BUILDING A DIGITAL EVIDENCE CLASSIFICATION MODEL

Transcription

1 DFIR Summit Prague 2018 BUILDING A DIGITAL EVIDENCE CLASSIFICATION MODEL Copyright 2018 Jason Jordaan, All Right Reserved

2 INTRODUCTION While digital forensics plays a key role in cybersecurity, it is also a recognised and developing forensic science discipline As a forensic science discipline it needs to comply with established forensic science principles to continue to justify its place as a forensic science The development of scientifically validated models can assist in this 2

3 INMAN-RUDIN PARADIGM Considered the core of forensic science: Transfer (Locard Exchange Principle) Identification (Placing Objects in a Class) Individualisation (Narrowing the Class to One) Association (Linking a Person with the Event) Reconstruction (Understanding the Sequence of Past Events) 3

4 THE NEED FOR A DIGITAL EVIDENCE CLASSIFICATION MODEL Classification is a core part of the Identification principle in the Inman-Rudmin Paradigm Having a clear classification model can help investigators and legal practitioners better understand the digital evidence at a conceptual level V1 of the model published in 2014 Scientific validation identified shortcomings in the V1 model V2 model developed based on validation findings 4

5 5

6 Logical Digital Evidence Trace Digital Evidence Transmission Digital Evidence 6

7 Logical Digital Evidence Trace Digital Evidence Transmission Digital Evidence User Created Application Operating System File System 7

8 Logical Digital Evidence Trace Digital Evidence Transmission Digital Evidence User Created Logical User Created Application Logical Application Operating System Logical Operating File System Logical File System 8

9 Logical Digital Evidence Trace Digital Evidence Transmission Digital Evidence User Created Logical User Created Trace User Created Application Logical Application Trace Application Operating System Logical Operating Trace Operating System File System Logical File System Trace File System and Protocol 9

10 Logical Digital Evidence Trace Digital Evidence Transmission Digital Evidence User Created Logical User Created Reconstructed User Created Trace User Created Application Logical Application Reconstructed Application Trace Application Operating System Logical Operating Reconstructed Operating System Trace Operating System File System Logical File System Reconstructed File System Trace File System and Protocol 10

11 Logical Digital Evidence Trace Digital Evidence Transmission Digital Evidence User Created Logical User Created Reconstructed User Created Trace User Created Data Packets Containing User Created Data Application Logical Application Reconstructed Application Trace Application Application Data Packets Operating System Logical Operating Reconstructed Operating System Trace Operating System Operating System Data Packets File System Logical File System Reconstructed File System Trace File System and Protocol File System Data Packets 11

12 FUTURE WORK Validation testing of V2 model Publication of peer reviewed paper in reputable and widely read academic journal Acceptance of the model by the broader forensic science community 12

13 SANS DFIR RESOURCES AND CONTACT INFORMATION PRESENTER CONTACT Jason Jordaan SANS INSTITUTE 8120 Woodmont Ave., Suite 310 Bethesda, MD SANS(7267) DFIR RESOURCES digital-forensics.sans.org SANS GENERAL INQUIRIES: REGISTRATION: TUITION: PRESS/PR: 13