- [Instructor] If you are an administrator
or manage information systems and networks,
you should definitely understand cyber forensics.
So, forensics is the process of using scientific knowledge
for collecting, analyzing and presenting evidence
and specifically, in some cases, even to the court.
Or in court.
The word forensics means to actually bring to the court.
So, forensics deals primarily with the recovery and analysis
of latent evidence.
So, latent evidence, it can take many forms.
So from fingerprints left on a window
to DNA evidence recorded from blood stains
to files on a hard drive.
So in the world of cyber forensics,
this is actually more related
to what type of information can you collect
from the network and the devices to one,
understand how a breach or an attack actually took place,
how the attacker compromise the systems
and subsequently, potentially, through attribution
on who the attacker was.
Cyber forensics is often referred to as computer forensics.
On the other hand, cyber forensics is actually
a more appropriate term than computer forensics.
Now, the two primary objectives in cyber forensics
are to find out what happened and to collect data
in a manner that is acceptable in a court,
so into a court of law.
Any device that can store data
is potentially the object of cyber forensics,
including things like computers, servers,
desktop machines, laptops,
tablet, smartphones,
network infrastructure devices like routers,
switches, firewalls, intrusion prevention systems,
any other type of logs from those devices,
network management systems, printers
and even vehicles' GPSs.
So, chain of custody is actually an important term
in cyber forensics.
So, and it's extremely critical to forensics investigations.
Now, chain of custody is the way
that you document and preserve evidence
for the time that you actually started
the cyber forensics investigation
to the time the evidence is actually presented at a court.
And it is extremely important
to be able to show clear documentation of things
like how the evidence was collected, when it was collected,
how it was actually transported,
how it was actually tracked throughout the investigation
and how it was stored.
Also, log and document how and who
had access to the evidence and how it was actually accessed.
So it is actually really important to know
that if you fail to maintain proper chain of custody
it's likely that you cannot use that evidence in court.
It is also important to know how to dispose
evidence after an investigation.
So, when you collect evidence
you must protect its integrity.
This involves making sure that nothing
is added to the evidence
and that nothing is actually deleted or destroyed.
And this is actually also referred to
as evidence preservation.
So, a method actually often used for evidence preservation
is to only work from a copy, not the original,
but from a copy of the evidence.
So in other words,
do not directly work with the evidence itself.
This involves creating an image
of any hard drive or any storage device.
So, there's several forensic tools out there,
so I'm including here, the two most popular ones.
The first one is actually Guidance Software EnCase.
And I'm also including a link where you can get
more information about that software,
and AccessData, Forensic Toolkit.
Also, including a link here for your reference.
Another methodology used in evidence preservation
is to use write-protected storage devices.
In other words that the storage device
that you're actually investigating
should immediately be write-protected before it is imaged.
And it should be actually labeled to include
many things like the investigator's name,
the date, when the image was actually created
and even if applicable, a case number
or some type of tracking number.
Also, you must prevent that electronic static, right
or other discharge damages or erases
that data that you're actually preserving.
You can use evidence bags that are antistatic,
you should also use to store those type of bags
for storing any type of digital devices,
any type of things like motherboards or SSDs,
any type of information or devices' hardware
that you're actually collecting.
So it is very important
that you prevent electrostatic discharge or ESD
and other type of discharges for damaging that evidence.
So some organizations even have
cyber security forensics labs.
So, and they're very controlled access environment that are
you know, that are controlled
to authorized users and investigators only.
So a method that is actually often
used is constructing what we call a faraday cage,
and this is actually a cage that is often built
out of a mesh of conducting metal
that prevents electro-magnetic energy
from entering into the the area or escaping from that cage.
So it also prevents devices from communicating
via things like wifi or cellular signals and so on.
So you don't want for any device to actually be
either communicating out via wireless mechanisms.
Now, how you transport the evidence to the forensics labs
and any other place, including the courthouse,
has to be done in a very careful way.
So it is critical that the chain of custody
must be maintained during this transportation.
And whenever you transport the evidence,
it's best if you can secure store that evidence
in a lockable container.
So, some type of container, briefcase,
or something that is actually lockable or that has a lock.
It is actually recommended.
So it is also recommended that a responsible person
stays with the evidence at all times during transportation
and during the handling of the evidence.