Chapter 2. Laying Hands on the Evidence

	"Unless you know where you are going, you won't know how to get there!"
	--Neil Strauss, The Rules of the Game

In this chapter, you will learn how to identify the different sources of evidence and get your hands on the evidence. You will learn how to acquire, manage, and handle the evidence to understand how a crime was committed.

The chapter will cover the following topics:

• Identifying sources of evidence

• Learning to handle the evidence

• Collecting network traffic using tcpdump

• Collecting network traffic using Wireshark

• Collecting network logs

• Acquiring memory using FTK Imager

Identifying sources of evidence

For any successful investigation, it is extremely important to successfully collect, collate, preserve, and analyze the evidence.

To begin with, we need to identify the sources of evidence for any investigation.

The sources of evidence can be easily divided into the following two categories:

Evidence obtainable from within the network

Consider the following image:

This can include the following:

• Evidence from network & device logs:

  A log is a record of all the activities and outcomes performed by a device or by outside agents on a device. Thus, all the incoming or outgoing events are logged on a system. Logs are a crucial part of the investigation ecosystem.

  Devices such as firewalls, intrusion prevention and detection systems, anti-virus servers, and so on generate logs. Other logs include operating system event logs, application logs, and so on.

• Network traffic:

  As discussed in the previous chapter, network traffic is transmitted in packets. The data is split...

Learning to handle the evidence

Once the sources of evidence are identified, the next critical aspect is to learn how to handle the evidence. In the previous chapter, we saw that forensics involves investigative processes used in a manner that is acceptable to a court of law.

Therefore, we need to ensure that all processes followed by us do not compromise the evidentiary value of the collected information.

Rules for the collection of digital evidence

Digital evidence, by its very nature, is fragile. It is extremely easy to tamper with and equally easy to destroy it.

In fact, in the early days, one of the key features that made computers so popular was the fact that a document that was made in a word processor could be very easily modified and mass produced.

In an evidentiary world, this means that whenever we handle the evidence or transport digital evidence, we may cause it to change. In fact, we may cause the digital evidence to change even when viewing it. Digital evidence may also degrade...

Collecting network traffic using tcpdump

Tcpdump is a command-line tool that runs on various flavors of Linux. It can be used for network traffic packet capture and analysis. It is a free tool that is distributed under the Berkeley Software Distribution (BSD) license.

Tcpdump requires the libpcap library to capture packets. Tcpdump has also been ported to Windows. In this avatar, it requires the WinPcap library, which is a port of libpcap for Windows.

Tcpdump is a great tool to learn about the traffic on your network in a more hands-on way. Though tcpdump requires more inputs from the user vis-à-vis higher analysis tools such as Wireshark, it really increases your fundamental understanding of the TCP/IP suite. Any security professional getting in the network forensics domain must understand the data in its raw form.

Tcpdump also provides the option to save the captured network traffic (packets) to a .pcap format file for future analysis.

From a learning perspective, we will use tcpdump with...

Collecting network traffic using Wireshark

While tcpdump is a cool tool to capture network traffic, Wireshark is widely used when it comes to network forensic investigations. In this section, we will focus on installing and using Wireshark to capture network traffic.

Wireshark is available for most of the OS, including Windows, Mac OS, and most flavors of Linux.

It is available for free download at https://www.wireshark.org/download.html.

Using Wireshark

Install Wireshark using the Ubuntu Software Center, as shown in the following screenshot:

Run Wireshark with network privileges either directly or using the terminal to start capturing packets, as shown in the following screenshot:

Configure according to network topology and other specific details using the Capture Options, as shown in the following screenshot:

To get started, all we need to do is select an interface to start capturing packets from. Let's select eth0, as follows:

When we select an interface to start capturing packets (eth0), the...

Collecting network logs

All machines on your network are not likely to be Linux; therefore, to keep a balance of things, we will use Windows as an example for this exercise.

To start Event Viewer, click on the start button and write Event Viewer, as shown in the following screenshot:

The Event Viewer will open up as shown in the following screenshot:

Event Viewer stores consists of the following components:

• Custom Views

• Windows Logs

• Applications and Services Logs

The different views stores are as follows:

• Custom Views:

  • Administrative Events: This contains the Critical, Error, and Warning events from all administrative logs, as shown in the following screenshot:

    

  • Location Activity: As the name suggests, this contains the location activity, as shown in the following screenshot:

  

• Windows Logs: Windows log stores events from legacy applications and events that apply to the entire system:

  • Application: The Application log stores events logged by the applications or programs. For example, a database...

Acquiring memory using FTK Imager

Memory is a very important source of evidence in an investigation process. All activities that happen on a system are usually reflected in the memory at the time.

The following is a step-by-step guide to acquire a system's volatile memory using the product FTK Imager.

This can be downloaded for free at http://accessdata.com/product-download.

1. Run FTK Imager as an administrator, as shown in the following screenshot:

   

2. Click on the File menu and select Capture Memory, as shown in the following screenshot:

   

3. Browse the destination folder, where you want to save the acquired memory dump, as shown in the following screenshot:

   

4. Click on Browse and create a destination folder, as shown in the following screenshot:

   

5. After creating the destination folder, click on Capture Memory, as shown in the following screenshot:

   

6. Click on Capture Memory and the memory dumping will start, as shown in the following screenshot:

   

7. Creation of pagefile starts after the completion of memory dump,...

Summary

In this chapter, you learned how to acquire evidence from different sources. You were also exposed to a number of tools such as tcpdump, Wireshark, Event Viewer, and FTK Imager. We have also studied how to use these tools to acquire evidence that could be relevant to our case.

The next chapter moves us along our journey of acquiring knowledge and skills in the network forensics arena. You will learn how to intercept and analyze network traffic using a number of tools. We will also get an opportunity to look at a case study, where we will see how this knowledge has been put into practice in the real world.