Fundamentals of Digital Forensics

Forensic science can be defined as the application of scientific principles to legal matters. In an incident, CSIRT (short for computer security incident response team) members may be called upon to perform analysis on digital evidence acquired during the incident, utilizing digital forensics tools, techniques, and knowledge. To make certain that the evidence is processed correctly and can subsequently be admitted in a courtroom, digital forensics examiners need to understand the legal issues, along with the fine points, of the digital forensics process.

In this chapter, we will examine the legal statutes that impact the CSIRT and digital forensics examiners, as well as the rules that govern how evidence is admitted in court. To provide context to actions taken, we will also explore the digital forensics process and, finally, address the infrastructure...

Legal aspects

As we saw in Chapter 1, Understanding Incident Response, a proper incident response involves key individuals from a variety of disciplines. This highlights one frequently held misconception: incident response is strictly a technology matter. One realm into which incident response falls heavily is the legal arena. There are a wide range of laws and regulations that directly impact an organization's incident response capability, ranging from breach notification to privacy. These laws provide a framework for governments to prosecute offenders, as well as providing strict rules concerning topics such as how evidence is handled and presented in court.

Laws and regulations

In the mid-1980s, as computer crime started...

Digital forensics fundamentals

As it was stated in the previous chapter, digital forensics is an important component of incident response. It is often the application of digital forensics methods that allows incident responders to gain a clear understanding of the chain of events that led to a malicious action, such as a compromised server or other data breach. For other incidents, such as internal fraud or malicious insider activity, digital forensics may provide the proverbial smoking gun that points to the guilty party. Before a detailed examination of the tools and techniques available to incident responders, it is critical to address the foundational elements of digital forensics. These elements provide not only context for specific actions, but also a method to ensure that evidence made part of an incident investigation is usable.

...

Summary

Incident response spans a wide range of disciplines, from legal to scientific. CSIRT members responsible for conducting digital forensics examinations should be very familiar with the legal and technical aspects of digital forensics. In addition, they should be familiar with the wide variety of tools and equipment necessary to acquire, examine, and present data discovered during an examination. The proper application of forensic techniques is critical to provide insight into the chain of events that led to the deployment of the CSIRT to investigate an incident. This chapter initially delved into the various legal aspects of digital forensics, such as the rules of evidence and laws pertaining to cybercrime. Next, the science of digital forensics was discussed, providing an understanding of how techniques should be applied to investigations. To enhance this knowledge, we...

Questions

1. What is not a federal rule of evidence?

A) Test for relevant evidence
B) Locard's principle
C) Testimony by an expert witness
D) Best evidence rule

2. A proper chain of custody should be maintained, to ensure the integrity of digital evidence.

A) True
B) False

3. Which items should be included as part of a digital forensics jump kit?

A) Physical write blocker
B) Notepad and pen
C) Networking cables
D) All of the above

4. What is NOT a portion of the forensic process?

A) Identification
B) Courtroom testimony
C) Collection
D) Analysis

Further reading

• Digital Forensics Research Workshop: https://www.dfrws.org
• ISACA Overview of Digital Forensics: http://www.isaca.org/Knowledge-Center/Research/ResearchDeliverables/Pages/overview-of-digital-forensics.aspx
• Historical background on the FBI CART: https://www.ncjrs.gov/App/Publications/abstract.aspx?ID=137561