“I suspect they've copied my database - what should I do?”
if you suspect a computer has been used during an intrusion or other incident that you've been tasked with looking into you need to make sure the steps you take won't destroy or spoil any electronic evidence that has been left behind.
One of the first things you need to do is calmly take stock and consider exactly what actions should follow. Unless your systems are currently under attack, it's unlikely that an additional ten minutes will significantly alter the outcome of the investigation. Use this time to set out a plan of action - this will really help you stay focussed and ensure that you carry out tasks in the correct order at the right time. It will also help you prepare any post incident report that you may need to present later.
The fewer people who know about the investigation, the better the chances of a successful outcome. Don't say or do anything to give the game away and don't tell anyone who doesn't have a direct need to know. In the early stages, this may include the owner of compromised data. More often than not, fraud and data theft is perpetrated by trusted individuals within the organisation who hold senior positions. Always hope for the best but assume and prepare for the worst.
The data helpful to your investigation may be spread across several systems and on different media - consider:
With most media like USB devices, simply sealing them in a plastic bag is sufficient to ensure that the data cannot be tampered with prior to copying and analysis by a forensics expert. The devices should be seized and stored in a secure locked place under your control.
Computers themselves are less straightforward.
Guidance on this topic has changed in recent years - simply switching off a computer may render the data on the disk inaccessible or destroy vital evidence like open documents, unsent email and memory resident malicious code.
The nature of the incident will have a significant bearing on what should be done. If vital evidence is in memory, then just switching the computer off will destroy this. If the computer is being controlled by an intruder who is attacking your systems from outside, then switching the computer off will warn the attacker or potentially destroy information relating to the attacker's location. If the attacker is actually copying critical or confidential information from your network, then you may have no option but to terminate their connection. Network information or encrypted malicious code stored in memory is irretrievably lost when the computer is switched off. In such a case it is helpful to simply remove network, broadband and other communications cables to ensure the flow of data is interrupted but that the evidence is preserved.
In the event that the computer's hard disk is encrypted with a password known only to the user or owner of the computer, then switching it off may mean this data cannot be accessed or analysed later.
There is no generally right or wrong answer and each case must be decided on its merits. If you're unsure what to do, call us at the number above for no-obligation, confidential and free advice about the best way to proceed.
If the computer is off, leave it off - do not switch it on.
Once again, if you're unsure what to do, call us at the number above for no-obligation free confidential advice about the best way forward.
If the computer is switched on and running, depending the likelihood of evidence being in memory or the computer hard drive being encrypted, either:
If you think there is a possibility that the hard disk is encrypted or that a running computer has been compromised by malicious code, then you absolutely should consult a forensic expert to image memory and any encrypted data. Time is critical in these situations as data will be purged from memory as a normal part of computer's operation and log files will be over-written, either deliberately by the intruder or naturally. Consider removing the network cable and/or disabling any wireless/Bluetooth if the computer holds critical or sensitive information.
Don't forget digital and relevant evidence is located in more than just the computer - decide if it necessary to seize or forensically image USB devices, digital cameras, digital voice recorders, external hard drives, post-it notes containing passwords, CDs, home directories and profiles on file servers, event logs on network logon servers, door access logs, CCTV, firewall logs, Internet proxy servers and many other devices - if in doubt call us at the number above for no-obligation free confidential advice about the best plan of attack.
If the subject of the investigation does not know he/she is being investigated keep it that way. In this case, consider covert forensic imaging - the process of making a copy for analysis without the user being aware.
Well intentioned IT departments have been the cause of many cases collapsing very early on as they lack the specific training required to preserve the very fragile data. The evidential chain is also very important here. In the event your incident ever gets to an industrial tribunal or court, then the court will want to know who had access to the exhibits and what changes they may have made. Cases have been won and lost on this point alone.
We can have a forensic analyst on-site, anywhere in the UK within 12 hours of the initial call.
We have the expertise, experience and tools to help you navigate an investigation and emerge on the other side with a clear understanding of what happened and why.
Either telephone us at the number above, or send us a note by email and we'll respond straight away.