ciss360 assignment and study guide

Assignment and Study Guide for CISS360

Chapter One

Terms

affidavit: A notarized document. Under the penalty of perjury. Can be a declaration when the document in not notarized.
allegation: charge made before proof
approved secure container: A fireproof container locked by a key or combination
attorney-client privilege(ACP): client information divulged to an attorney is confidential
authorized requester: Private domain: has the right to request an investigation.
bit-stream copy: A bit by bit duplicate of data on the original storage medium. Known as acquiring an image or making a forensic copy
chain of custody: The path that evidence takes from the start of an investigation until closed.
Computer Technology Investigators Network(CTIN): Pacific Northwest group of investigators that collaborate on better investigative techniques
data recovery: recovering deleted files
Digitial Evidence Specialist(DES): One who collects and protects the integrity of the data/evidence
digital foresnics: providing evidence through investigative procedures for legal purposes
evidence bags: Non static bags used to transport any computer components or digit devices
evidence custody form: A hard copy form showing who checked evidence in/out
exculpatory evidence: Evidence that indicates suspect in innocent
exhibits: Evidence used in court to prove a case
forensic workstation: A work station that copies evidence
Fourth Admendment: Ensures probable cause for search
hostile work environment: A workplace that prevents employees from doing their job due to hostile interaction from others
inculpatory evidence: Evidence that indicates suspect is guilty
industrial espionage: Theft of valuable proprietory information/data/ or products from a company that is
International Association of Computer Investigative Specialist(IACIS): Software creators for digital forensics
interrrogation: Attempting to get a confession for a specific incident or crime
interview: Conversation conducted to collect information from a witness or suspect to verify related facts
line of authority: Order by which a problem in elevated through ranks. Each rank has the legal right to investigate and possess/control/access evidence
multi-evidence form: Evidence custody form used to list all items associated with a case
network intrusion detection and incident response: Detecting attacks from intruders by using automated tools and manual processes.
professional conduct: Expected behavior of a professional supporting ethical behavior and integrity.
repeatable findings: Duplicating a result continually to insure accuracy
search and seizure: Obtaining evidence legally
search warrants: Legal document providing the investigators the right to examine private property to support or prove an allegation
single-evidence from verdict: Form attached to each piece of evidence. Provides a log of evidence handling to ensure integrity of the evidence
vulnerability/threat assessment and risk management: Weakest points of an attack surface. Covers all types of security
warning banner: Provides instruction to the user for the proper use of the company computer
white-collar crimes: Financially motivated non violent crime. Typical white-collar crimes could include wage theft, fraud, bribery, Ponzi schemes, insider trading, labor racketeering, embezzlement, cybercrime, copyright infringement, money laundering, identity theft, and forgery

Review Questions

1. Digital forensics and data recovery refer to the same activities. True or False?: False
2. Police in the United States must use procedures that adhere to which of the following? a. Third Amendment b. Fourth Amendment c. First Amendment: b. Fourth Amendment
3. The triad of computing security includes which of the following? a. Detection, response, and monitoring b. Vulnerability assessment, detection, and monitoring c. Vulnerability/threat assessment and risk management, network intrusion detection and incident response, and digital investigation d. Vulnerability assessment, intrusion response, and monitoring
4. What's the purpose of maintaining a network of digital forensics specialists?
5. Policies can address rules for which of the following? a. When you can log on to a company network from home b. The Internet sites you can or can’t access c. The amount of personal e-mail you can send d. Any of the above: d. Any of the above
6. List two items that should appear on a warning banner
7. Under normal circumstances, a private-sector investigator is considered an agent of law enforcement. True or False?: False
8. List two types of digital investigations typically conducted in a business environment.: Private and Public
9. What is professional conduct, and why is it important?: Professional conduct infers ethical behavior and integrity.
10. What's the purpose of an affidavit: Ties the evidence to a source with a level of creditability
11. What are the necessary components of a search warrant?: Case number, Investigating organization, Investigator
12. What are some ways to determine the resources needed for an investigation?: To define the objectives of the investigation
13. List three items that should be on an evidence custody form.: Date, case number, investigators organization and investigator's name name
14. Why should you do a standard risk assessment to prepare for an investigation?: To understand risk associated with investigation.
15. You should always prove the allegations made by the person who hired you.: False
16. For digital evidence, an evidence bag is typically made of antistatic material. True or False?: true
17. Why should evidence media be write-protected?: To protect the data from accidental deletion.

18. List three items that should be in your case report.: The process addressed, steps you took and description of findings
19. Why should you critique your case after it's finished: To improve your technique and provide a log to review for future cases
20. What do you call a list of people who have had physical possession of the evidence?: chain of custody
21. Data collected before an attorney issues a memo for an attorney-client privilege case is protected under the confidential work product rule. True or False?: True

Chapter One notes from Power Point Slides

ISO standard for digital forensics was ratified in October 2012: To insure a standard for Security techniques.
Federal Rules of Evidence (FRE): Ensured consistency in federal proceedings
FBI Computer Annalysis and Response Team (CART) was formed to handle cases involving digital evidence: was formed to handle cases involving digital evidence
CART: teamed up with the Department of Defense Computer Forensics Laboratory
Fourth amendment protects everyone' right to be secure from search and seizure: Every U.S. Jurisdcition has case law regarding evidence recovered from computers and other digital devices
This ensures the legality of the process: In terms of forensics investigating digital devices means:
Collecting data securely
investigating suspect data for origin and content
Presentation of forensic data to courts
Applying laws to digital device practices: Digital forensics is differrent from data recovery.
Data recovery is retrieving information that was deleted by mistake or lost: Forensics investigators often work as part of a team, know as an investion _____________?
Triand: A triand is three sides of a triangle...name them?; 1. Vulnerability and threat assessment and risk management.; 2. Network intrusion detection and incident response; 3. Digital Investigations
History of Digital Forensics: 1990's International Association of Computer Invertigative Specialist (IACIS); IRS created search-warrant programs; ASR Data created Expert Witness for Macintosh; ILOOK maintained IRS Criminal Investigation Division; AccessData Forensic Toolkit (FTK) is a popular commercial product
When statue's don't exist, case law is used: Allow legal counsel to determine if "Case law can be presuade"
Examiners must be familiar with recent court rulings on search and seizure in the electronic environment: How can I "To supplement your knowledge"
Develop and maintain contact with computing, network, and investigative professionals
Join computer user groups in both the pubic and private sectors
TRY: Computer Technology Investigators Network (CTIN)
Consult outside experts: Public-sector investigations involve government agencies responsible for criminal investigations and prosecution
Fourth Amendment to the U.S. Constitution•Restrict government search and seizure: When conducting public-sector investigations, you must understand laws on computer-related crimes including
Standard legal processes•Guidelines on search and seizure•How to build a criminal case: The Computer Fraud and Abuse Act was passed in 1986
Specific state laws were generally developed later: How does a criminal investigation start?
1. Witness or victim makes an allegation to the police
2. Police interview the complainant and writes a report about the crime
3. Report is processed and management decides to start an investigation or log the information in a police blotter
4. Blotter is a historical database of previous crimes
DEFR: First Responder, assesses, takes precaution and acquires and preserves evidence
DES Digital Evidence Specialist: Has the skill to analyze the data and determine when to use another specialist
Affidavit..sworn statement to support facts about or evidence of a crime and must include exhibits: Private sector uses legal means to address violations of company policies and litigation disputes. ie wrongful termination
Businesses strive to minimize litigation
Private sector crimes can involve harassement, email problems, falsification of data, gender and age discrimination, embezzelment, sabotage and industrial espionage
Businesses can publish policies to reduce risk of litigation
Post policies that define rules for computer and the network: What is a line of authority?
States who has the legal right to intiate an investigation.: How does a warning banner help?
A warning banner post a message stating company policy and divulges the r right to monitor use.: What are examples of an authorized requester?
Corporate Secuirty investigations
Corporate ethics office
Corporate equal employment opportunity office
internal auditing
General counsel or legal department: Private investigations search for What?
Evidence to support allegations of violation of company policy: What three common situations?
Abuse or misuse of computing assets
E-mail abuse
internet abuse: What positive outcome does a private investigator seek?
Minimizing risk to the company.
BYOD creates what kind of problem?: When it is attached to the network, one does not know who owns it.
What do some companies policies state when you connect a BYOD to your network?: They take ownership of the device.
What are characteristics of Professional conduct?: Ethical, maintains objectivity and confidentiality. Invest in continual education to stay current.
What is an investgators job?: To gather evidence in order to prove allegations of violation of company policy.
What is the purpose of collecting evidence?: Investigate the suspect's computer; Preserve the evidence to another computer; Make it available to the courts and corporate inquires.; Protect the chain of custody.
Why are computers so important to an investigator?: Computer both harbor evidence and contain evidence which can lead to conviction.
What is important when acquiring evidence?: Making sure evidence is not altered and or deleted; Potential evidence might be password protected
What are common misuses of computers?: surfing the internet; Sending personal emails; Using company computers for personal tasks.
What are the steps for problem solving?: What type of case is it?; Design the approach; Detailed checklist; Determine resourcs; Obtain and copy an evidence drive; identify the risks of losing the investigation; Minimize risk of compromising the investigation; Test the design you have for the investigation; Analyze and recover the digital evidence.; Investigate the data you recovered; Complete the case report; Critique the case
How do you systematically outline the case details?: Define the situation; Determine the nature of the case; List the specifics of the case; What type of evidence do you need.; Determine disk format; Locate the evidence; Based on these above factors you can determine the requirements for the case
What most a baics investigation plan include?: Acquire the evidence; Complete the evidence form and establish chain of custody; Transport the evidence to a computer forensics lab; Secure evidence in an [approved secure container]; Prepare your [forensics workstation]; retrieve the evidence from the secure container; Make a forensic copy of the evidence; Return the evidence to a secure container; Process the copied evidence with computer forensics tools
What are two types of [evidence custody form] also known as:?: chain of evidence form; [Single evidence form]; [Multi-evidence form]; What is an example of a [multi-evidence form]. This form is missing a signature line at the bottom.

What are important steps to take when securing evidence?: Use evidence bags; Computer safe products when collecting evidence like antistatic bags and pads; Use padded containers; Use tape to seal containers; Use CD drive bays; Use insertion slots for power supply electrical cords and usb cables; write intials on tape to prove "no tampering"; Make sure you have a safe environment for transporting and storing
What is a general overview of procedures you need to develop as an investigator?: Informal checklists; Make sure you know all the issues; ensure the correct techniques are used in an investigation
Employee termination is usually due to?: Abuse of corporate assest; Creating a hostile workplace; Viewing pornography; Sending inappropriate emails
In an organization what ensures or minimizes inappropriate conduct?: Posted policies
For internet abuse cases what does a investigator need to processs a case?: Organization's internet proxy server logs; Suspect computer's ip address; Your preferred computer forensics analysis tool
What are the recommended steps for an Internet Abuse investigation: Use standard forensic analysis techniques and procedures; Use appropriate tools to extract all Web page URL information; Contact the netowrk firewall administrator and request a proxy server log; Compare the data recovered from the forensic analysis to the proxy server log; Continue anlyzing the computer's disk drive data
How do you conduct an email abuse investigation?: Electronic copy of the offending email that contains the message header; email server logs; access local email server if messages stored there; Access the computer so you can perform an forensic analysis on it; Use your preferred computer forensics analysis tool; What are the recommended steps?; Use the standard forensic analysis; Obtain an electronic copy; Use FTK Internet Keyword Search option to extract all related email address information; examine header data of all messages
What are the rules for ACP or Attorney Client Privelege?: You must keep findings confidential; Have printouts of data you recovered; Attorneys must follow the rules for examining digital evidence; Make sure you understand the format the data.
What are the steps for an ACP investigation?: Obtain permission from [line of request]; List keywords of interest to investigation; Initiate the investigation with a plan; Make two bit stream images using different tools for each image; Compare hash signatures on all files to the original and re-created disks; Methodically examine every portion of the disk drive and extract all data; Run keyword searches on allocated and unallocated disk space; Windows OS's extract relevant registry entries; For binary data files such as CAD drawings, locate the correct software product; For unallocated data recovery, use a tool that removes or replaces nonpritable data
What are the steps for conducting an ACP case?: Consolidate all recovered data from the evidence bit-stream image into folders and subfolders; Minimize written communications with the attorney; Any communication written to the attorney must contain a header stating that it is "Priveleged Legal Communication-Confidential Work Product; Assist the attorney and paralegal in analyzing the data
Industrial espionage should be treated as criminal investigation
Staff needed: Digital investigator who is responsible for disk forensic examination; Technology specialist who is knowledgeable of the suspected compromised technical data; Network specialist who can perform log analysis and set up network sniffers; threat assessment specialist (typically an attorney
Guidelines when initiating an investigation: Determine whether this investigation involve a possible industrial espionage incident; Consult with legal advice/upper management; How to substantiate the allegation; Create list of keywords for disk forensics and sniffer monitoring; List and collect Resources for the investigation; Determine goal and scope of investigation
Planning considerations:: Examine all e-mail of suspected employees; Search internet newsgroups or message boards; Initiate physical surveillance; Examine facility physical access log for sensitive areas; Determine suspect location relative to asset; Study suspects work habits; Collect outgoing and ingoing phone logs
Steps to conducting an industrial espionage case: Brief personnel on the plan; Gather resources to conduct the investigation; Place surveillance systems at key locations; Discreetly gather any additional evidence; Collect all log data from networks and email servers; Report regulary to management and corporate attorneys; Review the inestigation's scope with management and corporate attorneys
Become a skilled interviewer and interrogator: Interview witness or suspect; Interrogation to get a suspect to confess.
Role as a digital Investigator: To instruct the investigator conducting the interview on what questions to ask and what the answers should be
Ingredients for a successful interview or interrogation: Being patient throughout the session; repeating or rephrasing the question to zero in on specific facts; Being tenacious
forensics lab or data-recovery lab: In data recovery, the customer or your company just wants the data back
Computer forensics workstation: A specially configured PC; Loaded with additionals bays and forensics softwar
To avoid altering the evidence use:: write-blockers devices; enable you to boot to windows without writing data to the evidence drive
Basic Requirements: A workstation running Windows 7 or later; a write-blocker device; Digital forensics acquistion tool; Target drive to receive the source or supect disk data; Spare PATA or SATA ports; USB ports
Additional useful itmes: Network interface card (NIC); extra usb ports; firewire 400/800 ports; SCSI card; Disk editor tool; Text editor tool; Graphic viewer program; other specialized viewing tools; gather resources indentified in investigation plan
Items needed: Original storage media; evidence custody form; evidence container for the storage media; Bit-stream imaging tool; forensic workstation to copy and examine your evidence; Securagle evidence locker, cabinet, or safe.; Avoid damaging the evidence
Bit-stream copy: Difference gets all bits on the disk, not just a backup. All slack and out of sector information
Bit-streams image: Known as an image and copies all data on a partition.; Important: Use a duplicate storage medium that matches manufactur's size and model
Acquiring an Image of evidence media: First rule: Preserve the original evidence; Conduct your analysis only on a copy of the data; Vendors provide acquisition tools; Windows tools require a write-blocking device when accquiring FAT or NTFS
What rates a good a complete job to get data?: Deleted files; File fragments; complete files
Process name for deleted files?: Autopsy
Steps to analyze a USB drive: Start Autopsy; Create a new case; Type the case name; Select the working folder
Steps to add source data: Select data source type; Select image file; Keep the default setting in the configure Ingest Module window...
Steps to display the contents of the acquired data: Click to expand Views, File types, By Extension, and Documents; Select the file to display; tag and comment; New Tag Name
What is the goal in analyzing the data: Search for information related to the complaint; Data analysis can be time-consuming task
Autopsy: Search for keywords; Display results; Click each file in the search results; export data; Search for specific filenames; Generate a report of all your activities
Additional features of autopsy: Display binary (nonprintable) data in the content viewer
Learn how to use Autopsy to build a report: Make sure you include the Autopsy program finding in your report
Why is "repeatability so important": Proves that it is not a intermittent result.
Why use a template?: Standarizes report and give you a form log that you can critique or edit over time.
Report objectives are findings of conclusive evidence.: Suspect did or did not commit crime.
Important: Keep a written journal of everything: Remember your notes can be used in court; Answer the six W's...yotnew; Requirement: You must also be able to explain the workings of the computer and network processes
Autopsy Report Generator:: html; excel; Text
Steps for Industrial Espionage: Gather all personnel and brief; Organize resources; Place surveillance systems at key locations; Discreetly gather any additional evidence; Colloect all log data; Report regularly to management; Review investigation's scope and report.
Skilled interviewer and interrogator: Interview: get facts to support; Interrogation: Process of trying to get a suspect to confess
Role as digital investigator: To instruct the investigator on what to ask and what the answers should be.
What are the ingredients for an investigations?: Patience; Repeating or rephrasing question to zero in on specific facts.; Tenacity
Data Recovery: Just want their data back vs Forensic for evidence
Forensic workstations: Specifically configured Pc or Apple
Has special bays and forensic software: How do you protect the evidence?; Write blockers are used which protects data during boot
What are the basic requirements for a Digital workstation: Win 7 or later; write blocker; Digital evidence software to capture data; Digital forensics analysis tool; Target drives; Spare PATA and SATA ports; extra usb ports
What questions should you ask?: Performance: improve your overall techniques?; Did the case develop the way you wanted it...bias!!s; Documentation: was it thorough?; Requesting source...did you get any feedback? postive/negative; New enlightening problems that can be logged and discussed.; Did you introduce new techniques and if so how did it work out?
What size are sectors in bytes?: A sector is size on hardware as a continouse address space. A sector could be different sizes. Sectors are organized in clusters.
CHS?
What is zone bit recording?
Areal density?
Clusters in Windows always begin at what number?
How many sectors in a cluster?: Varies depending on drive size....sectors per cluster
List three items stored in the fat database: file names, directory names, date and time stamps, the starting cluster number and file attributes (archive, hidden, system, and read-only
Ntuser.dat file contain?: User-protected storage area; containsthe list of most recently used files and desktop configuration settings
In FAT32, 123 KB file uses how many sectors?
What is the space on a drive called when a file is delected?: slack
List two features NTFS has that FAT does not?: Encryption and accomodates larger size.
MFT?: Tracks NTFS file information
In NTFS, files smaller than 512 bytes are stored in the MFT?
In Windows 7 and later, how much data from RAM is loaded into RAM slack on a disk drive?
Virtual cluster number?
Why was EFI boot firmware developed?: Provide user access from the operating system?
Device drivers contain what kind of information?: Instructions allowing the operating system to talk to Devices
Which of the following Windows 8 files contains user-specific information? user.dat, ntuser.dat, system.dat, sam.dat
Virtual machines have which of the following limitations when running on a host computer?
An image of a suspect drive can be loaded on a virtual machine. True or False?
EFS can encrypt which of the following?: NTFS file systems
What happens when you copy an encrypted file from an EFS-enabled NTFS disk to a non-EFS disk or folder?: The file decrypts.
What is a recovery certificate and how is it handle?: Provides a way to recover the certificate using the [EFS Recovery Key Agent] You can intiate a recovery two way, throught windows or from a command prompt using cipher or copy.
Whole Disk Encryption: Prevent divulging of data when device stolen.
What is a good third party tool accessing registry?: FTK Registry viewer
Downloaded to computer

Chapter Six

Terms

acquisition
brute-force attack: run on encrypted file if rainbow tables fail
Computer Forensics Tool Testing (CFTT): NIST provides guidelines for testing new tools
extraction
keyword search
National Software Reference Library: list of known file hashes for a variety of OSs, applications and images. Also hash values for mobile apps, specifically IOS and Android
password dictionary attack: dictionary of passwords to use to break the system. Passwords are usually one way hashes...meaning you can not apply an algorithm to break them.
reconstruction: Recreates a suspect drive to show what happened during a crime or incident. Methods for reconstruction are disk to disk copy, partiiton to partition copy, image to disk copy, image to partition copy, disk to image copy and rebuilding files from data runs and carving.
validation: validates the tool
verification: verifies the data
write-blocker: Simplest write of disk
The simplest method of duplicating a drive is using a tool that makes a direct disk-to-image copy from the suspect disk to the target location.
Shadowing a Drive: Time critical...attach parrallel drive and all writes go to it when live. Useful in court to show evidence

Assignment and Study Guide for CISS360

Chapter One

Terms

Review Questions

Chapter One notes from Power Point Slides

Chapter Two Lab Download and try autopsy March 20, 2020

Chapter Two

Chapter Two

Chapter Three

Chapter Four

Steve Gibson Security Now

Chapter Five

Chapter Six

Terms

Chapter Seven

Terms