Forensics Tricks of the Trade

Computerworld - Set Up Lunchboxes
According to Matt Yarbrough, a former assistant U.S. attorney, forensics experts use "lunchboxes," or special computers plugged into the suspect's system that allow investigators to examine a machine without turning on its power and booting from the drive. A lunchbox creates a bit-by-bit, sector-by-sector mirror of the machine. It then produces reports that are generated by one of several software packages used by law enforcement agencies such as the FBI.


Copy Slack Space
"Copying both active and unallocated space, called slack space, is also critical," says Kristin Nimsger, associate legal counsel and electronic discovery consultant at Eden Prairie, Minn.-based Ontrack Data International Inc. This is important because deleted files are never really deleted; they are merely stored in slack space.


Record the Chain of Custody
Nimsger also recommends creating an electronic log to record access to the original copy of the drive. This protects the chain of custody of the evidence. And before any analysis is conducted, she advises defining the scope of the investigation so as not to stumble into any privacy violations.


Isolate the Suspect System
Forensics investigations, especially ones that will produce admissible evidence, don't end after a copy of the suspect's hard drive is made. It's critical that the suspect system is locked down and isolated immediately, says Yarbrough.
Once an image of the hard drive has been captured, the hard drive should be bagged and tagged, or placed in a container in a secure evidence vault with a seal that's properly labeled and dated to show that it hasn't been tampered with. All analysis should be conducted on the copies only.
At the end of the day, it all comes down to convincing a judge that the data you are presenting in court is in fact what you say it is, says Yarbrough.


Create a Task List
A thorough investigation can take anywhere from 20 to 30 hours, says Morgan Wright, a senior information security specialist at Unisys Corp. "Therefore, it's important to have a checklist and to conduct every step as if it's going to end up in court," he says.


Use Automation Tools Only to Supplement Expertise
There are many automated tools to help with an investigation. They include Symantec Corp.'s Norton Disk Edit, AccessData Corp.'s Forensic Tool Kit, Guidance Software Inc.'s Encase and Raytheon Co.'s Silent Runner. But, Wright warns, "you should not be using automation to [make up for] lack of experience."