six-step methodology for volatile data collection

Methodology for volatile data collection

Step 1: Incident Response Preparation.

Step 2: Incident Documentation.

Step 3: Policy Verification.

Step 4: Volatile Data Collection Strategy.

Step 5: Volatile Data Collection Setup.

Step 6: Volatile Data Collection Process.

These steps are designed to be used by an investigator to investigate intrusion cases common to larger networks. For purposes of this document, our focus is on Step 6. Steps in the Volatile Data Collection Process Step 6, Volatile Data Collection Process, involves the following five steps:

1. Collect uptime, date, time, and command history for the security incident.
2. As you execute each forensic tool or command, generate the date and time to establish an audit trail.
3.  Begin a command history that will document all forensic collection activities.
4. Collect all types of volatile system and network information.
5. End the forensic collection with date, time, and command history.

A Methodology for the Law Enforcement Collection of Digital Evidence from a Running Computer. Some of the currently used tools include Helix, a bootable CD that is a collection of incident response tools, and “dd,” a tool written by George Garner to capture RAM . With the understanding that computer systems contain potential evidence that could be destroyed if traditional computer evidence collection methods are employed, investigators can use the following basic steps when collecting volatile evidence:

•  Maintain a log of all actions conducted on a running machine.
• Photograph the screen of the running system to document its state.
•  Identify the operating system running on the suspect machine.
•  Note date and time, if shown on screen, and record with the current actual time.
• Dump the RAM from the system to a removable storage device.
•  Check the system for the use of whole disk or file encryption.
• Collect other volatile operating system data and save to a removable storage device.
• Determine evidence seizure method (of hardware and any additional artifacts on the hard drive that may be determined to be of evidentiary value).
• Complete a full report documenting all steps and actions taken.

These basic steps allow the on-scene investigator to collect data that was previously overlooked as unnecessary or simply lost out of ignorance. Open source and commercial tools are currently available that easily allow for this methodology to be followed on a running system. The RAM is dumped first to capture the greatest amount of evidence available. It must be noted that inserting any device into the running system (flash drive, removable drive, or CD) will make minor changes to the system, albeit very small changes. The proper use of these tools does not add evidence or contraband to the system. Running a program to dump the RAM requires that a very small amount of RAM be occupied by the tool to conduct the RAM dump. Inserting a removable drive into a USB port adds an entry to the Microsoft Registry. All of these changes have no effect on the overall state of the evidence and can be further documented at a later time by a traditional forensic examination. Some small changes are made during the process of using some of the available tools that require interaction with the Windows operating system. These changes however, occur to the operating system files only and do not fundamentally change the content of the data saved on the system.

• Step 1: Incident Response Preparation.
• Step 2: Incident Documentation.
• Step 3: Policy Verification.
• Step 4: Volatile Data Collection Strategy.
• Step 5: Volatile Data Collection Setup.
• Step 6: Volatile Data Collection Process.

These steps are designed to be used by an investigator to investigate intrusion cases common to larger networks. For purposes of this document, our focus is on Step 6. Steps in the Volatile Data Collection Process Step 6, Volatile Data Collection Process, involves the following five steps:

1. Collect uptime, date, time, and command history for the security incident.
2. As you execute each forensic tool or command, generate the date and time to establish an audit trail.
3. Begin a command history that will document all forensic collection activities.
4. Collect all types of volatile system and network information.
5. End the forensic collection with date, time, and command history.

A Methodology for the Law Enforcement Collection of Digital Evidence from a Running Computer. Some of the currently used tools include Helix, a bootable CD that is a collection of incident response tools, and “dd,” a tool written by George Garner to capture RAM . With the understanding that computer systems contain potential evidence that could be destroyed if traditional computer evidence collection methods are employed, investigators can use the following basic steps when collecting volatile evidence:

1.  Maintain a log of all actions conducted on a running machine.
2.  Photograph the screen of the running system to document its state.
3. Identify the operating system running on the suspect machine.
4. Note date and time, if shown on screen, and record with the current actual time.
5. Dump the RAM from the system to a removable storage device.
6. Check the system for the use of whole disk or file encryption.
7. Collect other volatile operating system data and save to a removable storage device.
8. 8.   Determine evidence seizure method (of hardware and any additional artifacts on the hard drive that may be determined to be of evidentiary value).
9. Complete a full report documenting all steps and actions taken.

These basic steps allow the on-scene investigator to collect data that was previously overlooked as unnecessary or simply lost out of ignorance. Open source and commercial tools are currently available that easily allow for this methodology to be followed on a running system. The RAM is dumped first to capture the greatest amount of evidence available. It must be noted that inserting any device into the running system (flash drive, removable drive, or CD) will make minor changes to the system, albeit very small changes. The proper use of these tools does not add evidence or contraband to the system. Running a program to dump the RAM requires that a very small amount of RAM be occupied by the tool to conduct the RAM dump. Inserting a removable drive into a USB port adds an entry to the Microsoft Registry. All of these changes have no effect on the overall state of the evidence and can be further documented at a later time by a traditional forensic examination. Some small changes are made during the process of using some of the available tools that require interaction with the Windows operating system. These changes however, occur to the operating system files only and do not fundamentally change the content of the data saved on the system.

Hacker News

Anonymous member with twitter handle @OsamaTheGod leaked a huge database from server of Israeli Musical Act Magazine (act.co.il). The leaked database posted on public note website and includes users ID, username, password in clear text, IP address and phone numbers. Hacker posted data of about 10000 users from the site. Reason of hack yet not mentioned anywhere, but because hacker use #OpIsrael hash in his tweets, so this could be an attack against Israel in fight of Anonymous vs Israel.


NEW DELHI: The Bharat Sanchar Nigam Limited (BSNL) website, www.bsnl.co.in, was hacked and defaced on Thursday afternoon. A message on the home page said the attack was carried out by the hacktivist group, Anonymous India, as a protest against section 66 A of the IT Act and in support of cartoonist Aseem Trivedi, on an indefinite hunger strike at Jantar Mantar since Dec 8 for the same. The website was restored around 7 pm. .

Trivedi said he had received a call from Anonymous around 1.30 in the afternoon informing him that the website has been defaced. On being asked if such a form of protest was valid, Trivedi said, "When the government doesn't pay heed to people's protests against its laws and arrests innocent people for Facebook posts, then such a protest is absolutely valid."
For most of the afternoon and early evening, the BSNL website wasn't available directly. A cached version of the BSNL home page showed an image of cartoonist Trivedi with text that read "Hacked by Anonymous India. support Aseem trivedi (cartoonist) and alok dixit on the hunger strike. remove IT Act 66a databases of all 250 bsnl site has been d Hacked by Anonymous India (sic)". While this message was repeated over and over on the page, it ended with the line "Proof are (sic) here" followed by a link to a page containing the passwords to BSNL databases. BSNL officials were unaware of the attack until Thursday evening.
Late in the evening, Anonymous India tweeted from their account @opindia_revenge: "BSNL Websites hacked, passwords and database leaked... Anonymous India demands withdrawal of Sec 66A of IT Act."
In an open letter to the Government of India posted on alternate media website Kafila in June this year, Anonymous had explained they only carried out Distributed Denial of Service (DDoS) attacks on Indian government websites, which is different from the act of hacking per se.
Contrary views too exist. Sunil Abraham, executive director, Centre for Internet and Society, says the attack was unwarranted. "Speech regulation in India is not a lost cause, the Minister is holding consultations, MPs are raising the issue in Parliament, courts have been approached and there is massive public outcry on social media. Therefore I would request Anonymous India to desist from defacing websites," said Abraham. A group of MPs, including Baijayant Jay Panda from Odisha, are scheduled to present a motion in Parliament on Friday morning for the amendment of section 66A of the IT Act.
Last month, two young girls were arrested in Palghar, Maharashtra, for criticizing on Facebook the bandh that followed the death of Shiv Sena supremo Balasaheb Thackeray. Before that, Karti Chidambaram, son of finance minister P Chidambaram, took a man to court for commenting on his financial assets on Twitter. In both cases, the complainant 'used' section 66 A of the IT Act. The section and the Act have since come in for wide debate regarding freedom of speech.