Forensic experts use a variety of forensic procedures to collect and protect data after an attack. If you’re planning to take the SY0-501 exam, you should have a basic understanding of forensics concepts. This includes the process in data acquisition and preservation of evidence.
For example, can you answer this practice test question?
Q. An administrator recently learned of a suspected attack on a Florida-based web server from IP address 72.52.206.134 at 01:45:43 GMT. However, after investigating the logs, he doesn’t see any traffic from that IP at that time. Which of the following is the MOST likely reason why the administrator was unable to identify the traffic?
A. He did not account for time offsets.
B. He did not capture an image.
C. The IP address has expired.
D. The logs were erased when the system was rebooted.
More, do you know why the correct answer is correct and the incorrect answers are incorrect? The answer and explanation are available at the end of this post.
When performing data acquisition for evidence, it’s important to follow specific procedures to ensure that the evidence is not modified.
Capture System Image
A forensic image of a disk captures the entire contents of the drive. Some tools use bit-by- bit copy methods that can read the data without modifying it. Other methods include hardware devices connected to the drive to write-protect it during the copy process.
Chapter 5 of the CompTIA Security+: Get Certified Get Ahead: SY0-501 Study Guide introduces disk images as a common method used to deploy systems. These system disk images include mandatory security configurations and help ensure a system starts in a secure state. A distinct difference between standard system images and forensic images is that a forensic image is an exact copy and does not modify the original. This isn’t always true with system imaging tools.
One of the oldest disk imaging tools used for forensics is the dd command available in Linux systems, including Kali Linux. It can also be installed on Windows systems.
These methods capture the entire contents of the disk, including system files, user files, and files marked for deletion but not overwritten. Similarly, many tools include the ability to capture data within volatile memory and save it as an image.
After capturing an image, experts create a copy and analyze the copy. They do not analyze the original disk and often don’t even analyze the original image. They understand that by analyzing the contents of a disk directly, they can modify the contents. By creating and analyzing forensic copies, they never modify the original evidence.
The 601 Version of the Study Guide
The CompTIA Security+: Get Certified Get Ahead: SY0-601 Study GuideEach of the eleven chapters presents topics in an easy to understand manner and includes real-world examples of security principles in action.
You’ll understand the important and relevant security topics for the Security+ exam, without being overloaded with unnecessary details. Additionally, each chapter includes a comprehensive review section to help you focus on what’s important.
Over 300 realistic practice test questions with in-depth explanations will help you test your comprehension and readiness for the exam. The book includes:
- A 75 question pre-test
- A 75 question post-test
- Practice test questions at the end of every chapter.
Each practice test question includes a detailed explanation to help you understand the content and the reasoning behind the question. You’ll be ready to take and pass the exam the first time you take it.
If you plan to pursue any of the advanced security certifications, this guide will also help you lay a solid foundation of security knowledge. Learn this material, and you’ll be a step ahead for other exams. This SY0-601 study guide is for any IT or security professional interested in advancing in their field, and a must-read for anyone striving to master the basics of IT security.
Capture Video
Video surveillance methods such as closed-circuit television (CCTV) systems are often used as a detective control during an investigation. If a person is recorded on video, the video provides reliable proof of the person’s location and activity. For example, if a person is stealing equipment or data, video might provide proof.
As an example, I remember a high school student was working nights at a local grocery store. The store had a delivery of beer in a tractor-trailer that hadn’t been unloaded yet but was kept backed up to the store loading dock overnight. The student stole several cases of beer thinking the crime was undetectable. However, the entire scene was recorded on video. When he showed up for work the next evening, the store promptly called the police and provided a copy of the video. The video provided reliable proof that simply couldn’t be disputed.
Record Time Offset
In some cases, it’s easy to identify the time of an event such as in the figure. In the figure, you can easily identify the exact dates and times when someone created, modified, last saved, and last accessed the file. However, in some cases, you need to consider a time offset.
File Explorer showing exact dates and times
For example, Greenwich Mean Time (GMT) identifies the time at the Royal Observatory in Greenwich, London. Other times are often expressed as a relationship to GMT. For example, I live in the Eastern Standard Time (EST) zone, which has a four-hour offset. You can express the Date Accessed time as 5:10 p.m. EST. Using GMT, you can express the same time as 9:10 p.m. GMT. One benefit of using GMT is that it doesn’t change for daylight saving time, so it stays constant.
Many video recorders use a record time offset to identify times on tape recordings rather than the actual time. For example, a recording might use a displayed counter to identify the time that has passed since the recording started. Imagine that the counter advances 1,000 ticks or counts per hour. If the counter indicates an event occurred at an offset time of 1,500 and the recording started at midnight, then the time of the event was 1:30 a.m.
When analyzing timestamps of any evidence, it’s important to understand that these times are often based on an offset. If you can’t identify the offset, you might not be able to identify the actual time.
Screenshots
Screenshots are simply pictures of what you can see displayed on a computer screen. If you want to capture exactly what a user was doing, or specific displays, a screenshot is the perfect solution.
For example, in the figure above, is a screenshot of File Explorer. You can save screenshots as graphics files and embed these graphics into documents. Many operating systems include the ability to capture the screen and save it to the Clipboard. For example, you can capture the screen of almost any system by pressing the PrtScn key found on most keyboards. Many applications such as the Windows Snipping Tool or Snagit by TechSmith allow you to capture screenshots from specific windows or applications, any region of the screen, and even scrolling windows such as a long web page.
Q. An administrator recently learned of a suspected attack on a Florida-based web server from IP address 72.52.206.134 at 01:45:43 GMT. However, after investigating the logs, he doesn’t see any traffic from that IP at that time. Which of the following is the MOST likely reason why the administrator was unable to identify the traffic?
A. He did not account for time offsets.
B. He did not capture an image.
C. The IP address has expired.
D. The logs were erased when the system was rebooted.
Answer is A. The most likely reason is that he did not account for the time offset. The attack occurred at 01:45:43 Greenwich Mean Time (GMT) and the web server is in the Eastern Standard Time (EST) zone in Florida, which is five hours different from GMT.
There is no need to capture an image to view logs.
IP addresses on the Internet do not expire.
Logs are written to a hard drive or a central location; they are not erased when a system is rebooted.
See Chapter 11 of the CompTIA Security+: Get Certified Get Ahead: SY0-501 Study Guide for more information on implementing policies to mitigate risks
