Chapter 16: Exploiting Digital Forensics

Overview

Forensics, by definition, describes any aspect of science as it pertains to the law. Digital forensics, then, is an area of criminal or civil law in which the science of digital systems is brought into question. Forensic analysts are consulted to answer pertinent questions about the science of such systems, usually as one aspect of an overall investigation. In digital forensic investigations, the following questions are often asked:

• Who broke into the system and when?

• How did they get inwhat service or vulnerability was used?

• What files were changed?

• What data was stolen or compromised?

Digital forensics is a rapidly expanding area of science, but is rooted in the same foundation as other forensic sciences, for example, crime scene investigations. As with all areas of forensic science, an emphasis on methodology, keen attention to detail, and proper caretaking of data and findings is crucial to success.

There are many factors that play into a digital forensic investigation and often these are specific to the platforms, technology, and applications in use on the systems in question. However, some general methodology will be discussed herein along with best current practices. Key tools and example usage scenarios will be explored to help jumpstart your foray into digital forensics.

This chapter will provide information on the following:

• Standard Forensic Methodology Although most forensic tools and tactics are platform-specific, general forensic process and methodology will be explained to empower the reader to apply the methodology to any tools he or she chooses during an investigation.

• Forensic Techniques Common techniques will be discussed and tools explained in order to familiarize the reader with applying the standard forensic methodology.

• Advanced Digital Forensic Tools A suite of advanced tools will be applied in an example forensic investigation. The tools usage will include detailed data recovery and investigation techniques.

• Ongoing Investigation Other tools and processes will be described to assist an investigator in creating an environment to more easily monitor and trace activity as part of an ongoing investigation.