📋
A Journey From IT to IT Security
  • IT Training Resources
  • IT Security Roles
    • Web Application Security Specialist
      • Training Guide
      • Self-hosted Training Lab
        • Vulnerable Web Apps
      • Web Security testing Methodology
        • 1 Footprinting
        • 2 Scanning
        • 3 Enumeration
        • 4 Gaining Access
        • 5 Maintain Access
        • 6 Covering Tracks
        • 7 Vulnerability assessment
    • DevSecOps Engineer
      • Training Guide
      • Building a DevSecOps CD/CI Pipeline
        • Self-hosted DevOps CD/CI platforms
        • Software Component Analysis (SCA)
        • Static Application Security Testing (SAST)
        • Dynamic Application Security Testing (DAST)
        • System Hardening
        • System Compliance Analysis
        • Vulnerability Analysis
      • Ready-to-use and train DevSecOps CD/CI Pipeline
    • Chief Information Security Officer (CISO)
    • Digital Forensics Investigator
      • Forensics Methodology
    • Cloud Security Engineer
      • Getting started with kubernetes
  • Resources
    • IT Basics
      • Networking Basics Study Guide
      • RBAC / ABAC
      • Anonymous Surfing
      • Python Programming
      • Infrastructure as code
      • Containers
        • Docker
        • Docker security
      • The Security Development Lifecycle (SDL)
    • Literature
    • Useful Tool Tutorials
    • Useful Online Tools
    • Exploits
  • Unsorted
    • Gitlab-ci with docker-compose
Powered by GitBook
On this page
  • Investigative Process
  • Forensics Topics
  • Rules of a forensic investigator
  • ETI (Enterprise Theory of Investigation)
  • Types of evidence:
  • Characteristics of Digital Evidence
  • Best Evidence Rule
  • Federal rules of evidence
  • Laws
  1. IT Security Roles
  2. Digital Forensics Investigator

Forensics Methodology

Investigative Process

  • Assesss

  • Aquire

  • Analyse

  • Report

Forensics Topics

Hard Disks and File System

Data Aquisition

Anti-Forenscis

OS Forensics

Network Forensics

Web Attack Investigations

Database Forensics

Forensics in the cloud

Malware

Email Investigation

Mobile

Reporing

Rules of a forensic investigator

  • limit access to original evidence

  • make duplicate copies and examine those

  • record changes (we need to be able to justify)

  • chain of custody

  • setting standards (wait to aquire the evidence)

  • know your own limitations (find a proper person with the resources)

  • secure storage

  • legal (understand the jurisdiction, is it a crime to investigate?)

  • industry tools (know the latest tools)

ETI (Enterprise Theory of Investigation)

Types of evidence:

volatile: system time, processes, command history, etc.

non volatile: still available fter cutting the power (event logs, partitions, swap file, hidden files, registry)

Characteristics of Digital Evidence

  • Admissible Evidence relevant to the case, act in support of the client presenting it, and be well communicated and non- prejudiced.

  • Authentic investigators must provide supporting documents regarding the authenticity, accuracy, and integrity of the evidence with details such as source and its relevance to the case. If necessary, they must also furnish details such as author of the evidence or path of transmission.

  • Complete must either prove or disprove the consensual fact in the litigation

  • Reliable extract and handle the evidence while maintaining a record of the tasks performed during the process to prove that the evidence is dependable. Forensic investigation is conducted only on the copies of evidence.

  • Believable present evidence in a clear manner to the jury and obtain expert opinions where necessary

Best Evidence Rule

The best evidence rule is to prevent any alteration of digital evidence, either intentionally or unintentional.

Duplicate will also suffice as evidence under the following conditions:

ï‚· Original evidence is destroyed due to fire and flood. ï‚· Original evidence is destroyed in the normal course of business.

ï‚· Original evidence is in possession of a third party.

Federal rules of evidence

Laws

PreviousDigital Forensics InvestigatorNextCloud Security Engineer

Last updated 3 years ago