Computer forensics is a branch of digital forensics.
Digital Forensics Concepts
Digital forensics concepts:
- Evidence
Evidence
You can read more about evidence on this post.
Digital Forensics Incident Response (DFIR)
Digital Forensics Incident Response (DFIR) is a specialized field within cybersecurity that focuses on the collection, preservation, analysis, and presentation of digital evidence in support of legal proceedings or incident investigations. It involves the systematic process of identifying, containing, eradicating, and recovering from security incidents or breaches in an organization’s information systems.
DFIR activities include:
- Incident Identification: Recognizing and classifying potential security incidents or breaches based on various indicators such as anomalous network traffic, system alerts, or reports from users.
- Evidence Collection: Gathering digital evidence from various sources including computers, servers, network devices, storage media, and cloud services while maintaining the integrity and chain of custody of the evidence.
- Forensic Analysis: Analyzing the collected evidence using specialized tools and techniques to reconstruct events, determine the scope and impact of the incident, identify the root cause, and uncover any malicious activity or unauthorized access.
- Incident Containment and Eradication: Taking immediate actions to contain the incident, prevent further damage or data loss, and remove malicious entities from the affected systems or networks.
- Remediation and Recovery: Restoring affected systems and data to their normal state, implementing security patches or measures to prevent similar incidents in the future, and conducting post-incident reviews to improve incident response procedures.
- Documentation and Reporting: Documenting the entire incident response process, including findings, actions taken, and recommendations, and providing detailed reports for internal stakeholders, law enforcement agencies, or regulatory bodies.
Electronic discovery (also known as e-discovery) is the electronic aspect of identifying, collecting and producing electronically stored information (ESI) in response to a request for production in a law suit or investigation.
Digital Forensics Standards
ISO/IEC Digital Forensics Standards
ISO has developed a set of global digital forensics standards:
- ISO/IEC 27037:2012 “Guide for collecting, identifying, and preserving electronic evidence”
- ISO/IEC 27041:2015 “Guide for incident investigations”
- ISO/IEC 27042:2015 “Guide for digital evidence analysis”
- ISO/IEC 27043-1:2015 “Incident investigation principles and processes”
- ISO/IEC 27050-1:2016 “Overview and principles for eDiscovery”
NIST Digital Forensics Standards
NIST SP 800-86 is a reference about digital forensics. You can read it on this external link.
Digital Forensics Devices
A forensics drive controller or write blocker has many functions, and the main one is preventing any command sent to advice from modifying data stored on the device.
Digital Forensics Software Tools
Digital Forensic Tools featured on this post:
- dd
- Velociraptor
dd
dd is a Linux tool to create a bit-by-bit copy of the target drive that is well suited to forensic use, and special forensic versions of dd exist that can provide even more forensic features.
Velociraptor
Velociraptor is a FOSS forensics and incident response tool.
The Sleuth Kit
The Sleuth Kit is FOSS.
The Sleuth Kit official website
Oxygen Forensics Suite
Oxygen Forensics Suite is proprietary.
Oxygen Forensics Suite official website
The Volatility Framework
The Volatility Framework is developed by the Volatility Foundation. It is FOSS.
Volatility Foundation official website
You might also be interested in…
External References
- M. Chapple, D. Seidl; “CCSP Official Guide Third Edition“, chapter 9, section “Cloud Forensics”, pp. 281-284; Wiley, 2021