The Network Security Test Lab: A Step-by-Step Guide

CHAPTER 11 Forensic Detection

The term forensics may cause some people to think of DNA or the latest episode of Forensic Files. Others may have thoughts of collecting evidence while a hacker is in the midst of a computer break-in of a major company such as Sony or Target. Still others may see it as a means of conducting a computer investigation after the fact to analyze electronic evidence that can be used in court, such as efforts to prosecute members of Lulzsec or Anonymous. Forensics can be defined as any of these activities.

This chapter looks at the aspects of forensics that are also known as cyber-forensics. A forensic investigation must follow a strict set of rules that govern how the evidence is obtained, collected, stored, and examined. While the organization performing a forensic investigation may not know at the beginning of the investigation how or what will be found, the process must be followed carefully or any evidence obtained may become tainted and therefore inadmissible in a court of law.

Government, military, and law enforcement agencies have practiced forensics for many years, but it is a much younger science for private industry. Its growth can be tied to the increasingly important role that computers play in the workplace, as well as the type of information they maintain and the access they enjoy.

This growth means computer security specialists must have a greater understanding of computer forensics and the concept of chain of custody. Even if a forensic ...