Part 04 - Forensic Investigation Process

Video Activity

In this section on computer forensics we prepare to go to court. This involves the extremely important processes of evidence collection, analysis, and presentation. We also discuss the laws - in terms of the U.S. Constitution - governing this phase. We start off by discussing the first step in evidence collection which is Identification. In order f...

Join over 3 million cybersecurity professionals advancing their career
Sign up with

Already have an account? Sign In »

2 hours 38 minutes
Video Description

In this section on computer forensics we prepare to go to court. This involves the extremely important processes of evidence collection, analysis, and presentation. We also discuss the laws - in terms of the U.S. Constitution - governing this phase. We start off by discussing the first step in evidence collection which is Identification. In order for something to be admitted into evidence in a court of law, it must first be identified. Locard's Principle of Exchange is mentioned, which is based on the premise that a criminal will usually leave something behind even if it's just a tip-off about their motives based on what they stole. Pretty Sherlock Holmes, huh? The extremely important issue of evidence preservation is discussed next. The chain of custody for evidence MUST be well-documented! A history of how evidence was collected, analyzed, transported, and preserved is required. This process is vital since digital evidence CAN be manipulated! Important procedures for evidence handling are mentioned. This includes thorough documentation using photos of the crime scene and collected evidence along with evidence labeling and logging. We also raise the important issue of the Fourth Amendment regarding illegal search and seizure and how it applies differently to government agents vs. private individuals. The section concludes with a discussion of the processes of examination (just the facts!), analysis (turning data into info), presentation in court, and the climax that results in a decision or legal ruling on the presented evidence.

Video Transcription
All right, let's talk about the forensics investigation process. So again, we keep in mind that our goal is to present evidence in court. So these air the Seven Steps Identification Preservation Collection, examination, analysis, presentation in court
and then, ideally, a decision be made.
So we start out with identification, and what we're looking to is identify something as evidence and see what information is left behind what evidence is left behind. There's a principle called low cards principle of exchange. And what that says is that for
someone would take a criminal would take an income. There's a crime and there's a theft they leave behind. Something might be a fingerprint. Might be D N a. Or it could simply be the knowledge that what they took tells you something about them. So, for instance, if I take,
um, top secret information that might tell you that perhaps I'm involved with espionage so low Gorge Principal essentially says they're gonna leave something behind, you've gotta look for it
all right. Now, the very first step of a first responder after they've identified that something is evidence preservation. And that's so very essential because, as you remember, when we talked about the steps of forensics and the requirements. We know that
we can't modify evidence.
So preserving evidence, we're gonna make sure that everything is documented. Who has the evidence? What did they do with it? When did they have it? You know, pretty much the who. What? Where, When? Why, How
and we're gonna refer to this is the chain of custody and chain of custody is so very important. It's gonna track the history all the way up to the point where the evidence is actually presented in court.
We need to make sure that were also able to guarantee the integrity of the evidence. And you'll notice down at the bottom hashing algorithm. Zehr used to show that a hard drive, for instance, has not been modified. And we'll talk about that a little bit more later, but preserved the integrity of the evidence.
The next step is collection.
So going back, the things like minimizing limit the handling of evidence. Absolutely as much as possible. Document, document, document.
Ah, I'm not gonna read every single one of the's, but where it says capture an accurate image of the system. You know, the idea is we would never want to work on an original. We wanna work in a copy. We can't risk damaging or modifying the original.
So when we talk about working with systems, we need a system. Imagine we'll talk about that a little bit more.
Work fast. Always worked for most volatile toe least volatile and volatile means likely to change usually what that has to do with this power. You know, when you lose power to assist from the contents of ran, we're going. So we want to be very cognizant about that.
We also want to make sure that if you're not well trained, if you're not on the incident response team, you want to limit very much what you do. Because most of the time people can vary inadvertently and innocently or race evidence. So we want to make sure that
you're not going in and opening up. Files and folders are rebooting the system are powering it off
because in all likelihood, you're destroying evidence.
A few other things with collection. When we collect, as I mentioned, we're gonna work for most volatile toe least volatile, and we're gonna make sure that we document every step along the way. So coming in, we're gonna photograph the area, make sure that we have what's in memory
power down the system on Lee after we've gone through a series of processes as documented in our incident response strategy,
Um, photograph the inside of the system. That's fine. Label the evidence and document document document. You may need to get your internal departments legal in HR involved in the process.
All right, now, one other thing or another couple of things with forensics making sure that the evidence is acquired in a legal manner. So the Fourth Amendment protects the provides protection against illegal search and seizure from law enforcement.
It does not apply to private citizens.
So, for instance, if as a manager I find some indication of a crime on your desktop, I can seize that information and turn it over. The law enforcement's a law enforcement doesn't guarantee it's gonna be admissible, but I can do that without violating your Fourth Amendment rights.
Now, uh, evidence can be seized without violating Fourth Amendment rights in several situations. Anything that's been subpoenaed were discovered as a result of a search warrant.
Anything turned over voluntarily, of course, and then the last exigent circumstances and exigent circumstances made that. The evidence is in, um,
in danger of being destroyed but immediate danger of being destroyed. So in those elements we can bypass, law enforcement can bypass the Fourth Amendment.
Now, from collection, we move from examination to analysis. Now, examination is just the facts were just documenting information. What we're really doing is collecting data
with analysis. We're looking for meaning to that data, and we want to take data and turn it into information. So analysis goes a little bit farther, goes a little bit deeper, and you'll notice the very first bullet point under analysis. Primary image versus working copy.
The working copy should be a
it level copy
off the system. We don't want to work in the hard drive. And as a matter of fact,
once we're ready to pull the original hard drive out of the system, we put that in a right protected machine.
All right. And then we hash it.
Then we make a bit level copy
and we hash the copy.
The two hashish should be the same.
Then we analyze the copy and hash it again. And all three hashes should be the same. So it's very important that we follow those processes.
We present the information in court and any other supporting evidence and then, ideally, the result of the evidence of the investigation comes to a close.
So those were the processes off forensic investigation.
So if we go back identification, preservation, collection, examination, analysis,
presentation in decision.
Up Next
Security Operations

They are responsible for knowing where a network's possible vulnerabilities are and providing mitigation strategies to combat them. An effective Cyber Security Operations Manager will have experience in a technical security role including ...

Instructed By