Securing the digital crime scene

Whenever corporations suspect legal trouble, they'll need to preserve digital evidence, says Robert Goto, senior technical forensics adviser for Electronic Evidence Discovery in Seattle.

At the very least, network professionals should know who to call if they don't have the legal expertise to manage the investigations themselves. Along with companies specializing in digital evidence recovery such as EED and New Technologies, the Big Four accounting firms also offer forensics services.

But even calling in the experts requires corporations to handle some data. So Goto offers this advice:

•  Take custody of the entire computer, including keyboard and other peripherals, floppy diskettes and other removable media so you can show that what you took was a working computer.

•  Note unique identifiers, label items taken, seal smaller items in plastic bags and place in a secure area.

•  Document who did what throughout the chain of custody for each item collected. Maintain logs of where you are keeping records.

•  If the computer is to be recirculated, take the hard drive from the machine and secure it. An original makes the best evidence.

•  Then make a forensically sound image of the hard drive, using hardware-based drive imaging tools as opposed to a write-blocking software tool. (Tools can be found at here and here.) At this time, also note the system date/time before resecuring the hard drive.

•  Other data sources, such as network file shares and e-mail located in server-based e-mail systems, must be considered and preserved. Data throughout the network is the most difficult to gather and analyze, so EED has created a discovery tool for this widespread data.