Forensics Theory
Let's get ACADEMIC up in herrrreeeeeee!
I don't normally do this, but I like the theory for this and it is useful for thinking about how things work and why evidence gets left.
Various Academic Shenaniganery:
What is the scientific method?
- Controlled variables in order to establish repeatability
What is Locard's Exchange Principle?
- Every time you make contact with another person, place, or thing, it results in an exchange of physical materials. At the same time, you will also take something away from the scene with them.
The Inman-Rudin Paradigm
- Transfer, identification, individualization, association between source and target, the divisibility of matter, and reconstruction
Walk through the collection steps and explain the order of triage and why, using terms of order of volatility.
- Where is the evidence? List what systems were involved in the
incident and from which evidence will be collected. - Establish what is likely to be relevant and admissible. When
in doubt err on the side of collecting too much rather than not
enough. - For each system, obtain the relevant order of volatility.
- Remove external avenues for change.
- Following the order of volatility, collect the evidence. Next section will have more info on volatility order.
- Record the extent of the system's clock drift. Don't forget time zones!
- Question what else may be evidence as you work through the
collection steps. - Document each step.
- Don't forget the people involved. Make notes of who was there and what were they doing, what they observed and how they reacted.
What are the components useful for forensics in the order of volatility?
registers, cacherouting table, arp cache, process table, kernel statisticsmemorytemporary file systemsdiskremote logging and monitoring data (aka security/network logs)physical configuration, network topologyarchival media
Try to understand how a real incident response would use each of these components to build a holistic picture of what happened.