# Digital Crime Scene Investigation Methodology

## Investigation process

There is no single way to conduct an investigation.

It does not matter which process is used.

* As long as we find the right person and do not break any laws in the process.

However, some are more efficient than others.

The four major phases – based on the physical crime scene investigation process

<figure><img src="https://620581463-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNrxMTPBjxxzJFosGtQvH%2Fuploads%2F8rhCQKJ53Y12MrvnSWop%2F2023-10-07_15-05.png?alt=media&#x26;token=af4df7f2-9796-4bfc-8e40-ffcb74f45182" alt=""><figcaption></figcaption></figure>

## Phase 1 - Identify The Source of the Digital Evidence

* Physically identifying the origin of the digital evidence.
* Choose the best approach to analyze it.
* Equipment seizure.

## Phase 2 - System Preservation

### Goals

* preserve the state of the digital crime scene.
* reduce the amount of evidence that may be lost.

### Actions vary depending on the legal, business, or operational requirements of the investigation.

* legal requirements may cause you to unplug the system and make a full copy of all data or,
* could be a case involving a spyware infection or a honeypot and no preservation is performed,
* if it’s not going to court, techniques in between can be used.

### Preservation Techniques

#### Post-mortem Analysis

* pull the plug to reduce the amount of evidence that is overwritten.
* make duplicate copies of all data.
* use write blockers to prevent evidence from being overwritten.

#### Live Analysis

* kill or suspend suspect processes unplug or limit network connection.
  * use an empty hub or switch to prevent log messages about a dead link.
  * use network filters to avoid a remote connection from perpetrator to delete data.
* backup important data (logs, files, etc)

### Data Integrity

When important data are saved during a post-mortem or live analysis, a cryptographic hash should be calculated to later show that the data have not changed.

<figure><img src="https://620581463-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNrxMTPBjxxzJFosGtQvH%2Fuploads%2F4lje8LsSZ9BdbxEgRwQB%2F2023-10-07_15-16.png?alt=media&#x26;token=97416e33-c6a1-4a73-8eee-5c71bb582987" alt=""><figcaption><p>Cryptographic hash algorithms</p></figcaption></figure>

#### MD5 Cryptographic Hash

* this algorithm is broken since 2004.
* use only for retro compatibility purposes.
* it is possible to create collisions – different files with the same hash value [examples](http://www.mscs.dal.ca/~selinger/md5collision/).

Hash values by itself are not enough.

* given a message _M_, its hash value is _H(M)_ = _h._
* someone can change both _M_ and _h_, because _h_ doesn’t depend on a secret.

Possible solution:

* Digital Signatures.
  * depends on a private key.
  * better if done with a secure device.

## Phase 3 - Evidence Searching

* **Goal**: find data that support or refute hypotheses about an incident.
* Typically starts with a survey of common locations based on the type of incident:
  * Web-browsing habits: look at the Web browser cache, history file, and bookmarks.
  * Linux intrusion: look for signs of a rootkit or new user accounts.

It is important to look also for evidence that **refutes** your hypothesis instead of only looking for evidence that only supports your hypothesis.

### Searching Process

1. define the general characteristics of the object for which we are searching.
2. look for that object in a collection of data.
3. two key steps:
   1. determining for what we are looking.
   2. where we expect to find it.

### Searching Techniques

Most searching for evidence is done in a file system and inside files.

Search for files based on:

* Their names, or patterns in their names.
* A keyword in their content.
* Temporal data, such as the last accessed or written time.
* Hash values and compare them against a database.
  * Allows to find all files of a given type even if someone has changed their name [National Software Reference Library (NSRL) database](https://www.nsrl.nist.gov).

Analyzing network data based on:

* Packet headers, such as IP addresses, port number, protocol, ...
* Keywords inside packets content.

## Phase 4 - Event Reconstruction

**Goal**: try to answer questions about digital events in the system.

During the Evidence Searching Phase we might find several files that violate a law.

* But it doesn’t answer questions about events.
* The file may have been the effect of an event, but what application downloaded it? a web browser? a malicious software? - **several cases have used malware as a defense**.
* It may be possible to correlate the digital events with physical events.

Event reconstruction requires knowledge about the applications and the OS that are installed on the system so that you can create hypotheses based on their capabilities.
