Fluent Essays

Even though this project has 7 steps. I need you to do Step1 and Step 4 which is a total of 4 pages not including references APA format project_2.docx cloud_basedimaging.pdf project_2_resources.docx Unformatted Attachment Preview Project 2: Computer Architecture and Imaging Digital forensics involves processing data from many different types of devices, ranging from desktops to laptops, tablets to smartphones, servers to cloud storage, and even devices embedded in automobiles, aircraft, and other technologies. In this project you will focus on the architecture and imaging of desktop and laptop computers. You will be working in the VM to image and verify the contents of the following: 1. a USB stick 2. the RAM and swap space of a live computer 3. a networked computer hard drive There are seven steps in this project. In the first step you review a technical manual containing information about the various locations where we typically find data of forensic value. The next two steps guide you through the process of imaging a USB stick with both Linux and Windows tools. The next step poses several questions that frequently come up in cases similar to this scenario. In the next step, youre back to collecting forensic evidence; this time youre imaging the RAM (memory) and swap space of a live, running computer. In the next step, you image a computers hard drive over the network. In the final step, you compile all of the previous lab notes and reports into one comprehensive report. The final assignment in this project is a forensic imaging lab report that can be presented in a court of law. Before you can begin imaging the USB drive provided by your supervisor, you need to review your technical manual in order to prepare a statement of work to give to your companys legal team. Are you ready to get started? When you submit your project, your work will be evaluated using the competencies listed below. You can use the list below to self-check your work before submission. 1.1: Organize document or presentation clearly in a manner that promotes understanding and meets the requirements of the assignment. 1.4: Tailor communications to the audience. 1.5: Use sentence structure appropriate to the task, message and audience. 1.6: Follow conventions of Standard Written English. 2.2: Locate and access sufficient information to investigate the issue or problem. 2.3: Evaluate the information in a logical and organized manner to determine its value and relevance to the problem. 4.1: Lead and/or participate in a diverse group to accomplish projects and assignments. 10.3: Demonstrate the appropriate use of multiple digital forensic tools and techniques for imaging and verification. 10.4: Demonstrate an understanding of the different parts of a computer. 11.1: Perform report creation, affidavit creation, and preparation to testify. Step 1: Conduct a Background Review Before you have a chance to begin the imaging process, your supervisor calls to tell you that the organizations legal team has been asking questions about types, sources, and collection of digital information. They have also asked about file formats. Your supervisor asks you to prepare a brief explanatory memo. You use the departments technical manual to compose your memo on locations of valuable forensic information and formats in which digital evidence can be stored. You also review imaging and verification procedures. For the first step in this project, prepare a memo (1-2 pages in length) that summarizes possible locations of valuable digital forensic information, as well as collection and storage options in laymens language. For each location described, include a short description of the following: Area Types of data that can be found there Reasons why the data has potential value to an investigation in general, and for this case in particular The locations to be addressed are: USB sticks, RAM and swap space, and operating system hard disks. Also describe possible digital evidence storage formats (raw, E01 (ewf), and AFF), the advantages and disadvantages of each, and how digital forensic images are collected (local and remote, memory and disk) and verified. Your memo will be included in the final forensic imaging lab report. Step 2: Imaging of a USB drive using Linux tools (LAB) In the first step in this project, you reviewed technical information and imaging procedures and briefed your legal team on digital forensic basics. Now its time to move forward with the investigation. The USB stick may contain intellectual property that you can use to prove the suspects guilt, or at least establish intent. Security personnel recovered the stick from the suspects desk drawer the night before. You take possession of the stick, recording the physical exchange on the chain-ofcustody document prepared by the security officers. Your teams policy is, when practical, to use multiple tools when conducting digital forensic investigations, so you decide to image the USB stick using both Linux and Windows tools. To get started, review the lab instructions in the box below, as well as methods of acquisition. Then go to the virtual lab to set up your evidence drive and proceed to enable write protection, sterilize the target media, perform a static acquisition of Linux data, and verify the USB stick on the sterilized media using Linux tools in preparation for the report and notes requested by your supervisor. Step 3: Image a USB Drive Using Windows Tools (LAB) After imaging the USB drive with Linux in Step 2, your next step is to image the USB drive again, this time using Windows tools. Review the lab instructions in the box below, then go to the virtual lab. When you complete the activity, review your lab notes and report for accuracy and completeness; they will be included in your final forensic imaging lab report (Step 7). Step 4: Respond to Questions from the Legal Team In previous steps, you imaged the USB drive using Linux and Windows tools. In this step, you respond to pointed questions from your organizations legal team. The legal team has been involved in cybercrime cases before, but they want to make sure they are prepared for possible legal challenges. They have requested very specific information about your imaging procedures. Questions from the legal team: Assuming that this is a criminal case that will be heard in a court of law, which hashing algorithm will you use and why? What if the hash of your original does not match your forensic copy? What kinds of issues could that create? What could cause this situation? What if your OS automatically mounts your flash drive prior to creating your forensic duplicate? What kinds of problems could that create? How will you be able to prove that your OS did not automatically mount your flash drive and change its contents prior to the creation of the forensic copy? The legal team would like you to respond in the form of a brief memo (1-2 pages) written in plain, simple English. The memo will be included in your final forensic imaging lab report (Step 7) so review it carefully for accuracy and completeness. You are hoping that you will be able to access the suspects local computer next! Step 5: RAM and Swap Acquisition (LAB) In the previous step, you addressed the concerns of your companys legal team. While you were doing so, the suspects afternoon training session started so now you are able to move on to the next stage of your investigation. Your organizations IT department backs up the hard drives of HQ computers on a regular basis so you are interested only in the suspects RAM and swap space. The RAM and swap space may reveal programs used to hide or transmit intellectual property, in addition to the intellectual property itself (past or current). You have a four-hour window to acquire the RAM and swap space of his live computer. When you arrive at the suspects office, the computer is running, but locked. Fortunately, the company IT department has provided you with the administrator password so you log on to the system. Review the lab instructions in the box below, then go to the virtual lab. Follow the steps required to acquire and analyze the RAM and swap space from the live system. Step 6: Perform Forensic Imaging over a Network (LAB) In the previous step, you acquired and analyzed the RAM and swap space from the suspects live, local computer. In this step, you perform a similar analysis on his networked, offsite computer. Your supervisor confirms that the suspects remote office is closed for the weekend so you are free to image his computer via the network. The remote computer is locked, but the company IT department has provided an administrator password for your investigation. Using your forensic workstation at headquarters, you log on to the remote system. If the image were going to pass unencrypted over an untrusted network (such as the Internet), youd would want to conduct the transfer over SSH, but since youre on the company network and connecting to the remote office via a VPN, you can use the dd command to transfer a copy of the remote hard drive to your local workstation using the netcat tool. Review the lab instructions in the box below, then go to the virtual lab. Follow the steps required to image the computer over the network. Step 7: Submit Final Forensic Imaging Lab Report Now that youve completed the necessary acquisition and imaging tasks, youre ready to compile all of your reports and lab notes into a single forensic imaging lab report that you will submit to your supervisor. Your supervisor reminds you that your report may be presented in a court case so it needs to meet all legal requirements. The report should include the following sections: 1. One to two-page memo addressing the types, sources, collection of digital information, as well as file formats 2. Imaging of a USB drive using Linux tools (lab notes, report) 3. Imaging of a USB drive using Windows tools (lab notes, report) 4. One to two-page memo responding to questions about imaging procedures 5. RAM and swap acquisition--live, local computer (lab notes, report) 6. Forensic imaging over a network (lab notes, report) Upon completion of Steps 1-6, submit your final forensic imaging lab report to your supervisor (instructor) for evaluation. Submit Final Forensic Imaging Lab Report Before you submit your assignment, review the competencies below, which your instructor will use to evaluate your work. A good practice would be to use each competency as a self-check to confirm you have incorporated all of them in your work. • • • • • • • • • • 1.1: Organize document or presentation clearly in a manner that promotes understanding and meets the requirements of the assignment. 1.4: Tailor communications to the audience. 1.5: Use sentence structure appropriate to the task, message and audience. 1.6: Follow conventions of Standard Written English. 2.2: Locate and access sufficient information to investigate the issue or problem. 2.3: Evaluate the information in a logical and organized manner to determine its value and relevance to the problem. 4.1: Lead and/or participate in a diverse group to accomplish projects and assignments. 10.3: Demonstrate the appropriate use of multiple digital forensic tools and techniques for imaging and verification. 10.4: Demonstrate an understanding of the different parts of a computer. 11.1: Perform report creation, affidavit creation, and preparation to testify Cloud-based Imaging Cloud Storage • Cloud Storage has become very common and therefore, might be used for digital investigation. • Examples of common cloud storage • Dropbox • Google Drive • SkyDrive • iCloud 2 Cloud-based systems • In addition, cloud-based systems are used frequently in current businesses and therefore, could become subject of digital forensics analysis. 3 Cloud Forensics • According to NIST [2]: Cloud computing forensic science is the application of scientific principles, technological practices and derived and proven methods to reconstruct past cloud computing events through identification, collection, preservation, examination, interpretation and reporting of digital evidence. 4 Trend in Digital Forensics: Cloud Investigation • In Cloud Investigation, evidence gathering mechanism is a challenge. • In particular, acquisition of data to investigate on SaaS, PaaS, and IaaS (where data is in the cloud) is a challenge because of identifying and then subsequently imaging the data sources. • In addition, cloud investigations lead to jurisprudence/jurisdictional problems related to the ownership of the cloud storage and geographic location. 5 The following possible factors are possible for cloud forensics data collection [2]: 1) Identification of the cloud provider and its partners. 2) The ability to conclusively identify the proper accounts held within the cloud by a consumer. 3) The ability of the forensics examiner to gain access to the desired media. 4) Obtaining assistance of the cloud infrastructure/application provider service staff. 5) Understanding the topology, proprietary policies, and storage system within the cloud. 6) Once access is obtained, the examiner’s ability to complete a forensically sound image of the media. 7) The sheer volume of the media. 8) The ability to respond in a timely fashion to more than one physical location if necessary. 9) E-discovery, log file collection and privacy rights given a multi-tenancy system. 10) Validation of the forensic image. 11) The ability to perform analysis on encrypted data and the collector’s ability to obtain keys for decryption. 12) The storage system no longer being local. 13) There is often no way to link given evidence to a particular suspect other than by relying on the cloud provider’s word. 6 Complex/large digital investigations • For complex/large digital investigations, an investigation can be extended to incorporate a range of techniques that can provide further insights into the case and possibly make the investigation more efficient. 7 Digital Intelligence • Businesses regularly collect, manage, and analyze data such as ratings, comments, emails, different advertisements, transactions, and all other social networks data to extract valuable information about digital customer experience. • Such process is called digital intelligence that drives the measurement, optimization, and execution of marketing tactics and business strategies. • Such data can also be used for digital forensics investigation which is the forensics capture and analysis of data related to digital intelligence. 8 Intelligent Forensics • Intelligent forensics integrates the technological advances and applies resource in a more intelligent way into forensics investigation. • A wide range of tools and techniques including artificial intelligence, computational modelling and social network are used to find digital evidence much faster then normal relating different items from different sources to each other. • We posit that intelligent forensics is an approach that can be adopted to investigate particularly complex incidents. 9 Artificial Intelligence and Computer Forensics • If we assume what a digital investigator applies to an investigation can be formally structured, then it can be used to form knowledge representation (digital forensic information to reason about). • Similarly, if the knowledge is structured in such a way as to allow reasoning then the artificial intelligence concept of ontology (the formal structure of that representation so that reasoning can be applied) can be applied. 10 Disk Images • [1] Digital Forensics to Intelligent Forensics, Alastair Irons, and Harjinder Singh Lallie, Future Internet, 2014, 6, 584-596; • [2] Draft NISTIR 8006, NIST Cloud Computing Forensic Science Challenges. 11 References Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations: Computer Crime and Intellectual Property Section Criminal Division comprises public domain material from the Office of Legal Education Executive Office for United States Attorneys, U.S. Department of Justice. Real-time Electronic Surveillance Chapter 4 Electronic Surveillance in Communications Networks A. Introduction Criminal investigations often involve real-time electronic surveillance. In computer crime cases, agents may want to monitor a hacker as he breaks into a victim computer system or set up a cloned email account to monitor a suspect sending or receiving child pornography. In cases involving cellular telephones, agents may wish to obtain cell-site location information for a suspects cellular telephone to determine the suspects approximate location at the time of a call. Agents may wish to wiretap a suspects telephone or learn whom the suspect has called. This chapter explains how the electronic surveillance statutes apply to criminal investigations involving computers and also discusses how to obtain cell-site location information for cellular phones. Real-time electronic surveillance in federal criminal investigations is governed primarily by two statutes. The first is the federal Wiretap Act, 18 U.S.C. §§ 2510-2522, first passed as Title III of the Omnibus Crime Control and Safe Streets Act of 1968 (and generally known as Title III). The second statute is the Pen Registers and Trap and Trace Devices chapter of Title 18 (the Pen/Trap statute), 18 U.S.C. §§ 3121-3127, first passed as part of the Electronic Communications Privacy Act of 1986. Failure to comply with these statutes may result in civil and criminal liability, and in the case of Title III, may also result in suppression of evidence. B. Content vs. Addressing Information In general, the Pen/Trap statute regulates the collection of addressing and other non-content information for wire and electronic communications. Title III regulates the collection of actual content of wire and electronic communications. Title III and the Pen/Trap statute regulate access to different types of information. Title III permits the government to obtain the contents of wire and electronic communications in transmission. In contrast, the Pen/Trap statute concerns the real-time collection of addressing and other non-content information relating to those communications. See 18 U.S.C. § 2511(2)(h)(i) (stating that it is not a violation of Title III to use a pen register or trap and trace device); United States Telecom Assn v. FCC, 227 F.3d 450, 453-54 (D.C. Cir. 2000) (contrasting pen registers and Title III intercept devices); Brown v. Waddell, 50 F.3d 285, 289-94 (4th Cir. 1995) (same). The difference between addressing information and content is clear for telephone calls. The addressing information is the phone numbers of the originating and receiving telephones. The content of the communication is the actual conversation between the parties to the call. The distinction between addressing information and content also applies to Internet communications. For example, when computers on the Internet communicate with each other, they break down messages into discrete chunks known as packets and then send each packet out to its intended destination. Every packet contains addressing information in the header of the packet (much like the to and from addresses on an envelope), followed by the payload of the packet, which contains the contents (much like a letter inside an envelope). The Pen/Trap statute permits law enforcement to obtain the addressing information of Internet communications much as it would addressing information for traditional phone calls. However, collecting the entire packet ordinarily implicates Title III. The primary difference between an Internet pen/trap device and an Internet Title III intercept device is that the former is designed to capture and retain only addressing information, while the latter is designed to capture and retain the entire packet. The same distinction applies to Internet email. Every Internet email message consists of a set of headers that contain addressing and routing information generate ... Purchase answer to see full attachment