160 likes | 321 Views
COEN 252. Collection of Evidence. Ethical and Legal Requirements for Collecting Evidence. Expectations of Privacy Stems from the customs of the society. Is an ethical right. Is legally protected. Can be modified or removed by company policy.
E N D
COEN 252 Collection of Evidence Thomas Schwarz, S.J. SCU Comp. Eng. 2004
Ethical and Legal Requirementsfor Collecting Evidence • Expectations of Privacy • Stems from the customs of the society. • Is an ethical right. • Is legally protected. • Can be modified or removed by company policy. Thomas Schwarz, S.J. SCU Comp. Eng. 2004
Ethical and Legal Requirementsfor Collecting Evidence Stated monitoring policy • Removes most legal and ethical problems. • Can explain the reasons behind the policy. • Can be formulated and discuss instead of a reaction in the heat of the moment. • Can be (or its existence can be) advertised on login banners that apply even to intruders through the indirect consent doctrine. Thomas Schwarz, S.J. SCU Comp. Eng. 2004
Ethical and Legal Requirementsfor Collecting Evidence • Monitoring and logging: • Results in computer records that are probably business records, which makes it easy to admit them directly into evidence. • If we only log during the incident, the records themselves might not be admissible, however, system administrators could testify based on them. Thomas Schwarz, S.J. SCU Comp. Eng. 2004
Evidence Computer Evidence must be • Admissible. • Authentic. • Complete. • Reliable. • Believable and Understandable. Thomas Schwarz, S.J. SCU Comp. Eng. 2004
Logging • Its cheap and easy. • Intruders are not always successful in erasing their traces. • Log records become business records and are easier admitted into evidence. • Ideally, logs are on write once, read many devices. • In reality, one can come close to WORM. Thomas Schwarz, S.J. SCU Comp. Eng. 2004
Volatility • Volatility: evidence can degrade • Example: Evidence in RAM does not survive a power-off. • Example: network status changes when connections are closed and new ones opened. Thomas Schwarz, S.J. SCU Comp. Eng. 2004
Volatility Degrees of Volatility • Memory • Running processes • Network state • Permanent Storage Devices Thomas Schwarz, S.J. SCU Comp. Eng. 2004
Reacting to Volatility • Plan • What evidence are you looking for. • Where can it be found. • How do you get it. Thomas Schwarz, S.J. SCU Comp. Eng. 2004
Reacting to Volatility • Unplug the power-plug (battery) • Destroys volatile evidence. • Preserves completely stored evidence at the point of seizure. Thomas Schwarz, S.J. SCU Comp. Eng. 2004
Reacting to Volatility • Graceful shutdown • Destroys volatile evidence. • Alters system files. • Allows for clean-up software to run. Thomas Schwarz, S.J. SCU Comp. Eng. 2004
Reacting to Volatility • Unplug Network Cable • Removes access of an intruder to a system. • Alerts the intruder. • Dead Man Switch programs can destroy evidence. Thomas Schwarz, S.J. SCU Comp. Eng. 2004
Reacting to Volatility • Life Examination • Intruder with root privileges can watch. • System tools can be trojaned incl. booby-trapped • Use forensics tools on floppy / CD. Thomas Schwarz, S.J. SCU Comp. Eng. 2004
Reacting to Volatility • Know the trade-offs. • No good reasons for a graceful shutdown. • If life-investigation, then monitor network first. Thomas Schwarz, S.J. SCU Comp. Eng. 2004
Documentation and Chain of Custody • Document each step in a forensics procedure. • Best, if automatically generated. • Use forensically sound tools. • “Two Pair of Eyes” integrity rule for data gathering. • Best: Clear Procedural Policy. Thomas Schwarz, S.J. SCU Comp. Eng. 2004
Do Not Alter Evidence Evidence can be easily and inadvertently altered by the forensics procedure: • Use of improper tools like tar that alter file access times. • Trojaned system utilities. • Dead Man Switch • an intruder tool that changes files when the computer is no longer connected to the internet • System Shutdown and Reboot. Thomas Schwarz, S.J. SCU Comp. Eng. 2004