计算机犯罪侦查.pptVIP

Presentation Forrester Research, Inc. Theme Agenda Why prepare for digital investigations? The investigation process Types and goals of digital investigations Types of tools available Preparing for digital investigations Definitions Why prepare for digital investigations? “An ounce of prevention is worth a pound of cure.” Attacks are sometimes successful. Laws require the disclosure of some breaches. Civil litigation — e-discovery Work with law enforcement Resolve disputes, e.g., claims of harassment Uncover fraud Reasons given for not preparing “It won’t happen to me.” “Lightening doesn’t strike twice.” Tools and expertise are rare and expensive. Going to court is expensive; laws haven’t been tested. Investigations are a cost with no return, and there is no incentive to prepare for them. The investigation process Triggering event First responders perform triage May or may not terminate incident Perform no damage to evidence Acquire authorization to obtain evidence E.g., search warrant Document scene, search for evidence The investigation process (continued) Acquisition, storage, and handling of evidence In digital investigations, this means imaging disks. It may also mean copying the contents of memory. Analyze the evidence In digital investigations, this means searching all obtained evidence for clues and real evidence. Presentation of evidence and analysis The investigation process Review and improve For digital investigations, we need to sanitize and share the results of investigations, especially the preparations and methodologies that work and the lessons learned. Types of digital investigations Incident response investigation Internal investigation Criminal investigation Electronic discovery Data recovery Goals of digital investigations Prosecution Surveillance Incident response — elimination Incident response — root cause analysis Incident response — recovery Incident response — verification Employee misconduct Fraud detection E-discovery Golden rules of di