Table Of ContentIT/INFORMATION SECURITY/FORENSIC
Sachowski
Digital Forensics investigations
and
Digital Forensics
People, Process, and Technologies to Defend the Enterprise
D
Digital forensics has been a discipline of Information Security for decades now.
investigations
Its principles, methodologies, and techniques have remained consistent despite i and
the evolution of technology, and, ultimately, it and can be applied to any form of g
digital data. However, within a corporate environment, digital forensic professionals
i
are particularly challenged. They must maintain the legal admissibility and forensic t
viability of digital evidence in support of a broad range of different business functions a
that include incident response, electronic discovery (ediscovery), and ensuring the People, Process, and Technologies
l
controls and accountability of such information across networks.
F to Defend the Enterprise
Digital Forensics and Investigations: People, Process, and Technologies to o
Defend the Enterprise provides the methodologies and strategies necessary for
r
these key business functions to seamlessly integrate digital forensic capabilities
to guarantee the admissibility and integrity of digital evidence. In many books, the e
focus on digital evidence is primarily in the technical, software, and investigative n
elements, of which there are numerous publications. What tends to get overlooked
s
are the people and process elements within the organization.
i
c
Taking a step back, the book outlines the importance of integrating and accounting for
the people, process, and technology components of digital forensics. In essence, to s
establish a holistic paradigm—and best-practice procedure and policy approach—
a
to defending the enterprise. This book serves as a roadmap for professionals to
n
successfully integrate an organization’s people, process, and technology with other d
key business functions in an enterprise’s digital forensic capabilities.
i
n
Selling Points:
v
• Focuses on the strategic implementation of a digital forensic program within e
an enterprise s
• Addresses the administrative, technical, and physical components required t
for enterprise digital forensic capabilities i
g
• Details the people, process, and technology requirements for integrating digital
a
forensic capabilities throughout the enterprise
t
• Emphasizes the inherent benefits of infusing forensic processes and procedures i
throughout the enterprise itself, building from the inside out o
n
• Highlights the organizational, training, and implementation hurdles that can
s
derail sound forensic practices within a business organization
Jason Sachowski
K32256
6000 Broken Sound Parkway, NW
Suite 300, Boca Raton, FL 33487
711 Third Avenue
an informa business New York, NY 10017
2 Park Square, Milton Park
www.crcpress.com Abingdon, Oxon OX14 4RN, UK
K32256_cover.indd 1 4/2/18 2:37 PM
Digital Forensics and
Investigations
9781138720930_C000.indd Page i 12/04/18 12:27 PM
9781138720930_C000.indd Page ii 12/04/18 12:27 PM
Digital Forensics and
Investigations
People, Processes, and Technologies to
Defend the Enterprise
Jason Sachowski
CRC Press
Taylor & Francis Group
6000 Broken Sound Parkway NW, Suite 300
Boca Raton, FL 33487-2742
© 2018 by Taylor & Francis Group, LLC
CRC Press is an imprint of Taylor & Francis Group, an Informa business
No claim to original U.S. Government works
Printed on acid-free paper
International Standard Book Number-13: 978-1-138-72093-0 (Hardback)
This book contains information obtained from authentic and highly regarded sources. Reasonable efforts
have been made to publish reliable data and information, but the author and publisher cannot assume
responsibility for the validity of all materials or the consequences of their use. The authors and publishers
have attempted to trace the copyright holders of all material reproduced in this publication and apologize
to copyright holders if permission to publish in this form has not been obtained. If any copyright material
has not been acknowledged please write and let us know so we may rectify in any future reprint.
Except as permitted under U.S. Copyright Law, no part of this book may be reprinted, reproduced,
transmitted, or utilized in any form by any electronic, mechanical, or other means, now known or hereafter
invented, including photocopying, microfilming, and recording, or in any information storage or retrieval
system, without written permission from the publishers.
For permission to photocopy or use material electronically from this work, please access www.copyright.
com (http://www.copyright.com/) or contact the Copyright Clearance Center, Inc. (CCC), 222 Rosewood
Drive, Danvers, MA 01923, 978-750-8400. CCC is a not-for-profit organization that provides licenses and
registration for a variety of users. For organizations that have been granted a photocopy license by the CCC,
a separate system of payment has been arranged.
Trademark Notice: Product or corporate names may be trademarks or registered trademarks, and are
used only for identification and explanation without intent to infringe.
Visit the Taylor & Francis Web site at
http://www.taylorandfrancis.com
and the CRC Press Web site at
http://www.crcpress.com
Contents
Preface ................................................................................................................xi
Acknowledgments ............................................................................................xiii
About the Author ..............................................................................................xv
Introduction ....................................................................................................xvii
SeCtion i enABLinG DiGitAL FoRenSiCS
1 Introduction to Digital Forensics ...........................................................3
A Brief History of Forensics and Technology ................................................3
Evolutionary Cycle of Digital Forensics ........................................................7
Technical and Scientific Working Groups .....................................................9
Scientific Working Group on Digital Evidence (SWGDE) .........................12
Principles of Digital Forensics ....................................................................13
Summary ...................................................................................................17
Glossary .....................................................................................................17
2 Investigative Process Methodologies ....................................................19
Existing Process Models .............................................................................19
Mapping Out Process Models ....................................................................22
The Process Methodology Workflow ..........................................................24
Summary ...................................................................................................33
Glossary .....................................................................................................33
3 Education, Training, and Awareness ....................................................35
Organizational Roles and Responsibilities ..................................................35
Types of Training and Awareness ................................................................39
Specializations ............................................................................................41
An Educational Roadmap ..........................................................................42
Nontechnical Knowledge ...........................................................................45
Educational Resources ................................................................................50
Summary ...................................................................................................51
Glossary .....................................................................................................51
v
vi ◾ Contents
4 Laws, Standards, and Regulations .......................................................53
The Role of Technology in Crime ...............................................................53
A Brief History of Crime and Technology ..................................................55
Types of Laws .............................................................................................56
Federal Rules of Evidence ...........................................................................59
Good Practices for Computer-Based
Electronic Evidence....................................................................................61
Legal Precedence ........................................................................................61
Search Warrants ........................................................................................64
Subpoenas ..................................................................................................65
Jurisdiction ...............................................................................................66
Summary ...................................................................................................66
Glossary ....................................................................................................66
5 Ethics and Professional Conduct..........................................................69
Importance of Ethics ..................................................................................69
Principles of Ethics .....................................................................................70
Ethics in Digital Forensics ..........................................................................72
Certifications and Accreditations ................................................................77
Summary ...................................................................................................78
Glossary .....................................................................................................78
SeCtion ii enHAnCinG DiGitAL FoRenSiC CAPABiLitieS
6 The Business of Digital Forensics .........................................................81
The Role of Digital Forensics in an Enterprise ............................................81
Starting a Digital Forensic Program ............................................................82
Maintaining a Digital Forensic Program .....................................................97
Challenges and Strategies .........................................................................102
Industry Regulation .................................................................................102
Political Influences ...................................................................................103
Summary .................................................................................................103
Resources .................................................................................................104
Glossary ...................................................................................................104
7 Controlling Mobile Devices ...............................................................107
Brief History of Mobile Devices ...............................................................107
Persistent Threats and Challenges .............................................................108
Mobile Device Governance ......................................................................111
Enterprise Management Strategies ............................................................114
Device Management Methodologies ........................................................116
Device Management Capabilities .............................................................117
Mobile Device Process Methodology ........................................................120
9781138720930_C000.indd Page vi 12/04/18 12:27 PM
Contents ◾ vii
Legal Considerations ................................................................................129
Summary .................................................................................................130
Resources .................................................................................................130
Glossary ...................................................................................................131
8 Cloud Computing Enablement ...........................................................133
Brief History of Cloud Computing ..........................................................133
What is Cloud Computing? .....................................................................134
Persistent Threats and Challenges .............................................................137
Cloud Computing Governance ................................................................139
Enterprise Management Strategies ............................................................141
Cloud Computing Process Methodology ..................................................147
Legal Considerations ................................................................................153
Summary .................................................................................................154
Resources .................................................................................................155
Glossary ...................................................................................................155
9 Combatting Antiforensics ..................................................................157
What Are Antiforensics? ...........................................................................157
Traditional Techniques .............................................................................158
Detection Methods ..................................................................................167
Strategic Countermeasures .......................................................................171
Summary .................................................................................................172
Resources .................................................................................................172
Glossary ...................................................................................................173
10 Digital Evidence Management ...........................................................175
Types of Digital Evidence .........................................................................175
Evidence Gathering Considerations..........................................................182
Cause and Effect ......................................................................................186
Data Security Requirements .....................................................................188
Preservation Strategies ..............................................................................191
Enterprise Log Management ....................................................................196
Summary .................................................................................................200
Resources .................................................................................................200
Glossary ...................................................................................................201
11 Digital Forensic Readiness .................................................................203
Forensic Readiness 101 ............................................................................203
Cost versus Benefit ...................................................................................204
Ten Steps to Forensic Readiness ...............................................................205
Achieving Forensic Readiness ...................................................................216
Summary .................................................................................................216
Glossary ...................................................................................................217
9781138720930_C000.indd Page vii 12/04/18 12:27 PM
viii ◾ Contents
SeCtion iii inteGRAtinG DiGitAL FoRenSiC CAPABiLitieS
12 Incident Management and Response ..................................................221
Understanding the Incident Response Workflow ......................................221
The Incident Response Team (IRT) ..........................................................227
What to Expect During an Incident .........................................................229
Investigative Techniques ...........................................................................235
Reverse Engineering Malware ...................................................................237
Timeline Analysis .....................................................................................238
Summary .................................................................................................239
Glossary ...................................................................................................240
13 Electronic Discovery and Litigation Support .....................................241
What is Electronic Discovery (eDiscovery)? ..............................................241
Understanding the eDiscovery Workflow .................................................248
Managing Litigation Discovery ................................................................257
The Role of Digital Forensics in a Litigation .............................................259
Discovering Electronically Stored Information (ESI) ................................261
Summary .................................................................................................263
Resources .................................................................................................263
Glossary ...................................................................................................263
14 Information Security and Cybersecurity ............................................265
Information Security vs Cybersecurity ......................................................265
Digital Forensics in Enterprise Security ....................................................269
Security Investigations ..............................................................................283
Summary .................................................................................................290
Resources .................................................................................................291
Glossary ...................................................................................................291
SeCtion iV APPenDiXeS
Appendix A: Investigative Process Models ..................................................295
[P01] Computer Forensic Investigative Process (1995) .............................297
[P02] Computer Forensic Process Model (2001) ......................................297
[P03] Digital Forensic Research Workshop (DFRWS) Investigative
Model (2001) ...........................................................................................298
[P04] Scientific Crime Scene Investigation Model (2001) ........................298
[P05] Abstract Model of the Digital Forensic Procedures (2002) ..............298
[P06] Integrated Digital Investigation Process (2003)...............................299
[P07] End-to-End Digital Investigation (2003) ........................................299
[P08] Enhanced Integrated Digital Investigation Process (2004) ..............300
[P09] Extended Model of Cybercrime Investigation (2004) .....................300
[P10] A Hierarchical, Objective-Based Framework for the Digital
Investigations Process (2004) ...................................................................301
9781138720930_C000.indd Page viii 12/04/18 12:27 PM
Contents ◾◾ iixx
[P11] Event-Based Digital Forensic Investigation Framework (2004) .......301
[P12] Four Step Forensic Process (2006) ..................................................301
[P13] Framework for a Digital Forensic Investigation (2006) ...................302
[P14] Computer Forensic Field Triage Process Model (2006) ...................302
[P15] FORZA: Digital Forensics Investigation Framework (2006) ...........302
[P16] Process Flows for Cyber Forensics Training and
Operations (2006) ...................................................................................303
[P17] Common Process Model for Incident and Computer
Forensics (2007) ......................................................................................303
[P18] Dual Data Analysis Process (2007) ................................................304
[P19] Digital Forensic Investigations Framework (2008) .........................304
[P20] Digital Forensic Model Based on Malaysian Investigation
Process (2009).........................................................................................304
[P21] Generic Framework for Network Forensics (2010) .........................305
[P22] Generic Computer Forensic Investigation Model (2011) ................305
[P23] Systematic Digital Forensic Investigation Model (2011) ................306
[P24] Advanced Data Acquisition Model (ADAM) (2011) .....................306
Appendix B: Education and Professional Certifications .............................307
Professional Certifications ........................................................................307
Formal Education Programs .....................................................................309
SeCtion V teMPLAteS
Template A: Investigator Logbook ..............................................................323
Template B: Chain of Custody ....................................................................325
Bibliography ................................................................................................329
Index ...........................................................................................................337
