Computer Forensics 101

1. SCALI Annual Seminar May 8, 2004 Computer Forensics 101 Essential Knowledge for 21st Century Investigators with Case Studies Presented by Steve Abrams, M.S. Abrams Computer Forensics Charleston, SC / Long Island, NY (866) 301-5331 * www.AbramsForensics.com

2. What is Computer Forensics ? The search for, and the collection of, evidence from computer systems in a standardized and well-documented manner to maintain its admissibility and probative value in a legal proceeding.

3. Computer Forensics is not “Hacking” Never use “Spy-ware” Never “hack” a password Never login to an account unauthorized (without a warrant or court order) Keystroke loggers no longer legal All of these violations are now (usually) afelony.The law is in flux, beware!

4. Computer Forensics is not “Hacking” Stick to the evidence left on the hard drive, and you should be on safe legal ground. Provided you have proper consent to search the hard drive.

5. Component Steps of Computer Forensics • Make a Forensic Image • Create Indexes and setup “case” • Look for evidence within the image • Generate Report (CD-ROM / Written)

6. Component Steps of Computer Forensics Make a Forensic Image • Requires Extensive Knowledge of Computer Hardware and Software, Especially Operating Systems and File Systems. • Requires Special “Forensics” Hardware and Software • Requires Knowledge of Proper Evidence Handling. • In Most States Requires a P.I. License, and Consent to Search the Computer.

7. Consent Who Can Consent to a Search (Spouse, Parent, Business Owner) Get it in Writing (Boilerplate Affidavits)

8. STATE OF SOUTH CAROLINA ) ) COUNTY OF _______________ ) Affidavit of _______________________ Consent given to search a personal computer. PERSONALLY appeared before me the undersigned who duly sworn and says as follows: 1. My Name is _______________________________________. I reside at _____________________________________________________ 2.I have hired Steven M. Abrams, M.S., P.I., to conduct a computer forensics examination of a hard drive from a personal computer, which is in my possession. 3. I have consented to a search by Mr. Abrams of all data contained on the hard drive. 4. I attest that the computer hard drive which I have consented to have searched is marital property; to which I have had unfettered access. 5. I acknowledge that I have been informed that state and federal law requires Mr. Abrams to notify law enforcement authorities of any suspected child pornography or evidence of criminal activity found on a computer during his examination.

9. Component Steps of Computer Forensics Make a Forensic Image Rule #1 – Never Alter the Evidence Media in the Process of making a Forensic Image. This necessitates special hardware and software.

10. Component Steps of Computer Forensics Create Indexes and setup “case” Access Data Forensic Toolkit (FTK) Based on the dtSearch Engine, requires an index step which can take several hours or days to complete. After which keyword / expression searches are instantaneous.

11. Component Steps of Computer Forensics Create Indexes and setup “case” Access Data Forensic Toolkit (FTK) • Implements “Hashing” which allows standard system software and duplicate files to be safely ignored, and dangerous files (e.g. Child Porn) to be identified automatically. • FTK Hashing is Based on the Known File Filter (KFF) Engine.

12. A hash value (or simply hash), also called a message digest, is a number generated from a string of text. The hash is substantially smaller than the text itself, and is generated by a formula in such a way that it is extremely unlikely that some other text will produce the same hash value. In Computer Forensics, hashes are used to uniquely identify a specific file. The hash value generated from a file becomes its “digital fingerprint”. MD5 and SHA are the two most common hash algorithms used in computer forensics. Hashing

13. Hash codes can be used to quickly match files found during your investigations to lists of “Known Files” maintained by the Federal Government and Federal Law Enforcement Agencies. These “Known Files” can include innocent files, such as components of MS Windows and “off the shelf” application software, that can safely be ignored by your investigations. These “Known Files” can also include contraband files, such as child pornography and hacker tools, that should be highlighted by your investigations. Hashing

14. Component Steps of Computer Forensics Look for evidence within the image • View Graphics, Emails, Documents, etc. • Keyword Searches • Bookmark relevant material for inclusion into report • Good investigation skills needed, must interview the client to get background material needed to focus the CF investigation.

15. Component Steps of Computer Forensics Generate CF Report • Usually in HTML format • Can be printed or on CD-ROM • Basis for Investigation Report, Affidavits, Deposition and Testimony. • CF Report often supplemented with other investigation methods (Online Databases, Email / Phone Interviews)

16. Live FTK Demo Demonstrate Steps of a Computer Forensics Examination

17. Case Histories

18. Case HistoriesDomestic Relations

19. Case HistoriesDomestic Relations PornographyAdulteryFinancial Assets

20. Case HistoriesWiretap / E.C.P.A.

21. Case HistoriesFinancial Crimes