Computer Forensics

• Identify the perpetrator or parties involved in the legal matter
• Locate and recover data, files, or e-mail messages relating to the legal matter
• Reconstruct damaged databases and files

Chain of custody issues –

• Evidence is not altered, damaged, contaminated, or destroyed by the investigative procedures
• No malicious software is permitted to infect or corrupt the subject computer, the investigator’s computer, or other computers on either network.
• All possible relevant evidence extracted from the subject’s computer or network is fully preserved.
• An unbroken chain of custody is established, documented, and maintained
• Minimal interruptions to the operations of the business under investigation occur.
• The privacy and confidentiality of all data on the subject’s computer and network are properly maintained.

Special issues –

• Logical versus physical erasure/deletion and slack spaces
• Data files, logs, e-mail, instant messages, metadata
• Swap files, temporary files, recycle bin, recent items and other OS logs, servers, communications & relay servers, web snapshots, backups, and other sources of duplicates of data
• Anti-forensic software
  • Potential magnetic-force (and tunneling) microscopy

Steps in Forensic Investigation of Computers –

• Size up the situation
• Log every detail – document with photos, diagrams, logs, complete workpapers, witnesses
• Conduct the initial survey
• Assess the probability of ongoing undesirable activity
  • If need to monitor activity: keyboard logger, packet sniffer, etc.
• Power down
• Check for booby traps, remove write pins from original hard drive
• Duplicate the hard drive or other permanent storage media & secure the original
  • Use imaging software, verify with checksums MD5 (old) old SHA (new version)
• Analyze the hard drive
  • Use professional tools, such as EnCase
  • Overcome passwords and/or encryption
  • Searches: manual, keyword
  • If needed data is not available, consider alternative computer sources
• Identify individuals and computers within a network environment
• Identify and process other types of computer storage media
  • Examples: USB flash drives, memory cards, removable drives, CD, DVD

- R. S. Kulzick – 5/03/2007 -