Computer Forensics 101 Essential Knowledge for 21 st Century Investigators with Case Studies Presented by Steve Abrams, M.S. Abrams Computer Forensics.

Computer Forensics 101

Essential Knowledge for 21st Century Investigators

with Case StudiesPresented by Steve Abrams, M.S.

Abrams Computer ForensicsCharleston, SC / Long Island, NY

(866) 301-5331 * www.AbramsForensics.com

SCALI Annual Seminar

May 8, 2004

What is Computer Forensics ?

What is Computer Forensics ?

The search for, and the collection of, evidence from computer systems in a standardized and well-documented manner to maintain its admissibility and probative value in a legal proceeding.

Computer Forensics is not “Hacking”

Never use “Spy-ware”Never use “Spy-ware”Never “hack” a passwordNever “hack” a password

Never login to an account unauthorized Never login to an account unauthorized ((without a warrant or court orderwithout a warrant or court order))Keystroke loggers no longer legalKeystroke loggers no longer legal

All of these violations are now All of these violations are now (usually)(usually) a a felony.felony. The The law is in flux, beware!law is in flux, beware!

Computer Forensics is not “Hacking”

Stick to the evidence left on the hard Stick to the evidence left on the hard drive, and you should be on safe legal drive, and you should be on safe legal ground. Provided you have proper ground. Provided you have proper consent to search the hard drive.consent to search the hard drive.

Component Steps of Computer ForensicsComponent Steps of Computer Forensics

1. Make a Forensic Image2. Create Indexes and setup “case”3. Look for evidence within the image4. Generate Report (CD-ROM / Written)

Component Steps of Computer ForensicsComponent Steps of Computer Forensics

Make a Forensic ImageMake a Forensic Image Requires Extensive Knowledge of Computer

Hardware and Software, Especially Operating Systems and File Systems.

Requires Special “Forensics” Hardware and Software

Requires Knowledge of Proper Evidence Handling.

In Most States Requires a P.I. License, and Consent to Search the Computer.

Consent Consent

Who Can Consent to a SearchWho Can Consent to a Search(Spouse, Parent, Business Owner)

Get it in WritingGet it in Writing(Boilerplate Affidavits)

STATE OF SOUTH CAROLINA )

)

COUNTY OF _______________ )

Affidavit of _______________________

Consent given to search a personal computer.

  PERSONALLY appeared before me the undersigned who duly sworn and says as follows:

1.     My Name is _______________________________________. I reside

at _____________________________________________________

2.  I have hired Steven M. Abrams, M.S., P.I., to conduct a computer forensics examination of a hard drive from a personal computer, which is in my possession.

3.     I have consented to a search by Mr. Abrams of all data contained on the hard drive.

4.     I attest that the computer hard drive which I have consented to have searched is marital property; to which I have had unfettered access.

5.     I acknowledge that I have been informed that state and federal law requires Mr. Abrams to notify law enforcement authorities of any suspected child pornography or evidence of criminal activity found on a computer during his examination.

Component Steps of Computer ForensicsComponent Steps of Computer Forensics

Make a Forensic ImageMake a Forensic ImageRule #1 – Never Alter the Evidence Rule #1 – Never Alter the Evidence Media in the Process of making a Media in the Process of making a Forensic Image.Forensic Image.

This necessitates special hardware and software.

Component Steps of Computer ForensicsComponent Steps of Computer Forensics

Create Indexes and setup “case”Create Indexes and setup “case”Access Data Forensic Toolkit (FTK)

Based on the dtSearch EnginedtSearch Engine, requires an index step which can take several hours or days to complete. After which keyword / expression searches are instantaneous.

Component Steps of Computer ForensicsComponent Steps of Computer Forensics

Create Indexes and setup “case”Create Indexes and setup “case”Access Data Forensic Toolkit (FTK) Implements “Hashing” which allows standard

system software and duplicate files to be safely ignored, and dangerous files (e.g. Child Porn) to be identified automatically.

FTK Hashing is Based on the Known File Filter (KFF) Engine.

HashingHashingHashingHashing

A hash value (or simply hash), also called a message digest, is a number generated from a string of text. The hash is substantially smaller than the text itself, and is generated by a formula in such a way that it is extremely unlikely that some other text will produce the same hash value. In Computer Forensics, hashes are used to uniquely identify a specific file. The hash value generated from a file becomes its “digital fingerprint”. MD5 and SHA are the two most common hash algorithms used in computer forensics.

HashingHashingHashingHashing

Hash codes can be used to quickly match files found during your investigations to lists of “Known Files” maintained by the Federal Government and Federal Law Enforcement Agencies.

These “Known Files” can include innocent files, such as components of MS Windows and “off the shelf” application software, that can safely be ignored by your investigations.

These “Known Files” can also include contraband files, such as child pornography and hacker tools, that should be highlighted by your investigations.

Component Steps of Computer ForensicsComponent Steps of Computer Forensics

Look for evidence within the imageLook for evidence within the image View Graphics, Emails, Documents, etc. Keyword Searches Bookmark relevant material for inclusion into report Good investigation skills needed, must interview the

client to get background material needed to focus the CF investigation.

Component Steps of Computer ForensicsComponent Steps of Computer Forensics

Generate CF ReportGenerate CF Report Usually in HTML format Can be printed or on CD-ROM Basis for Investigation Report, Affidavits,

Deposition and Testimony. CF Report often supplemented with other

investigation methods (Online Databases, Email / Phone Interviews)

Live FTK Demo

Demonstrate Steps of a Computer Forensics Examination

Case HistoriesCase HistoriesCase HistoriesCase Histories

Case HistoriesCase HistoriesDomestic RelationsDomestic Relations

Case HistoriesCase HistoriesDomestic RelationsDomestic Relations

Case HistoriesCase HistoriesDomestic RelationsDomestic Relations

Case HistoriesCase HistoriesDomestic RelationsDomestic Relations

PornographyPornographyAdulteryAdulteryFinancial AssetsFinancial Assets

Case HistoriesCase HistoriesWiretap / E.C.P.A.Wiretap / E.C.P.A.

Case HistoriesCase HistoriesWiretap / E.C.P.A.Wiretap / E.C.P.A.

Case HistoriesCase HistoriesFinancial CrimesFinancial CrimesCase HistoriesCase Histories

Financial CrimesFinancial Crimes