An Ontology for Digital Forensics in IT Security Incidents - OPUS

16 CHAPTER 4. FORENSICS
Basic rules how to correctly examine cases are listed in [Kruse and Heiser,
2001]. The guidelines in [National Institute of Justice (U.S.), 2004] demand
similar precautions including:
• One should acquire the evidence without altering or damaging the
original data.
• It has always to be provable that the data where evidence is found is
the same as the original one and has not been modied during analysis.
• Every step needs to be documented to prove a complete chain of custody.
Digital forensics has three phases according to [Carrier, 2003]:
1. Acquisition
2. Analysis
3. Presentation
In phase one the data is collected. In phase two this data is analysed to nd
pieces of evidence. The ontology belongs to the analysis section as it gathers
the information collected in the acquisition phase and simplies the detection
of evidence. The third phase diers depending on where the evidence are
used. The evidence need to be presented in another way if used in a case
before court, in a corporate investigation or anywhere else.
In [National Institute of Justice (U.S.), 2001] electronic devices to look
for data are presented and the kind of evidence that can be found there.
Additionally caveats are mentioned that concern the retrieval or the storage
of the data. Furthermore procedures for the handling of these devices are
explained in order not to destroy or tamper evidence.
For investigating a case the examiner will rst take a snapshot of the
computer. This is useful as the original data can stay unchanged and makes
it easier to prove the consistency to the snapshot if required in the course
of the case. In most cases the snapshot contains hard disk and random
access memory data. These snapshots are often called dumps, images, or
samples. This can be compared to taking pictures and other samples of a
crime scene.[Carrier, 2003]
If taking the snapshot from a running (live) system one problem is that
it can hardly be granted that the snapshot is taken at a specic point in
time. In particular it means that the data is possibly being changed while
the snapshot is being taken. As the system is running, programs can change
data. Additionally it takes time to take the snapshot and in this time the
data already read and to be read might change so that the snapshot is not
consistent. Furthermore, if a program writes to the memory where the tool
for retrieving the snapshot reads, it can tamper with the integrity of the