- [Narrator] Cyber security forensics,
and specifically the art of collecting evidence
can take many different forms
depending on the conditions of each case
and also the devices from where you actually
are collecting that evidence, right?
Now, to prevent or minimize the contamination
of the actual source and that evidence,
you can use different tools
that includes things like a piece of hardware
called a write blocker, right?
And a specific device.
So you can actually copy all the data
or collect an image of the system, right?
And that's actually extremely important
that you preserve evidence in a correct way, right?
Now, the imaging process
is actually intended to copy all blocks of data
from the computing device
to the forensics professional evidentiary system, right?
So this is sometimes referred to as a physical copy
of all data as a distinct
from a local or logical copy, rather,
which is only copying
what the user will actually normally see, right?
So now logical copies do not capture all data
and the process will actually alter some of the metadata
to the extent that the forensics value of that data
is actually greatly diminished, right?
Now, that results in possible legal challenges
by the opposing legal team
in the case that you're actually in court.
Now, that's why a full bit forbid copy
is the preferred forensics process, right?
The file created on the target device
is actually called a forensics image
or forensics image file.
These are some of the most common file types
for forensics images for your reference.
They include like things like .AFF, .ASB, EO1, dd
or raw image files, and also virtual images formats
such as a VMDK or VDI in the case of VMs, right?
Now, the benefit of actually being able
to actually create an exact copy of the data
is that you can actually copy that data
and then the original device can be returned to the owner
or actually store for a trial
without normally having to actually be an examined
repeatedly, right?
So you actually work from that copy.
This also reduces the likelihood
of the drive to actually fail, for drive failures,
or evidence contamination, right?
Now, SANS has a good resource
that goes over disc imaging tools in cyber forensics.
And I'm actually including the link here for your reference.
So, I invite you to actually read that white paper
that goes over how disc imaging works
and also the different disc imaging tools available
in the market.
Now in short, imaging or disc imaging
is actually the process of making a forensically sound copy
to media that can retain the data
for extended amount of time, right?
One of the things to be careful about this
is actually to make sure that the entire image
or the entire disc it is actually taken
and that the disc imaging do not alter
the layout of the copy
or even omit free or deleted space, right?
That's important.
And you actually learn some of these concepts
earlier in this course.
Now, it is very important to have a forensically sound copy
of the original evidence
and that you only work from that copy, right?
And that's actually, of course,
to avoid making changes or altering the original image.
Now, in addition,
you should also use appropriate media
to avoid any alteration or contamination of the evidence,
right?
So, the original copy should be placed in a secure storage
or a secure safe.
There's also the process of file deletion
and also it's degradation
and eventually erase your,
through the system operation, right?
So these results
in many files being actually partly being stored
in the unallocated area of a system hard drive.
And typically,
such fragments of files can actually only be allocated
or carved out manually.
And typically, it's actually using a hex editor
to be able to identify the specific file headers, right?
Not only the file headers,
but also the footers and the segments held in the image.
And this is because the file system
allocation information is actually not typically available
and results in a very labor intensive
and is a challenging operation
for the forensics professional.
Now, file carving a continues to be an important process
using many cases where the recovery of the alleged,
deleted files is actually required, right?
So now there are different forensic tools
such as iLook IX, Encase and many others
that provides features that allows you to locate blocks
and sectors of hard drives
that actually can contain deleted important information,
right?
So recovering files from unallocated space
is actually usually referred to as data carving.
It is very important to make sure
that the timestamps of all files on a system being analyzed,
of course, during the cyber forensic investigation
are actually reliable, right?
And this is because it is critical
for making a valid reconstruction of key events
of that security incident or that specific attack.
Now, collecting evidence for mobile devices
is another thing that you actually have to worry about,
right?
So mobile devices such as cell phones, wearables, tablets,
are not imaged in the same way as desktops.
Today's internet of things or IOT landscape,
it is very different than from just a few years ago, right?
So now you actually have to worry about collecting evidence
from low power and low resource devices,
including not only mobile devices, but also sensors,
fog edge devices, and many others, right?
So now even your refrigerator, your thermostat,
different sensors around the house
or a manufacturing utility or a farm,
list goes on and on.
The world of IOT
this actually is becoming a lot more complicated.
Now, the hardware and the interfaces of these devices
from a forensics perspective are very different, right?
So for example, an iPhone cannot be accessed
unless you actually know the manufacturing password
from Apple.
And of course, there has been many dilemmas
and things in the news that you actually have heard before,
right?
This is because of course,
Apple uses a series of encrypted sectors
located in microchips
making it actually difficult to access specific raw data
inside the actual phones and tablets
and mobile devices that they produce.
Now also newer Android versions
also prevent more than backup being taken from a device
and no longer allow physical dumps to actually be recovered,
right?
So that's another challenge in some cases
in cyber security investigations and cyber forensics.
Now also in some cases,
not only is needed to collect evidence from mobile devices,
but also from mobile device management applications
or MDM solutions, right?
So that's something to actually keep in mind.
Another thing is actually collecting evidence
from networking infrastructure devices, right?
You can collect a lot of information
from network infrastructure devices
such as routers, switches,
wireless line controllers, load balancers, firewalls,
and many other devices that can be very beneficial
for cyber security forensics investigation, right?
So, collecting all this data can be easier said than done,
of course, right?
This is why it is extremely important
to have one or more systems
as a central log repository strategy
and to configure all your networking devices
to actually forward events
to these central log analysis tools, right?
You should also make sure that it can hold
several months worth of events, right?
So, as you actually learn during your preparation
for the previous exam the sec fund exam,
Syslog is actually often used to centralize
the collection of logs
and of course, to store that in centralized systems, right?
And now you should also increase the type of events
that are logged in your environment,
for example, DHCP events, and NetFlow, network metadata,
VPN logs, and so on.
Now, another important thing to keep in mind
is that network devices can also be compromised, right?
And subsequently the data generated by these devices
can also be assumed to be compromised
and manipulated by the attacker.
So, finding forensic evidence for these incidents
can be a little bit more troublesome and much harder
than what we think, right?
So, for example, a device actually can be compromised
to the fact that can be manipulated to,
let's say, perform network address translation.
But whenever you do a show run
or you show the configuration on the device
or show statistics of network address translation or net,
you don't see anything
because the attacker may have manipulated the system
that actually suppresses
not only the configuration parameters
but also the logs that are generated
that are relevant to that specific feature,
in this case net, right?
Now,
network infrastructure devices actually can be compromised
by different attack methods,
including of course, leftover troubleshooting commands
that the administrator actually may leaving there
or in the case of Cisco tech,
perhaps actually helping you in troubleshooting,
also manipulating Cisco IOS images, right?
Now modern technologies like Secure Boot of course,
prevents this.
But in the case of legacy devices,
actually we saw that in many cases
where the iOS images actually were manipulating
and being installing the devices,
also security vulnerabilities, of course.
Now, Cisco has several good resources
that goes over device integrity assurance
and also the verification of those devices.
And I'm including here tons of references,
including things like
the Ciscos Software Integrity Assurance,
same thing for Cisco XE Fee,
how to harden Cisco IOS devices,
also how to perform image verifications in Cisco IOS,
how to also do offline analysis of image integrity as well.
And of course, as you seeing here,
the list goes on and on.
Now, these documents go over
numerous identification techniques.
That includes image file verification
using MD5 and SHA256 using the image verification features,
not only in the device, but also offline,
verifying authenticity of digitally signed images,
running iOS runtime memory integrity verification
using core dumps,
also creating a known good text region
part of those type of core dumps as well.
And the text memory section export and how to analyze that.
And even checking for external accounting logs, Syslogs,
checking for boarding information,
checking their Roman variables and also Roman information
because in the past,
even the Roman has been compromised, right?
Now, there are several preventive steps
that you can actually take
to facilitate a forensics investigation
of networking devices.
And that actually includes different best practices
like maintaining the Cisco IOS image file integrity, right?
Also implementing change control,
hardening the software distribution server
that you actually use
to distribute the image to the devices,
keeping Cisco IOS software updated, right?
And making sure that you follow the Cisco PSIRT advisories,
security advisories,
and that you actually patch your devices,
of course, checking for Secure Boot,
Cisco supply chain security,
leveraging the latest iOS security protection features,
using authentication, authorization and accounting,
implementing configuration controls,
protecting the interactive access to devices,
gaining traffic visibility with NetFlow,
and also using centralized and comprehensive login
as we mentioned before.
So again, all this list is actually for your reference
and also included in the documents
that I provided the links before.