This chapter is from the book
This chapter is from the book
This chapter is from the book
15.2 Preparation
The key to a successful computer forensic project is thorough preparation. Not only is preparation necessary for the most effective performance of the tasks at hand, but it is also critical for preserving any and all evidence for potential use in court. If there is even a hint that the evidence has been contaminated in any way, it cannot be used in efforts to prosecute the potentially guilty party.
Though it's not what we want, we will suppress the names of the senior executives involved in this case.
At the outset of the investigation in this case, we attempted to learn as much as possible about the many "suspect" systems to be analyzed, including the following:
-
Size of the hard drive(s)
-
Type of each hard drive—for example, Integrated Drive Electronics (IDE), Small Computer System Interface (SCSI)
-
Operating systems
-
Associated storage peripherals—for example, external hard drive(s), CDs, tapes
-
Number of system users and their names
With any computer forensic examination you have both a suspect system and an analysis system. The suspect system is obviously the one that computer forensic analysis will be conducted on. The analysis system is the one that will be used to perform the analysis.
We worked with the client's IT assessment management team and obtained an inventory sheet that contained most of the information we needed. As you might imagine, they were very cooperative. Our primary concern was the size of the hard drives because we needed to prepare our analysis systems to ensure that we had the proper amount and type of hard drives for imaging the suspects' drives.
Once we were confident that we had the proper number and types of hard drives, we sanitized them and verified that they were in proper working order. Because we use the same analysis hard drives on multiple engagements, it is important for the drives to be wiped completely clean between engagements. Never should data from one job end up in the files of another job. If there is any doubt about the sanitization process, err on the side of caution and just buy brand-new drives. Actually, buying new drives is fairly common practice because whenever the investigation is being done as part of a criminal or legal action, the hard drive goes into evidence. We don't get these drives back, even after the case is over, because there may be an appeal down the road, for which the original evidence will need to be investigated.
A hard drive can be wiped clean in a variety of ways, such as through the Linux operating system's DD function or through commercially available software. The process involves writing a series of characters repeatedly over the entire hard drive and essentially "wiping" it clean of any data from a prior computer forensic analysis. This investigation required us to purchase several brand-new hard drives, but to take no chances, we wiped them clean as well. This added step ensured that no data would exist on our analysis drives until one of our team members placed it on the drive.
To use the Linux DD function to wipe a hard drive clean, you can utilize the following command:
# > dd if=/dev/urandom of=/dev/hda
where /dev/hda is the physical address of the analysis drive, and urandom is the built-in "random" number generator from Linux. This process should be repeated as many times as you desire. Many professionals sanitize their hard drives as many as three to nine times.
Upon examining the sanitized drive, you should see only a series of random characters throughout. No data should remain on the drive after this process is completed.
15.2.1 The Nature and Source of the Allegation
One other essential preparation step was to work with the lead auditors and attorneys to ensure that all of our computer forensic technicians understood the nature and scope of the investigation and the purpose for conducting the computer forensics. Basically, we needed to ensure that everyone understood his or her own role and place within the overall team's goals.
We approached the task by holding facilitated meetings first thing every morning. Our meetings provided an opportunity for the computer forensic technicians and the financial investigators to share information.
The meetings also provided us the opportunity to collaborate as a team on identifying the type of information we should search for during the computer forensic examination. For this particular project, the financial investigators suggested that Excel spreadsheets, Word documents, PowerPoint presentations, and e-mail correspondence would be the most likely places where evidence of fraud would turn up, as well as being the best indicators of who had taken part in the fraud.
From information gathered at these meetings, we collaborated on developing a list of key search terms that we would use for string searches later in the computer forensic process. The terms we chose were determined by the type of information being sought for use in an accounting fraud case. A lot of the words we came up with are what would be considered typical for a case of accounting fraud; others were specific to the industry, company, and executives involved. When developing a list of search terms, you will almost always include the names of the people being investigated, as well as other pertinent parties, such as customers, vendors, and business partners—that is, the names of any relevant entity. Sample search terms that could be utilized in an accounting fraud case are shown in Table 15.1.
Table 15.1. Possible Search Terms for Accounting-Fraud Cases
|
allowance |
growth |
overstatement |
|
audit |
incentive |
per our discussion |
|
beginning balance |
income |
prepaid |
|
bonus |
in connection |
receivable |
|
confirm |
internal |
repay |
|
deduction |
investigate |
total |
|
earned |
investigation |
year-end |
One use for search terms, especially when they are to be used to search through e-mail, is to check whether the suspects have been communicating with each other about the investigation, or the potential for an investigation if they are caught. (Such evidence would prove premeditation, negating the "I didn't know it was against the rules" defense.) This is why the words investigate and investigation are included in the list of search terms.
One thing we should mention is that we collaborated with the lawyers and accountants on the development of search terms. Certainly we wanted the financial investigators' input on the kinds of evidence to look for specific to their industry. But this is not to suggest that they were controlling the forensic investigation. If there was any doubt about whether a term should be included or not included, we included it. The seriousness of the matter (and, we'd like to think, the professionalism of those involved allowed the situation to remain collaborative and not competitive).