MyCERT 3rd Quarter 2011 Summary Report - CyberSAFE Malaysia

6Based on the statistics, there was a20% reduction in numbers compared toprevious quarters. This is might due to theestablishment of digital forensics laboratoryby some LEAs, for example PDRM’s ForensicCheras Facility and the MACC facility. Whenit involves high profile cases, these LEAsnormally will be referred to by the DFD.In doing so, these LEAs can validate theirfindings by having a trusted second party tocarry out the necessary analysis. This is alsoproof that the LEAs practises impartiality.Most of the LEAs and RBs were trained byDFD’s professionals. This would indirectlystrengthen the cooperation between thetwo sides enable the sharing of expertise intheir respective fields. The establishment ofdigitals forensics labs by LEAs showed thatour aim to empower our LEAs has started toproduce results. DFD can now focus moreon cases which requires more technicaland advance technology. This type of casesneeds more in-depth research since thecriminals are more IT savvy and more up-todatetools are used.Data Recovery Case StatisticsData recovery is the process of salvagingdata from damaged, failed, corrupted,or inaccessible secondary storage mediamediums when it cannot be accessednormally. Often, data is salvaged fromstorage mediums such as internal orexternal hard disk drives, solid state drives(SSD), USB flash drives, storage tapes, CDs,DVDs, Redundant Array of Independent(or Inexpensive) Disks (RAID), and otherelectronics storage mediums. Recovery maybe required due to physical damage to thestorage device or logical damage to the filesystem that prevents it from being mountedby the host operating system.Another scenario involves a disk-levelfailure, such as a compromised file systemor disk partition or a hard disk failure. Inany of these cases, the data cannot be easilyread. Depending on the situation, solutionsinvolve repairing the file system, partitiontable or master boot record, or utilisinghard disk recovery techniques ranging fromsoftware-based recovery of corrupted datato hardware replacement on a physicallydamaged disk. If hard disk recovery isnecessary, typically, the disk itself has failedpermanently and the focus is rather on aone-time recovery, salvaging whatever datathat can be read.In a third scenario, files have been “deleted”from a storage medium. Theoretically,deleted files are not erased immediately;instead, references to them in the directorystructure are removed, and the space theyoccupy is made available for overwriting.In the meantime, the original file may berestored.Figure 3 shows the breakdown of casesreceived under Data Recovery (Jul-September2011) from Public, Private and GovernmentAgencies in Quarter 3 of 2011.Figure 3: Breakdown of cases received by Sector under DataRecovery (Jul-Sept 2011)It can be concluded that cases receivedfrom the government sector constituted thehighest majority with 16 cases, followedby the public sector with nine cases andthe private sector with two cases. Effectivefrom October 2011, Data Recovery serviceswill be taken over by CyberSecurity Clinics.CyberSecurity Clinic is another initiative byCyberSecurity Malaysia with the aim to helpe-Security | Cyber Security Malaysia | Vol: 28-(Q3/2011)© CyberSecurity Malaysia 2011 - All Rights Reserved