Please enable JavaScript.

Coggle requires JavaScript to display documents.

17:5 (IS auditor should consider key elements of computer forensics during…

- - - - ensure that it is writeprotected.
      - By examining volatile data, investigators can determine what is currently happening on a system. Volatile data includes
        
        open ports,
        
        active processes,
        
        user logons and
        
        open files
        
        other data present in RAM
  - - - process should include
        
        standards of quality, integrity and
        reliability.
        
        includes software used and media where an
        image was made.
      - could include different sources, such as system logs, firewall logs, IDS logs, audit trails and network management information.
  - - - possible because imaging duplicates the disk
        surface, sector by sector.
        
        possible to recover destroyed information (erased even by reformatting) from the disk’s surface.
  - - - • Be able to withstand a barrage of legal scrutiny
      - • Accurately describe the details of an incident
      - • Be understandable to decision-makers
      - • Be unambiguous and not open to misinterpretation
      - • Be easily referenced
      - • Contain all information required to explain conclusions reached
      - • Offer valid conclusions, opinions or recommendations when needed
      - • Be created in a timely manner
- - - - and have not been tampered with or modified during the process of collection and analysis.
    - - chain of evidence contains information
        regarding:
        
        • Who had access to the evidence (chronological manner)
        
        • The procedures followed in working with the evidence (e.g., disk duplication, virtual memory dump)
        
        • Proving that the analysis is based on copies that are identical to the original evidence (e.g., documentation, checksums or timestamps)
  - - - identification of information that is available and
        might form the evidence of an incident
    - - the practice of retrieving identified information and
        preserving it as evidence
        
        requires being able to document chain-of-custody so that it can be established in a court of law.
        
        includes the imaging of
        original media in presence of an independent third party. #
    - - extracting,processing and interpreting the evidence. #
        
        Extracted data could be unintelligible binary data after it has been processed and converted into human readable format.
        
        requires an in-depth knowledge
        
        should be performed using an image of media and not the original.
    - - presentation to the various audiences, such as
        management, attorneys, court, etc.
        
        Acceptance of the evidence depends on
        
        manner of presentation (because it should be convincing)
        
        qualifications of the presenter
        
        credibility of the process that is used to
        preserve and analyze the evidence.