Computer Forensics

and Investigations
Dean R. Beal
CISA, CFE
 What is Fraud?
Any illegal act characterized by deceit,
concealment or violation of trust.

These acts are not dependent upon the

threat of violence or physical force.

Frauds are perpetrated by parties and

organizations to obtain money, property, or
services; to avoid payment or loss of
services; or to secure personal or business
advantage.

Fraud Prevention and Detection in an Automated World, GTAG Global

Global Technology Audit Guide (IIA,
The Institute of Internal Auditors, 2009), 1.
 Impact of Fraud
U.S. organizations lose 7% of their
annual revenues to fraudulent
activity.

If this percentage were applied to the

estimated 2010 U.S. gross domestic
product of $14.307 trillion, we could
project that more than 1 trillion
would be lost to fraud in 2010.
Report on Occupational Fraud and Abuse, The ACFE, 2008.
Why Do People Commit Fraud?
Opportunity
Because they can

Pressure
Financial or occupational

Rationalization
There is nothing wrong with it

Fraud
Fraud Basics: White-
White-Collar Crime Demographics, Employee Thieves: Who Commits The Most
Most
Fraud?,
Fraud?, http://www.acfe.com/resources/view.asp?ArticleID=502
 Why Do People Commit Fraud?
Interviews with persons who committed fraud have shown
that most people do not originally set out to commit fraud.

Often they simply took advantage of an opportunity; many

times the first fraudulent act was an accident perhaps
they mistakenly processed the same invoice twice.

But when they realized that it wasnt noticed, the

fraudulent acts became deliberate and more frequent.

Dave Coderre, author of The Fraud Toolkit; Fraud Detection: Using Data Analysis Techniques to
Detect Fraud
Fraud and CAATTs and Other BEASTs for Auditors
Auditors
 10 - 80 - 10 Law
10% of people will never commit
fraud.

80% of people will commit fraud

under the right circumstances.

10% actively seek out opportunities

for fraud.

Dave Coderre, author of The Fraud Toolkit; Fraud Detection: Using Data Analysis Techniques to
Detect Fraud
Fraud and CAATTs and Other BEASTs for Auditors
Auditors
Goals of a Fraud Program

Prevention
Detection
Deterrence
 The Institute of Internal Auditors (IIA),
International Professional Practices
Framework (IPPF)

2120.A2 - The internal audit

activity must evaluate the
potential for the occurrence of
fraud and the manner in which
the organization manages fraud
risk.
Fraud Prevention and Detection in an Automated World, GTAG Global
Global Technology Audit Guide (IIA,
The Institute of Internal Auditors, 2009), 1.
 The Institute of Internal Auditors (IIA),
International Professional Practices
Framework (IPPF)
1210.A2 - Internal auditors must
have sufficient knowledge to evaluate
the risk of fraud and the manner in
which it is managed by the
organization, but are not expected to
have the expertise of a person whose
primary responsibility is detecting
and investigating fraud.
Fraud Prevention and Detection in an Automated World, GTAG Global
Global Technology Audit Guide (IIA,
The Institute of Internal Auditors, 2009), 1.
 IT Related Fraud Risks
Theft of Hardware
Identity Theft
Pirated Software
Unlicensed Software
Insider Trading
Corporate Espionage
Conflicts of Interest
Bid Rigging
Kickbacks
Copyright Violations
 Red Flags During IT Risk
Assessment
No Controls
Control Weaknesses
Not Part of SOX
Never Audited
Significant Changes in Technology
Since Last Audit
High Criticality Rating of Data
 Red Flags During
IT Audit Interviews
Personal Problems
Financial Problems
Job Dissatisfaction
Personal Relationships with External
Vendors
Complete Control
Nobody Else to Fill In
No Vacation
Living Large
 Red Flags During
IT Audit Fieldwork
Look Beyond Audit Checklists
Look Beyond COBIT Guidelines
Denied Access to Staff
Denied Access to Data
Elevated Access Permissions
No Audit Logging/Monitoring
Logging/Monitoring without Reviewing
SOD
Overrides
Little or No Management Oversight
Excessive Trust
No Documentation
 How Can IT Auditors Help?

Has a Fraud Occurred Here?

How Did They Do It?

Can a Fraud Occur Here?

How Would They Do It?

Would Anyone Know?

How Can IT Auditors Help?

Take Away
Opportunities
to Commit Fraud

Prevent
 Detection
Tips
Hotline Calls

Risk Assessments

Audits

Continuous
Auditing/Monitoring
 Detection

Reality = Reactive

Goal = Proactive
 Assessing the Allegation
Management Receives
Management Reviews
Management Assigns

Guidelines
Should exist within department for
outlining steps taken for performing a
forensics investigation
 Planning and Starting
the Investigation
Objectivity Concerns
Timing Issues

Game Planning

Keywords

Off Site/On Site

Equipment Needs

Interviews
 Computer Forensics
The main goal of computer forensics is
to identify, collect, preserve, and
analyze data in a way that preserves
the integrity of the evidence collected
so it can be used effectively in a legal
case.

Computer Forensics, http://www.us-cert.gov/reading_room /forensics.pdf

 Electronic Evidence
In the mid 1990s, most people
believed that electronic evidence was
of little or no value and was
inherently unreliable.

Since that time, however, it is more

than likely than not to make the case.
It may be the only evidence.
The Computer & Internet Fraud Manual (USA: Association of Certified Fraud Examiners, 2005), 140.
Locards Exchange Principle
Dr. Edmund Locards work in the
area of forensic science and
crime scene reconstruction.

When two objects come into

contact, material is exchanged or
transferred between them.

Harlan Carvey, WINDOWS FORENSICS ANALYSIS (Burlington, MA: Syngress, 2009), 4,5.
Locards Exchange Principle
If you watch the popular CSI crime
show on TV, youll hear one of the
crime scene investigators refer to
possible transfer.

This usually occurs after a scene in

which a car hits something or when
an investigator examines a body and
locates material that seems out of
place.
Harlan Carvey, WINDOWS FORENSICS ANALYSIS (Burlington, MA: Syngress, 2009), 4,5.
Locards Exchange Principle
The same principle applies to the
digital realm.

Two computers communicate over a network.

Information from each will appear in process
memory or log files on the other.

Removable storage device is attached to a

computer. Information about the device will
remain resident on the computer.

Harlan Carvey, WINDOWS FORENSICS ANALYSIS (Burlington, MA: Syngress, 2009), 4,5.
Locards Exchange Principle
When we interact with a live system,
whether as the user or as the
investigator, changes will occur on
that system.

Changes will occur simply due to the

passage of time, as processes work,
as data is saved and deleted, as
network connections time out or are
created, and so on.
Harlan Carvey, WINDOWS FORENSICS ANALYSIS (Burlington, MA: Syngress, 2009), 4,5.
 Types of Data Collected in
Computer Forensics
Volatile data is any data that is stored
in memory, or exists in transit, that
will be lost when the computer loses
power or is turned off.

Persistent data is the data that is

stored on a local hard drive (or
another medium) and is preserved
when the computer is turned off.

Computer Forensics, http://www.us-cert.gov/reading_room /forensics.pdf

 Tools
Forensics Tool Kit (FTK)
EnCase

ProDiscover

Data Wiping Tools

Data Storage

PC Tool Kit
 Bit Stream Image
A bit stream image is an
exact duplicate of a
computers hard drive in
which the drive is copied
from one drive to another,
bit by bit.
Dave Kleiman, et al., The Official CHFI Study Guide for Computer Hacking Forensic Investigators
Investigators
(USA: Syngress, Elsevier, 2007), 9.
 Bit Stream Image
Bit Means at the Binary Level
01000001 = A
01100001 = a

Everything is Copied
Deleted Files
Fragments of Files
 Backup Copy
Backup software can only copy or
compress files that are stored in a
folder or share a known file type.

Backup software cannot copy deleted

files or e-mail messages or recover
file fragments.

Bill Nelson, et al., Guide to Computer Forensics and Investigations (Canada: Course Technology,
Thompson Learning, 2004), 50.
Acquiring the Forensics Image

Network
Snapshot

Physical
Static
 CIA Triad

Confidentiality
Integrity

Availability

Ed Tittel, et al., CISSP, Certified Information Systems Security Professional, Study Guide (USA:
SYBEX, 2003), 3.
 ProDiscover Remote Agent
Can connect to any computer on the
network.
By IP address
By computer name
Install remote agent executable.
Captures image of hard drive over the
network.
Runs in the background as a Service.
User does not know they are being
imaged.
 Write Blockers

http://www.forensicpc.com/products.asp?cat=38
 Write Blockers
Reads
Reads

Writes
Writes

Suspect
SuspectHard
Hard Hardware
Hardware Forensics
Forensics
ForensicsPC
Forensics PC
Drive
Drive Write
WriteBlocker
Blocker HardDrive
Hard Drive

FireWire
FireWire
or
or USB
USB
IDE/SATA
IDE/SATA USB
USB
 FTK

Forensic Toolkit (FTK) version 1.81.5

Release Date: October 7, 2009

FTK
FTK Case Log
FTK Processes to Perform
Data Carving
FTK Refine Case
FTK Refine Index
FTK Add Evidence
FTK Add Evidence
FTK Add Evidence
FTK Setup Complete
FTK Processing
FTK Overview
FTK Explore
FTK Graphics
FTK E-Mail
FTK Search
FTK Bookmark
Processing the Forensics Image
Data Carving
File Types

KFF

Key Words

Bookmarks

Graphics

Deleted Files

Metadata
Processing the Forensics Image
Password Protected Files
Encrypted Files

File Slack

Windows Registry

index.dat
index.dat
 Regular Expressions
Allows forensics analysts to search
through large quantities of text
information for patterns of data such
as the following:

Social Security Numbers

Telephone Numbers
Computer IP Addresses
Credit Card Numbers
AccessData BootCamp Training Manual, (AccessData
(AccessData Corporation, 2006), 389.
 Regular Expressions
Perl
Regex++

\<\d\d\d[\- ]\d\d[\- ]\d\d\d\d\>

Social Security Numbers

\<\d\d\d\d(\-| )\d\d\d\d(\-| )\d\d\d\d(\-| )\d\d\d\d\>

Credit Card Numbers
 dtSearch Search Requests
A natural language search is any
sequence of text, such as a
sentence or a question.

dtSearch sorts retrieved

documents based on their
relevance to your search request.
AccessData BootCamp Training Manual, (AccessData Corporation, 2006), 397.
 dtSearch Search Requests
FTK
Sherpa Software

Boolean Searches
or
and
not
*
?
%
&
 Compiling Electronic Evidence
Secured Area
Can be Time Consuming

Target and Forensic Hard Drive

Capacities
Rules of Electronic Evidence
Records stored in computers
can be divided into three
categories: non-hearsay,
hearsay, and records that
include both hearsay and
non-hearsay.
Searching & Seizing Computers and Obtaining Electronic Evidence in Criminal
Investigations, Computer Crime & Intellectual Property Section United States
Department of Justice, http://www.cybercrime.gov/ssmanual/05ssma.html#A
Rules of Electronic Evidence
Non-hearsay records are
created by a process that does
not involve a human assertion.
Conduct is a command to a
system, not an assertion, and
thus is not hearsay.
Searching & Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations,
Computer Crime & Intellectual Property Section United States Department
Department of Justice,
Justice,
http://www.cybercrime.gov/ssmanual/05ssma.html#A
Rules of Electronic Evidence
Hearsay records contain
assertions by people, such
as: a personal letter; a
memo; bookkeeping records;
and records of business
transactions inputted by
persons.
Searching & Seizing Computers and Obtaining Electronic Evidence in Criminal
Investigations, Computer Crime & Intellectual Property Section United States
Department of Justice, http://www.cybercrime.gov/ssmanual/05ssma.html#A
Rules of Electronic Evidence
Mixed hearsay and non-hearsay
records are a combination of the first
two categories, such as: email
containing both content and header
information; a file containing both
written text and file creation, last
written, and last access dates; chat
room logs that identify the
participants and note the time and
date of "chat.
Searching & Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations,
Computer Crime & Intellectual Property Section United States Department
Department of Justice,
Justice,
http://www.cybercrime.gov/ssmanual/05ssma.html#A
Rules of Electronic Evidence
Authentication
Before a party moves for admission of
an electronic record or any other
evidence, the proponent must show
that it is authentic. That is, the
proponent must offer evidence
"sufficient to support a finding that
the matter in question is what its
proponent claims."
Searching & Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations,
Computer Crime & Intellectual Property Section United States Department
Department of Justice,
Justice,
http://www.cybercrime.gov/ssmanual/05ssma.html#A
Rules of Electronic Evidence
Authorship
Although handwritten records may be
penned in a distinctive handwriting
style, computer-stored records do not
necessarily identify their author. This
is a particular problem with Internet
communications, which can offer their
authors an unusual degree of
anonymity.
Searching & Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations,
Computer Crime & Intellectual Property Section United States Department
Department of Justice,
Justice,
http://www.cybercrime.gov/ssmanual/05ssma.html#A
Rules of Electronic Evidence
The Best Evidence Rule
The best evidence rule states that to
prove the content of a writing,
recording, or photograph, the
"original" writing, recording, or
photograph is ordinarily required.

Searching & Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations,
Computer Crime & Intellectual Property Section United States Department
Department of Justice,
Justice,
http://www.cybercrime.gov/ssmanual/05ssma.html#A
Rules of Electronic Evidence
Federal Rule of Evidence
901(b)(4) is helpful to
prosecutors who seek to
introduce electronic records
obtained from seized storage
media.
Searching & Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations,
Computer Crime & Intellectual Property Section United States Department
Department of Justice,
Justice,

http://www.cybercrime.gov/ssmanual/05ssma.html#A
Rules of Electronic Evidence
A prosecutor introducing a hard drive
seized from a defendant's home and
data from that hard drive may employ
a two-step process.

First, the prosecutor may introduce the

hard drive based on chain of custody
testimony or its unique characteristics
(e.g., the hard drive serial number).

Searching & Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations,
Computer Crime & Intellectual Property Section United States Department
Department of Justice,
Justice,
http://www.cybercrime.gov/ssmanual/05ssma.html#A
 Chain of Custody
A chain of custody is the accurate documentation of
the movement and possession of a piece of evidence,
from the time it is taken into custody until it is
delivered to the court.

This documentation helps prevent allegations of

tampering.

It also proves that the evidence was stored in a

legally accepted location, and it documents who is in
custody and control of the evidence during the
forensic testing phase.

Dave Kleiman, et al., The Official CHFI Study Guide for Computer Hacking Forensic Investigators
Investigators
(USA: Syngress, Elsevier, 2007), 9.
 Chain of Custody Form
Physical Evidence

Case Number
Investigating Organization
Investigator
Nature of Case
Location Where Evidence was Obtained
Evidence Recovered By
Date and Time
Description of Evidence
Vendor Name
Model Number
Serial Number
Location Where Evidence is Currently Stored
Evidence Processed by Item Number
Disposition of Evidence/Date/Time
Signatures

Bill Nelson, et al., Guide to Computer Forensics and Investigations (Canada: Course Technology,
Thompson Learning, 2004), 37- 37-39.
 Chain of Custody Form
Image Evidence
Case Number
Investigating Organization
Investigator
Nature of Case
Image Type
Image Method
Date and Time
Description of Evidence
MD5 Hash Totals
Location Where Evidence is Currently Stored
Disposition of Evidence/Date/Time
Signatures
Rules of Electronic Evidence
Second, prosecutors may consider using the "hash
value" or similar forensic identifier assigned to the
data on the drive to authenticate a copy of that
data as a forensically sound copy of the previously
admitted hard drive.

Similarly, prosecutors may authenticate a

computer record using its "metadata"
(information "describing the history, tracking, or
management of the electronic document").

Searching & Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations,
Computer Crime & Intellectual Property Section United States Department
Department of Justice,
Justice,
http://www.cybercrime.gov/ssmanual/05ssma.html#A
 Hash Values
Hashes use cryptographic algorithms to
create a message digest of the data and
represent it as a relatively small piece of
data.
The hash can be used to compare a hash of
the original data to the forensic copy.
When the hashes match, it is accepted as
proof that the data is an exact copy.

Dave Kleiman, et al., The Official CHFI Study Guide for Computer Hacking Forensic Investigators
Investigators
(USA: Syngress, Elsevier, 2007), 10.
 Hash Values
Original MD5 Hash Value:
6f8e3290e1d4c2043b26552a40e5e038

Imaged MD5 Hash Value:

6f8e3290e1d4c2043b26552a40e5e038
:Verified

MD5 Hashes
Image Level
File Level
 Metadata
NameValue
Title Computer Forensics and Investigations
Author Dean
Template Satellite Dish
LastAuthor Dean
Revision Number 335
Edit Time 6:41:06 PM
Created 2/6/2010 9:24:32 AM
Last Saved 2/14/2010 8:17:51
PMWord Count1675
AppName Microsoft Office PowerPoint
 Other Electronic Evidence
Scope Creep
New Evidence Discovered
Personal or Private Property
Internet/Social Networking

Google Hacking
 Other Concerns
Evidence Locker
Hard Drive Storage

Retention

Destruction
Wiping
Wiping
 Email
Warning Banners
Real Time

Back-ups

Can See It All

 Acquiring Data
Know Corporate Applications and
Systems
Make Friends with IT
Loss of Confidentiality
Gain Direct Access Corporate
Source Data
Less Hands in the Cookie Jar
Write Queries
CIA
 Data Analytics
ACL
TOAD

FOCUS

QMF

Adabas

Cognos

Microsoft Access

SQL Server

Image: Louis Davidson, SQL Server 2000 Database Design (Birmingham, UK: Wrox, 2001), 131,331.
 Data Analytics
Fixed Length
Variable Length

Delimited

Multiple Record

HL7

EDI

PDF

DBF

Image: Louis Davidson, SQL Server 2000 Database Design (Birmingham, UK: Wrox, 2001), 131,331.
 Closing the Investigation
Criminal Violations
Corporate Risk and Liability

Policy Violations
 Closing the Investigation
Report Preparation
Support the Allegation

Refute the Allegation

Consult with Law

Consult with Management

Consult with Senior Executives

 Conclusion
Corporate Policies and Procedures
International
EU Safe Harbor
Federal
HIPAA
FCPA (Foreign Corrupt Practices Act )
FTC
State
Security Breaches
Other
BSA (Business Software Alliance )
PCI
RIAA (Recording Industry Association of America)
SIAA (Software & Information Industry Association)
 Conclusion
Remain fair and objective
Present the facts as discovered

Document everything you do

Get access to corporate source

data
Reactive is good, proactive is

better
 Data Hiding
A sector is the smallest physical storage
unit on the disk.

A cluster can consist of one or more consecutive

sectors. Cluster size can be changed to optimize
file storage. A larger cluster size reduces the
potential for fragmentation, but increases the
likelihood that clusters will have unused space.

http://www.ntfs.com/hard-disk-basics.htm#Hard
 Data Hiding

http://explorerplusplus.com/blog/54-file-slack
 Data Hiding

The Slacker tool is the first tool that allows you to hide
files within the slack space of the NTFS file system.

http://synfulpacket.blogspot.com/2008/11/metasploit-anti-forensics-project-mafia.html
Data Hiding
Data Hiding
Data Hiding
Data Hiding
Data Hiding
 Data Hiding
Message in a Bottle #1 Message in a Bottle #2

Which One Contains the Company Trade Secrets?

Data Hiding
 Steganography
Updated Steganography SearchPak
February 17, 2010

The Steganography SearchPak was created from hash values

extracted from the latest version of the Steganography Application
Fingerprint Database (SAFDB) created and maintained in
Backbones Steganography Analysis and Research Center (SARC).
SAFDB is the worlds largest commercially available hash set
exclusive to steganography applications. Digital forensic
examiners around the world are using hash values from SAFDB to
detect the presence of steganography applications on seized
media. Detecting the presence of steganography applications is a
strong indication the application may have been used to conceal
digital evidence. When files associated with steganography
applications are detected, users have the option of contacting
Backbone for further assistance with finding and extracting the
hidden evidence using advanced steganalysis tools developed in
the SARC.

http://www.dfinews.com/articles.php?pid=865
 Whats Ahead
The Cloud
December 15, 2009

Our social norms are evolving away

from the storage of personal data on
computer hard drives to retention of
that information in the cloud, on
servers owned by internet service
providers.
Oregon state court opinion in a criminal matter, State v. Bellar, 231 Or.App. 80, 217 P.3d 1094
(Sept. 30, 2009).
 Whats Ahead
The challenge of traditional forensics and larger hard drives
is that the acquisition typically takes hours -- sometimes
days -- depending on the size and number of drives. After
authentication, forensic investigators then have to dig
through the massive amount of data, which can take a
significantly long time. If you've ever done full-text
indexing of a large drive, then you know it's not a quick
process.
Now's the time to start preparing because tomorrow might
be the day you get the call about a case involving a dozen
computers in which each one contains one to four 1.5
terabyte hard drives and a server containing about 10
terabytes of data.

http://www.darkreading.com/blog/archives/2009/10/the_future_of_d.html
http://www.darkreading.com/blog/archives/2009/10/the_future_of_d.html
 Whats Ahead
The Crime Scene Evidence Youre Ignoring
October 2009

New storage and entertainment devices are constantly

released to the mass market. Files can be stored on
anything that a computer sees as a "drive." It may be
tempting to leave a digital camera at a crime scene
because the investigator sees nothing on the screen.
The point then is not to think about which devices to seize,
or even which kinds of evidence (video, e-mail, documents,
etc.) to look for. The key word is "anything:" any kind of
device, any kind of evidence.

http://www.officer.com/print/Law-
http://www.officer.com/print/Law-Enforcement-
Enforcement-Technology/The-
Technology/The-crime-
crime-scene-
scene-evidence-
evidence-youre-
youre-
ignoring/1$48858