Among my favourites are:

- Follow the Golden Rule. Assume that the personal information and photos you display are available to everyone and anyone, not just to your friends.
-To protect children from online predators, do not post a child’s name in a photo tag or caption. If someone else does, delete it if you can, or ask the member who owns the photo to remove the name.
-Do not mention being away from home. Doing so is like putting a “Nobody’s Home” sign on your front door. Be vague about the dates of your travel plans and vacations.

For more please visit the SANS site.

The whitepaper recommends using screen capture video recording software called Camtasia by Techsmith. I have limited experience with this particular software but have used other freeware and video capture services for similar purposes. I have used Techsmith`s Snagit product before and I have had good luck with it.

The whitepaper also suggests using Video Downloadhelper, a Firefox extention to capture videos. I’ve used this app for a long time and like it a lot; however, some people prefer commercial products and there are those which are not free but are quite reasonalby priced, such as SWF Toolbox and RealPlayer Plus. I particularly like the SWF Toolbox for the additional functionality, but Realplayer Plus is a well known brand and some people take comfort in that.

There are a couple of key points to take from the white paper which I think are worth highlighting:
- Make sure you record the audio files separately
- Make sure you capture the video files separately
- Make sure you capture the HTML code by either opening up the source code through “View Source” or by saving a copy of the web page. The white paper suggests that it is important to do because the HTML would show any hidden trackers or code that might not show up on the rendered web page; and because a person who is competent in HTML could recreate the page with the appropriate tools (a variation the old “a competent person with the same information would reach the same conclusions argument”).

I also believe however, that it is important to capture the HTML for a variety of other reasons. Not least of which is to find out the original source of referenced material. Embedded keywords in headers can also help demonstrate mens rea. I put these here to attract a certain type of traffic from search engines (i.e. search engine optimization, a kind of marketing), therefore I knew what I was doing when I posted these fake identity cards for sale on line……and so the argument goes.

The white paper is aimed at MySpace, but given the fact that social media is so prolific, and because just about every kind of webpage can contains just about every kind of content the points could be applicable to most forensic Internet investigations.

There are a few areas that the white paper could have addressed, although to some they may be obvious. First, the investigators notes should reflect what he or she is doing and how they arrived at where they did. This includes things like the search terms they used, when they conducted the research, etc. A Google search on Monday may not provide the same results on Friday, but at least it should be clear to observers that when the search was done these are the results which were provided.

Second, a video is nice, and you can certainly take stills from a video to put them in your report, but I also like to produce pdfs of webpages. These work well in written reports.

Third, there is the issue of non-repudiation for the evidence you collected. Creating a checksum all of the information you obtain and then burning everything to a DVD and closing the session is a good idea. I`m using a DVD-R as an example, but I`m technology neutral. An encrypted flash drive or SD card or whatever else you prefer would also work.

Some of these principles are discussed further in Vere Software whitepaper “Collecting Legally Defensible Online Evidence.” I`ve blogged about this before and I think it is also good, basic reading.

Last but not least, the speed at which you capture information is important. You don’t want to go through a lot of effort to record things and then end up producing a video that is blurred. Editing can clean up the video a little bit but it is a huge time consumer and you cannot over edit lest your video be rejected as investigators should be aware of this constraint and move slowly if they are going to capture their sessions by a screen capture.

I’d also recommend that readers check out the other great publicly available whitepaper that is on the Search.org website for doing Internet investigations called “Setting up an Online Investigative Computer: Hardware, Connectivity and Software Recomendations”. It was written in 2004 so some of the specifications are a little old, but the principles are still relevant.

In my view the technology is going to keep evolving and because of this we must stay grounded in the basics. Improving searching by using semantic search techniques that understand natural language is fine, but it is still searching and we must be able to explain how we arrived at the results we did. Social networking sites, virtual worlds and so on are all interesting and important; and evidence will exist in these places, but just like the old school chatroom, they are all just tools for communicating in different ways.

Ours is to know the principles and evolve the processes for the new technologies.

I found that Chapter 15 “The Dark Streets” (of Twitterville) to be particularly interesting.

For more information on some Twitter advanced research techniques you can check out this blog post.

On August 10, 2010 we’ll be having a discussion on SCADA attacks, so mark your calendars for that one as well.

After our summer format program has concluded we launch into the annual three-part case study. This year’s topic is IT Security Mobilization Units – A Case from the Field. It promises to be very cool, with an interactive discussion around the use of live forensics to conduct real-time investigations by mobile rapid Computer Incident Response Teams (CIRT) in some highly challenging environments. As always attendees are encouraged to engage and discuss this evolving topic. The dates for these events are: September 14, 2010, October 12, 2010 and November 9, 2010.

The November 9, 2010 meeting will also include our Chapter’s annual general meeting where we hold elections for the next year’s board. For those who are interested in participating in the board level of the Chapter, this is a good time to start thinking about how you would like to become involved.

Of course if it is a YouTube video there is usually the YouTube logo in the bottom right, so that solves part of your quandry, but this solution will deal with locating both where the video was posted and who posted the video.

The Solution: It should be said upfront that this solution likely has an expiry date since YouTube, Vimeo, etc. change their coding every so often. That being said, this has been working for the last two years at least.

First, open the source code of the web page you’re viewing. My preference is to use the “View Selection Source” on Firefox; however, the view page source function in Explorer will also work.

Second, using either your own scrolling or the Find Function (“Cntrl F”) search for the common “src=” line which will be immediately before the link to the video.

Third, look for the video id which will be the string of alpha-numeric numbers after the http://www.youtube.com/v/ and before the & (ampersand) in the case of YouTube posts. In the case of the previous Evince Blog post “Copyright Battle” posted on June 30th, 2009 where a video was posted from YouTube the string is: http://www.youtube.com/v/PhSnQbflg2A&hl=en&fs=1&rel=0 so what you are looking for is the PhSnQbflg2A .

Note: You now know the source site where the video was streaming from.

Alternatively for steps one to three you can identify the video id by using the “copy embedded html” function on the right click menu when you hover over the video posted on the blog. Then paste the html code on a word document and the video id will be fairly apparent.

This is the embedded html for the previously mentioned video on Copyright battle. You can click on the image to view the code alone.

Note: the video id appears after both “value=” and “src=”.

Finally, conduct a search using the video id on Google (or other search engine) or YouTube itself (or the other video posting website you believe the video is from). That should lead you to find the page where the video was posted and hence to the original poster of the video. You can use the inurl: function although I have found my success with that approach to be inconsistent.

If anyone has any suggestions on how to improve this strategy, or other methods of accomplishing the same thing, please let me know.

The speaker will be Webster Pilcher, Regional Manager for Digital Investigations and Electronic Discovery at Clearwell. The topic will be Digital Investigations and Forensic Evidence Gathering.

This centre of excellence approach looks like it has real potential and I’m looking forward to seeing what research products and training emerge in the coming years. It would also be interesting to see if they partner with any universities to offer Masters level degrees given that the training is likely to be fairly specialized.

For more information visit their press release.

In order to foster innovation, the culture of a university environment must support the principles of academic freedom and the sharing of information. The traditional principles of IT security (e.g. control of information assets) are often directly opposed to this concept. This presentation will examine the unique issues and challenges associated with managing? IT security in the University environment, and will also discuss the non-traidtional approaches that must be employed to improve IT security in a University.

The speaker will be Jamie Campbell, CISSP, Manager of Information Security and Operating Platforms at Carleton University. We’re very much looking forward to having Jamie speak.

Even if you are unable to come to see Jamie speak on March 2, 2010 please drop by the new HTCIA Ottawa website to check out the new look and feel. I think you’ll agree that the design and implementation team did a great job!

Bruce is an excellent speaker and I would encourage anyone in the Ottawa area who is interested in technology security and investigations to join us at the event.

Creating a Time-line in Excel

I have identified two sources for this. First if you’re working on an older version of Excel you can use the templates at Vertex42 LLC or Mr. Excel.

If you are using a version of Excel that is the 2007 or later, you can use the template that is included in the software. For a tutorial on the function there is one available on the Microsoft website.

Link Analysis in Excel

There are a couple of ways of doing this. The simplest way is to set up a spreadsheet with set of columns that reflect things such as Person/Entity Name, Address 1, Address 2, City, Province/State, telephone number, fax number, etc. After you have populated your worksheet you can then use the Pivot Table function to see the links that may exist for example, it might identify entities that share the same fax number or address.

The Pivot Table function is found under the Data menu and although it does not provide a graphical representation (it is text/chart based), it still effective to identify links between contact points. There is commercial software available that will do a much better job of providing graphical representations of link analysis charts but on simple files or if you are on a budget that does not allow you to purchase more expensive software this solution can help.

The key is to ensure that your data is entered in exactly the same format. For example if you are entering phone numbers you must choose between the format (xxx) xxx-xxxx and the format xxx-xxx-xxxx (without the brackets on the area code). You cannot do some data entry in one format and some in the other or the pivot table will not identify the links.

In order to achieve this consistency you may wish to create sub-lists on other spreadsheets linked to drop-down menus in your main sheet. This is accomplished using the Validation function in Excel which is also under the Data tab.

One solution which I have not yet had the opportunity to test is called NodeXl which is a graphical link analysis tool built on top of Microsoft Excel. I have come across a few references on the web from sources which I regularly review, including Analysts Corner and http://www.kdnuggets.com/software/social-network-analysis.html.

Comparing Two Lists

Ever have to compare two lists of items, such as a list of vendors or a list of social network friends to see if a value exists on both lists? Check out the post on IACA Analyst Toolbox site’s by an individual named Michael Chesbro. The formula in the output column is: =VLOOKUP(A1:A10,$D$1:$D$7,1,FALSE).

You can add some conditional formatting on your output column to make the results of interest a little more vibrant.

The Find Function

This is about as simple as it gets but so very helpful. You access this function by pressing “Ctrl f”. A search box will appear that lets you search through your spreadsheet (or workbook) for a specific term. For example if you have a list of vendors in a spreadsheet and you need to see if “bad guy co.” is on your list of vendors, this is the function that you need. It is not all that useful in small lists because you can manually scan the list faster than using the function.

Another example is when you want to see how similar terms are used across multiple spreadsheets within a work book. Say for instance that you are aware that a specific payment of interest is called “fundraiser”, you may search through the entire workbook for other payments labeled “fundraiser” to see where they appear. To do this you simply hit Ctrl F, click on Options and select “within workbook.”

The caveat here is the same as the caveat on many of the other tips provided. Your data format must match the format of the entries in the worksheet or you are not going to necessarily find what you are looking for (pardon the pun).

A work-around for this is using only a part of the search term which you are likely to find included in your source data. Rather than searching for “bad guy co” which may be listed as “badguyco” or “thebadguycompany” on your list of vendors, you may just want to search for the term “guy” (without quotes of course).

Separate Terms

If for whatever reason you need to separate whole terms into separate parts which is called parsing, the “Text to Columns” function under Data on the toolbar is very useful.

For example, let’s assume that you imported some HTML code into Excel from a website you were reviewing. After sorting a few different ways you end up with a series of rows that look something like:

Column A

id=abcd
id=defg
id=lkjl
id=lkjn

For your analysis you would like to use only the id values rather than including the “id=”. To do this simply access the Text to Columns function, click other and put the equal sign in the “other” space provided. This would end up producing the following:

Column A
id
id
id
id

Column B
abcd
defg
ikjl
lkjn

Other sources

If you are a Certified Fraud Examiner and you’re interested in learning more Excel tips and tricks I would also suggest that you review the “Fear Not the Software” articles from various issues of Fraud Magazine. The articles are written by Richard B. Lanza (and occasionally other contributors) and are very insightful.

Mandatory Disclaimer: Evince Services, Inc. is in no way related to Microsoft, but Excel is a commonly used software and therefore a possible low-cost solution for some reader’s problems. NodeXL®, Excel® and Microsoft® are registered trademarks of Microsoft Corporation. Mr. Excel® is a registered trademark of Tickling Keys, Inc.