Embed Doc
Copy Link
Readcast
Collections

CommentGo Back

Download

Basic Computer Forensics forSystem Administrators

Daryl Sheppard11 February 2007Version 1.0

Contents

Introduction................................................................................................................2Computer Forensics and System Administration.......................................................3“It won’t happen to me!”..............................................................................................4Identifying an incident.................................................................................................5What to do..............................................................................................................6Collecting evidence....................................................................................................8Applying the Rules................................................................................................10Chain of Custody..................................................................................................13How to collect the evidence......................................................................................15The Ideal Situation................................................................................................15The less-than-ideal situation.................................................................................17Offline Copy of Tools............................................................................................20Testing the tools...................................................................................................20The System Administrators Forensic Toolkit............................................................21Presenting the Evidence..........................................................................................23Conclusion...............................................................................................................24Annex A Sample Chain of Custody form..................................................................25References...............................................................................................................26

Title page image taken from: http://electronicevidenceretrieval.com/eer_computer_forensics_defined.htm

Introduction

In many cases that involve the use of forensic investigation after an incident hasoccurred, whether by law enforcement or internal organisation security, vitalevidence has been destroyed or made unusable by the system administratorsresponsible for operating the system. This isn’t to say that they have been negligentin their responsibilities; it is quite the opposite. The destruction of forensic data hasoccurred due to the fact the system administrator has been undertaking their primaryfunction; running their systems and ensuring that they keep running.What this demonstrates is that the goals of these two fields, computer forensics andsystem administration, are at times mutually exclusive. The computer forensicspecialist needs to keep the “scene of the crime” just as it was when the intruder leftit. The system administrator needs to get things back to business as usual as quicklyas possible.The intent of this paper is to develop a common ground between the two fieldswhere the primary objectives of each can be reached as closely as possible.The areas that this paper will cover are:



Educating system administrators in what to do after an incident has occurredto ensure that forensic evidence is not lost



Cover the basic rules and regulations surrounding proper evidence handling



Developing a system administrators forensic tool kitThe areas that this paper will

not

cover are:



An in-depth knowledge of computer forensics. This paper is intended only toprovide system administrators with front-line first response knowledge. Itsintention isn’t to make you a forensic expert, but just to provide enoughknowledge to secure data for further analysis by computer forensicspecialists. A real world analogy is that this will teach you how to put thepolice tape around the scene of the crime, collect basic information and handit over to the detectives when they arrive

of 00

Computer Forensics for System Administrators

This paper was written for a presentation given at the 2007 State Conference for the Victorian Chapter of SAGE-AU. The basis of this paper was taken from a paper I wrote for my ... (More)

Download or Print

1,917 Reads

Info and Rating

Category:	How-To Guides/Manuals
Rating:	(2 Ratings)
Upload Date:	08/06/2009
Copyright:	Attribution Non-commercial
Tags:	Computers Technology Law Systems forensics computer forensics System Administrator Computers Technology Law Systems forensics computer forensics System Administrator (fewer)