American Society of Crime Laboratory Directors (ASCLD)

ASCLD is a non-profit organization that provides a set of guidelines and standards for forensic labs. The organization not only promotes excellence in forensic practices, but also encourages innovation in the forensic practitioner community. ASCLD is not an accrediting body and should not be confused with ASCLD/LAB. More information can be found on their website at ascld.org.

American Society of Crime Laboratory Directors/Lab Accreditation Board (ASCLD/LAB)

ASCLD/LAB was originally a committee, within ASCLD, when it was created in 1981. Since 1982, however, it has been accrediting crime labs. In 1984, ASCLD/LAB became a separate non-profit entity with its own board of directors. It currently certifies labs for federal, state, and local agencies, as well as some crime labs based outside the United States. The certification process of crime labs includes computer forensics labs. As an impartial entity, ASCLD/LAB strives to maintain certain standards for forensics labs, including standards that govern the behavior and practices of lab employees and their managers. In other words, those who work in a forensics lab must be always mindful of the law and continually adhere to proper scientific practices. Moreover, ASCLD/LAB also promotes a code of ethics for lab staff and management.

ASCLD/LAB Guidelines for Forensic Laboratory Management Practices

Laboratory managers are advised to act with integrity and create an environment of trust and honesty. A forensics laboratory should also have quality controls and maximize the use of laboratory resources in an efficient manner, to effectively manage the laboratory’s casework. A laboratory manager is also accountable for maintaining the health and safety of those who work in the lab. Furthermore, maintaining the security of the laboratory, particularly with respect to access, is also a responsibility of the manager. The manager must also ensure that she hires highly qualified staff and also encourages research and continuous training, including staff certifications. The following list summarizes the proper laboratory management practices, as outlined by ASCLD/LAB (https://www.ascld.org/wp-content/uploads/2018/07/Guidelines-for-Forensic-Laboratory-Management-Practices-2018.pdf):

• Managerial competence

• Integrity

• Quality

• Efficiency

• Productivity

• Meeting organizational expectations

• Health and safety

• Security

• Management information systems

• Qualifications

• Training

• Maintaining employee competency

• Staff development

• Environment

• Communication

• Supervision

• Fiscal

• Conflict of interest

• Response to public needs

• Professional staffing

• Recommendations and references

• Legal compliance

• Fiscal responsibility

• Accountability

• Disclosure and discovery

• Work quality

• Accreditation

• Peer certification

• Peer organizations

• Research

• Ethics

Many law enforcement agencies strive to attain ASCLD/LAB certification, but most never secure this certification. It might not always be necessary to realize this certification, but agencies should still try to adhere to many of the principles outlined by ASCLD/LAB, including maintaining best practices and industry protocols, proper documentation, and ongoing training for lab personnel.

ISO/IEC 17025:2017

ISO/IEC 17025:2017 are the “General requirements for the competence of testing and calibration laboratories”. These international standards can apply to any type of laboratory that carries out calibration and testing activities, which may include digital forensics laboratories. Formed in 1946, the International Organization for Standardization (ISO) is an independent, non-government organization, which is comprised of 162 national standard bodies. ISO provides guidance on many standards in technology, from certifications to hardware and software standards. For example, ISO 9660 provides guidance for the Compact Disc File System (CDFS) and the hardware for optical disc manufacturers. Thus, a music CD purchased in Ireland can work on a CD player in Canada.

ISO/IE 17025 may be used in conjunction with ASCLD/LAB. The version, released in 2017, replaces the previous guidelines that were released in 2005. The latest version provides a greater emphasis on information technology, through the use of computer systems, electronic results, and reporting. While the standards outlined in ISO/IEC 17025:2017 have been primarily adopted by traditional scientific laboratories (biology, chemistry, medical, etc.), in theory, these standards could be adopted by a digital forensic laboratory.

Scientific Working Group on Digital Evidence (SWGDE)

The Scientific Working Group on Digital Evidence (SWGDE) is a committee dedicated to sharing research and setting standards for investigators working with digital and multimedia evidence. The group was formed in 1998 and subsequently began working with ASCLD/LAB in 2000. Later in 2003, the field of digital evidence was added to the ASCLD/LAB accreditation program.

Federal, state, and local law enforcement officers, who do not have any commercial interests, are invited to join as regular members. Additionally, educators, and those from the private sector, can join as associate members. SWDGE is a marvelous resource for computer forensics research on topics that range from investigations involving various operating systems to best practices in mobile phone examinations (www.swgde.org).

SWGDE is well-respected and provides best practices for computer forensics examinations, digital evidence collection, image authentication and much more. Their publications are continually updated to incorporate the latest advances in technology. For example, with a dramatic increase in full disk encryption on computer systems, SWGDE emphasizes the importance of forensically imaging live systems, especially volatile memory (primarily RAM).

Evidence Acquisition Laboratory

An evidence acquisition laboratory is responsible for extracting evidence from hard drives, flash drives, and other storage devices to create read-only forensic image files. The staff members in this laboratory need to be skilled in imaging software like FTK, EnCase, and X-Ways. Additionally, they will often have to crack passwords using tools like AccessData’s Password Recovery Toolkit (PRTK), perhaps with the addition of rainbow tables. Rainbow tables are password hashes used for a dictionary attack on a file or even a volume. Files, folders, and drives may also need to be decrypted. Laptop hard drives and associated removable flash memory or external drives often utilize an encryption tool such as Credant, and therefore a computer forensics examiner will need a decryption key. Often, decryption is nearly impossible or impossible when a suspect has used Pretty Good Privacy (PGP) encryption or has activated full-disk encryption using FileVault or FileVault2 on a Mac.

Email Preparation Laboratory

Email evidence is arguably the most important type of evidence that can be retrieved from a computer. Email often reveals our most innermost thoughts and the most incriminating evidence. Because of the tremendous importance of email in investigations, some computer forensics departments have a laboratory dedicated to email examinations, where staff will parse email files to make them easier to view by attorneys involved in a case.

Inventory Control

Sometimes an investigation involves thousands of hard drives and storage media. Moreover, the sources can vary greatly, from magnetic tapes, to hard disk drives, to zip disks, to thumb drives. Therefore, proper management and control of this storage media is critical. A laboratory is often devoted to the management and storage of evidence.

Large corporate investigations create vast amounts of evidentiary data. For example, the collapse of Enron, due to corporate malfeasance, necessitated the use of numerous computer forensics examiners, who sifted through thousands of emails and other digital data. The investigation generated 31 terabytes of data (10¹² bytes), which is the equivalent of 15 academic libraries. More paper was generated for this one investigation than exists in the Library of Congress.

Laboratory Information Management Systems

Using an off-the-shelf product will reduce the time to develop and manage case management and may be necessary if system developers are not available or cannot be factored into a budget. Lima Forensic Case Management, by IntaForensics, is one option for a digital forensics laboratory. ASCLD/LAB also provides guidance about case management. Nevertheless, if information technology developers are available, then it is recommended that a custom information management system be developed. This is because the needs of each laboratory are different. For example, the needs of an eDiscovery firm are very different from a high technology crime laboratory for a district attorney’s office. A larger district attorney’s office may maintain a scheduling system for prosecutors to meet with forensic examiners. The crime laboratory may also maintain a special intake area for evidence so that a prosecutor does not need to enter the crime laboratory. With larger laboratories, an information management system is critical so that cases are managed appropriately and are prioritized. Furthermore, an information management system should have a comprehensive reporting system so that case metrics can be reported and to help senior management identify how the purchase of forensic tools and training programs may be justified.

Web Hosting

Once evidence has been extracted, analyzed, and parsed into a readable format, it needs to be made available to a company’s lawyers. Simply emailing the evidence to legal counsel is often not feasible. Therefore, a computer forensics department or consulting firm may provide a web hosting service, where authorized individuals can access the evidence for an investigation through a secure website. Discovery is the period leading up to a trial when each party involved in civil litigation can request evidence from the other party. Hence, web hosting can provide a safe and effective way to display evidence to the plaintiff and defense counsels. Of course, discovery can not only include evidence from a computer but also evidence in the form of depositions or subpoenas from entities not party to a lawsuit.

The technical skills of staff members, assigned to this area of a computer forensics department, are certainly different than in other areas of the department. Website designers are required (at least, during the initial phase) to create the site, and web developers are needed to organize the information. Additionally, staff skilled in database design, development, and management are required to create a database that will not only contain searchable evidence and reporting features, but also will manage access to relevant information in a secure manner. Additionally, staff are needed to continually upload and maintain the evidence online for various investigations.

Laboratory Layout

The layout of your laboratory will be determined by your investigative needs, the number of staff who will be involved in investigations, and the resources that you have available. Figure 4.1 is a diagram of a relatively small computer forensics laboratory.

Evidence Locker

An evidence locker is a metal cabinet with individual compartments that can be locked individually. These cabinets are often made of steel with tamper-resistant padlocks. A high-end door lock, like a Simplex lock, should be used with other physical security measures. Figure 4.2 shows an image of the door to an evidence room, and Figure 4.3 shows digital evidence stored in the evidence room.

Hardware

A number of hardware devices must be budgeted for when developing a computer forensics laboratory. The following sections highlight the most important items that should be purchased.

Cloning Devices

Every computer forensics laboratory should have a forensic disk duplicator (cloning device) for forensically cloning hard disk drives at the crime scene or in the laboratory. Many different types of hard disk duplicators exist. They generally provide a feature to sanitize a harvest drive, which is an important process in preparing for an investigation. However, when purchasing a disk cloner, the purveyor should ensure that the device is a “forensic” device. Higher-end hard disk cloners have the ability to create multiple copies simultaneously. The investment is worthwhile if the laboratory handles large quantities of suspect hard drives. Disk cloners typically support both SATA and IDE hard disk drive connections.

Write-Blockers

As noted in Chapter 3, “Handling Computer Hardware”, a write-blocker is a hardware device that allows an individual to read data from a device, such as a hard drive, without writing to that device. In general, a write-blocking kit will include a number of different write-blockers, power adapters, and cables, which will connect to eSATA, SATA (see Figure 4.5), IDE, Serial Attached SCSI, USB (see Figure 4.7), and FireWire (see Figure 4.6) devices. A lab should also maintain a write-blocking card reader (see Figure 4.8) for Secure Digital cards, xD cards, Memory Sticks, and so on, as well as a ZIF hard drive adapter and cables. The latter is used for imaging or cloning 1.8-inch ZIF hard disk drives, manufactured by Toshiba, Samsung, and Hitachi. These hard disk drives can be found in Dell Latitude D420 and D430 laptops. When the ZIF adapter and ZIF cable are connected between the suspect’s 1.8-inch ZIF hard disk drive and the IDE connection, cloning the drive can often fail, so be prepared to image the drive through the USB connection on the laptop (with a write-blocker of course). Any failure to clone or image a drive should be included in the investigator’s notes.

SIM Card Readers

Cellular telephones that operate on the Global System for Mobile (GSM) Communications network contain a Subscriber Identity Module (SIM) card, which will need to be forensically examined using a SIM card reader (see Figure 4.9). Chapter 9 provides more information on this topic.

Harvest Drives

Harvest drives are hard disk drives that act as receptacles for evidence acquired from the suspect’s hard disk drive. A computer forensics laboratory often uses thousands of SATA drives annually. Remember, in most cases, two copies of each of the suspect’s hard drive are made. The same type of SATA hard disk drives can be used to clone the hard disk drives of both Macintosh computers (Macs) and personal computers (PCs), regardless of whether they are desktops or laptops. As previously noted, harvest drives should be sanitized (wiped clean) when initially purchased. Naturally, a variety of sizes of hard disk drives should be purchased, and an investigator should always have hard drives with the latest capacities available to ensure that they can cope with the latest technologies. An investigator should also always carry extra harvest drives to an investigation because the cloning process can fail and there may be no time to sanitize the harvest drive (or destination drive) again and restart an acquisition. USB-powered hard disk drives (see Figure 4.10) should also be part of the investigator’s collection of harvest drives because direct drive-to-drive cloning may not be possible.

Toolkits

Every computer forensics examiner needs a computer toolkit similar to the one depicted in Figure 4.11. The tools are primarily screwdrivers used for removing hard drives from desktops, laptops, and the enclosures surrounding external hard drives. Other tools should also be considered, including a snips to remove cable fasteners and pliers to hold or bend wires and other objects.

Flashlights

An investigator sometimes requires the use of a good flashlight for locations where the lighting is poor and inadequate. Moreover, there are times when a suspect may try to hide digital devices and therefore a flashlight is required.

Digital Cameras

An investigator’s notes are key to effectively documenting an investigation. Photographing devices that are seized is critical to properly documenting an investigation. An investigator should take photographs of where the devices are located. Additionally, the configuration of devices or how they are connected should be carefully photographed and documented. This is important because the investigator may need to re-create how a number of devices were connected, especially with an unusual setup that is unfamiliar to the investigator.

When photographing a computer, the investigator must photograph the computer, its drive bays (CD/DVD, etc.), ports (serial, USB, etc.), and the serial number of the computer. The serial number format varies on different computers; sometimes there will be “S/N” before the number, and on Dell computers, the serial number is called the Service Tag. When the cover on a desktop is removed to display the hard disk drive, be sure to look for multiple hard disk drives. The investigator should photograph the drives before they are removed and then note the order in which each hard disk drive was located. Each drive should be differentiated by the serial number of the hard disk drive. Each hard disk drive should be photographed, and the investigator should verify that the serial number in each photograph is clearly visible. Finally, it is always important to bring replacement batteries for the digital camera.

Evidence Bags

Evidence bags (see Figure 4.12) come in many shapes and sizes, but they all serve the same purpose: to prevent tampering evidence and to record the chain of custody. This means that an evidence bag will have a tamper-resistant device, like an adhesive closure strip, so that the evidence cannot be accessed surreptitiously. Antistatic polyethylene evidence bags are designed to protect electronic devices from static electricity, and a computer forensics examiner should always have these when going onsite (crime scene).

Evidence Labels

All drive bays should be sealed with an evidence label, and computers should be wrapped with tape to ensure that the evidence is not tampered with.

Photo Forensics

The importance of photos to investigations is clear because they are so personal and they are so prevalent. To give you an example of their importance, an estimated 6 billion photos are uploaded to Facebook every month. Photos can be used in all types of investigations, but child abuse is certainly the most important in terms of relying on evidence to convict a suspect. Photos are also quite important to cases involving intellectual property and copyright issues. Chapter 11, “Photograph Forensics”, provides more detailed information about photo forensics.

Photo File Formats

JPEG is the most popular picture file format and is supported by most systems and photo-enabled devices. Many other picture file formats exist, however. Websites can contain JPEG, GIF, and PNG picture formats. Cameras use JPEG and RAW formats. The Adobe Digital Negative (DNG) format also is used, and Microsoft has its proprietary BMP format. All of these images are raster-based graphics that are rectangular pictures based on pixels.

Photo files are sometimes compressed. There are two types of compression: (i) lossy compression where the picture is made smaller with some image quality compromise and loss of data and (ii) lossless compression where unneeded data is eliminated from a file without loss of original data. JPEG photos use lossy compression.

Photo Metadata

As previously noted, EXIF data (see Figure 4.19) is the metadata found in images that can contain the date and time that a photo was taken, the make and model of the camera that took the picture, and an embedded thumbnail of the image. EXIF data can also contain the geographic location (longitude and latitude) of where the photograph was taken. Sometimes the serial number of the camera may also be stored in a photograph. The user may of course also add a personalized description to an image.

Photo Evidence

Most forensic imaging tools, like FTK, EnCase, and X-Ways, can efficiently find and display photo images in a separate category. More photo images can be found by carving pictures that are embedded in other files, like emails for example. Photo files have now become so large that they are often fragmented across a hard disk drive. When fragmentation occurs, reconstructing these images can be problematic. If a fragment is overwritten, then reconstruction is virtually impossible, which is in contrast to many other file types.

Adroit Forensics

Adroit Forensics is a photo forensics tool developed and distributed by Digital Assembly. Adroit uses a process called SmartCarving, which enables the investigator to reconstruct a photograph when file fragments of the picture are located in non-contiguous sectors on a hard disk. The tool can also categorize photographs by date and by camera. Filters can be applied to search for skin tones and, more specifically, child faces.

Laboratory Management

The American Society of Crime Laboratory Directors Laboratory Accreditation Board (ASCLD/LAB) provides extensive guidelines on best practices for managing a forensics laboratory. Many people view the ASCLD/LAB certification as the ultimate approval of a forensics laboratory. Most laboratories will never be ASCLD/LAB certified, but many labs still adhere to the principles outlined by ASCLD/LAB. Some forensics laboratory managers believe that attaining this certification will benefit their standing in the courtroom as experts who follow proper protocols. Thus, it is important to outline some of these guiding principles in the proceeding sections.

Laboratory Access

Restricting access to a computer forensics laboratory is extremely important and should be part of your physical security plan. Ideally, only those who handle evidence and manage the laboratory should have access to the room or building where your equipment and evidence are held. Access to a laboratory can be controlled using the following methods:

• Picture identification card

• Biometric authentication

• Security guard

• Closed-circuit television (CCTV)

• Keypad with access code

To prevent unauthorized access, other precautions should be put in place. The laboratory manager can perform a background check, with the assistance of the human resources department, to make sure that employees have nothing in their background, such as a criminal record, that would preclude employment in the laboratory. Naturally, the laboratory manager should also undergo a background check before employees are assigned to the laboratory. Unfortunately, many employers do not continue to monitor the activities of their laboratory employees after they are hired.

Laboratory Access Auditing

An audit of those who access the computer forensics laboratory is necessary. Preferably, a system is in place that can automatically record anyone who enters the laboratory, possibly by recording entry automatically when a person uses his or her identification card to enter the laboratory. This audit could hopefully be backed up with CCTV surveillance. At a minimum, there should be a clipboard, by the entry point, where staff and visitors are required to sign in and out of the laboratory with the date and time. Figure 4.20 shows a sample sign-in sheet.

Using the dd Utility

As previously noted, dd is a UNIX command-line utility used to copy data from a source location to a destination. From a computer forensics perspective, dd is important because it is an accepted file format for forensic imagining and because of its versatility. In addition, dd is versatile because it can be used to image very specific data, the user can verify images by using the MD5 algorithm, and images can be sourced from a specific computer on a network and that image sent to a network location.

The basic format of a dd command follows:

Click here to view code image

dd if=<source> of=<destination> bs=<byte size>

In the example above, if is short for input file and of is short for output file. The byte size is often set at 512 bytes but differs according to the file system you are working with and how quickly you want to copy the source data.

As noted earlier, a destination drive should be sanitized before acquiring data. dd can be used to forensically clean a drive using the following command:

dd if=/dev/zero of=/dev/

In the example above, dev is short for device. When executed, the drive will have zeros written to it. This command confirms that the drive now just contains zeros:

Click here to view code image

dd if=/dev/sda | hexdump -C | head

In the previous example, sda refers to the hard disk, which is the source of data you want to copy. Here is a list of other devices you might want to copy from:

• sr0: CD-ROM

• fd0: Floppy disk

• sdb1: USB volume

The following command would then create a copy of the source file:

Click here to view code image

dd if=/dev/ of=/dev/ bs=512 conv=noerror

In the previous expression, conv=noerror is used to skip blocks with bad data.

A major benefit of using the dd utility is the ability to image a file across a network. In UNIX, we can use a utility called netcat to copy files over a network. We use the command nc, which is used for netcat. Following is the structure of dd over a network:

Click here to view code image

dd if (input file) | nc (NetCat) <Target-IP Address> <Port>

Here is an example of a netcat command:

Click here to view code image

dd if=/dev/hda bs=512 | nc 192.166.2.1 8888

In the previous example, 192.166.2.1 is the IP address of the target computer and 8888 is an arbitrary port number that we will use to transmit the file.

It is also possible to conduct remote imaging of a hard drive over a network using SSH, which can prevent sniffing by a third party (https://www.linode.com/docs/migrate-to-linode/disk-images/copying-a-disk-image-over-ssh/).

Using Global Regular Expressions Print (GREP)

Many computer forensics tools today have become so user-friendly that some people have termed them “push-button forensics”. While using these tools can be nice, relying on them too much could mean that an investigator fails to understand the science behind these tools. This is problematic when an investigator is called on to be an expert witness and must explain how these tools work. Additionally, when we have a better understanding of concepts like Global Regular Expressions Print (GREP) and know Linux commands, we gain more control over how we conduct an investigation and become more competent.

Most of the computer forensics imaging tools available contain advanced search features, one of which is GREP. Global Regular Expressions Print (GREP) is a powerful set of UNIX expressions used for pattern matching. When using GREP, each line from a file is copied to the buffer, is compared against a search string (or expression), and then, if there is a match, outputs the result to the screen. GREP can be used not only to search through files, but also to search through the output of a program. GREP allows an investigator to search evidence files for key terms or numbers using specialized expressions.

Amazingly, very few computer forensics books cover GREP, even though this powerful search feature can be found in forensic tools like EnCase. Similarly, GREP provides tremendous search capabilities from the command line.

Here is a list of commands used in GREP:

• c Does not print the keyword, but instead details the number of times the keyword displays.

• -f searches a particular file for a keyword.

• -i is not case sensitive, meaning that it ignores the case of the search term.

• -l Outputs the filenames of the matches.

• -n Provides details about which lines in a file contain a match.

• -v Displays the lines that do not contain the keyword.

• -x Outputs only exact matches.

• $ is used to search lines that end in a certain character.

Imagine a file containing the following data:

Secluded
Sector
Sect
Sects
$ect

The following simple GREP expression searches each line for any word containing Sect in the file test.txt:

# grep "Sect" test.txt

The following result then prints onscreen:

Sector
Sect
Sects

To specify the line when the match was made, you use the following:

# grep -n "Sect" test.txt

The following result then prints onscreen:

2:Sector
3:Sect
4:Sects

To search for an exact match, use the following command:

# grep -x "sect" test.txt

The following result prints onscreen:

Nothing is printed to the screen because Sect in the file is not an exact match with sect.

To find keywords that end with the letter r, you use the following expression:

# grep "r$" test.txt

The following result prints onscreen:

Sector

Extended Global Regular Expressions Print (EGREP) allows for the additional use of operators not found in basic GREP. The following shows EGREP notation:

The use of ? means that the previous character may or not be in the keyword. Take a look at this example:

# grep "Sects?" test.txt

The following result prints onscreen:

Sect
Sects

In EGREP, a | is known as a pipe. On the PC keyboard, hold down the Shift key and then press the key above the Enter key. A pipe functions as an “or” command. Here is an example of an EGREP expression using a pipe:

# egrep "Sect|Sects" test.txt

the following result prints onscreen:

Sect
Sects

The same result prints to the screen. Thus, you should remember that GREP and EGREP will often provide multiple expression connotations to produce the same output.

Finally, there is FGREP. Fast Global Regular Expressions Print (FGREP) is a UNIX search utility that does not use regular expressions but interprets characters literally and is therefore faster than GREP. Consider an FGREP expression:

# fgrep "$ect" test.txt

The following result prints onscreen:

$ect

We can now take a look at a more practical example of how an investigator might use GREP. In this example, a detective has been tipped off about a Word document on a suspect’s machine. The file is called bank.docx. The investigator does not know the name of the file or its contents, but we know:

Click here to view code image

Dave,
Here's the stolen credit card details that I told you about.
Have fun!
J-Man

1. James Colgan
Card# 6011-0001-0001-0001-0001
CVV: 444
Expiration: 12/14
Telephone: (212) 555-0879
SS# 123-45-6789

2. Francis Bolger
Card# 53690001000100010001
CVV: 444
Expiration: 0113
Telephone: 6095551111

An informant told the detective that the suspect had accessed the Word document (.docx) within the past three days. The following GREP expression can find all Word documents accessed in the past three days:

# find . -name '*.docx' -atime -3

Here is a breakdown of that command:

• # is automatically added in UNIX and indicates that this is the root user.

• find is the search function in FGREP.

• . refers to all files being searched.

• -name refers to a search for a filename.

• * is the Kleene star, which means that anything can display before the proceeding file extension.

• .docx refers to the file extension we are searching for.

• -atime refers to the access time.

• -3 refers to three—in this case, three days.

If the detective knew the approximate modify date, then -mtime (Modified Date) could have been used instead of -atime (Access Date).

The following are some additional helpful GREP expressions for investigators.

City, State, Zip Code

Click here to view code image

'[a-zA-Z]*, [A-Z][A-Z][0-9][0-9][0-9][0-9][0-9]'

Email Address

Click here to view code image

'[a-z0-9.]*@[a-z0-9.]*.[a-z][a-z][a-z]+'

The + indicates that there could be either two or three letters at the end of the email address.

The following GREP expression will find an IP address:

IP Address

Click here to view code image

'[0-9]*.[0-9]*.[0-9]*.[0-9]*'

This regular expression is for IPv4 addresses. The * looks for any number of characters between 0 and 9 digits long. The . indicates that a period follows.

FTK and EnCase tools have their own versions of GREP, so understanding the GREP commands listed previously is extremely helpful.

Financial Fraud

The criminal investigation noted above involved financial fraud and, more specifically, credit card theft. Before continuing with GREP searches of the file listed previously, it is prudent to understand some basic information about credit cards to make your GREP searches more efficient. Moreover, credit card fraud is a huge problem in the Western world.

There are distinctive groups of bank and credit cards. Certain cards, like American Express, MasterCard, and Visa, are issued through banks. These can be in the form of credit, debit, or prepaid (or gift) cards. Other cards, like Discover, are issued direct to the customer without a secondary bank. Capital One is in a separate category, as it is a bank that issues its own credit cards.

When searching for credit card numbers on a computer, it is helpful to know how the numbering system works. The Major Industry Identifier (MII) refers to the first digit of a credit card number. Figure 4.21 shows some issuer categories.

The Issuer Identification Number (IIN) refers to the first six digits of a credit card number. A credit card number can range from 12 digits to 19 digits. Figure 4.22 shows a list of some of the major credit card issuers and their IINs.

Based on the information in the preceding matrices and the data in the bank.docx file, it is clear that the credit card belonging to James Colgan is a Discover card, whereas Francis Bolger owns a MasterCard. This is helpful because if we wanted to search for MasterCard on a computer, we know that the first two digits range between 51 and 54 and that the credit card has a total of 16 digits.

A simple GREP search for a 16-digit credit card with five groups of four digits and dashes could be written as follows:

Click here to view code image

# grep "[[:digit:]]{4}-[[:digit:]]{4}-[[:digit:]]{4}-[[:digit:]{4}-
[[:digit:]]{4}" bank.docx

Result(s): 6011-0001-0001-0001-0001

However, we can see from the bank.docx file that Bolger’s credit card number is listed without dashes. Therefore, to find both matches, an EGREP command can be used:

Click here to view code image

# egrep "[[:digit:]]{4}-?[[:digit:]]{4}-?[[:digit:]]{4}-?[[:digit:]{4}-
?[[:digit:]]{4}" bank.docx

The ? in the previous command denotes that the dash may or may not appear for it to be a positive match and print to the screen.

Result(s): 53690001000100010001 and 6011-0001-0001-0001-0001

The following GREP search on bank.docx finds numbers with 20 digits and no dashes:

Click here to view code image

# grep "[[:digit:]]{20}" bank.docx

Result(s): 53690001000100010001

The following GREP command finds credit cards that begin with a 4 or 5 or 6. In other words, a Visa card, MasterCard, or Discover card could be a match, but an American Express would not be a match because it begins with a 3.

Click here to view code image

# egrep “[[:digit:]][456]{3}-?[[:digit:]]{4}-?[[:digit:]]{4}-?[[:digit:]{4}-
?[[:digit:]]{4}” bank.docx

Result(s): 53690001000100010001 and 6011-0001-0001-0001-0001With the previous expression run on the bank.docx file, both credit cards would be a match and would be output to the screen. [456] in GREP is the equivalent of the series {4,5,6}.

The bank.docx file also contains telephone numbers that might be of interest to us. The following GREP search looks for a 10-digit telephone number with no spaces:

Click here to view code image

# grep "^[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]$"

Result: 6095551111

It is important to note that, as with Word, Microsoft Office documents are actually a file bundle. Therefore, another program needs to be run before a GREP search can be performed. Likewise, a direct GREP search cannot be performed on an entire hard drive, although FTK and EnCase make the GREP search process easier.

One cannot underestimate the importance of knowing Linux as a computer forensics investigator. The importance of knowing Linux becomes even more apparent when we cover Android forensics, as discussed in Chapter 9, “Mobile Forensics”. There are numerous wonderful resources available online, including the following for Bash Shell Scripting (http://www.tldp.org/LDP/abs/html/).

Check Fraud

Another important type of investigation is check fraud. An investigator might want to run a GREP search to find ABA numbers. An American Bankers Association (ABA) number is found on checks and indicates how this financial instrument is to be routed through the banking system. The first two digits of the ABA relate to a corresponding Federal Reserve Bank. Figure 4.23 lists these banks.

An investigator can quickly ascertain the exact bank and branch for a check by checking online websites like Bank Routing Numbers (routingnumber.aba.com).

GREP and EGREP searches can be used for any alphanumeric search, including searches for IP addresses, Social Security numbers, email addresses, picture files, and many other important searches.

Classroom Discussions

1. Explain the process by which you would plan, create, and maintain a successful computer forensics lab.

2. How can GREP be used in computer forensics investigations?

3. Detail the type of equipment that a computer forensics examiner in law enforcement would need to bring to a crime scene.

4. Why have skimmers become such a huge problem worldwide?

Multiple-Choice Questions

1. Which of the following fire extinguishers are suitable for electrical fires?

1. AFF

2. FAC

3. DBA

4. ABC

2. Which of the following indicates the routing information for a bank branch?

1. ABC

2. AFF

3. ABA

4. ESI

3. Which UNIX search utility does not use regular expressions but interprets characters literally and is therefore faster than GREP?

1. FGREP

2. GREP

3. EGREP

4. XGREP

4. Which of the following best describes using a predetermined list of words to decrypt data or authenticate a user?

1. Dictionary attack

2. Brute-force attack

3. EGREP

4. Cryptanalysis

5. Which of the following formats is the forensic disk image file format developed by Guidance Software?

1. AFF

2. dd

3. AD1

4. E01

6. Which of the following formats is the forensic disk image file format developed by ASRData’s Expert Witness?

1. AFF

2. E01

3. SMART

4. RAW

7. Which of the following best describes what electronically stored information (ESI) can include?

1. Email

2. Spreadsheets

3. Databases

4. All of the above

8. Which of the following organizations is an independent body that provides forensics lab guidelines and certification?

1. ASCLD

2. ASCLD/LAB

3. ESI

4. SWGDE

9. Which of the following refers to the first six digits of a credit card number?

1. Issuer Identification Number

2. Major Industry Identifier

3. Electronically stored information

4. Sequential identification number

10. Which of the following is not a forensic file image format?

1. dd

2. E01

3. SMART

4. UPS

Fill in the Blanks

1. The open source file format developed by Simson Garfinkel and supported by Autopsy and The Sleuth Kit forensics software is called __________ Forensics Format.

2. An ATM __________ is used to capture data from the magnetic strip on credit cards or ATM cards.

3. A cellphone __________ is a device that prevents cellular telephone users from connecting with other cellular telephones by blocking all radio signals.

4. The programming language developed by Guidance Software that allows EnCase users to create their own customized function and features in EnCase is called __________.

5. File __________ is the process of identifying a file by certain characteristics, such as a file header or footer, rather than by the file extension or metadata.

6. When unneeded data is eliminated from a photo, this is referred to as __________ compression.

7. A(n) __________ machine is a computer running software that allows for an instance of an operating system, or multiple operating systems, without making any changes to the user’s computer.

8. __________ power supply is a power supply containing a battery that will maintain power in the event of a power outage.

9. A(n) __________ is a point-of-sale skimmer.

10. An evidence __________ is a metal cabinet with individual compartments that can be locked individually.

Projects