recently computer forensics has been in the headlines at a recent cyber security symposium
headlines were made not in regards to the evidence found but rather the absence of evidence
as i watched the event and i also saw some of the tweets that came out of it
i realized that it's hard to understand forensics too often we think it's easy we think it's just
merely looking at an image and seeing what's going on and what you don't realize is especially in
forensics you're not seeing the operating system as you normally see it as rob graham indicated
what you're trying to sift through is a lot of things you don't understand
and a lot of things that you can't pin down exactly to what's going on
case in point let's look at ftk imager ftk imager is a pretty standard forensic tool
that allows you to take a image of a hard drive it then allows you to also look at the hard drive
and what you're looking at is what i could kind of call the flat view of it so
while you're looking at it you're not seeing the mounted drive you're seeing the file systems
you're seeing the ones and zeroes out there you're seeing hexadecimals so sometimes you have to
know like how things are structured in a program before you can understand what you're looking at
so here for example is a sample image of a hard drive and i've got several partitions
and you drill down and you've got supposedly orphan unallocated space
down here in partition two and as if you are familiar with this folder structure of a windows
environment things start to look a little bit more familiar program files program files x86 users
and what you're looking for is you know like where are the windows event logs located when it's
not a mounted system i mean bottom line a windows machine in this dd format when you're looking
at it from a forensic standpoint looks totally different than a windows machine when it's booted
so if you're not familiar with how things should look and what you're looking at things can look
suspicious the same is true for things like wireshark i mean these logs are very chatty
and sometimes you have to understand what's going on in the environment in the network to see
what's normal so when you do forensics you want to make sure that you do some of these steps
before the incident so you understand what is the normal traffic what is the normal evidence files
looking like in your environment you don't want to be doing this after the event you
want to get the resources and get the expertise ahead of time so that you establish a baseline
what is normal in your network another way you can have a forensic view of your machine
and this is actually cloud-based so you can look at it after the fact
is the microsoft defender used to be called defender atp and now it's called microsoft
defender for endpoints and what this gives you is a timeline view of what's going on in your machine
and again it's one of those things you have to see what is normal because here you've got events
in here that say in an unknown process change the protection and for my machine i know that's
perfectly normal i see it often so establishing what is normal in environment is key to really
using forensics to your advantage and making sure that you understand nefarious things versus normal
things bottom line computer forensics takes time and logs you need to make sure that you've
enabled your network to capture this information you need to make sure that logging and these
logs are stored elsewhere off the machine it's not a project that one should do quickly
you want to take time to understand your environment bottom line forensics is not easy
it takes expertise and it takes planning take the time now when you don't need it
for planning how when you do need it until next time this is susan bradley for cso online
you