SANS Digital Forensics and Incident Response Blog: Author - benjaminwright

Cloak Your Incident Investigation with Confidentiality

Summary: When an enterprise investigates a data security incident, it is often wise to involve legal counsel early. Counsel may be able to ensure the details of the investigation are kept confidential by law. Infosec Law and Politics Are Dangerous. The law and politics surrounding data security are highly adversarial. Legal and political adversaries have … Continue reading Cloak Your Incident Investigation with Confidentiality


Undercover Agents Record Social Media Evidence

How should investigators record fast-changing online evidence, such as social media? Case in point: The Mercer County (New Jersey) Prosecutor's office followed hundreds of street gang affiliates on Myspace. How did it do that economically? Instead of using seasoned, highly-trained police investigators, it commissioned a team of mere interns. The interns, acting as undercover agents, … Continue reading Undercover Agents Record Social Media Evidence


Cloud Investigation

Narrated Screencast Assures Investigator's Personal Accountability The collection of cloud evidence vexes investigators, whether they be police, auditors or consumer watchdogs. As more and more social and commercial interactions occur in the Internet cloud, new methods are needed for proving what happened. Traditional digital forensics emphasizes an investigator gaining access to data stored on a … Continue reading Cloud Investigation


Using Investigator Video as Evidence in Court

On this blog I previously published ideas for capturing cyber investigation evidence, such as evidence showing what a hyperlink on the web does at a particular point in time or evidence showing what a dynamic web page displayed at a given moment. I demonstrated a split-screen video, where the investigator records his words and … Continue reading Using Investigator Video as Evidence in Court


How to Preserve Cyber Investigation Evidence | Screencast Tool

Witness Signature Commonly, a cyber investigation examines how a digital resource - like an app, a hyperlink or a web search box — works. Example: Investigator observes that when mouse clicks on hyperlink X, browser goes to web page containing content Y. As an investigator observes how a resource works, he wants to record … Continue reading How to Preserve Cyber Investigation Evidence | Screencast Tool