WGU C702 Study Guide 2022 With

WGU C702 Study Guide 2022 With Complete Solution Computer Forensics - Deals with the process of finding evidence related to a digital crime Cybercrime - Any illegal act that involves a computer, its systems, or its applications Internal Attacks - Insider attacks, considered as a primary threat, refer to attacks by disgruntled individuals working in the same firm or household as the victim. Examples of internal attacks include espionage, theft of intellectual property, manipulation of records, and Trojan horse attack.External Attacks - External attacks originate from outside of an organization or can be remote in nature. Such attacks occur when there are inadequate information security policies and procedures.Rules of Forensics Investigation - A forensic examiner must keep in mind certain rules to follow during a computer forensic examination, as well as to handle and analyze the evidence. This will safeguard the integrity of the evidence and render it acceptable in a court of law.The forensic examiner must make duplicate copies of the original evidence and start by examining only the duplicates. The duplicate copies must be accurate replications of the originals, and the forensic examiner must also authenticate the duplicate copies to avoid questions about the integrity of the evidence.The computer forensic examiner must not continue with the investigation if the examination is going to be beyond his or her knowledge level or skill level.Forensic Investigator Rules - Limit access and examination of the original evidence Record changes made to the evidence files Create a chain of custody document Set standards for investigating the evidence Comply with standards Hire professionals for analysis of evidence 1 / 4

Evidence should be strictly related to the incident The evidence should comply with the jurisdiction standards Document the procedures applied on the evidence Securely store the evidence Use recognized tools for analysis Enterprise Theory of Investigation (ETI) - ETI is a methodology for investigating criminal activity. It adopts a holistic approach toward any criminal activity as a criminal operation rather than as a single criminal act.Understanding Digital Evidence - Digital evidence includes all such information that is either stored or transmitted in digital form and has probative value. Investigators should take utmost care while gathering digital evidence as it is fragile in nature. According to Locard's Exchange Principle, "anyone or anything, entering a crime scene takes something of the scene, and leaves something of themselves behind." Locard's Exchange Principle - Every contact leaves a trace Digital Forensics Challenge - Forensic investigators face many challenges during forensics investigation of a digital crime, such as extracting, preserving, and analyzing the digital evidence. For example, system data that an intruder can easily change or destroy should have priority while assembling the evidence.Volatile Data - Temporary information on a digital device that requires a constant power supply and is deleted if the power supply is interrupted. Important volatile data includes: system time, logged on user(s), open files, network information, process information, process-to-port mapping, process memory, clipboard contents, service/driver information, command history, etc.Non-volatile Data - Permanent data stored on secondary storage devices, such as hard disks and memory cards. Information stored in non-volatile form includes: hidden files, slack space, swap file, index.dat files, unallocated clusters, unused partitions, registry settings, and event logs.Characteristics of Digital Evidence - Admissible Authentic Complete Reliable Believable 2 / 4

Admissible Evidence - Relevant to the case, acts in support of the client presenting it, and be well communicated and non-prejudiced.Authentic Evidence - investigators must provide supporting documents regarding the authenticity, accuracy, and integrity of the evidence with details such as source and its relevance to the case.If necessary, they must also furnish details such as author of the evidence or path of transmission.Complete Evidence - must either prove or disprove the consensual fact in the litigation Reliable Evidence - extract and handle the evidence while maintaining a record of the tasks performed during the process to prove that the evidence is dependable. Forensic investigation is conducted only on the copies of evidence.Believable Evidence - Presents evidence in a clear manner to the jury and obtain expert opinions where necessary Best Evidence Rule - The best evidence rule is to prevent any alteration of digital evidence, either intentionally or unintentionally.When will a duplicate suffice as evidence? - Original evidence is destroyed due to a fire or flood.Original evidence is destroyed in the normal course of business.Original evidence is in possession of a third party.Civil Cases - Involves disputes between two parties, which may include an individual versus a company, an individual versus another individual, or a company versus another.They relate to violation of contracts and lawsuits, where a guilty verdict generally results in monetary damages to the plaintiff.Criminal Cases - Involves actions that are against the norms of society. Did you know what you did? If so, it is criminal.Investigators must follow a set of standard forensic processes accepted by law in their respective jurisdiction. If they have a warrant, investigators have the authority to seize computing devices. A formal investigation report is required and law enforcement agencies are responsible for collecting and analyzing evidence. Punishments are harsh and can include a fine, jail, or both. Standard of proof needs to be very high and it can be difficult to capture certain evidence such as GPS device evidence. 3 / 4

Administrative Investigation - refers to an internal investigation by an organization to discover if its employees, clients and partners are abiding by the rules or policies.Violation of company policies.• Involves an agency or government performing inquiries to identify facts with reference to its own management and performance • Non-criminal in nature and related to misconduct or activities of an employee that includes but

are not limited to:

• Violation of organization's policies, rules, or protocols. Resource misuse or damage or

theft

• Threatening or violent behavior. Sexual Exploitation, harassment and abuse
• Improper promotion or pay raise, corruption and bribery

Scientific Working Group on Digital Evidence (SWGDE) - Principle 1: To ensure that digital evidence is collected, preserved, examined, or transferred in a manner that safeguards the accuracy and reliability of the evidence, law enforcement and forensic organizations must establish and maintain an effective system for quality control.Standards and Criteria 1.1 All agencies that seize and/or examine digital evidence must maintain an appropriate SOP document. 1.2 Agency mgmt. must review SOPs on an annual basis to ensure their continued suitability and effectiveness. 1.3 SOPs must be generally accepted or supported by data gathered and recorded in a scientific manner.

1.4 The agency must maintain written copies of the appropriate technical procedures.

1.5 The agency must use hw and sw that is appropriate and effective for the seizure/examination procedure.

1.6 All activities related to the seizure, storage, examination, or transfer of digital evidence must be recorded in writing and be available for review and testimony.Forensic Readiness - refers to an organization's ability to make optimal use of digital evidence in a limited period and with minimal investigation costs. It includes technical and nontechnical actions that maximize an organization's competence to use digital evidence.What tasks does a forensic investigator perform? - Evaluates the damages of a security breach identifies and recovers data required for investigation Extracts the evidence in a forensically sound manner Ensures proper handling of the evidence Acts as a guide to the investigation team Creates reports/documents about the investigation required to present in a court of law Reconstructs the damaged storage devices and uncovers the info hidden on the computer

• / 4