1 IT Investigative Tools Tools and Services for the Forensic Auditor.
-
Upload
clara-burns -
Category
Documents
-
view
221 -
download
1
Transcript of 1 IT Investigative Tools Tools and Services for the Forensic Auditor.
1
IT Investigative Tools
Tools and Services for the Forensic Auditor
2
Digital Crime Scene Investigation Problems with Digital Investigation Timing essential – electronic evidence
volatile Auditor may violate rules of evidence NEVER work directly on the evidence Skills needed to recover deleted data or
encrypted data
3
Digital Crime Scene Investigation Extract, process, interpret Work on the imaged data or “safe copy” Data extracted may be in binary form Process data to convert it to
understandable form Reverse-engineer to extract disk partition
information, file systems, directories, files, etc Software available for this purpose
Interpret the data – search for key words, phrases, etc.
4
Digital Crime Scene Investigation Technology
Magnetic disks contain data after deletion Overwritten data may still be salvaged Memory still contains data after switch-off Swap files and temporary files store data Most OS’s perform extensive logging (so do
network routers)
5
Disk Geometry
Track
Sector
Cylinder
(Clusters aregroups ofSectors)
6
Slack Space
End of FileEnd of File Slack SpaceSlack Space
Last Cluster in a FileLast Cluster in a File
7
Illustration of Forensic Tools
Forensic Software Tools are used for … Data imaging Data recovery Data integrity Data extraction Forensic Analysis Monitoring
8
Data Imaging
EnCase
Reduces internal investigation costs Platform independent Automated analysis saves time Supports electronic records audit Creates logical evidence files — eliminating
need to capture entire hard drives
9
Data Recovery
File Recovery with PC Inspector
10
Data Eradication
Securely Erasing Files
11
Data Integrity
MD5 Message Digest – a hashing algorithm used to
generate a checksum Available online as freeware Any changes to file will change the checksumUse: Generate MD5 of system or critical files
regularly Keep checksums in a secure place to
compare against later if integrity is questioned
12
Data Integrity
MD5 Using HashCalc
13
Data Integrity HandyBits EasyCrypto
14
Data Integrity Private Disk
15
Data Monitoring
Tracking Log Files
16
Data Monitoring
PC System Log
17
Security Software Log Entries
18
19
Free Log Tools
20
Audit Command Language (ACL) ACL is the market leader in computer-
assisted audit technology and is an established forensics tool.
Clientele includes … 70 percent of the Fortune 500 companies over two-thirds of the Global 500 the Big Four public accounting firms
21
Forensic Tools
Audit Command Language
ACL is a computer data extraction and analytical audit tool with audit capabilities …StatisticsDuplicates and GapsStratify and ClassifySamplingBenford Analysis
23
24
25
26
27
Forensic Tools: ACL
Benford Analysis States that the leading digit in
some numerical series follows an exponential distribution
Applies to a wide variety of figures: financial results, electricity bills, street addresses, stock prices, population numbers, death rates, lengths of rivers
Leading Digit
Probability
1 30.1 % 2 17.6 % 3 12.5 % 4 9.7 % 5 7.9 % 6 6.7 % 7 5.8 % 8 5.1 % 9 4.6 %
28
29
30
31
Data Monitoring
Employee Internet ActivitySpector captures employee web activity
including keystrokes, email, and snapshots to answer questions like:
Which employees are spending the most time surfing web sites?
Which employees chat the most? Who is sending the most emails with
attachments? Who is arriving to work late and leaving early? What are my employees searching for on the
Internet?
32
Data Monitoring : Spector
Recorded Email
33
Data Monitoring : Spector
Recorded Web Surfing
34
Data Monitoring : Spector
Recording Keystrokes
35
Data Monitoring : Spector
Recorded Snapshots
36
37
Data Capture : Key Log Hardware
KeyKatcher Records chat, e-mail, internet &
more Is easier to use than parental
control software Identifies internet addresses Uses no system resources Works on all PC operating
systems Undetectable by software
www.lakeshoretechnology.com
38
index.dat filesContain all of the Web sites that you have ever visited. Every URL, every Web page, all of the email that has been sent or received through Outlook or Outlook Express.On Windows 2000 and Windows XP there are several "index.dat" files in these locations:
\Documents and Settings\<Username>\Cookies\index.dat
\Documents and Settings\<Username>\Local Settings\History\History.IE5\index.dat
\Documents and Settings\<Username>\Local Settings\History\History.IE5\MSHist012001123120020101\index.dat\Documents and Settings\<Username>\Local Settings\History\History.IE5\MSHist012002010720020114\index.dat
\Documents and Settings\<Username>\Local Internet Files\Content.IE5\index.dat
These files cannot be deleted without special software!
39
40
Background Checks
41
42
43http://www.expressmetrix.com/solutions/
44
45
ipconfig /allipconfig /all
46
ipconfig /displaydns
47
netstat -a
48
49
Eraser
http://www.heidi.ie/eraser/
Private Disk
http://www.private-disk.net/
HashCalc
http://www.slavasoft.com/hashcalc/index.htm
PC Inspector
http://www.download.com/3000-2242-10066144.html
VeriSign
http://www.verisign.com
HandyBits Encryption
http://www.handybits.com/
EnCase
http://www.handybits.com/
50
Spector
http://www.spectorsoft.com/
Stolen ID Search
https://www.stolenidsearch.com/
Abika Background Check
http://www.abika.com/
Guide to Log Management
http://csrc.nist.gov/publications/nistpubs/800-92/SP800-92.pdf
ACFE Fraud Prevention Checkup
http://www.acfe.com/documents/Fraud_Prev_Checkup_IA.pdf
NetWitness
http://www.netwitness.com/
GASP Std V 7.0 Free Software
http://www.bsa.org/usa/antipiracy/Free-Software-Audit-Tools.cfm
Federal Guidelines for Searches
http://www.cybercrime.gov/searchmanual.htm
51
Florida Criminal Database
http://www.fdle.state.fl.us/CriminalHistory/
Federal Bureau of Prisons
http://www.bop.gov/