Don't Let Legacy Media Foil Your Forensic InvestigationDon't Let Legacy Media Foil Your Forensic Investigation
When performing incident response and forensics on a compromised system, the focus of analysis is on the most immediately available and relevant sources of evidence. Volatile data collected from a running system, the hard drive, network flow data, and logs collected on a central server all serve as useful sources for determining the particulars of the incidents. But what about incidents that go back further, requiring you to dig into backup tapes -- and potentially very old ones?
June 29, 2009
When performing incident response and forensics on a compromised system, the focus of analysis is on the most immediately available and relevant sources of evidence. Volatile data collected from a running system, the hard drive, network flow data, and logs collected on a central server all serve as useful sources for determining the particulars of the incidents. But what about incidents that go back further, requiring you to dig into backup tapes -- and potentially very old ones?Fortunately, I've dealt with very few cases where I had to retrieve information from backup tapes. However, the ones I did weren't pretty. The last was the worst one because the tapes were the best source of evidence, thanks to the botched first response by the client's sysadmins. Making matters worse, the client used an expensive and proprietary backup software that they could use only to extract the data for analysis. Oh, yeah: and it was brutally slow.
The article "Computer Forensics - Don't Let the Tape Evidence Escape You" is what started me thinking about tapes, legacy media, and, moreover, the impact on computer forensic investigations. Unless they've been at it for a very long time, independent forensic investigators are unlikely to have an arsenal of legacy tape, magneto-optical, Zip disk, and other drives at their beck and call when needed in an investigation. They either have to rely on their client to have the right drives or call a specialty shop that has the right drives to read the data for the. (Luckily, those places do exist.)
A similar scenario could affect an enterprise that does its own internal investigations. The simplest scenario would be if its backup and incident response strategy didn't take into consideration data stored on media kept long after the system that could read them was decommissioned. I've seen it numerous times in my day-to-day educational environment, where faculty needs to read data from old tapes, Zip disks, and even floppies, and they must go searching for the right drive to get their old research from it.
Looking forward, what's going to happen to CDs and DVDs? Will we be using those formats in 20 years? And, if so, will the media on which you chose to write the data to still be good? It's something to keep in mind as you're building your forensic team. Make sure they have the tools they need and that they are aware of what media types are in use within the organization to ensure they can handle it if it becomes necessary.
And don't forget to test it. You never want to be in a situation of thinking you can analyze a tape or disk, only to realize your equipment doesn't work.
John H. Sawyer is a senior security engineer on the IT Security Team at the University of Florida. The views and opinions expressed in this blog are his own and do not represent the views and opinions of the UF IT Security Team or the University of Florida. When John's not fighting flaming, malware-infested machines or performing autopsies on blitzed boxes, he can usually be found hanging with his family, bouncing a baby on one knee and balancing a laptop on the other. Special to Dark Reading.
About the Author(s)
You May Also Like
Reducing Cyber Risk in Enterprise Email Systems: It's Not Just Spam and PhishingNov 01, 2023
SecOps & DevSecOps in the CloudNov 06, 2023
What's In Your Cloud?Nov 30, 2023
Everything You Need to Know About DNS AttacksNov 30, 2023
9 Traits You Need to Succeed as a Cybersecurity Leader
The Ultimate Guide to the CISSP
Modernize your Security Operations with Human-Machine Intelligence
The Evolving Ransomware Threat: What Business Leaders Should Know About Data Leakage
2021 Gartner Market Guide for Managed Detection and Response Report