>> Hello cyber audience, and welcome back
to incident response, and advanced forensics.
My name is Max Alexander,
and I'll be your subject matter expert
>> for today's lesson,
>> which is Forensics in Support of Incident Response.
What does forensics have to do with incident response?
Beyond your traditional incident response role,
so just doing a cursory investigation
of some basic incidents,
forensics can help identify
the total extent of an incident.
By looking at maybe more of
the operating system, and machine,
incident responders can get a better idea of
exactly what happened during this incident.
Forensics can also identify
a timeline of the depth of events.
Just merely knowing the malware
infected the system may not be enough.
Going back and reconstructing
that timeline of when the malware took place,
what it did or not even malware.
But maybe if you're looking at some type
of insider threat investigation,
hoping to establish a timeline,
puts a person behind
a keyboard during maybe an incident of theft occurring.
Forensics can also help identify
actions taken by malware and malicious users.
What did the malware do when it was on the system?
What did that malicious user do
when he or she was using the system?
Forensics can also help with damage assessments.
Helping to determine what data was taken;
what did the malware do when it was on the system?
What files did it package up?
Lastly, forensics can help tell a story,
and answer the basic interrogatives,
who, what, when, where, why, and how.
Forensics should build that picture.
It should help tell that story, that complete picture,
of exactly what happened during an incident.
Before we go on any further,
and discuss how to do forensics,
there's some basic golden rules that must be
followed when doing any forensic investigation
in support of an incident.
The first rule is
securing the scene, and making it safe.
From a law enforcement perspective,
>> securing the scene is making sure that
>> there's no suspect there who
>> can potentially cause injury or death to responders.
But that could also be extended into the greater sense
>> of making sure that the scene is
>> safe from potential hazards.
Could be fire, electrical hazards,
anything that could put the responder at risk,
you essentially want to make
sure that the scene is safe,
and if it is not, try and make it
safe to the best of your ability.
Further, if you believe that the computer
which is involved in the incident you're investigating,
is somehow destroying evidence,
or you've found the computer that you
think may be involved in the particular incident
>> that you're investigating,
>> you should take immediate steps to
preserve that computer,
and preserve that evidence.
Or if you find a thumb drive,
you should take caution
to preserve that thumb drive.
Any type of digital evidence that
you find during your investigation,
you should take the steps to ensure that that device,
that that computer is going to be
uncontaminated during your investigation process.
The next thing that you should ask is that,
do you have that legal basis to seize this computer,
to seize this evidence.
Now in corporate environments,
more than likely you are the data owner.
You own the computer system.
Generally you do have that legal right
to seize the computers,
and the data that is on it.
However, there are caveats to that,
especially when we talk about BYOD devices,
and bringing those to work.
If you have company data on those devices,
what authority do you have to seize that data?
Also, I look at this from a US perspective,
but if you're overseas,
there are laws outside of
the United States that many people may not be aware of,
and then you'd have to abide and apply those laws to
your forensic investigation process.
The next rule is do not access any computer files.
If the computer's off,
leave it off and if it's on,
don't start searching through the computer.
Now, this is mainly geared toward your first responder
who is really unaware of basic forensic principles.
Oftentimes, a trained forensic investigator or
forensic caterer may not be the person
who's going to respond to this incident.
It may be someone who
has minimal knowledge of computer systems,
minimal knowledge forensics and
they think that they're trying to
help and they're going to
start searching through the computer,
which is something you don't want to do
because you could essentially contaminate,
and damage any evidence that you have.
If you hope to take this case to court,
it would essentially put the kibosh on doing that.
The next golden rule is,
if the computer's on,
>> take appropriate steps as we're going to
>> discuss later on how to shut down
>> properly the computer,
>> and prepare it for transportation as evidence.
Then I'll caveat that with if there is any type of
volatile memory that you're going to
take from that system,
we would want to collect that volatile memory and/or
the Windows Recovery encryption keys for BitLocker;
we may also want to take those as well.
I will go ahead and caveat that rule.
The golden rules continue.
If you reasonably believe
that a computer is destroying evidence,
immediately shut down the computer
>> by pulling the power port
>> from the back of the computer.
>> Obviously, if it's a laptop,
pulling the power port is not going to do any good.
You would more than likely want to shut the system
down either by pushing
the power button or clicking on the Windows icon,
and selecting power down.
We do have a whole section that does cover that.
Moving on, the camera is available to computers
on taking pictures of the screen.
If the computer is off,
take pictures of the computer, it's location,
and any electronic media attached,
and/or cables or other devices.
Again, we have another section devoted
entirely to taking photographs.
A picture's worth a thousand words quite literally,
it saves time in an investigation.
>> When you're doing this forensic investigation,
>> and you're doing this incident response,
the last thing that you have time to do is sit around,
and write extensively,
although you do have to take notes.
Taking a picture can simplify and
>> speed up that process.
>> Then the last golden rule is asking yourself,
do special legal considerations apply?
Are you doing an incident response,
a forensic investigation
on someone who may have doctor,
attorney, clergy, psychiatrist, newspaper,
or publisher privileges, etc.?
Depending on where you work and the type of
incidents that you're going to respond to,
some of those caveats may apply,
and those individuals may be afforded
different privacy rights than your standard users.
Again, consult your legal counsel when encountering
>> any types of situations such as those.