Junk

Ask something
Discussion Locked

Digital Forensic Investigations

0 helpful
17 replies

by steffi28

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hey guys just doing my final year project, its a framework on Preparing an Organisation for a
Digital Forensic Investigation, I'm a little behind and should of tried to go around companies with questionnaires to help me finish off the part where I say whether or not companies are fully prepared for forensic investigators and what they know and don't know etc...

Basically I want you guys to let me know if it is possible of course considering privacy and secrecy acts,

first is your company small, medium, large.

what your company has in place to prevent hackers, viruses, denial of service attacks...

When do you think a forensic investigator is needed to be called onto the scene

and finally what would you expect them to do whilst performing a forensic investigation.

I understand some of you can't answer cos of privacy those who want to answer off TR just PM me

hope you guys can help a little
Thanks
Steffi

17 replies

by gadgetgirl

I don't have three days to type all that up! If you're still on skype or sightspeed or something, we can set up a session over Easter. There's no way I can get everything over that I want to about forensic investigations in an email!!!

I don't think you'll get very definitive answers on what people are using to keep out the bad boys - you may get an overall view, or a shortlist of known deterrents, but I hope you're not after specifics....

You're just starting your dissertation NOW??

Sheesh, girl, you're gonna have to go some. Feel free to use me as proof reader....

GG

by steffi28

Just kept putting it on the back burner and well realised with 5 weeks to go I better get it done :(

Booked a few days off work so I can do several all nighters and try get it all sorted luckily I dont have to make anything just write I think I'll be ok :)

Yup still got Skype if I can remember my logon! Let me know when your free, and also I might take you up on that proof reading in a few weeks :)

Thanks GG knew you'd help :D

by gadgetgirl

If we can't get skyped (I'm having bandwidth problems at home) pm me, and I'll give you the landline number.

GG

by tig2

Like GG, trying to write it all out would be a mega-PITA.
Way too much information.

PM me your Skype details or I will try to record a monologue
and send it. With the time difference recording a podcast for
you might be the best way to go.

Don't forget, Google is your friend!

by robo_dev

But some of the larger companies have this capability.

One large firm I know has a security team whose job duties include doing forensic investigations when needed.

They are highly trained in areas such as evidence preservation, data forensics, and chain of custody techniques.

They use software tools such as EnCase, Autopsy, and TCT (The Coroners Toolkit).

They use forensic drive duplication hardware, as well as write-blocker devices. They store their evidence in a hefty safe.

They have the appropriate certifications such that if/when called to testify in court, their expertise and training is respected.

http://www.opensourceforensics.org/tools/index.html

There's a term for asking people what defenses they have in place to prevent hackers and so forth: it's called social engineering.

by steffi28

I promise I'm not social engineering just researching :) I'm a student surely that explains it all ;)

Thanks for the info :) never knew some companies done that suppose it opens a whole knew can of worms though because what happens if its an inside job, I mean I wonder if their information would still be admissible as they could be suspects, hmm something else for me to think about :)

Thanks for the info though :)

by robo_dev

The issue is to determine things like:

who is stealing money
who is leaking confidential info
who is downloading illegal porn
who is posting bad things about the company stock on a blog about investing

When the 'stakes' are people's jobs, as well as millions of dollars (or pounds), then the evidence must be collected and preserved using the proper methods or the company could end up firing the wrong people or losing their intellectul property to their competitors.

by tig2

I can vouch for Steffi. She was our resident bad girl while in
Germany last term.

That said, I can see why you would not want to post detail
like that. Way too risky these days!
:)

by robo_dev

Look for the sites where the newbie web server and firewall admins post questions.

The first step of any attack is reconnaissance.

If you want an object lesson in data laying around on the web, go to the google hacking database site.

johnny.ihackstuff.com/ghdb.php

by dadspad

A lot of the forensic investigations are done by local City, County and State agencies. Go online and you can find addresses to send mail, hopefully email. Phone numbers are not always good in governents here. But they may be able to get you in touch with the correct people for what you need.

I wish I could help you more, but really have nothing to do with these departments.

by steffi28

Thats as good a place as any to start looking thanks :)

Any help no matter how small is appreciated dad so thanks :)

by steffi28

Can't remember my skype details not used it since I've come back from Germany, think I might have to create one.

You guys are all great don't know what I'd do without you lot sometimes :D

Thanks Tig :)

by tig2

Peer me with the specific subjects that you want info on. i
should think, for instance, that you need to know what
IPSEC thinks the best practices are. What else that didn't
get into your post?

Think it over and email me a list.

:D

yeah, we're lifesavers. We're good at that!

by dawgit

Are you sure you're not my daughter? ( geez, just like one of my kids) Anyway here's one possible source of course the book: "Forensic Discovery" (here at
[ http://www.porcupine.org/forensics/forensic-discovery/ ] by: Dan Farmer
and Wietse Venema. There is a lot of useful info in the material they have there. Good references as well. Read. I could, maybe, try, to give some input, but first I would need to know just which direction you're going to go, so I don't want to waste more of your time. I have been, (still am in a decreased capacity) involved in a rather large organization that sort of handles that type of fun stuff. And my last company was a medium (quietly rather large) that does have a good handle on this. Anyway good luck, now get to work. -d

by hal 9000

Now let me guess the drinking and parting where way too much fun to stop to do the work right. ;)

OK Steffi, I've had a little bit of experience with this so if you need to know something ask away though I'm not sure just how much assistance I may be.

As for your question above about Internal Forensics the people who do this are not generally involved in the Day to Day running of the show so they wouldn't normally be suspects. However if they where to [b]Go Native[/b] the damage would be considerable but it would also be the last time that they ever worked again so it's not really worth their while unless something [b]Really Big[/b] is involved and even then the people that I know have way too much Integrity to be involved.

There are several companies that I've dealt with previously where I've had to ask questions of these people not to circumvent any [b]"Security Issues"[/b] that they put in place.

If you have a Specific Question just drop me a line and I'll do my best to answer in a short note but it may get a bit long. :^0

Col

This discussion is closed to new replies.