- [Instructor] Chain of custody is critical
to forensics investigations.
It is the way you document and preserve evidence
from the time that you started
the cyber forensics investigation
to the time the evidence is presented at court
or to your executives,
in the case of an internal investigation.
It is extremely important to be able to show
clear documentation of how the evidence was collected,
when it was collected, how it was transported,
how it was tracked, how it was stored,
and who had access to the evidence and how it was accessed.
If you fail to maintain a proper chain of custody,
it is likely you cannot use that evidence in court.
It is also important to know how to dispose of evidence
after an investigation.
Maintaining the data integrity
is also a very important piece of the process.
When you collect evidence, you must protect its integrity.
This involves making sure that nothing is added
to the evidence and that nothing is deleted or destroyed.
This is known as evidence preservation.
A method often used for evidence preservation
is to only work with a copy of the evidence.
In other words,
not directly working with the evidence itself.
This involves creating an image of a hard drive
or any storage device.
Several forensics tools are available on the market,
such as Guidance Software's EnCase
and Access Data's Forensic Toolkit.
There are several open source tools and Linux distributions
that can be used for digital forensics.
Examples include Security Onion, CAINE, SIFT and others.
Another methodology used in evidence preservation
is to use right protected storage devices.
In other words, the storage device you are investigating
should immediately be right protected before it is imaged,
and should be labeled to include the following;
investigator's name, the date when the image was created,
and the case name or number, if applicable.
Additionally, you must prevent electronic static
or other discharge from damaging
or erasing evidentiary data.
Special evidence bags that are anti-static should be used
to store digital devices.
It's very important that you prevent electrostatic discharge
and other electrical discharges from damaging your evidence.
Some organizations even have cyber forensics labs
that control access
to only authorized users and investigators.
One method often used involves constructing
what is called a Faraday cage.
This cage is often built out of a mesh
of conducting material that prevents electromagnetic energy
from entering into or escaping from the cage.
Also, this prevents devices from communicating
via Wi-Fi or cellular signals.
Transporting the evidence to the forensics lab
or any other place including the courthouse,
has to be done very carefully.
It is critical that the chain of custody
be maintained during this transport.
When you transport the evidence,
you should secure it in a lockable container.
It is also recommended that the responsible person
stay with the evidence at all times
during the transportation.
Computer memory is any physical device capable
of storing information in a temporary or permanent state.
Memory can be volatile or non-volatile.
Volatile memory is memory that loses its contents
when the computer or hardware storage device loses power.
RAM is an example of volatile memory.
That's why you never hear people say
they are saving something to RAM.
It's designed for application performance.
You might be thinking that there isn't a lot of value
for the data stored in RAM.
However, from a digital forensics viewpoint,
the following data can be obtained by investigating RAM;
such as running processes, who's logged in,
passwords and clear text, unencrypted data,
instant messages, registry information,
executed console commands, attached devices,
open ports, listening applications.
Non-volatile memory and VRAM on the other hand,
holds data with or without power.
EPROM would be an example of non-volatile memory.