Identifying and Seizing Electronic Evidence. Tyler Wotring Director of Cyber Forensics National White Collar Crime Center

Transcription

1 Identifying and Seizing Electronic Evidence Tyler Wotring Director of Cyber Forensics National White Collar Crime Center

2 Cyber Forensics How does technology affect forensics? How does technology affect cyber forensics?

3 The Changing Face of Crime How has technology aided in these crimes? ID theft Counterfeit documents Credit card theft Child exploitation Shop-lifting Organized Crime

4 ID Theft Traditional Stolen mail, trash picking/dumpster diving Modern Phishing, stolen devices, malware Data breaches

5 Credit Card Theft Stolen records Physical or electronic Sold on the internet Skimming Device used to swipe and store credit card numbers Restaurants Bars 3 rd party Device overlaid on top of a real one Gas stations ATMs Transfer numbers to a New card

6 Counterfeit Documents Manual creation Mortgage documents Passports Automated Software programs Purchase of documents

7 Child Exploitation Anonymity Facebook Sharing of images/videos Websites Peer to Peer (P2P) Communication Chat rooms Texting Apps Storage Cloud Inexpensive media

8 Organized Crime Intelligence gathering Promoting criminal activity Communication Possibly stored Provoking others Uploaded photos GPS Potential leads

9 Threats and Roadblocks The Going Dark Phenomenon International Data Storage

10 Identifying and Seizing Preparation Preparing for a successful operation Recognition Identifying the devices capable of storing data Variety of shapes and sizes Preservation Preventing contamination/data loss Collection Best practices for handling and storing evidence

11 Pre-Seizure Considerations Gathering intelligence Identifying the tools and resources Legal Considerations

12 Gathering Intelligence Type of crime Type of evidence Tools needed Sophistication of the suspect Assistance on scene Different tools Location Home: animals, cameras, neighbors Business: create an image on scene? Resources Social media, Google, ISPs, utility companies

13 Digital Evidence Any information stored or transmitted in a digital format that can be of evidentiary value in a court proceeding. Photos Videos Documents Logs Etc, etc, etc

14 Roles of Digital Evidence Devices and digital evidence can have many roles in an investigation Target of the crime Tool of the crime Repository of the crime Fruit of the crime

15 Scope of the Problem How many devices are in use? How much data are these devices storing

16 Storage media

17 Internal Storage - Hard Disk Drive (HDD) Traditional internal storage for desktop and laptop computers Multiple connection types IDE SCSI SATA SAS Storage capacity Average Desktop ~1-2 TB Average Laptop ~ 512 GB 1 TB Current Max 12 TB

18 Internal Storage - Solid State Replacing traditional HDDs in laptops and high-end desktops Multiple connection types SATA msata M.2 PCI-Express Storage capacity Average ~ GB Current max 4 TB*

19 External Storage Flash Drives Available in wide variety of shapes, sizes, and colors Multiple connection types USB Micro USB USB-C Lightning Storage capacity Average ~32-64 GB Current max 2 TB

20 External Storage Flash Drives

21 External Storage Memory Cards Used in a wide variety of devices Mobile Phones Tablets Digital Cameras Video Cameras Drones Digital Photo Frames Many different types SD (full size, mini, micro) Compact Flash XQD Memory Stick Look for a Memory Card Reader!

22 External Storage Memory Cards Small or very small in physical size Maximum storage capacity SD GB MicroSD GB XQD GB Compact Flash GB

23 External Storage Portable Hard Drives Traditional HDD or solid state Multiple connection types USB USB-C FireWire Thunderbolt esata Wireless Storage capacity Average ~1 TB Current Max - 8 TB

24 External Storage Optical Media Compact Disc (CD) ~700 MB Digital Versatile Disc (DVD) ~4.7 GB Blu-Ray GB

25 Computing Devices

26 Global Computer Ownership (%) U.S. Russia Venezuela China Malaysia Thailand Average South Africa Philippines India Kenya Source: Spring 2014 Global Attitudes survey. Q148e. PEW RESEARCH CENTER

27 Global Mobile Phone Ownership (%) South Korea Australia Isreal U.S. Malaysia China Average South Africa Kenya Philippines India Source: Spring 2015 Global Attitudes survey. Q71 & Q72. PEW RESEARCH CENTER

28 Desktop Computers Multiple form factors Desktop Tower All-in-One Numerous manufacturers Lenovo HP Dell Apple ASUS Strong Do-It-Yourself (DIY) market

29 Desktop Computers Typical components Random access memory (RAM) Average ~4 8 GB AMD/NVIDIA graphics card Optical Drive (r/w) USB, USB-C ports Built-in card reader Internal storage Average ~1 2 TB

30 Laptop Computers Outselling desktop computers for many years Numerous manufacturers Lenovo HP Dell Apple Google Typical components RAM Average ~2 4 GB USB, USB-C ports Internal storage Average ~ GB

31 Mobile Phones Feature Phones Still holds majority ownership in many nations Standard cellular phone capabilities Calls Text messages Address Book Calendar Camera (maybe) Limited internal storage

32 Mobile Phones Smartphones Expanded capabilities of a feature phone High resolution video/photo camera Global Positioning System (GPS) WiFi connectivity Cloud storage Third party applications Messaging Social media Financial Two main platforms Android ~83% worldwide market share ios ~15% worldwide market share

33 Mobile Phones Smartphones Internal storage Average ~ GB External storage MicroSD Card USB, USB-C, or Lightning flash drives

34 Tablets Hybrid device combining smartphone and laptop functionality Three main platforms ios Microsoft Windows Android Internal storage Average ~ GB External storage External storage MicroSD Card USB, USB-C, or Lightning flash drives

35 Miscellaneous Devices

36 Wearables Various purposes and capabilities Smart Watches Fitness Trackers GPS Health

37 Digital Cameras From Point-and-Shoot to Digital SLR Some may have a small amount of internal storage Most use memory cards to expand storage Optional capabilities Video recording GPS WiFI

38 Video Cameras Some may have a small amount of internal storage External Storage Memory cards Hard drive Magnetic tape Optional capabilities Still shooting GPS WiFI

39 Gaming Devices Three main platforms Sony Playstation Microsoft Xbox Nintendo Switch Not just for gaming anymore Video and text chat Media streaming Web browsing Internal storage Xbox/Playstation ~1 TB Switch ~32 GB

40 Networking Devices Used to connect devices to each other and the Internet May have internal storage Can have logs of interest Connection logs Traffic logs

41 Wireless Surveillance Cameras Actively recording/streaming? Safety concerns Alerting person(s) of interest Storage May have internal storage External storage could be cloud, remote, or removable media

42 Internet of Things

43 Internet of Things (IoT) The network of physical devices, vehicles, and other items embedded with electronics, software, sensors, actuators, and network connectivity which enable these objects to collect and exchange data.

44 IoT Personal Assistant Devices Google Home Amazon Echo Show Amazon Echo Amazon Echo Dot Apple HomePod

45 IoT Home Automation Video Doorbell Connected Detectors Smart Door Lock Connected Lighting Connected Thermostat

46 IoT Smart Televisions Built-in Streaming Boxes

47 What s Next?

48 Preservation

49 Acquire Volatile Data Collect data that may otherwise be lost or no longer available when power is removed Prioritize acquisition based on value, volatility, and/or the effort required to collect the data Be as unobtrusive as possible Document, document, document If on-scene examination is necessary: Performed by an experienced examiner Know what information is needed Know where to find the information

50 Order of Volatility Network connections Login sessions Contents of memory Running processes Open files Network configuration Operating system time

51 Acquire Volatile Data Develop a process/procedure Acquisition will be performed on a live system These actions will modify data Document all actions performed Use trusted tools to collect data Test and validate all tools and procedures

52 Documentation Traditional questions Who, what, where, when, why Ask suspect specific questions Passwords, red flags, hidden devices Photo, video, or sketch Entire scene Before and after Individual evidentiary items

53 Places to Search Don t forget core investigative processes Near the computer Username & passwords Plain sight Within reach Habitual Under the keyboard In the computer

54 Do I collect everything? Manual(s) Software Hardware Cables

55 Storing Electronic Evidence Secure location Limited access Climate controlled environment Prioritize evidence Low battery

56 U.S. National White Collar Crime Center Nearly 40 years of training and technical assistance experience Cybercrime Financial Investigations Intelligence Over 115,000 persons trained, and over 70,000 agencies represented Current offerings include over 30 cybercrime courses Face-to-Face Asynchronous online 24/7 platform Synchronous live virtual classroom capability Long standing history of public and private partnerships including U.S. State,Local, and Federal agencies, Microsoft, Apple, and Symantec

57 Tyler Wotring Director of Cyber Forensics National White Collar Crime Center