Download - Foreign Military Studies Office - U.S. Army

each element is a standard way of fleshing out the activities and, perhaps, even
the intent of the crime. In cyberspace, this is a little bit more difficult because a
suspect can be miles away from the scene. Still a useful tool for a forensic
examination of a computer system is a timeline analysis. A timeline analysis
includes important files or data obtained from the physical and logical level
analyses, users and dates, and times of computer usage, file creation, file
deletion, or file changes that might pertain to the case. It is imperative to know
who created or downloaded a file of information with value to the computer
being analyzed, how it got there, and when it got there. Many case types benefit
from this type of analysis, such as intrusion cases, fraud cases, and plagiarism
cases.
Login logs, audit logs, system logs, and dial-up logs may provide
additional information for this type of analysis. Intrusion cases are especially
dependent on the sequence and timeline analysis of events. System logs include
Intrusion Detection System (IDS) logs, web application logs, firewall logs,
router logs, operating system logs and other application logs. The file attributes
that an operating system’s file system stores about a file can include such
important timeline items as file creation date (when a file was created), file
modified date (the last time it was changed), last file access date (last time that
file was opened or viewed), and last archived date (last time the file was backed
up or archived). An example would be a co-conspirator of a hacker who broke
into a computer card site. A timeline analysis could show when the subject
acquired the information as, for example, an attachment to an email from the
original hacker. This type of information may help make the case to prove that
the subject was part of the crime and decided what to do with the information.
Perhaps the file was attached to another email and sent out to another coconspirator
as proof of his hacker buddy’s “work well done.”
2. Technology Used in Network Forensics or Investigations
Today many crimes have associated network data that can be used as
evidentiary information. If a crime is committed at work, the Local Area
Network (LAN) can offer additional information. An example of this is an
individual who uses a workplace computer to download or upload pornography
from the Internet, communicates with others about uploading and downloading
pornography, or uses the Internet chat rooms to converse about illicit sexual
conduct. The network file server could contain some of the images if the
worker used his network home directory or perhaps the public areas of the file
server’s disk to place some of the evidence. The network server probably has
logs regarding when the worker’s account was logged in, and it may also
contain the download records of what account downloaded what file and from
where. This type of evidence would be obtained from the servers on the
network and not the worker’s computer. Other areas on the network that may
324