Forensic Data Gathering,

Reconstruction and Analysis

CE00397-6

Case Study
 Standard Operating Procedure

 Standard Operating Procedure / Incident Handling Process

Preparation

Reflection /
Identification
Lesson Learned

Recovery Containment

Eradication

Module Code and Module Title Title of Slides Slide 2 of 9

 Standard Operating Procedure

Preparation

 Preparation enables easy coordination among staff

 Provides baseline protection
 Uses virus detection and eradication tools
 Company staff is given training at this stage

Module Code and Module Title Title of Slides Slide 3 of 9

 Standard Operating Procedure

Identification
 Identification involves validating, identifying and reporting the incident
 Determining the symptoms given in ‘how to identify an incident’
 Identifying nature of the incident
 Identifying events
 Protecting evidence
 Reporting events

Module Code and Module Title Title of Slides Slide 4 of 9

 Standard Operating Procedure

Containment
 Containment limits the extent and intensity of an incident
 It avoids logging as root on the compromised system
 Avoid conventional methods to trace back as this may alert the attackers
 Prepare complete backups of infected systems
 Change the passwords of all unaffected systems in the LAN

Module Code and Module Title Title of Slides Slide 5 of 9

 Standard Operating Procedure

Eradication
 Look into additional information along with the information gathered in the 3rd
(Containment) phase to find out reasons for the particular incident
 Use standard anti-virus tools to remove virus/worms from storage medias
 Improve security measures by enabling firewalls, router filters or assigning new
IP address
 Perform vulnerability analysis

Module Code and Module Title Title of Slides Slide 6 of 9

 Standard Operating Procedure

Recovery
 Determine the course of actions
 Monitor and validate systems
 Determine integrity of the backup itself by making an attempt to read its data
 Verify success of operation and normal condition of system
 Monitor the system by network loggers, system log files and potential back doors

Module Code and Module Title Title of Slides Slide 7 of 9

 Standard Operating Procedure

Reflection / Lesson Learned / Follow-up

 Revise policies and procedures from the lessons learned from the past
 Determine the staff time required and perform the following cost analysis:
 Extent to which the incidents disrupted the organization
 Data lost and its value
 Damaged hardware and its cost

Module Code and Module Title Title of Slides Slide 8 of 9

 Standard Operating Procedure

Case Study – Given In A Hard Copy

Module Code and Module Title Title of Slides Slide 9 of 9

 Standard Operating Procedure

Q&A

Module Code and Module Title Title of Slides Slide 10 of 9

 What we will cover next

Cloud Forensics

Module Code and Module Title Title of Slides Slide 11 of 9

 Standard Operating Procedure

Thank You

Module Code and Module Title Title of Slides Slide 12 of 9