Webinar: Where DF meets IR: an incident response case, which turned out to be a criminal one
This webinar walks through a case of corporate incident response that escalated into a criminal investigation. It shows how a digital forensics and incident response (DFIR) team investigates suspected data theft. Topics covered include deploying acquisition agents across multiple offices, analyzing Windows artifacts, and uncovering malware delivered through a weaponized USB drive. Although the case is fictional, all of the methods demonstrated are real and applicable to actual investigations.
What is the difference between digital forensics and incident response
Incident response involves detecting, containing, and recovering from an active security incident. Digital forensics is the process of preserving and analyzing evidence in a legally sound manner. The two processes overlap when an incident requires an investigation. As this case shows, an incident response investigation can reveal evidence that transforms an incident into a criminal forensic case.
The incident response phase
The webinar demonstrates several incident response techniques used in a live corporate environment:
- Deploying acquisition agents across a Windows domain using Group Policy Objects (GPO), without visiting each machine, is practical when a company has offices across the country
- Targeted acquisition of specific file types instead of full multi-terabyte disk imaging, to avoid disrupting a live corporate environment
- Live memory acquisition, which matters when drives are encrypted with BitLocker
The digital forensics phase
The forensics phase demonstrates how the team built a case from Windows artifacts:
- Running OCR on scanned PDF documents to make image-based text searchable (50+ languages supported)
- Tracing documents back to the specific computers they were found on
- Using jump lists to prove a sensitive document was opened from a thumb drive, including drive label and timestamps
- Identifying a suspicious recently created local user account on a domain machine as a sign of compromise
- Correlating Windows event logs and the registry to map a security identifier (SID) to a human-readable username
- Detecting persisting malware in memory with a free RAM capture tool
- Using volume shadow copies as point-in-time snapshots to narrow down when files appeared on a machine
- Reconstructing activity with a forensic timeline
Additional methods relevant to such cases
- Triage for fast identification of relevant data
- File and data carving for deleted, hidden, or relocated evidence
- Native SQLite analysis, including damaged or fragmented databases
- Remote connection (RDP) trace analysis
Presented by
Elena Mishkareva, Digital Forensics Specialist at Belkasoft.
Who should watch
Corporate security and incident response teams, law enforcement investigators, DFIR analysts, and anyone who needs to understand how a corporate breach investigation is conducted end to end.
FAQ
What is the difference between digital forensics and incident response?
Incident response focuses on detecting, containing, and recovering from an active security incident. Digital forensics focuses on preserving and analyzing evidence in a legally sound way. An incident response investigation can uncover evidence that turns it into a criminal forensic case.
Can you investigate a corporate breach without full disk imaging?
Yes. In a live corporate environment, targeted acquisition of specific file types or artifacts is often more practical than full disk imaging, which requires large storage and can disrupt operations.
How can you tell if a computer was compromised?
Indicators include recently created local user accounts on domain machines, unexpected services running, malware persisting in memory, and unusual artifacts such as a sensitive document opened from an external drive.
How can you find out when files were copied to a computer?
Volume shadow copies act as snapshots over time. Comparing a snapshot that does not contain a file with one that does lets investigators narrow down when the file appeared.