Table of Contents for

System Forensics, Investigation, and Response, 3rd Edition

Many crimes today involve the use of computers and networks. A computer or another device can play one of three roles in a computer crime:

• It can be the target of the crime.

• It can be the instrument of the crime.

• It can be an evidence repository that stores valuable information about the crime.

In some cases, a computer can have multiple roles. It can be the instrument of a crime and also serve as a file cabinet that stores critical evidence. For example, an attacker may use a computer as a tool to break into another computer and steal files. The attacker may then store the stolen files on the computer used to perpetrate the theft. When investigating a case, it is important that the investigator know what roles a computer played in the crime and then tailor the investigative process to those roles.

Applying information about how a computer was used in a crime also helps when searching a system for evidence. If a computer was used to hack into a network password file, the investigator should look for password-cracking software and password files. If a computer was the target of a crime, such as an intrusion, the investigator should check audit logs and look for unfamiliar programs. Knowing how a computer was used in a crime helps narrow down the evidence collection process. Hard drives today are generally very large. Therefore, checking and analyzing every piece of data a computer and associated media contain can take a long time. Often, law enforcement officials need information quickly. Having a general idea of what to look for on a suspect computer speeds the evidence collection process.

Computers can be involved in a variety of types of crimes, including white-collar crimes, violent crimes such as murder and terrorism, counterintelligence, economic espionage, counterfeiting, child pornography, and drug dealing, among others.

The Internet has made targets much more accessible, and the risks involved for criminals are much lower than with traditional crimes. From the comfort of home or some other remote site, a cybercriminal can hack into a bank and transfer millions of dollars to a fictitious account. In essence, the criminal can rob the bank without the threat of being physically harmed while trying to escape.

Cybercrime can also involve modification of a traditional crime by using the Internet in some way. It can be as simple as the online illegal sale of prescription drugs or as sophisticated as cyberstalking. Pedophiles use the Internet to exchange child pornography and pose as children to lure victims into real-life kidnappings. Laws governing fraud apply with equal force, regardless of whether the activity is online or offline.

In the arena of computer forensics, the nature of the crime can have a significant effect on the forensic process. Certain crimes are more likely than others to yield certain types of forensic evidence. For example, identity theft is likely to leave email evidence via phishing emails, but hacking into a system and stealing data probably does not leave any email evidence. On the other hand, hacking into the system probably does leave evidence in the firewall and intrusion detection system logs, whereas phishing emails may not.

In order to select the appropriate forensic tests, the investigator must understand the types of computer crimes and how each crime affects the forensic process.

Most computer security books categorize computer attacks based on the nature of the attack; for example, such books look at denial of service attacks, malware, hacking into webpages, and so forth. However, for our purposes, this chapter categorizes computer attacks based on the type of crime being committed, regardless of how it was performed. As you proceed through this chapter, you will see that this makes more sense for forensic examinations. This chapter examines the following categories:

• Identity theft

• Hacking systems for data

• Cyberstalking/harassment

• Internet fraud

• Non-access computer crimes

• Cyberterrorism

These are rather broad categories that encompass a great many activities, but the categories work well for investigating criminal behavior.