INDEX

180 day rule 112

acceptable use policy 82–3

preservation of evidence 57–8

violations of 14

access control, re-establishing after system compromised 58

AccessData

AD eDiscovery 126

Enterprise 168

Forensic Toolkit 98, 125, 193

FTK Imager 164

memory analysis with Enterprise 167

Mobile Phone Examiner+ 126, 186

acquisition

cloud computing 171–7

evidence 129–46

mobile devices 184–6

report of findings 192

agile software development 45

AlienVault

Open Threat Exchange 49

SIEM tool 23, 24 (fig.)

allocation units see clusters

‘always on,’ 148

Amazon Web Services (AWS) 170, 174–5

S3 (Simple Storage Service) 172

American Academy of Forensic Sciences 115

analysis of artefacts 144–6

overcoming challenges 145–6

relevant items 145

analysis of evidence 104

software suites 125

Android

JTAG port 184

OS 179

physical acquisition 185

smartphones 124, 126, 186–7

Software Development Kit 183

antivirus software 51, 59

appendices, report of findings 194

Apple

APFS (Apple file system) 137–8, 188

iCloud attack case 199–200

iCloud platform for mobile devices 183

iOS 124, 126, 137, 141, 179, 186, 187–8

Mac physical memory 161–2

smartphones 187–8

ARP cache 153–4

Association of Chief Police Officers (ACPO) 109–10

attribution of crime across borders 105–7

audit, security incident detection 25

authentication logs 48–9

Autopsy (open source software) 127

backups 58

Baker, Bill 174

baseline of normal activity 44–5

Belkasoft RAM Capturer 164

blacklisting, virtual patch development 55

blame 69–70

Blu-ray disc (BD) 135

Border Gateway Protocol (BGP) 54

borders, attribution of crimes across 105–7

botnets 16, 114

Bourne-Again Shell (Bash) ‘Shellshock’ Vulnerability 55

Brighton and Sussex University Hospitals NHS Trust 74

British Airways 33

‘bug bounty programme,’ 85

business, security breaches bad for 81

business pressures

driver of live acquisition 148–9

interfering with digital forensics 57–8

reason for security incident 26

cables, grab bag contents 120

CAN-SPAM Act 2003 (US) 113

Cb Response (Carbon Black) 64, 65 (fig.)

CDs

live 120

non-volatile storage 155

securing crime scene 103

cellular networks 180

chain of custody 96–7

forms 118

report of findings 192

transportation of evidence 103

chief information security officer (CISO) 32

child pornography 109, 113

Child Protection and Obscenity Enforcement Act 1988 (US) 113

China, attribution of cybercrime 105

chip off, mobile device data recovery 184

civil investigations 100

cloud computing

acquisition in 171–7

container forensics 177–8

eDiscovery tools 126

live acquisition 175

mobile device backups 183

service provider cooperation in investigation 103

terminology 169–71

cloud storage services

data handling mistakes 13

reason for security incident 26

Cloudflare/Cloudbleed 85

clusters 131

command injection vulnerabilty 18

Comprehensive Crime Control Act 1984 (US) 110–11

Computer Fraud and Abuse Act (US) 110–11

Computer Misuse Act 1990 (UK) 107–8

Computer Security Incident Handling Guide 11

conclusions and opinions formed, report of findings 193–4

consultants, use of 38

containers 177–8

containment, incident response phase 52–7

customer data leak 56

denial of service attack 53–4

employee terminated 56–7

network device infected with malware 52–3

phishing email 56

web application critical vulnerability 54–6

web site defaced 53

content management system (CMS) vulnerability in 53

corporate

communications 33

investigations 100

Corvil, wire data tool 21

cost, incident response service providers 89

courier services 103

CPU registers and cache volatility of 153

crash dump, memory capturing 165

credentials compromised, re-establishing access control 58

credit cards

hacking and 15

stealing malaware 30

crime scene

difference between physical/digital 101

securing physical 102–3

criminal investigations 100, 108–9

Criminal Justice and Public Order Act 1994 (UK) 109

critical business processes 30–1

cryptographic hashes 49, 51, 119, 123–4, 143, 146

customer data 12–13

containment of leak 56

customers

availability of playbook to 28–9

contractual requirements 84

reputational damage 78–9

cyber liability insurance policy 76

cyberbullying 197, 199

Data Breach Investigations Report (Verizon) 41

data flow diagram 31, 32 (fig.)

Data Protection Act 1998 (UK) 13

database query logs 48

dd command line utility (Linux) 165

decryption, software suites 125, 145–6

Delta Airlines 33

denial of service (DoS) attacks 16–17

Computer Misuse Act 1990 (UK) 108

containment 53–4

tracking changes 68

deployment times, security tools 64

development team, working with 47

digital camera, grab bag contents 119

digital versatile disk (DVD) 135

securing crime scene 103

disciplinary actions 73–4

disk duplication equipment 118–19, 123

disk geometry 130–2

distributed denial of service (DDoS) attacks 16

Computer Misuse Act 1990 (UK) 108

DNS (Domain Name System) 17, 47, 158

denial of service attack against records 53–4

documentation 2, 31, 98

chain of custody 96

DoD 5220-22.2.M media sterilization standard 124

door badges/access 49

employee termination 56–7

double-blind penetration tests 36–7

due diligence 81–3

cloud computing 171–2

duplicates, working on 97

Dyn 17

Dynamic Host Configuration Protocol (DHCP) 158

eDiscovery suites 126

Elasticsearch, log aggregation tool 20–1

Electronic Communications Privacy Act (US) 111–12

Email Privacy Act (US proposed) 112

emails

CAN-SPAM Act 2003 (US) 113

Hillary Clinton 131–2

Mat Honan hacking case 197–8

phishing attacks 15, 56, 79

Stored Communications Act (US) 112

employees

anonymous reviews 86

containment after termination 56–7

culture of trust with 41

reports of security incidents 52

empowerment of security team 71

EnCase 98

evidence file format 123–4, 125, 164

investigative software suite 125

memory analysis 167–8

encryption 98–9

driver of live acquisition 149–50

network traffic 157–8

network traffic and memory 163

ransomware and 16

removable storage media without 13

Endpoint Protection (Symantec) 51

ephemeral see containers

Equifax 60–1

eradication

incident response phase 57–8

and preservation 61–7

ethical standards 115–16

Europe, laws applicable to forensics 106–7, 114–15

event, different to incident 83–4

evidence

analysis 104

chain of custody 96–7

eradication and preservation 61–7

exculpatory 193

inculpatory 193

log files valuable as 21

preservation compared to eradication 57–8

report of findings 193

secure storage of 79

software suites for collection of 125

storage 103

transporting 103

executive summary, report of findings 191–2

existing security policies, review of 29

external incident types 14–19

denial of service attack 16–17

hacking attack 15

malware/ransomware 15–16

phishing 15

software vulnerability 17–18

ExtraHop, wire data tool 21, 22 (fig.) 158

failure to test, reason for security incident 26

Falcon Insight (CrowdStrike) 64

false positive/negatives 18–19, 51, 52

family of suspect 201–2

Faraday bags see RF-shielded bags

FAT (File Allocation Table) 137

file formats, capturing volatile memory 164

file integrity monitoring (FIM) 51–2

file systems 136–8

acquisition tools and 138

commonly used 137–8

functions 136–7

files 143–4

carving 144

cryptographic hashing of 143

file-carving tools 166–7

known file filters 143

finance, quantifying cost of incident 76–9

firewall 48

firewall rules

customer data leak 56

site-to-site VPN 87

first responder, role of 95

Fmem (Linux) 165

Forensic Card Reader (UltraBlock) 135

forensic developer, role of 95

forensic fundamentals 96–9

chain of custody 96–7

challenges 98–9

documentation 98

tools and techniques 98

working on duplicates 97

forensic readiness 38–9

in-house 38

law enforcement involvement 38–9

use of consultants 38

Forensic Toolkit (AccessData) 98, 125

FTK Imager 164

memory analysis 167–8

forensic tools

grab bag 117–20

hardware 120–4

memory analysis 167–8

networks 127

open source 127–8

software 124–7

forensic workstations 121

forensics laptop, grab bag contents 119–20

forensics-ready environment 61–3

fraud

Computer Fraud and Abuse Act (US) 110–11

Computer Misuse Act 1990 (UK) 108

Identity Theft Penalty Enhancement Act (US) 112

Freedom Act (US) 113

funding for control improvements 75

General Data Protection Regulation (GDPR) 13, 37–8, 106, 114–15

investigator as data processor 115

Glassdoor 86

Gmail 112, 197–8

Good Practice Guide for Digital Evidence 109–10

Google Cloud Platform 170, 175

Google Drive 13, 46

grab bag 117–20

grep Linux command line utility 63

hacking

Computer Misuse Act 1990 (UK) 107–8

hacktivism 15

law in US 111

victim of 197–8

hard disk drive 129–34

disk geometry 130–2

interfaces 132–4

magnetic disks 129–30

solid-state drives 130

hardware, forensic 120–4

hardware security module (HSM) 31

hashing see cryptographic hashes

‘Heartbleed’ software vulnerability 17–18

hex editor 123, 126

HFS+ file system 138

hibernation files, memory capture from 165–6

Honan, Mat 197–8

HTTP requests 20, 48, 54, 55, 62, 156

human resources

involvement of teams in post mortem meeting 73–4

security incident detection 25

hybrid cloud 170

hypervisor 151–2

identification, incident response phase 41–52

antivirus software 51

detections that fit 46–7

employee reports of incidents 52

file integrity monitoring (FIM) 51–2

log file monitoring 48–9

network traffic monitoring 47–8

open-source intelligence (OSINT) 52

SIEM tool 49

threat intelligence 49

time to detect 41–2

what to look for 44–5

when to look 45–6

where to look 42–4

identity theft 200

Identity Theft Penalty Enhancement Act (US) 112

incident

awareness from social media 84–5

definition of 82

different to event 83–4

notification 85–6

report 75–6

timeline 72

incident responder

cost of 77

role in preserving evidence 57–8

incident response, things to avoid 60–70

blame 69–70

eradication and preservation 61–7

incident from an incident 67–9

incident response process 40–59

containment (see containment, incident response phase)

eradication 57–8

identification (see identification, incident response phase)

recovery 59

variations on process 40–1

incident response service providers 88–90

three primary factors 89

indicator of compromise (IoC) 49

Information Commissioners Office (ICO) 74

infrastructure as a service (IaaS) 47, 170

forensics 172–3

intelligence services 109, 112–13

internal incident types 12–14

acceptable use policy violations 14

inappropriate data handling 12–13

mishandling security credentials 13–14

unauthorised access 14

International Association of Computer Investigative Specialists (IACIS) 115

International Mobile Equipment Identity (IMEI) 181–2

International Mobile Subscriber Identity (IMSI) 181

internet

accidental exposure to 26

browsers 144

crimes across borders 105–7

IoT devices denial of service attack 17

internet service providers (ISPs) Regulation of Investigatory Powers Act 2000, 109

intrusion detection system 18–20

investigative process 100–4

analysis 104

media 103

mobile devices 102

non-physical scenes 103

powered-off devices 102

powered-on devices 102

reporting 104

scoping 101

securing physical scene 102–3

storage of evidence 103

transporting evidence 103

investigative software suites 124–5

investigator

roles 95

skills required 94

stresses and strains of work 203–4

IP address, denial of service attack against 53–4

iPhone, FBI encryption case 99

ISO 27001, 37

ISO, variations on incident response phases 40–1

isolation of infected network device 52–3

IT asset management (ITAM) 42–4

jailbreaking 187

Jamf 43

Joint Test Action Group (JTAG) 184

journaling 138

Kaspersky Lab, analysis of memory images 166

kernel statistics 154

law enforcement, forensic readiness involvement 38–9

lead investigator, role of 95

legislation 107–15 see also entries for individual laws

Lencioni, Patrick 30

LinkedIn 86–7

Linux

dd command line utility 165

file system 138, 141–2

log files 143

memory 161

memory grabber 165

process table 154

routing table 153

temporary file system 154

live acquisition 97, 147–59

business pressures 148–9

full disk encryption 149–50

technique 152

live CD/USB 120, 126–7

load balancer pool 53

Locard’s exchange principle 101

lockout, mobile device 181

log aggregation tools 20–1, 48

log files 20–1

monitoring 48–9

network traffic 158

quality not quantity 62–3

retention of 63

logical acquisition, mobile devices 185

Long-Term Evolution (LTE) 180

machine learning, security incident detection 21

magnetic disks 129–30

malware 15–16

fileless and live acquisition 151

network device infected with 52–3

phishing email and 56

USB sticks and 49

manual acquisition, mobile devices 184–5

marketing emails 113

media sterilisers 123–4

media storage devices, securing crime scene 103

medical records 200

memory

artefacts found in 162–3

Linux 161

Mac 161–2

Microsoft Windows 161

memory analysis 166–8

exploring images 166–7

forensic tools 167–8

real-time 168

memory capturing 164–6

acquisition tools 164–5

crash dumps and hibernation files 165–6

file formats 164

memory cards 135

memory dumps 160, 165

Memory Grabber (Linux) 165

mergers and acquisitions 87

Metasploit framework 44, 166

micro SD card, mobile devices 185

micro-services architecture 177

Microsoft Azure 170

Microsoft Windows

file system 137

physical memory 161

WannaCry ransomware attack 16

Mirai botnet 17

misinformation 57

mistakes, made during incident response process 60–9

mobile devices 179–88

forensic hardware kits 124

forensic software suites 126

securing crime scene 102

mobile devices, seizing 182–4

damaged 184

powered off 183

powered on and locked 183

powered on and unlocked 182–3

Mobile Phone Examiner+ (AccessData) 126, 186

National Health Service (NHS) ransomware attack 16

Netflix 174–5

Netflow (Cisco) 47–8

netstat command-line utility 48, 153, 163

Netwitness 23

network forensics 155–8

encrypted traffic 157–8

finding evidence 155

packets 156–7

traffic logs 158

wireless 158

Network Mapper 43

Network Time Protocol (NTP) 46

networks

connection information in memory 162–3

device infected with malware 52–3

flow records 47–8

forensic tools 127

restoring connectivity 59

traffic monitoring 47–8

wire data 21

NIST 11, 37

definitions of incident/events 82, 83–4

incident response process phases 40

Nmap 43

non-physical crime scene 103

non-technical incident detection 23–5

‘normal,’ identification of security incident 44–5

North Korea, attribution of cybercrime 106

NTFS (New Technology File System) 137, 139

ntop, wire data tool 21, 158

open-source forensic tools 127–8

open-source intelligence (OSINT) 52, 86–7

Open SSL 17, 85

Open Threat Exchange (Alienvault) 49

open windows, contents in memory 162

operating systems 139–43

Apple macOS 140–1

Linux 141–3

Microsoft Windows 139–40

network connection tools 48

optical disks 134–5

Ormandy, Tavis 84–5

OSSEC 52

OSXPMem utility (Rekall) 164

Outlook.com 112

overly restrictive security controls 25

PACE see Police and Criminal Evidence Act 1984 (UK)

packets 156–7

page tables 167

Paraben

E3: DS 126, 185

PAP 8000 camera 185

passcode removal, mobile devices 183

passwords 13–14, 58

found in memory 162

‘Heartbleed’ vulnerabity 17

PATA/IDE disk interface 133–4

Patriot Act (US) 112–13

payment card data 12

Payment Card Industry Data Security Standard (PCI DSS) 12, 37

peer review, playbook testing 34–5

penetration test, security incident detection 25

double-blind 36

pens and paper, grab bag contents 118

people

alerting to an incident 34

incident response test 73

reason for security incident 26

security professional learning about business 87–8

Peripheral Component Interconnect (PCI) Express bus 164

perpetrators 201–3

personal data, rights of individuals in Europe 114–15

personal safety 101, 201

personal unblocking key (PUK) 181

phishing 15

Computer Misuse Act 1990 (UK) 107

containment of 56

Equifax example 60–1

photographs, chain of custody 96

PIN code (SIM cards) 181

platform as a service (PaaS) 170

forensics 175–6

playbook

audience 28–9

cloud computing and 170

testing 34–7

tweaks and changes following post mortem meeting 74–5

playbook building 28–34

assemble team 32–3

business processes 30–1

data flow diagrams 31, 32 (fig.)

outline process 34

‘regular’ incident management 29–30

review existing policies 29

third party contacts 34

playbook testing 34–7

double-blind penetration tests 36–7

peer review 34–5

scenario-based testing 35–6

table-top exercise 35

.plist files 187–8

police, security incident detection 23

Police and Criminal Evidence Act 1984 (UK) 108–9

post mortem meeting 71–6

control improvements 75

incident report 75–6

incident response playbook and 74–5

incident response test 73

incident timeline 72

misconduct 73–4

time between incident and 71–2

vendors 74

post-traumatic stress disorder (PTSD) 204

powered-off devices, securing crime scene 102, 183

powered-on devices, securing crime scene 102

private cloud 170

process table 154

processing

disk images 135–6

evidence with software suites 125

productive time, cost of losses 77–8

professional bodies 115

Project Zero (Google) 84–5

protected computers under CFAA in US 110–11

Protection of Children Act 1978 (UK) 109

public cloud 170

public relations (PR) 84–7

containment after incident 57

incident notification 85–6

OSINT 86–7

recovery process 59

QRadar 23

quantifying cost of incident

incident responders 77

loss of productive time 77–8

quarantine, antivirus software 51

RAID configuration, driver of live acquisition 150–1

ransomware 16

cost of incident example 76–8

recovery of files from 59

real-time memory analysis 168

recovery, incident response phase 59

recovery of compromised data 58

reducing security to fix problem 68–9

‘regular’ incident management 29–30

Regulation of Investigatory Powers Act 2000 (UK) 109

reimaging of compromised systems 58

Rekall framework, memory analysis 167

remote workers

detecting abnormal usage 47

logging platforms and 62

removable media 134–5

memory cards 135

non-volatile storage 155

optical disks 134–5

USB 134

report, investigative process 104

reporting of evidence, software suites 125

reports

audience 194

layout and content 190–4

reputational damage 78–9

retention of logs 63

RF-shielded bags 120, 182–3

risk

double-blind penetration tests 36–7

mergers and acquisitions 87

reducing security to fix problem 68–9

role of investigator 190

rooting, Android smartphones 186–7

rootkit-style viruses 51

routing table 153

RSA, spear phishing emails case 79

running process information, physical memory artefacts 162

Russia, attribution of cybercrime 105

safety deposit box 97

Samanage 43

SAS disk interface 132–3

SATA disk interface 132

scenario-based testing, playbook 35–6

virtual patching drills 54–5

scoping 101

screwdrivers, grab bag contents 118

scrubbing centre 54

SD cards, securing crime scene 103

search warrants 108–9

sectors 131

Secure Shell (SSH) 157–8

security assessment questionnaire 82

security credentials, mishandling 13–14

security incident and event management (SIEM) 21–3, 49

security incidents

definition 11

reasons for 25–6

types 12–18

Security Monkey 175

security policy, different organisations 11–12

security tools, cost of 64

security updates, malware attack and 15

service accounts, passwords and 13

ServiceNow Asset Management 43

sexting 199

Sexual Offences Act 2003 (UK) 109

SHA-256, 49, 143, 192

shadow IT 13, 46

signatures, IDS & IPS systems 20

SIM cards 181

acquisition of data 186

Simple Network Management Protocol (SNMP) 53

slack space 131–2

mobile device acquisition 185

Sleuth Kit 127

smartphones 179, 186–8

Snowden, Edward 5, 113

social media 84–5, 86–7

monitoring tools 52

software, forensic 124–8

software as a service (SaaS) 171

forensics 176–7

software vulnerability 17–18

solid-state drives 130

Sony Pictures incident, attribution of cybercrime case 106

Sophos 51

spam 113

spear-phishing 15

RSA case 79

speed, incident response service providers 89

Splunk, log aggregation tool 20

SSL proxies 111–12

standards, compliance with 37–8

standards, incident response phases 40–1

sterile media 118–19, 123–4

storage, security of evidence 96–7, 103

Stored Communications Act (US) 112

subcontractors 74

Sumologic, log aggregation tool 20

surveillance, enhanced in US 112–13

table-top exercise, playbook testing 35

Talk Talk 86

Target, credit card phishing attack 72

tcpdump 127

team, assembling 32–3

technical controls, incident detection 19–23

IDS & IPS 20

log files 20–1

machine learning 21

SIEM tools 21–3

wire data tools 21

templates for reports 191

temporary files 154–5

Temporary Mobile Subscriber Identity (TMSI) 181, 186

third-party contacts 34

Threat Exchange (Facebook) 49

threat hunting 64

threat intelligence feeds 49

ThreatConnect 49, 50 (fig.)

time delay, Equifax case 60–1

tools and techniques

proven 98

report of findings 192–3

torch, grab bag contents 119

tracking changes 67–8

traffic filtering see scrubbing centre

training

first responder/forensic readiness 64–7

in-house forensic readiness 38

lack of 26

Transport Layer Security (TLS) 157, 163

Tripwire 52

trust

culture within organisation 23

cybercrime and 199

incident response service providers 89

Twitter, open source intelligence 52

UFED suite (Cellbrite) 185

unauthorised access 14, 107–8

United Kingdom, laws applicable to forensics 107–10

United States, laws applicable to forensics 110–14

Universal Mobile Telecommunications System (UMTS) 180

US Secret Service 110

guidelines on seizing electronic evidence 113–14

usability, mobile devices 179–80

USB debugging 183

USB/flash drives 134, 137, 138, 140, 141

user accounts 13–14

user credentials, containment of phishing email attack 56

User Datagram Protocol (UDP) packets 46

user-reported security incidents 23

vendors, legal counsel involvement 74

Veritas, eDiscovery platform 126

Verizon, Data Breach Investigation Report 41

victims 69–70, 196–200

virtual local area network (VLAN) remediation 53

virtual machines, driver of live acquisition 151–2

virtual memory 167

virtual patching 54–6

removal of 59

viruses, Computer Misuse Act 1990 (UK) 108

VMware 19, 152, 165

volatile data/evidence 127

volatile memory/evidence 97, 160

securing crime scene 102

volatility, order of 152–5

Volatility Framework, memory forensics suite 165, 167

VPN, site-to-site 87

walkthrough test see table-top exercise, playbook testing

WannaCry 16

‘waterfall’ software development 45

web application

critical vulnerability 54–6

firewall (WAF) 54

log files 63

websites

containment of defaced 53

fake versions of 15

whitelisting, virtual patch development 55

Windump 127

WinHex (X-Ways) 126

wiper malware 15–16

Sony Pictures incident 106

wire data tools 47, 48, 158

Wireshark 127, 156–7

Wiretap Act 1968 (US) 111

witnesses, technical/expert 190

write blockers 97, 118, 122

memory cards 135

mobile phone physical acquisition 185

smartphone cable 182

solid-state drives 130

USB 134

XFS file system 138

Yahoo 42

youths, victims of cybercrime 199–200

zero-cost retainers 88, 89

zgrep 63

zipgrep 63

zombies 16