Forensics and Cyber Threat Research Area

Threat Intelligence | Insider Threat Detection | User Behavior Analytics | Cyber Threat Management | Data Security Intelligence | Cloud Security Intelligence Application Security Intelligence | Anomaly & Pattern Detection |  Security Information Event Management | Digital Forensics | Data Recovery | Malware Investigation | Packet Analytics | Packet Forensics | security operations and analytics platform architecture (SOAPA)

Cyber Threat Analytics

Home » Blog » Reconstructing Past Digital Events

 Posted in Digital Forensics

Reconstructing Past Digital Events

   20th February 2016  Leave a Comment on Reconstructing Past Digital Events 1 1085

Reconstructing Past Digital Events

Project Name: Reconstruction of Past Digital Events

Description: This blog will help all forensics investigator to Reconstruct of Past Digital Events.

Author: Rohit D Sadgune

Frequently Asked Question on Computer Forensics Investigation

  • How to Reconstructing Past Digital Event
  • Backup of Digital Events
  • Importanance of Reconstructing Past Digital Event
  • Review of Past Digital Events

Forensics Checklist

  1. Create a timeline to reconstruct the events that led to your system being corrupted. This can be particularly difficult when it comes to computers—clock drift, delayed reporting, and differing time zones can create confusion in abundance.
  2. Do not change the clock on an affected system.
  3. Record any clock drift and the time zone in use, as you will need this later, but changing the clock just adds in an extra level of complexity that is best avoided.
  4. Synchronize the log files. Log files usually use timestamps to indicate when an entry was added, and these must be synchronized to make sense.
  5. Use timestamps. You’re not just reconstructing events; you are making a chain of events that must be accounted for as well.
  6. Use the GMT time zone when creating your timestamps, because the incident may involve other time zones than your own. Using a common reference point can make things much easier.
  7. Make sure you have a dedicated host for the job when analyzing backups. This examination host should be secure, clean (a fresh, hardened install of the operating system is a good idea), and isolated from any network—you don’t want it tampered with while you work, and you don’t want to accidentally send something nasty down the line.
  8. Commence analysis of the backups once the system is available. Making mistakes at this point shouldn’t be a problem—you can simply restore the backups again if required.
  9. Document everything you do. Remember the mantra.
  10. Ensure that what you do is not only repeatable, but that you always get the same results.
  11. Reconstruct the chain of events leading to and following the attacker’s break-in now that you have collected the data.
  12. Make sure you correlate all the evidence you have gathered (which is why accurate timestamps are critical). It’s probably best to use graphical tools, diagrams, and spreadsheets.
  13. Include all of the evidence you’ve found when reconstructing the attack—no matter how small it is, you may miss something if you leave a piece of evidence out.
  14. Review audit trails of system activity to pinpoint how, when, and why the incident occurred, since the amount of damage that occurred with an incident can be assessed.

GO BACK TO COMPUTER FORENSICS CHECKLIST

Author: Rohit Sadgune
Core Working Areas :- Threat Intelligence, Digital Forensics, Incident Response, Fraud Investigation, Web Application Security Technical Certifications :- Computer Hacking Forensics Investigator | Certified Ethical Hacker | Certified Cyber crime investigator | Certified Professional Hacker | Certified Professional Forensics Analyst | Redhat certified Engineer | Cisco Certified Network Associates | Certified Firewall Solutions | Certified Network Monitoring Solution | Certified Proxy Solutions
Website

Leave a Reply

Your email address will not be published. Required fields are marked *

Enter Captcha Here : *

Reload Image

Indicator of Attacks | Indicator of Compromise

Top SIEM Use Cases | Threat Hunting Hypothesis | Deep Packet Inspection | Insider Threat Hunting | Hunting Data Exfiltration | Banking Fraud | ATM Use Cases | Cross Channel Data Exfiltration | Hunting Endpoint Anomaly | Denial-of-service | Man-in-the-middle (MitM) attack | Spear phishing attacks | Drive-by attack | Eavesdropping attack | Birthday attack