Transcript Lecture2 - The University of Texas at Dallas

Digital Forensics
Dr. Bhavani Thuraisingham
The University of Texas at Dallas
Lecture #2
Fundamentals
August 22, 2007
Outline
 Review of Lecture I
 Introduction
 Applications
- Law enforcement, Human resources, Other
 Services
 Benefits
 Using the evidence
 Case Histories/Studies
 Conclusion
 Next Steps: Lecture 3
 Reference: Chapter 1 of the Text Book + additional references
Review: Digital Forensics
 Digital forensics is about the investigation of crime including
using digital/computer methods
 More formally: “Digital forensics, also known as computer
forensics, involved the preservation, identification, extraction,
and documentation of computer evidence stored as data or
magnetically encoded information”, by John Vacca
 Digital evidence may be used to analyze cyber crime (e.g.
Worms and virus), physical crime (e.g., homicide) or crime
committed through the use of computers (e.g., child
pornography)
Review: Digital Forensics - II
 The steps include the following:
- When a crime occurs, law enforcement officials gather
every piece of evidence including information from the
crime scene as well as from the computers
- The evidence gathered is analyzed
- Techniques include
 Intrusion detection
 Data Mining
 Analyzing log files
 Analyze email messages
 Lawyers, Psychologists, Sociologists, Crime investigators
and Technologists have to work together
 International Journal of Digital Evidence is a useful source
Introduction: Computer (Digital) Forensics
 What is computer crime?
 What is the objective/priority of computer forensics?
 What is more important: Accuracy or speed?
 Who is a forensics specialist?
Computer Crime
 Computers are attacked – Cyber crime
- Computer Virus
 Computers are used to commit a crime
- E.g., child predators, Embezzlement, Fraud
 Computers are used to solve a crime
 FBI’s workload: Recent survey
- 74% of their efforts on white collar crimes such as
-
healthcare fraud, financial fraud etc.
Remaining 26% of efforts spread across all other areas
such as murder and child pornography
Source: 2003 Computer Crime and Security Survey, FBI
Objective and Priority
 Objective of Computer Forensics
- To recovery, analyze and present computer based material
in such a way that is it usable as evidence in a court of
law
Note that the definition is the following: “computer
forensics, involves the preservation, identification,
extraction, and documentation of computer evidence
stored as data or magnetically encoded information”, by
John Vacca
 Priority
- Main priority is with forensics procedures, rules of
evidence and legal processes; computers are secondary
- Therefore accuracy is crucial
-
Accuracy vs Speed
 Tradeoffs between accuracy and speed
- E.g., Taking 4 courses in a semester vs. 2 courses; more
likely to get Bs and not As
Writing a report in a hurry means likely less accurate
 Accuracy: Integrity and Security of the evidence is crucial
- No shortcuts, need to maintain high standards
 Speed may have to be sacrificed for accuracy.
- But try to do it as fast as you can provided you do not
compromise accuracy
-
The Job of a Forensics Specialist
 Determine the systems from which evidence is collected
 Protect the systems from which evidence is collected
 Discover the files and recover the data
 Get the data ready for analysis
 Carry out an analysis of the data
 Produce a report
 Provide expert consultation and/or testimony?
Applications: Law Enforcement
 Important for the evidence to be handled by a forensic expert;
else it may get tainted
 Need to choose an expert carefully
What is his/her previous experience? Has he/she worked
on prior cases? Has he/she testified in court? What is
his/her training? Is he CISSP certified?
 Forensic expert will be scrutinized/cross examined by the
defense lawyers
 Defense lawyers may have their own possibly highly paid
experts?
-
Applications: Human Resources
 To help the employer
- What web sites visited?
- What files downloaded
- Have attempts been made to conceal the evidence or
fabricate the evidence
- Emails sent/received
 To help the employee
- Emails sent by employer – harassment
Notes on discrimination
- Deleted files by employer
-
Applications: Other
 Supporting criminals
- Gangs using computer forensics to find out about
members and subsequently determine their whereabouts
 Support rogue governments and terrorists
- Terrorists using computer forensics to find out about
what we (the good guys) are doing
 We and the law enforcement have to be one step ahead of the
bad guys
 Understand the mind of the criminal
Services
 Data Services
- Seizure, Duplication and preservation, recovery
 Document and Media
- Document searched, Media conversion
 Expert witness
 Service options
 Other services
Data Services
 Data Seizure
- The expert should assist the law enforcement official in
collecting the data.
Need to identify the disks that contain the data
 Data Duplication and Preservation
- Data absolutely cannot be contaminated
- Copy of the data ahs to be made and need to work with
the copy and keep the original in a safe place
 Data Recovery
- Once the device is seized (either local or remote) need to
use appropriate tools to recover the data
-
Document and Media Services
 Document Searches
- Efficient search of numerous documents
- Check for keywords and correlations
 Media Conversion
- Legacy devices may contain unreadable data. This data
-
ahs to be converted using appropriate conversion tools
Should be placed in appropriate storage for analysis
Expert Witness Services
 Expert should explain computer terms and complicated processes in
an easy to understand manner to law enforcement, lawyers, judges
and jury
- Computer technologists and lawyers speak different languages
 Expertise
- Computer knowledge and expertise in computer systems,
storage
- Knowledge on interacting with lawyers, criminology
- Domain knowledge such as embezzlement, child exploitation
 Should the expert witness and the forencis specialist be one and the
same?
Service Options
 Should provide various types of services
- Standard, Emergency, Priority, Weekend After hours
services
 Onsite/Offsite services
 Cost and risks – major consideration
 Example: Computer Forensics Services Corporation
- http://www.computer-forensic.com/
- As stated in the above web site, this company provides
“expert, court approved, High Tech Investigations,
litigation support and IT Consulting.” They also
"Preserve, identify, extract, document and interpret
computer data. It is often more of an art than a science,
but as in any discipline, computer forensic specialists
follow clear, well-defined methodologies and procedures.”
Other Services
 Computer forensics data analysis for criminal and civil
investigations/litigations
 Analysis of company computers to determine employee
activity
If he/she conducting his own business and/or
downloading pornography
- Surveillance for suspicious event detection
 Produce timely reports
-
Benefits of using Professional services
 Protecting the evidence
- Should prevent from damage and corruption
 Secure the evidence
- Store in a
secure place, also use encryption technologies
such as public/private keys
 Ensure that the evidence is not harmed by virus
 Document clearly who handled the data and when - auditing
 Cleint/Attoney privilege
 Freeze the scene of the crime – do not contaminate or change
Using the Evidence: Criminal and Civil
proceedings
 Criminal prosecutors
 Civil litigation attorneys – harassment, discrimination,
embezzlement, divorce
 Insurance companies
 Computer forensics specialists to help corporations and
lawyers
 Law enforcement officials
 Individuals to sue a company
 Also defense attorneys, and “the bad guys”
Issues and Problems that could occur
 Computer Evidence MUST be
- Authentic: not tampered with
- Accurate: have high integrity
- Complete: no missing points
- Convincing: no holes
- Conform: rules and regulations
- Handle change: data may be volatile and time sensitive
- Handle technology changes: tapes to disks; MAC to PC
- Human readable: Binary to words
Legal tests
 Countries with a common law tradition
- UK, US, Possibly Canada, Australia, New Zealand
 Real evidence
- Comes from an inanimate object and can be examined by
the court
 Testimonial evidence
- Live witness when cross examined
 Hearsay
Wiki entry “Hearsay in English law and Hearsay in United
States law, a legal principle concerning the admission of
evidence through repetition of out-of-court statements”
 Are the following admissible in court?
- Data mining results, emails, printed documents
-
Hearsay in the US Law (from Wiki entry)
 Hearsay is a legal term that describes a class of evidence
generally disallowed by most courts in the United States. The
"Hearsay Rule" is an analytic rule of evidence that defines
hearsay and provides for both exceptions and exemptions
from that rule. The "Hearsay Rule" is as varied as the
jurisdictions that define it. That is to say, there is no allencompassing definition of hearsay in the United States.
However, most evidentiary codes defining hearsay adopt
verbatim the rule as laid out in the Federal Rules of Evidence
[1] Rule 801, 28 U.S.C. App. See Rule for Courts-Martial 801,
Manual for Court Martial, United States (2005 ed.). Historically,
the rule against hearsay is aimed at prohibiting the use of a
person's assertion, as equivalent to testimony to the fact
asserted, unless the assertor is brought to testify in court on
the stand where he may be placed under oath and crossexamined.
Traditional Forensics vs Computer Forensics
 Traditional Forensics
- Materials tested and testing methods usually do not
change rapidly
Blood, DNA, Drug, Explosive, Fabric
 Computer Forensics
- Material tested and testing methods may change rapidly
- We did not have web logs in back in 1990
- We did not have RAID storage in 1980
-
Case Histories/Studies
 Case History
- Vogon Forensics Bulletin, Vol 3, #3, Vogon International
Limited, Talisman Business center, Talisman Road,
Bicester, Oxford shire, OC26 6HR, UK, 2001
 Case Study
- Flying laptop
- Burned tapes
- Computer Forensic Services and Systems
Vogon International (Taken from
http://www.vogon-computer-evidence.co.uk/)
 Vogon's computer forensic Investigation Services cover all areas of computer
fraud, computer misuse, internet/email abuse, pornography and hacking
amongst many others.
Our computer forensic Laboratory Services use the latest developments in
forensic computing technology and our experts are able to find any evidence
present anywhere on any storage media.
Our Electronic Disclosure and discovery services that provide unparalleled
levels of litigation support and unrivalled technological expertise across all
media within the time scale and budget you require.
Data Recovery: Our ability to recover data is unmatched - we do the
seemingly impossible such as retrieving data from overwritten DLT, LTO or
3590 tapes, rebuild RAID & multi-disk systems and in our research labs
routinely recover from others' attempts at Data Recovery.
Conclusion
 Important to have experts for computer forensics
evidence gathering and analysis
 Important to secure the evidence: authenticity,
completeness, integrity
 Important to have the proper tools for analysis
 Important to apply the correct legal tests
 Computer forencis can be used to benefit both the
“good and bad guys”
 Need to be several steps smarter than the enemy
Next Steps: Lecture #3
 Chapter 2 of the Text book + additional references
 Types of Computer Forensics Technology
 For each technology presented, we will also
analyze why it is useful