Digital Forensics Investigation Plan for Corporate Incidents

Scene Preparation and Evidence Collection

The plan for processing a potential crime or incident scene depends upon maintaining the integrity of the scene as well as the integrity of the data. That means the first step is to prevent scene contamination. Preparing for the search is therefore a critical early stage in this process.

The team must have legal authority to proceed with the seizure of evidence, and this authority should be demonstrated upon arrival. Likewise, the team should use appropriate safety equipment when arriving on scene to ensure that nothing is jeopardized (U.S. Department of Justice, 2008).

To prepare for the search, the team will first document the condition and state of the scene. Before anything is moved, the team should photograph and record screen information from all workstations involved. It is important to assess the current state of each system before any investigative work begins. Digital forensics best practice holds that computers should remain powered on if they have not yet been turned off, as this preserves any connections established via illegal actions that could be lost upon shutdown. However, if software running on the computer is actively damaging the computer or network, the device may be shut off promptly. Backup servers should be in place to maintain the organization's workflow in case the servers under scrutiny must be disconnected for inspection. A continuity of operations plan should be ready to implement before the team begins collecting data.

The team will identify potential digital evidence by understanding that digital evidence carries a kind of fingerprint — DNA-type information left behind whenever a process is changed. However, evidence can be easily lost or altered without anyone noticing; therefore, time is of the essence. As soon as the team arrives, it should seek to secure Internet-based evidence, computer-based evidence, and mobile device evidence where applicable, based on participant accounts of what occurred (National Forensic Science Technology Center, 2015a).

Once data is collected, it must remain free from contamination. Digital evidence can be lost or damaged during recovery or transfer; it is therefore essential that a copy or image of the data be produced as a backup. This means the device or devices in question must be copied onto a separate, clean medium — one that has not been previously used. It is important that the backup medium be completely free of all prior data, because any information already on the medium could potentially be examined by the investigation team. Even if a drive has been erased, it should not be used as a backup unless it has been fully wiped, as residual content may still exist and interfere with the investigation.

All digital evidence should be labeled and identified with information regarding where it came from, its purpose in the facility, its precise location when found, and why it was collected. Evidence should then be packaged and transferred in a secure manner. Secure transfer should include signing out and signing in packages, and ensuring that all data is monitored via checkpoint processes during delivery and receipt.

To ensure proper storage and chain of custody, logs will be maintained for all individuals taking and handing over custody of evidence — from the crime scene investigators to laboratory team members where evidence will be scrutinized. Without a proper chain of custody, data can be lost or altered, and without a clear record of who last handled the evidence, questions of accountability and responsibility arise.

References

Jakobsson, M., & Juels, A. (2010). Server-side detection of malware infection. NSPW. Retrieved from http://nspw.org/papers/2009/nspw2009-jakobsson.pdf

LaChapelle, C. (2014). Disaster recovery options for smaller companies. NetworkWorld. Retrieved from

Londis, D. (2007). Windows XP security: Manually remove viruses from your PC. GPost. Retrieved from http://www.groovypost.com/howto/find-and-remove-most-common-viruses-from-pc/

National Forensic Science Technology Center. (2015b). A simplified guide to digital evidence. Retrieved from http://www.forensicsciencesimplified.org/digital/how.html

TechNet. (2013). Microsoft. Retrieved from https://technet.microsoft.com/en-us/library/cc770266(v=ws.10).aspx

U.S. Department of Justice. (2008). Electronic crime scene investigation: A guide for first responders. Washington, DC: Office of Justice Programs.

Vacca, J. (2009). Computer and information security handbook. Burlington, MA: Morgan Kaufmann Publishers.