Appendix: Resources

Published: January 11, 2007

This appendix provides information about various resources that you can use to conduct a computer investigation.

Preparing Your Organization for a Computer Investigation

To prepare your organization for an internal computer investigation, you should assemble a readily available computer investigation toolkit that includes software and devices you can use to acquire evidence. Such a toolkit might contain a laptop computer with appropriate software tools, different operating systems and patches, application media, backup devices, blank media, basic networking equipment, and cables. Preparing this toolkit can be an ongoing task as you find the need for various tools and resources, depending upon the investigations you need to conduct.

Use the following guidelines when building and using a computer investigation toolkit:

• Decide which tools you plan to use before you start the investigation. In addition to the Microsoft® Windows® Sysinternals and other Windows tools discussed in this document, the toolkit will typically include dedicated computer forensics software, such as Encase by Guidance Software, The Forensic Toolkit (FTK) by AccessData, or ProDiscover by Technology Pathways.
• Ensure that you archive and preserve the tools. You might need a backup copy of the computer investigation tools and software that you use in the investigation to prove how you collected and analyzed data.
• List each operating system that you will likely examine, and ensure you have the necessary tools for examining each of them. For example, you can use Windows Sysinternals tools (described later in this appendix) such as PsInfo, PsLogList, and ProcessExplorer to examine computers that run Windows XP and Windows Server® 2003.
• Include a tool to collect and analyze metadata.
• Include a tool for creating bit-to-bit and logical copies.
• Include tools to collect and examine volatile data, such as the system state. Some examples from Windows Sysinternals include ListDLLs, LogonSessions, PendMoves, Autoruns, and ProcessExplorer. Windows tools include Systeminfo, Ipconfig, Netstat, and Arp.
• Include a tool to generate checksums and digital signatures on files and other data, such as the File Checksum Integrity Validator (FCIV) tool. This tool is available through Microsoft Knowledge Base article 841290, Availability and description of the File Checksum Integrity Verifier utility.
• If you need to collect physical evidence, include a digital camera in the toolkit.

In addition, ensure that your toolkit meets the following criteria:

• Data acquisition tools are shown to be accurate. Proving accuracy is generally easier if you use well-known computer forensics software.
• The tools do not modify the access time of files.
• The examiner's storage device is forensically sterile, which means the disk drive does not contain any data, before it is used. You can determine whether a storage device is forensically sterile by running a checksum on the device. If the checksum returns all zeros, it does not contain any data.
• The examiner's hardware and tools are used only for the computer investigation process and not other tasks.

Worksheets and Samples

The following table provides a list of worksheets and samples you can use during your computer investigation. Some of these resources are available as separate Word documents, and are included in the Microsoft Download Center file from which you extracted this guide. Others are available through a link to the Web site of the National Institute of Justice.

Table A.1. Worksheets and Samples

Reporting Computer-Related Crimes

 Note    Much of the information in this section is from the Reporting Computer, Internet-Related, or Intellectual Property Crime page in the Computer Crime & Intellectual Property Section of the United States Department of Justice Web site.

You should first consult with your legal advisors to determine whether it is necessary to report specific computer-related crimes to appropriate authorities at the local, state, federal, or international level, depending on the scope of the crime. Most likely, your local or state authorities would be the first ones to contact. If it is a computer-related federal crime, then you might need to report the crime to local offices of federal law enforcement. As noted earlier, this guidance is only intended for use in the United States.

United States law enforcement agencies that investigate Internet-related crime include the following:

• Federal Bureau of Investigation (FBI)
• United States Secret Service (USSS)
• U.S. Immigration and Customs Enforcement (ICE)
• U.S. Postal Inspection Service
• Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF)
• U.S. Drug Enforcement Administration (DEA)

These agencies have offices throughout the United States, and contact information is available in local telephone directories or through Internet searches. Generally, federal crimes can be reported by telephoning the local office of an appropriate law enforcement agency and requesting the Duty Complaint Agent. If the organization has joined the Electronic Crimes Task Force (ECTF), InfraGard, or the International High Technology Crime Investigation Association (HTCIA), then the appropriate contact person may already be known. Contacting someone who is known and knows your organization simplifies the reporting process.

Many agencies have trained agents who specialize in computer hacker cases.

Local Law Enforcement Agencies

In some situations, the best choice is to contact a local law enforcement agency. Such agencies or high technology crimes task forces might have trained personnel who can investigate an incident. Agencies that have trained personnel include the REACT Task Force, which serves the San Francisco Bay area, the CATCH Team, which serves the San Diego region, and other police agencies.

Information in the following table can help you determine which federal agency to contact for certain types of crime.

Table A.2. Law Enforcement Agencies for Different Types of Crime

Training

Have at least some incident response team members attend formal computer investigation training. Without relevant training, it is unlikely that the team will be effective in the investigation. In fact, unskilled examiners could negatively affect the investigation by accidentally destroying volatile evidence.

For a list of nonprofit agencies, organizations, Federal law enforcement agencies, and academic institutions that provide computer forensic training, see "Appendix G. Training Resources List" in Forensic Examination of Digital Evidence: A Guide for Law Enforcement by the National Institute of Justice, an agency of the U.S. Department of Justice.

Tools

Every investigation will likely be different. The tools you use should be appropriate for obtaining the information you seek, but it is always a good idea to gather more evidence than you might need.

This section provides information about the Windows Sysinternals tools and other Windows tools that can help you conduct an internal computer investigation. Tool types are represented by icons in the first column of the following table:

Table A.3. Tool Types

The following tables provide information about numerous tools that you can use in computer investigations.

Windows Sysinternals Tools

Table A.4. Windows Sysinternals Tools Information

Windows Tools

Table A.5. Windows Tools Information