• Bad Sushi - Fighting back against phishing attacks
• When Lawyers Attack - Strangely the only presentation focused on E-Discovery
• Highway to Hell - A presentation on privacy flaws in the EZ-PASS and FasTrak toll systems
• Storm Botnet - A look at the largest automated computer attack plaguing the Internet
• XPloiting Google Gadgets - Apparently there are some security flaws in these handy little tools
• BlueTooth 2.1 - A presentation on new security features and flaws
• The Virtualization Security Apocalypse - The title really says it all

            We live in a very technologically advanced society. These days everyone relies on computers in one way or another. Whether it is ordering your groceries online, buying a gift for your mother on an auction site, or doing your tax returns. We are all very dependent on computers. This trend has held true in the legal system as well. Everyday more and more computers and computer related accessories are being introduced as evidence in courtrooms around the world. This presents a daunting task for the computer forensics professional. This task is made even more difficult by myths and unrealistic expectations about a computer’s capabilities, as well as what a forensic professional can do with a computer, spawned by popular culture. Computers and the internet are the new fad. There are hundreds of books, movies, and TV shows about computers. Some of them true, but the majority of the material we see on TV shows and movies is very fictionalized and unrealistic.

I’m sure most people are familiar with CSI, the popular forensics show. At some point each season they use “computer forensics” to solve parts of their cases. I was recently watching an episode where the CSI crew used “computer forensics” to track down a suspect via the airline tickets he had purchased. The computer technician mashed furiously on his keyboard while the words “Computer Forensics” flashed in red on the top of his screen. Before I knew it, they had located their suspect. Unfortunately folks that is not really how it works. I am sure lawyers feel the same way about shows like Law and Order.

With all of this in mind I will attempt to dispel the most common myths about computer forensics. These are things we have been asked about time and time again. Computer Forensics isn’t nearly as sexy as TV and movies make it out to be and here is why:

A computer forensics analyst can recover any file that was ever deleted on a computer since it was built. This simply is not true. We can, however, recover deleted files, and/or parts of deleted files, but this number differs for every computer. When you delete a file or empty your recycle bin the file you have selected has its entry removed from the computer’s file system. The contents of the file has not been written over or removed from your hard drive, it simply has had its entry in the file system directory removed. This means that the file will hang around in unallocated file space until the file system writes a new file over it. A new file can be written over the old one because it no longer has a placeholder in the directory, in the form of a directory entry. For example, if you are in a movie theatre and decide you need to use the restroom, you will usually leave something in your seat, like your coat, in order to let others know that seat is occupied. You can think of the coat as the file’s directory entry. If you decide to take your coat with you when you go, there is no way for others to know that you are occupying that seat. There is a good possibility when you return from the restroom your seat will still be there, but there is a chance it may now be occupied by another person, and you just lost the best seat in the house.

Metadata is the all knowing, all seeing, end all piece of information on a file. Not even close. Most people think of Metadata like the slip that comes in a book you check out from the library. Those slips contain a list of all the people that have checked the book out recently, and for how long they had it. Metadata is not like that. While it does contain some useful information about the file, the scope of that information is much more limited than most people think. In general here is a list of the information contained in a file’s Metadata:

             I. The Author

             II. MAC Time (Modified, Accessed, Created)

             III. File Name

             IV. File Size

             V. File Location

             VI. File Properties (i.e. Hidden , Read-Only)

This is still very useful information but it is by no means the information rich tome that people make it out to be.

Having a forensic software license makes someone a computer forensics expert. If owning a hockey stick makes me an NHL all star than yes. I don’t know that I need to go into great detail on this issue. Since computer forensics is still such a new field, there is a lack of standards and guidelines for practicing computer forensics. If you want to practice law in America, you must pass the Bar. There is no system like this in place for the computer forensics field. Therefore, there are a lot of people out there that claim to be computer forensics experts, when in truth they have a decent understanding of a computer forensics program and that is about it. Simply put, would you want someone to perform surgery on you because they happen to own an MRI machine, or someone that went to school for it?

E-Discovery is an uncontrollable money eating machine. If you work with a veteran firm that has a lot of experience in this area, this is not the case. We do a lot of EDD work here at Jones Dykstra and Associates, I’d say about eighty percent of my time is spent doing EDD work for my clients. Most of the time when clients come to us with EDD request we spend a great deal of time getting background information from them, like the number of laptops, desktops, and servers they currently employ, as well as what types of information they need us to produce. Then we figure out, based on their needs, which systems we need to target. Based on this analysis we are able to give them a very accurate fixed price up front, with no hidden surprises. Our veteran experience allows us to judge very accurately the amount of work we will have to do, to produce the desired results for our clients, and thusly we are able to give them a fixed price on our work most of the time.

Cell phone forensics is easy. Not really. There are few programs available to do cell phone forensics. These programs also don’t work very well. This is due in part to the fact that new cell phones come out every day, and it’s very hard for these software vendors to keep up with the ever changing cell phone market. These programs are also targeted at older phone types, not the Smartphone/PDA/Espresso maker type that most business people use today. In our line of work these tend to be the type of people targeted for investigation. These new phones contain their own operating systems, like Windows Mobile and others, which causes problems for the forensic programs. Many of these newer Smartphones are still being tested by software vendors. Even if you are able to make a forensic duplicate of one of these phones, the data you get out of it is very hard to view.

The best available data is on running machines. Not always, there are options that a lot of people do not consider. It is not a problem to shut down an employee’s workstation and duplicate it, but what do you do if you need to pull information from a company’s main database? Can you shut it down? How will that affect daily operations? I’ve seen the fear in the faces of a company’s IT staff when we asked them to shut down their domain controller or Exchange Server. They know that those systems can be very temperamental and may not come back if we have to shut them down. A lot of the time when we are doing EDD work, the information we are looking for occurred in the past. Why not pull the information we need from backup tapes? Most responsible companies keep an accurate library of backup tapes. Isn’t that the point of a backup tape, to store important company information in a non-volatile format? In the case of the Exchange Server, do we really have to shut down the system to duplicate it, or can we pull the PSTs we need using Exmerge. These are very safe alternatives to shutting down vital running systems, and will most likely contain the information we are looking for, in these scenarios everyone wins.

Computer forensics experts catch the hacker every time. Most of the time they go untouched. When companies call us in after an intrusion, they usually want us to stop the bleeding but rarely care about catching the group responsible for the intrusion. Most of the attacks we have seen recently originate in China, and there isn’t really anything we can do to stop them. We have no jurisdiction there and the hackers know we can’t touch them. Most companies are not willing to put the time, the money, or the effort into catching the people that attack them. They want the intrusion to stop, the attacker removed, and they want information on how to better protect themselves in the future.

            Well I hope I’ve done a decent job at dispelling some of the myths about computer forensics. It’s not as sexy as CSI makes it sound is it? On the other hand we do get to do a lot of cool things in the field, and we do get to help a lot of people during their time of need. Those things definitely make up for the lack of flash that TV portrays.

Some of my thoughts on E-Discovery versus Computer Forensics

I find that e-discovery and computer forensics are commonly misunderstood and often used in the wrong context. Many skills used during computer forensics projects can be easily applied to e-discovery projects, and vice versa, even though the goals of these processes are very different. In this blog article I will attempt to highlight the similarities and clarify the differences between both. I will also attempt to show how they can be combined for a more complete and comprehensive computer investigation.

In order to put e-discovery and computer forensics in context, I will discuss these terms used during the situation of litigation. The graph below represents any litigation involving computer data that you may experience. Imagine that any litigation will begin at the top stage and progress towards the bottom stage. As the litigation starts at the top and travels downward, it may be solved in any of the current stages before reaches the next stage. In those cases, the litigation does not have to travel the whole triangle but can be easily solved with less work. That is a reason why I made the graph into a triangle. A number of filed litigations are settled before they actually go to court, and therefore not every stage in the graph below is needed.

The pre-litigation advice stage usually takes place before any incident occurs. For example, common pre-litigation advice could consist of a recommendation to implement e-mail and documentation retention systems in order to make future incidents easier and less costly. Since the initial advice stage is usually dependent on the situation and client we speak with, we will switch gears for the purposes of this article to talk about the e-discovery and computer forensic stages of your incident.

E-discovery:

The first stage of litigation consists of determining what documents or files exist and where they exist on all of the computer systems in question. At the early stages of litigation, you may just want all of the relevant documents or files from the computer systems so that you can use them to build the specifics of your case. The criteria for any e-discovery project usually boils down to needing every relevant document on the computer systems that matches a certain specification. Keyword searching is the most commonly used specification in these cases and usually yields sufficient results for most situations. Keyword searching usually yields an acceptable percentage of deleted and undelete files from your computer systems.

Although it sounds simple, e-discovery is far from that. There are a lot of factors that can make e-discovery a lot more complicated than it sounds. The sheer quantity of data is usually the driving factor in how difficult an e-discovery project will be. For most companies is not out of the question to have 10 or more employees involved in any one litigation. Each of those employees may have at least one laptop or desktop and probably has one or more e-mail mailboxes. A single file could be duplicated hundreds of times across each person's computer and e-mail mailbox. In many instances, multiple files are duplicated in this manner amongst many users. This duplication becomes difficult when you must process, analyze, and produce the data so somebody can easily review it by hand. One of the goals we attempt to accomplish during e-discovery is to provide the smallest most relevant data set from a very large unstructured data set. By limiting the duplication of the files mentioned above, we make it possible for reviewers to review only one file and then the review is simultaneously applied to many different places that file originally existed.

Computer Forensics:

E-discovery may be used at the beginning of a project when it is more important to find a great quantity of relevant data rather than the minute artifacts in a computer system. On the other hand, computer forensics is often used when a specific piece of data needs to be analyzed at great depth. Computer forensics is often used to explain, in technical terms, what a person did and when it was done on a computer system. An examiner could use computer forensics on a very small set of data, such as one file, to help prove the case. Sometimes only one file could be the "smoking gun".

For example, we may use computer forensics to determine if a computer system was maliciously modified before the investigation began. Computer forensics would allow us to examine specific portions of the hard drive, such as file metadata, in order to determine if the computer system was modified in an unauthorized manner. Another example of computer forensics may be the examination of a rogue file on a computer system. A painstaking examination can be made of any unknown file in order to determine what the file is for, what it accomplishes, why it is on the computer system, and how it originally got there.

Similarities:

First, people that perform e-discovery and computer forensics use the same types of data. Computer data is usually acquired by the same forensic software using the same techniques which saves every bit of a computer hard drive for your processing efforts. Both e-discovery and computer forensics can undelete computer files and recover data that the user believes has been removed from their computer system. This is because in most circumstances the data that is acquired is the same for both processes.

Second, some of the same software tools can be used for e-discovery and computer forensics. For example, we have used the forensic toolkit (FTK) and both e-discovery projects and computer forensic projects. Most software along these lines provides the user with deleted and undeleted files in an easy to navigate format. What you choose to do with the files is dictated by the type of project you are working on, such as an e-discovery project or computer forensics examination. Most software, like FTK, offers functionality for a mass export of the files matching your criteria, or you can use the software to examine specific files as you would do during a computer forensic examination.

Third, the same basic skill sets for the examiner are required for e-discovery and computer forensics. Since we use the same software for e-discovery and computer forensic projects, the user does not have to learn anything new to use the software to accomplish two different goals. Therefore, the same basic skill sets of data acquisition, processing, and presentation are used in both e-discovery and computer forensic projects. Once you have learned the software and the methodologies behind it, it is very easy to apply them to other types of projects.

Lastly, the same basic processes are used for e-discovery and computer forensics. Most of the same basic processes are initially used in both types of projects. For example, in nearly every e-discovery and computer forensic project you will want the capability of examining deleted files. Usually the first steps to these projects undelete any deleted files on the computer you are examining. Keyword searching is often used during e-discovery projects in order to reduce the data set that you have to review. Keyword searching is also used during computer forensics to locate the file or files you want to examine. Also, in both e-discovery and computer forensic projects you do not want to examine the same file over and over, which would dramatically waste your time. This is a process that we call de-duplication. You can de-duplicate the data using the same process during e-discovery and when performing computer forensics. Nearly any type of process you use on one you can apply to the other.

Differences:

First, there is a vast difference in breadth versus the depth of the analysis that occurs between e-discovery and computer forensics. In e-discovery, you usually produce a large number of files with little regard to their actual content. Granted, you may still care some about the content of the files as you are producing data that is responsive to some set of predefined criteria, but very rarely do we actually examine the content of every single file during an e-discovery project. We are usually producing these documents for a different party, such as our client, to review. While performing computer forensics, we may be interested in all of the files on the computer system, but we spend a majority of our time examining a select few files. We could spend many hours, days, or months just examining one file on a computer system if it is relevant to our investigation.

Second, an examiner's goals are very different between e-discovery and computer forensics. During e-discovery, our goal is usually to produce relevant documents for a third party to examine. During computer forensics, we are usually performing the examination of the relevant files ourselves. The files we examine during computer forensics tend to be a lot more difficult to view natively. For example, we will examine event logs, installed programs, file metadata, and many other types of files that the reviewers during an e-discovery project would not be able to understand. Furthermore, e-discovery is typically used to produce a large number of files in order to substantiate your case while computer forensics is used to play back a user's activity on computer system.

Third, a different level of planning goes into an e-discovery project versus a computer forensic examination. We find that often during e-discovery engagements that the client wants us to grab a large number of computers versus focusing our examination on a select few during computer forensics examinations. A different sense of planning is needed when large numbers of computers are to be examined versus only a few. It is not uncommon to see hundreds and hundreds of computers during e-discovery when we would only examine a select few during a computer forensics project. It can be very difficult getting access to hundreds of computers when each has a person using them during the normal workday. If you have to examine only a few computers, your planning becomes much easier.

Bringing It Together:

You may be wondering: "Why take the time to differentiate between these two different types of projects?" In my opinion, I think it is unnecessary for people to choose two different companies or individuals to provide the same basic services. As you can see above, there are more similarities than differences between e-discovery and computer forensics. It is my belief that being good at one makes you better with the other. Allow me to explain.

Being able to manage large data sets (we have worked on some cases that involved more than 54 terabytes of information) and getting to the relevant data more efficiently, as it is often done during e-discovery projects, only complements your computer forensics efforts that you perform later on. Sometimes finding the really important files for your computer forensic analysis is very similar to finding the relevant files in e-discovery project. Conversely, understanding a large number of computer file formats in painstaking detail, as often done in computer forensic projects, can make your e-discovery procedures much better because you can process files that common software and consultants may not be able to process. In some cases these more difficult files, such as proprietary files, can hold the most important information for your case.

The moral the story? The next time you are hiring a person or engaging an outside company for your e-discovery or computer forensic needs, I recommend that you select a person or company that can complete the full triangle I presented above for you. There should be no need for you to select one person or company to complete just the e-discovery process and then find another person or company to take care of your computer forensic needs.

On the other hand, if you are a person or company that takes care of these needs, I recommend that you do not pigeonhole yourself into only one type of analysis. The e-discovery and computer forensics industry is large and still waiting for its superstars. Be sure to explore all that it offers.

Additional References:

http://en.wikipedia.org/wiki/E-discovery

http://en.wikipedia.org/wiki/Computer_forensics