or lose their freedom but there is some type of financial aspect. Usually, the equipment and the data that can be inspected are going to be negotiated and a long time may pass before these devices are seized. Civil investigations tend to be data-driven and the extracted data, like I said, must be filtered by the court's requirements. You may have limitations on what you can examine and what you can look at. You may only be able to look at photos or you may only be able to look at messages or documents. It depends on the type of case and what the court decides. Administrative investigations are usually fact-finding inquiries. These type of things are that somebody broke a rule or a policy or a protocol. It's some type of professional misconduct. A lot of times we're talking about fraud audits or somebody looking at something they're not supposed to be on their company computer or using it for something they're not supposed to be using it for. This is a generic model of on scene flow that we would use when we're dealing with collecting evidence on a scene. The first concern is going to be scene safety and that's going to apply no matter what type of investigation you are doing. The next thing we want to think about when we're collecting evidence is we want to isolate the evidence. If the evidence is connected to a network, the evidence could be altered or remotely wiped so we want to get the evidence off the network. The next thing we want to do is we want to document the scene. You want to take photographs, draw a diagram, do a video. But you want to show that scene as it was when you first arrive before anybody moves anything. The next thing we're going to do is we're going to scan the scene and identify what could be evidence to us. Once we've identified our possible sources of evidence, we're going to collect them and we're going to do so in a proper manner, and we're going to document that collection. What I mean by that is you're going to document who found it, where they found it, what time. All these things are very important when it comes to authenticating the evidence later on in any type of court action. Now these next three boxes you see in that reddish color are only going to apply if you have a forensic expert on scene, because if you don't, after documenting the collection, what's going to happen is people are going to pull the plugs from the back of the computers, and package the evidence, but if you have a forensic person on scene, a forensic examiner, and you come across a running computer, the first thing you want to do is look and see if there's any type of destructive process running. The three things we want to look for is RAM, encryption, and destruction. I like to use the acronym RED. The R stands for RAM, and that's going to be random access memory. Once the computer is shut off, that random access memory is gone, so we're going to lose all that data. The E in RED, encryption. If you have an encrypted volume that is up and open in RAM and you shut the computer off, you may never be able to examine that volume because encryption is going to kick in and if you can't get back in, you will not be able to see what is on that encrypted volume. Then I mentioned destructive, if this destructive process is running, you want to immediately pull the plug from the back of the computer to stop that destructive process from running. If it's a laptop, make sure you take the battery out. If we do have an up and running computer, the first thing we want to do is collect RAM. If we have an encrypted volume up, we want to take a logical image of that volume, so at least we have that in case we cannot get back into that encrypted volume. Maybe the suspect won't give up the password, or there could be other reasons why we can't get back in. Again, destructive processes pull the plug. If you come across a computer that is off and you have a forensic expert on the scene and you suspect that there might be evidence on that computer and the case is urgent, it could be a missing kid, it could be that you want to get enough evidence to make an arrest because you're afraid your suspect will flee, you might want to do an on-scene preview of that computer. The other issue is triage. If you come upon a scene where you have multiple devices, you don't just want to collect everything. You don't want to take 10 or 20 computers when only one or two may have evidence that's going to be relevant to your case. You might want to do some triage, so you don't have to collect everything. Once that is done, you would properly package the evidence. Package computers in plastic unless there is some liquid on the computer. It could be a body fluid or there just could be some type of liquid, in that case, package the computer in paper. You're going to properly then transport the evidence. You want to package it so that it's secure and not going to be damaged during transport, and when you get the evidence back to your location, you're going to want to put that evidence in a secure room where access is limited. Forensic analysis preparation. Now that we've got our evidence back to our lab, we're going to examine it. The first thing we're going to do is you want to review all the paperwork. What I mean by that is you want to read all the reports that were written. If there is a search warrant involved or a court order, you want to read that too. You want to make sure you understand where the scope of your authority comes from and what your scope is. You may have a limited search and you want to make sure you understand that before you begin your analysis. You want to make a plan to examine the computer. Again we talked about understanding what type of case you're investigating and what type of evidence you want to find, and where you think that evidence might be located. Again confirm your search authority and scope. That is so important, because you may have a limited scope, and that may be one sentence in an entire search warrant, but if you miss that one sentence, you're going to be violating your search authority. Be aware of and plan for conflicts. What I mean by that is you may have a computer that came from an attorney's office and that's going to be privileged information. You could have medical information that would be limited by HIPAA. You could have somebody who's a writer and they have their proprietary information on there. You want to make sure you're aware of all the conflicts. You also want to be aware of what tools you have, what tools are available, and what tools you might need for this investigation in case you have to obtain another tool. You're going to have to go back and refine your plan as needed as you progress through the investigation. This is a generic model for what happens at the lab. When a detective or somebody brings a computer to you to examine, there's going to be some form of intake where you documented who brought it to you and what date and time you received it. Then you're going to photograph the evidence and you're going to document the evidence noting any damage to that evidence before it became in your custody. You want to photograph and document the evidence. You're going to document the make, model, serial number, and any type of damage and you're going to take photographs. You're going to preserve the evidence, and this usually involves some type of write blocking. You're not writing to the original evidence. Then you're going to create a bit-stream copy. You're going to image that drive. Once you're done with that, you're going to validate the copy, you're going to take one last hash and validate if you haven't made any changes to the original evidence, and then you're going to secure the original evidence in a place where access is controlled. When you're done with that, you're going to examine the copy of the evidence. We never work on the original evidence, we always work off of a copy. You're going to report your findings. You're going to have your report peer reviewed, you're going to have it looked at by another professional and then you're going to present your findings. We have some special type of cases that you'll probably come across in the corporate world, like an intellectual property theft investigation. In this case, you want to always consider the suspect's computer a crime scene. That device should be considered a crime scene. You want to immediately preserve. Do not access that device and do not allow anybody else to access that device. You're going to want to take a look and see how the suspect may have exfiltrated data. We're looking at how the suspect got the data off the computer. Did he use a DVD or CD or USB device? Did he use that computer to transfer data to a home network? What type of activities was he doing? Was he negotiating a salary with another company, with a competitor? Was he selling proprietary information? Were there any mass deletions or drive wiping or programs that are meant to hide or destroy data? You want to take a look at all that when you're investigating and intellectual property theft case. E-discovery cases, which would be another case you would come across in a corporate type environment, are not the same as your ordinary examination. What you're doing in an e-discovery case is you're collecting information and this may be in response to a lawsuit, a freedom of information request, or some other type of investigation. These types of data that you're going to be looking to collect are going to be emails, documents, presentations, databases, perhaps voicemails or some other type of media file, you're going to look at social media remnants that may be left on the computer and websites. E-discovery, you're going to be looking at metadata. It's focused on the metadata as opposed to collecting the data. How, when and where was this document created, these are going to be more of a focus than the actual content. Then you must know where the data is. Where is it you're going to locate this data? Is it archived? A lot of companies use email archival systems. So you're going to have to understand where this data is, you're going to be thinking about the documents metadata, when, how, and where it was collected. When you're doing an e-discovery project, you're going to have to scope it and this is going to begin with a data mapping exercise. You're also going to have to identify the physical location of the data. The data maybe on a server off-site, the data may be in the Cloud. You're going to have to understand all of those aspects when you're doing an e-discovery case. In the next module, we're going to download software and get our systems ready to start examining digital evidence.
