ORGANIZATIONS ARE BATTLING ATTACKERS with increasingly sophisticated skills. System forensics is crucial to determining how an attack succeeded and developing controls to prevent future strikes. However, companies often make mistakes that prevent successful forensic investigations. They may fail to incorporate security controls to prevent attacks. They may also fail to collect appropriate data to support a forensic examination. Businesses should have their environments forensically ready.
Collecting data as evidence is difficult in any situation. This is why forensic examiners document the process and maintain a chain of custody throughout their investigations. Collecting electronic evidence involves special complexities. Electronic evidence has none of the permanence of conventional evidence. It can't be touched or seen, and it is difficult to assemble into a coherent argument. This chapter discusses some of these difficulties and what a system forensics expert can do to overcome them. The first part of this chapter focuses on the basics of evidence collection, including why it's important to collect evidence, obstacles to data collection, and types of evidence. It then examines issues related to seizing and protecting evidence.
Collecting electronic evidence can be expensive. Data collection processes are strict and exhaustive. Systems affected may be unavailable for regular use for extended time frames. Data is useful only after analysis. In light of the costs and business interruption caused by a forensic investigation, why should one ever be conducted? Organizations have three reasons:
Determine what has been stolen or damaged and assess the damage to the organization.
Determine how the event occurred and develop controls to prevent a recurrence.
Determine who is responsible and has legal culpability. An organization needs evidentiary support for criminal prosecution and civil damage recovery.
It's important for an organization to learn from a breach. Without knowledge of what happened, it is impossible to prevent repeated breaches using the same techniques. The cost of data collection may be high, but the cost of repeatedly recovering from compromises is much higher—in terms of money, business disruption, and corporate image.
The two key stakeholders after an attack are the attacker and the victim. The attacker is responsible for the damage done. However, the only way to bring that person to justice and to seek recompense is with adequate evidence to prove the person's actions. The victim must collect information regarding the damages caused and restore normal operations as much as possible. Information provided by the victim is also used to assess the severity of the sanctions—damage recovery, fines, length of incarceration—that should be applied against the attacker. Under some legal theories, victims also have a community responsibility to provide information that may prevent future attacks perpetrated by the same individual or group or using the same techniques. Victims might also have a legal obligation to perform an analysis of evidence collected—for instance, if the attack affected customer health or financial records.
Electronic crime is difficult to investigate and prosecute. Build your case on data that remains on storage media after an attack.
Computer transactions are fast, including transactions with criminal intent. They can be conducted from anywhere, through anywhere, and to anywhere. They can be in clear text, encoded, encrypted, or anonymized. Unlike handwriting or signatures, computer transactions have no intrinsic identifying features. Perpetrators can modify or destroy any paper trail or computer records. Also, auditing programs intended to monitor transaction accuracy may automatically destroy data remnants left by computer transactions.
You can often restore the details of transactions through analysis. Even so, tying a transaction to an attacker is difficult. Attaching identifying information such as personal identification numbers does not automatically prove who was responsible for a transaction. Such information shows that whoever did it either knew or could get past those identifiers. Systems must be designed with protected methods for recording responsibility for transactions. Forensic examinations must document that those access controls were in place and functional at the time the system recorded the data.
Legal proceedings recognize three types of evidence:
Real evidence—Real evidence is any evidence that speaks for itself, without relying on anything else. This may be a visitors' log, the physical presence of a server or desktop, or the date of a letter validated by a third party, such as the U.S. Postal Service.
Testimonial evidence—Testimonial evidence is any evidence supplied by a witness. This type of evidence is subject to the perceived reliability of the witness. If the witness is considered reliable, testimonial evidence can be almost as powerful as real evidence. Documents from a word processing program written by a witness may be considered testimonial—as long as the author is willing to state that he or she wrote it.
Hearsay—Hearsay is any evidence presented by a person who was not a direct witness. An example of hearsay is documents from a word processing program written by someone without direct knowledge of the incident under investigation. Hearsay is generally inadmissible in court, so avoid using it.
In your role as forensic investigator, take these three categories of evidence into consideration to ensure that the data you collect is useful.
Follow these five rules when collecting electronic evidence:
Admissibility—The evidence must be able to be used in court. Failure to comply with this rule is equivalent to not collecting the evidence in the first place. However, the cost of collection has already been spent.
Authenticity—To make a case, show that the evidence relates to the incident.
Completeness—Evidence must show more than one perspective of the incident. A forensic specialist is also an independent evaluator. He or she collects evidence that can prove the attacker's actions as well as evidence that can prove a person's innocence. For example, if an investigator can show that an attacker was logged on at the time of the incident, he or she also must show who else was logged on and why those people likely didn't do it. The phrase for this is exculpatory evidence— that is, evidence that clears or tends to clear someone of guilt—and it is an important part of proving a case.
Reliability—The evidence collected must be reliable. Don't let evidence collection and analysis procedures cast doubt on the authenticity and veracity of your evidence.
Believability—The evidence presented should be clearly understandable and believable by a jury. A binary dump of process memory, for example, might not make sense to a jury. Similarly, if the jury sees a formatted, human-understandable version of the same information, you must be able to show its relationship to the original binary.
Use the preceding five rules to derive some basic do's and don'ts of data collection:
Minimize handling and corruption of original data—Create a master copy of the original data and then don't touch the original itself but always secondary copies. Any changes made to the originals will affect the outcomes of analysis later done to copies. Also, don't run any programs that modify the access times of all files. In addition, remove any external avenues for change and, in general, analyze the evidence after collecting it.
Account for any changes and keep detailed logs of actions—Sometimes evidence alteration is unavoidable. For example, in photo enhancement, the software changes the original bit patterns in the picture. In these cases, it is absolutely essential that you document the nature, extent, and reasons for the changes. Remember to account for any changes—not only data alteration but also physical alteration of the originals, such as the removal of hardware components. In addition, collect supporting research that backs use of a particular data enhancement technique in case the analytical results require proof.
Comply with the five rules of evidence—Following the five rules is essential to guaranteeing successful evidence collection.
Do not exceed current knowledge—If you find that you are out of your depth, either learn more before continuing or find someone who knows the territory. It is important to establish ongoing relationships with subject matter experts. No one person is an expert in everything. Soldiering on without the needed knowledge damages an investigation and compromises any results.
Follow local security policy—Failure to comply with a company's security policy could create problems both for you and for the evidence you gather.
Capture an image of the system that is as accurate as possible—Capturing an accurate image of the system minimizes the handling or corruption of original data. Differences between the original system and the master copy count as changes to the data. Always account for any differences.
Be prepared to testify—If you are the forensic specialist on your team who collects the evidence, the court will need you to appear to validate the material collected. If you are unable to testify for any reason—illness, other duties, etc.—any document created related to the data collection process must stand on its own. Otherwise, the evidence becomes hearsay, which is inadmissible.
Ensure that actions are repeatable—No one is going to believe an investigator whose actions can't be repeated and provide the same results each time. Don't base your plan of action on trial and error.
Proceed from volatile to persistent evidence—Some electronic evidence is more volatile than other evidence. Therefore, collect the most volatile evidence first. See the section "Volatile Data: Two Schools of Thought" in Chapter 6, "Controlling a Forensic Investigation," for information on whether to shut down a suspect system before collecting evidence.
Work fast but thoroughly—The faster you work, the less likely the data is to change. Volatile evidence may vanish entirely if you don't collect it in time. Although the evidence you collect must be accurate data, don't rush. If a crime involves multiple systems, a team of investigators can work on them in parallel. They should work on each single system methodically. Automation of certain tasks makes collection proceed even faster.
Don't run any programs on the affected system—An attacker may have left trojaned programs and libraries on a suspect system. Running programs on the system might inadvertently trigger something that could change or destroy evidence. With this danger in mind, remember to use programs from read-only media, such as CD-ROMs, that are statically linked.
Note
Today's digital forensics involves more than just laptops and desktops. Look at network and communication data, which makes logging essential. Proving an incident has occurred is impossible with just a hand-sketched network diagram and some Web access logs. You will also need logs from firewalls, routers, and intrusion detection systems.
A system should be running a system logging function. Keep these logs secure and back them up periodically. Effective system logs are time stamped, showing when each activity occurred. So, digitally sign and encrypt any logs collected to protect them from contamination.
You should copy and remove a log from the machine on which it was created. If logs are kept locally on a compromised machine, an attacker could possibly alter or delete them. Storing logs on a remote device can reduce this risk. However, it is still possible for an attacker to add decoy or junk entries to the logs prior to the date on which you copied them.
Regular auditing and accounting of a system is useful for detecting intruders. The forensic expert can draw on audit results as evidence. You can use messages and logs from programs to show what damage an attacker did. Audits and log reviews can verify the timing of when various events occurred.
Monitoring network traffic can be useful for many reasons. For example, it can help gather statistics to provide a usage profile, identify irregular activity and possibly stop an intrusion in process, and trace where an attacker is coming from and what he or she is doing. Monitoring logs as they are created can provide important information and help identify suspiciously missing information.
You can compile information gathered while monitoring network traffic into statistics to define normal behavior for a system. Then use these statistics to get early warning of an attacker's actions. In addition, monitoring the actions of users can provide early warning: Unusual activity or the sudden appearance of unknown users should trigger closer inspection.
Investigators work with two basic methods of data collection: freezing the scene and honeypotting. The two aren't mutually exclusive. It is possible to collect frozen information after or during any honeypotting.
Freezing the scene involves taking a snapshot of the system in its compromised state. The organization must notify the necessary authorities—the police and the organization's incident response and legal teams. However, the organization should avoid letting the media find out about the incident yet, if possible.
As a forensic specialist, your job is to collect whatever data is available and put it on removable nonvolatile media in a standard format. The programs and utilities you use to gather the data should also be collected onto the same media as the data. Create a cryptographic message digest for all the data you pull together, and then compare the digests to the originals for verification.
Honeypotting is the process of creating a replica system and luring an attacker into it to monitor his or her activities. A related method, sandboxing, involves limiting what an attacker can do while still on the compromised system, so you can monitor the attacker without much further damage. The placement of misleading information and the attacker's response to it is a good method for determining the attacker's motives. Either remove or encrypt any data on the system related to the attacker's detection and actions. Otherwise, the attacker can cover his or her tracks by destroying this data.
Honeypotting and sandboxing are extremely resource intensive, so they may be infeasible. They also involve legal issues such as entrapment. As in any other questionable situation, an organization should obtain legal advice before beginning honeypotting and sandboxing operations.
In case of intrusion—either from outside or inside the company—an organization should have a response plan and a team ready to take charge. This team should involve information technology (IT), management, legal, and human resources representatives. Those on the frontlines, typically the IT staff, must know who to call and the first course of action. As discussed in Chapter 13, "Incident and Intrusion Response," a clearly documented plan is essential for an investigation team to be successful in collecting admissible evidence. The team should design the plan with the assistance of legal counsel and law enforcement agencies to ensure compliance with all applicable local, state, and federal laws. After developing a plan of attack and identifying the evidence that the team should collect, investigators can begin the process of capturing the data, also referred to as seizing evidence.
The following sections provide a general guideline for steps involved in processing computer evidence. These steps present only one of many approaches that investigators use to process computer evidence.
Depending on the computer operating system, shutting down the computer usually involves pulling the plug or shutting down a network computer by using the necessary commands. You may wish to take pictures of the screen image. However, keep in mind that destructive processes may be operating in the background. These can be in memory or available through a connected modem. Depending on the operating system involved, a password-protected screen saver may also kick in at any moment. This can complicate the computer's shutdown. Generally, time is of the essence, and you should shut down the computer system as quickly as possible.
Move the subject computer system to a secure location where you can maintain a proper chain of custody and begin processing evidence. Before dismantling the computer, it is important to take pictures of the computer from all angles to document the system hardware components and how they are connected. Labeling each wire is also important, so that you can easily reconnect each one when the system configuration is restored to its original condition.
Seized computers are often stored in less-than-secure locations. Both law enforcement agencies and corporations sometimes fail to properly transport and store suspect systems. It is imperative that you treat a subject computer as evidence and store it out of reach of curious computer users.
Sometimes, individuals operate seized computers without knowing that they are destroying potential evidence and the chain of custody. A seized computer left unattended can easily be compromised. Someone could plant evidence or destroy crucial evidence. Lack of a proper chain of custody can make a savvy defense attorney's day. Without a proper chain of custody, you can't ensure that evidence was not planted on the computer after the seizure.
Tip
Don't leave a suspect computer unattended unless it is locked up in a secure location.
You should be able to prove that you didn't alter any of the evidence after taking possession of a suspect computer. Such proof helps rebut allegations that the investigator changed or altered the original evidence.
Since 1989, law enforcement and military agencies have used a 32-bit mathematical process to support device authentication. Mathematically, a 32-bit validation is accurate to approximately 1 in 4.3 billion. However, given the speed of today's computers and the vast amount of storage capacity on today's computer hard disk drives, this level of accuracy is no longer accurate enough. A 32-bit cyclical redundancy check (CRC) can be compromised. Some forensic tools can mathematically authenticate data with a high level of accuracy. You can use these programs to authenticate data at both a physical level and a logical level. New Technologies, Inc. (NTI), offers two such programs: CrcMD5 and DiskSig Pro. (For more information on these tools, see http://www.forensics-intl.com.)
Modern hard drives are voluminous. It is impossible for a computer specialist to manually view and evaluate every file on a computer hard drive. Therefore, you need state-of-the-art automated forensic text search tools to help find the relevant evidence. One such tool is NTT's TextSearch NT, which is certified for use by the U.S. Department of Defense. Intelligent filtering tools can also be helpful in crafting lists of keywords for use in computer evidence processing. Some examples are NTT's NTA Stealth, Filter_N, FNames, Filter_G, GExtract, and GetHTML. (For more information on these tools, see http://www.forensics-intl.com.)
Usually some information is known about the allegations, the computer user, and any alleged associates. Gather information from individuals familiar with the case to help compile a list of relevant keywords. Then apply these keywords in a search of all computer hard drives and CDs using automated software. Keeping the list as short as possible is important, and the list should avoid common words or words that make up part of other words.
Tip
It's important for an investigator to determine where the evidence he or she is looking for is stored. Using a checklist helps collect evidence and also helps double-check that the data being sought is there.
The following sections discuss three areas to search for keywords: the Windows swap file, file slack, and unallocated space.
The Windows swap file is a potentially valuable source of evidence and leads. With Windows Server 2003, Vista, Server 2008, and 7, the swap file may be set to be dynamically created as the computer is operated. This is the default setting, and when the computer is turned off, the swap file is erased. However, all is not lost because the swap file's contents can easily be captured and evaluated.
In the past, investigators carried out the tedious task of evaluating the swap file with hex editors. Evaluating just one swap file took days. With the use of automated tools, this process now takes only a few minutes. NTA Stealth, Filter_N, FNames, Filter_G, GExtract and GetHTML are examples of intelligent filters that automatically identify patterns of English language text, phone numbers, Social Security numbers, credit card numbers, Internet e-mail addresses, Internet Web addresses, and names of people. They are all available from NTI (see http://www.forensics-intl.com).
Most people who use computers are unaware of a data storage area called file slack. However, it is a source of significant security leakage. File slack contains raw memory dumps that occur during a work session as files are closed. The data dumped from memory ends up being stored at the end of allocated files, beyond the reach or view of the normal computer user. File slack can provide a wealth of information and investigative leads. Like the Windows swap file, this source of ambient data can provide relevant keywords and leads for your forensic research.
Note
File slack is typically a good source of Internet leads. According to NTI, tests suggest that file slack provides approximately 80 times more Internet leads than the Windows swap file. Therefore, cases involving possible Internet uses or abuses shouldn't overlook this source of potential leads.
On a well-used hard disk drive, file slack may occupy several gigabytes of storage space. Evaluate file slack for relevant keywords to supplement the keywords identified in the previous steps. You should add these new keywords to your original list of keywords for use later.
Specialized forensic tools are required to view and evaluate file slack. You can analyze file slack with computer applications that use fuzzy logic or artificial intelligence. Examples are NTA Stealth (see http://www.forensics-intl.com/nta.html), Forensic Toolkit (see http://www.digitalintelligence.com/software/accessdata/forensictoolkit3/), and SilentRunner (see http://www.accessdata.com/silentrunner.html).
On a well-used hard disk drive, gigabytes of storage space may contain data associated with previously erased files. This space is known as free space, or unallocated space. Unallocated space is typically a good source of data that was previously associated with word processing temporary files and other temporary files created by various computer applications.
Evaluate unallocated space for relevant keywords to supplement the keywords identified in the previous steps. Such keywords should be added to your list of keywords for use in the next processing step.
Because of the nature of data contained in unallocated space and its volume, system forensics investigations need specialized and automated forensic tools for evaluation. Ontrack's EasyRecovery DataRecovery (see http://www.ontrackdatarecovery.com/file-recovery-software/) and Evidor from X-Ways Software Technology AG (see http://www.x-ways.net/evidor/) do this. So does NTT's utility GetFree (see http://www.forensicsintl.com/getfree.html).
Use the list of relevant keywords identified in the previous step to search all pertinent computer hard disk drives and removable media. Several forensic text search utilities are available in the marketplace. For example, NTT's TextSearch NT and TextSearch Plus are state-of-the-art tools that federal government intelligence agencies have validated as security review tools (see http://www.forensics-intl.com).
It is important to review the output of the text search utility. It is equally critical to document relevant findings. When you have identified relevant evidence, note the fact and then completely review the identified data for additional keywords. You should then add these new words to the original list of keywords and conduct a new search using the text search utility.
Tip
Text search utilities can also be used effectively in security reviews of computer storage media.
From an evidence standpoint, filenames, creation dates, and last modified dates and times can be relevant. Therefore, it is important to catalog all allocated and "erased" files. Sort the files based on the filename, file size, file content, creation date, and last modified date and time. Such sorted information can provide a timeline of computer usage. The output should be in the form of a word processing-compatible file to help document computer evidence issues tied to specific files.
Encrypted, compressed, and graphics files store data in binary format. As a result, text search programs can't identify text data stored in these file formats. These files require manual evaluation, which may involve a lot of work, especially with encrypted files. Depending on the type of file, view and evaluate the content as potential evidence.
Reviewing the partitioning on seized hard disk drives is also important. Evaluate hidden partitions for evidence and document their existence.
With Windows operating systems, you should also evaluate the files contained in the Recycle Bin. The Recycle Bin is the repository of files selected for deletion by the computer user. The fact that they have been selected for deletion may have some relevance from an evidentiary standpoint. If you find relevant files, thoroughly document the issues involved.
Depending on the application software involved, you may need to run programs to learn their purpose. Destructive processes tied to relevant evidence can prove willfulness on the attacker's part. Such destructive processes can be tied to hot keys or the execution of common commands linked to the operating system or applications.
When you identify issues and discover evidence, document these findings. In addition, document all the software used in a forensic evaluation of evidence, including the version numbers of the programs you use.
When appropriate, your documentation should indicate licensure to use the forensic software involved. Screen captures of the operating software also help to verify the version of the software and how you used it to find and/or process the evidence.
Note
Have a legal copy of any forensic software you use. Smart defense lawyers usually question software licensing, and software pirates do not stand up well under the rigors of a trial. Software piracy is a criminal violation of federal copyright laws.
As part of the documentation process, include a copy of any software used for an investigation with the output of the forensic tool involved. Normally, this is done on an archive CD or an external storage device such as an external hard drive. This documentation methodology eliminates confusion about which version of the software was used to create the output. Often it is necessary to duplicate forensic-processing results during or before trial. Duplication of results can be difficult or impossible to achieve if the software has been upgraded and the original version used was not retained. Most commercial software is upgraded routinely, but it may take years for a case to go to trial. Retention of archival copies of programs should be included in software license agreements.
Note
It isn't reasonable to expect all nations to know about and abide by the laws and rules of other countries. However, countries need a means for exchanging evidence. Components of the U.S. Department of Justice and the Department of State can help coordinate evidence sharing between countries.
An investigation goal is to collect and preserve evidence that will be admissible in a court of law. Forensic specialists must protect forensic data from contamination. They must be able to demonstrate that evidence has been successfully protected from corruption or loss.
With this in mind, never use originals in forensic examination. Instead, use verified duplicates. This ensures that the original data remains protected and enables you to run tests that might corrupt data. Run any tests on a clean, isolated host machine. You could create problems by allowing an attacker's programs to access a network.
A big part of forensics is carefully documenting how evidence is handled so you can present it in court. As discussed in Chapter 1, "System Forensics Fundamentals," a good way of ensuring that data remains uncorrupted is to maintain a chain of custody. This is a detailed list of what actions were performed with subject systems and data after they were seized. Without a chain of custody, lawyers can allege that evidence was tampered with and prevent successful prosecution. The chain of custody involves the following measures:
Keeping evidence within an investigator's possession or control at all times
Documenting the collection of evidence
Documenting the movement of evidence between investigators
Securing evidence appropriately so it can't be tampered with or corrupted
Note
After you have successfully collected data, analyze it to extract the evidence needed to document and describe what actually happened. Again, documentation of analysis is crucial. You must be able to show that you can consistently obtain your results from the procedures performed and that others can independently repeat these procedures with the same results.
It is important to document all data characteristics, such as who found the data; when, where, and how it was transported; who had access to it; where it is stored; and what was done with it. Sometimes a case ends up with more documentation than collected data, but this can be necessary to prove a case.
To reconstruct the events that led to corruption of a system, create a timeline. This can be particularly difficult when it comes to computers. Clock drift, delayed reporting, and different time zones can create confusion. Never change the clock on a suspect system. Instead, record any clock drift and the time zone in use.
Log files usually use timestamps to indicate when an entry was added. Timestamps must be synchronized to make sense within an event timeline. For example, timestamps on remote systems should be synchronized to the time of the subject computer. You should also use timestamps. After all, you are not just reconstructing events but making a chain of events that you can account for.
Note
Forensic investigators typically make copies of a compromised system or other evidence and perform analysis on the copies. Courts also accept evidence that is produced in the normal course of business. For example, if a firewall administrator routinely examines logs on a daily basis and sees evidence of a hack, those logs can be considered a normal business record.
When analyzing backups, it is best to use a dedicated host. This examination host should be secure and clean, with a fresh, hardened installation of the operating system. Also, isolate the host from any network so that it can't be tampered with and so problems aren't accidentally sent out to other machines. Once the dedicated host system is available, you can begin analyzing the backups.
After collecting data, an organization can attempt to reconstruct the chain of events leading to and following a break-in. As an investigator, correlate all the evidence gathered. When reconstructing the attack, include all the evidence you find, no matter how small. It is possible to miss important connections or interactions if evidence is left out.
Companies spend millions of dollars each year to ensure that their networks and data are properly protected against intrusion. Companies use a defense-in-depth approach because they know that attackers—given enough time and money—can bypass or subvert any single control. Layering controls substantially improves security by increasing an attack's cost and complexity. When unauthorized access occurs, the last line of defense is legal action against the intruder. If system forensics investigators do not properly collect and maintain evidence of an intrusion, it is inadmissible in a court of law. It is important to remember one of the basic rules of the U.S. legal system: If there is no evidence of a crime, there is no crime in the eyes of the law. Therefore, investigators must take utmost care in collecting, seizing, and protecting digital evidence.
Collecting electronic evidence is not a trivial matter. Investigators have many complexities to consider, and must always be able to justify their actions. An investigator needs the right tools and knowledge of how the process works to properly gather and document the evidence required.
Artifacts
Dead man's switch
Exculpatory evidence
Freezing the scene
Hearsay
Honeypotting
Order of volatility
Sandboxing
No two investigations are the same.
True
False
Which of the following is not a step in the process of collecting and analyzing evidence?
Identifying the evidence
Preserving the evidence
Creating the evidence
Analyzing the evidence
Presenting the evidence
Which of the following is the best type of evidence to support a case?
Testimonial evidence
Real evidence
Hearsay
Rules of evidence
Admissibility, authenticity, completeness, reliability, and believability are called the _______.
Never store system logs on a remote server.
True
False
When is the best time to notify law enforcement when dealing with a breach?
Immediately after the breach is suspected
After evidence collection has begun
After the attacker is identified
It depends on the circumstances of the case.
Which of the following is a data collection process that involves creating a replica system and luring an attacker into it for further monitoring?
Collecting artifacts
Honeypotting
Freezing the scene
Sandboxing
Which of the following are important factors in maintaining the chain of custody? (Select three.)
Keeping evidence within an investigator's possession or control at all times
Locking the evidence in an airtight chamber
Documenting the collection and movement of evidence
Securing the evidence appropriately so it can't be tampered with
Videotaping all data collection
To search a hard drive for forensic evidence, an investigator should prepare a list of keywords to search for. What are the three main areas of a system that should be searched for these keywords? (Select three.)
C: drive
Swap file
Recycle Bin
File slack
Unallocated space
Forensic investigators should never use originals. Instead, they should use verified duplicates.
True
False
The ________ is a detailed list of what was done with original copies and systems after they were seized.
An investigator should set the clock on a suspect system to the GMT time zone.
True
False