Piecing Together Digital Evidence

The Computer Analysis Response Team

In 1991, an FBI working group began meeting to examine the investigative issues
surrounding computer crime. And in 1992, CART—the Computer Analysis Response Team—
was officially created.

Computer Analysis Response Team, or CART, is the FBI’s go-to force for providing digital
forensic services not only to our own investigators but also in some instances to our local,
state, and federal partners.

The cases that CART examiners work from cyber crimes and computer intrusions to violent
crimes, financial crimes, organized crime, and national security matters.

And once they have finished their forensic work, CART examiners are also available to testify
in court as expert witnesses on their findings

Questions:

1) What Should the Connecticut Company have done to prevent the computer
intrusion? How to detect this in the first place?

 The company should have protected its vulnerability in the software with extra
measures, considering the sensitivity of Intrusion and the impact that it can create
for its Business.
 Company should have overcome its negligence and brought in systems along with
processes that help detect any Intrusions.
2) What Security Controls for an Organization should implement to prevent, detect,
and recover from computer intrusion?

 As learnt from the Advo case, an Integrated System has to be setup between
Physical Security and IT Security establishing processes like restricted access to
places with role based access controls.
 For Detection, Systems should be in place to detect any intrusion, and with the
awareness about this system amongst the employees.
 For Recovery, Security Incidents reporting systems should be place to help monitor a
pattern and finally report it to the Law Enforcement Agencies.
3) Why would someone use a forged email address? Explain how this worked to the
intruders Advantage in this case?
 It was a Form of Social Engineering attack, it help perform a broad range of malicious
activity accomplished through email correspondences with using boatingCT.com.
 The advantage of this form of attack helped the intruder use psychological
manipulation to trick users into making security mistakes or giving away sensitive
information.
4) When the FBI New Haven Office requested the log files from the University of Akron,
none were available. Do you think it typical for universities not to retain log files?
What is the impact of this on the security of university computing environments?
 Usually, the Website activities which are recorded in the log files contain sensitive
information which when leaked could lead any types of fraud. Hence, to protect the
university systems from any vulnerability these files are not retained.
 However, when intruder uses the system, their trail cannot be tracked because of
the same reason.
5) The FBI New Haven CART field examiners imaged the hard drive and worked off of
that. They did not use the original drive or the original evidence. Why?
 Imaging creates a version control or a backup preserving the integrity of the
original evidence before it is presented in court.