Fundamental Computer Investigation Guide For Windows
Overview
Internet connectivity and technological advances expose computers and computer networks to criminal activities such as unauthorized intrusion, financial fraud, and identity and intellectual property theft. Computers can be used to launch attacks against computer networks and destroy data. E-mail can be used to harass people, transmit sexually explicit images, and conduct other malicious activities. Such activities expose organizations to ethical, legal, and financial risks and often require them to conduct internal computer investigations. This guide discusses processes and tools for use in internal computer investigations. It introduces a multi-phase model that is based on well-accepted procedures in the computer investigation community. It also presents an applied scenario example of an internal investigation in an environment that includes Microsoft® Windows®–based computers. The investigation uses Windows Sysinternals tools (advanced utilities that can be used to examine Windows–based computers) as well commonly available Windows commands and tools. Some of the policies and procedures invoked in investigations that result from computer security incidents might also exist in disaster recovery plans. Although such plans are beyond the scope of this guide, it is important for organizations to establish procedures that can be used in emergency and disaster situations. Organizations should also identify and manage security risks wherever possible. For more information, see the Security Risk Management Guide. On This Page
Computer Investigation ModelAccording to Warren G. Kruse II and Jay G. Heiser, authors of Computer Forensics: Incident Response Essentials, computer forensics is "the preservation, identification, extraction, documentation, and interpretation of computer media for evidentiary and/or root cause analysis." The computer investigation model in the following figure organizes the different computer forensics elements into a logical flow.  The four investigation phases and accompanying processes in the figure should be applied when working with digital evidence. The phases can be summarized as follows:
Detailed information about each of the phases is provided in the chapters of this guide. Initial Decision-Making ProcessBefore you begin each of the general investigation phases you should apply the initial decision-making process shown in the following figure.  You should determine whether or not to involve law enforcement with the assistance of legal advisors. If you determine that law enforcement is needed, then you need to continue the internal investigation unless law enforcement officials advise you otherwise. Law enforcement might not be available to assist in the investigation of the incident, so you must continue to manage the incident and investigation for later submission to law enforcement. Depending on the type of incident being investigated, the primary concern should be to prevent further damage to the organization by those person(s) who caused the incident. The investigation is important, but is secondary to protecting the organization unless there are national security issues. If law enforcement is not involved, your organization may have existing standard operating procedures and policies that guide the investigation process. Refer to the "Reporting Computer-Related Crimes" section in Appendix: Resources in this guide for types of crimes that need to be reported to law enforcement. Chapter SummaryThis guide is comprised of five chapters and an appendix, which are briefly described in the following list. The first four chapters provide information about the four phases of the internal investigation process:
AudienceThis guide is intended for IT professionals in the United States who need a general understanding of computer investigations, including many of the procedures that can be used in such investigations and protocols for reporting incidents. Caveats and DisclaimersThis guidance does not constitute legal advice, and is not a substitute for individualized legal and other advice from legal advisors. You should always consult your legal advisors before you decide whether to implement any of the described processes. The tools and technologies described in this guide are current at the time of its release, and may change in the future. It is also important to understand that legal restrictions may limit your ability to implement these procedures. For example, the United States has many laws related to the rights of people who are suspected of committing illicit acts. Unless legal restrictions are specifically referenced in existing policies and procedures established by the organization, it is important that you obtain legally binding written approvals from legal advisors, management, and key stakeholders throughout the internal investigation.  NoteThis guide does not include information about incident response policy and procedure development, specific data imaging product guidance, guidance about building a forensics lab, or computer investigations in non-Windows environments. For information about incident response policy and procedure development, see the Microsoft Operations Framework (MOF) Web site. References and CreditsThe information in this guide is based on information provided by recognized industry experts and other guidance, including the following publications:
Style ConventionsThis guidance uses the style conventions that are described in the following table.
Support and FeedbackThe Solution Accelerators – Security and Compliance (SASC) team would appreciate your thoughts about this and other Solution Accelerators. Please contribute comments and feedback to secwish@microsoft.com. We look forward to hearing from you. Solution Accelerators provide prescriptive guidance and automation for cross-product integration. They present proven tools and content so you can plan, build, deploy, and operate information technology with confidence. To view the extensive range of Solution Accelerators and for additional information, visit the Solution Accelerators page on Microsoft TechNet.
|
In This Article
|
