Evidence/Investigation
Name the first 2 steps in Evidence Lifecycle
1. Discovery
2. Protection
3. Recording
A real-time mirror of your system and network activity
running in sync. Allows for minimum disruption and
downtime.
Hot Site
What is RAID
Redundant Array of Independent / Inexpensive Disks
All files backed up, archive bit and modify bit will be deleted
Full
1. Detect • 2. Respond • 3. Report • 4. Recover •
5. Remediate • 6.Review
Incident Response steps
Collect facts to determine matters of the incident.
Interviewing
An alternative workspace with power and HVAC setup, but no hardware. All recovery efforts will be technician heavy.
Cold Site
Writing the same data across multiple hard disks, slower as data is written twice, doubles up on storage requirements
Disk Mirroring
Backup files changed after last full backup, archive bit deleted
Incremental
• Data Purging: degaussing Archived data not usable for forensics
• Data Clearing: Cannot recover using keyboard
• Remanence: Data left in media deleted
Sanitizing and Disposing of Data
Reasonable facts, with proof of crimes, acts and methods used, event documentation
Relevant
A middle-ground solution which includes skeletal hardware, software and connectivity to restore critical functionality.
Warm Site
Writes data across multiple disks simultaneously, provides
higher write speed.
Disk Striping
Only modified files are backed up, do not delete archive bit. Need last full backup and last incremental backup for a full restore.
Differential
The management of change and development within a business or similar organization.
Change Management
Obtain a confession by evidence retrieval method.
• The Process: Prepare questions and topics, summarize information
Interrogation
Who does an organization contract with a to provide backup services
Service Bureau
Typically use Fibre Channel and iSCSI. High speed block level storage.
Storage Area Network (SAN)
Adding servers for increased fault tolerance.
Redundant servers
Any non-redundant part of a system that, if dysfunctional, would cause the entire system to fail.
Single Point of Failure (SPOF)
What are the four Characteristics of Evidence
Sufficient Reliable Relevant Permissible
What is RTO
Recovery Time Objective
Typically an NFS server, file-level computer data storage server connected to a computer network.
Network-Attached Storage (NAS)
Set of servers that process traffic simultaneously
Server clustering
Management of investments on behalf of others
Access Management