[Day 2] 1. Incident Response Plan

There are five steps that are followed in the IRP:

1. Preservation:

   • Secure the crime scene: Ensure no digital equipment is removed from the area.
   • Take backups of all storage devices before beginning any analysis.
   • Tag every piece of evidence systematically.
   • Record cryptographic hashes (e.g., MD5 or SHA256) for portable storage devices like pen drives.
   • Preserve system logs:
     • Logs are often overwritten using FIFO (First In, First Out) by default. Adjust settings to create new log files once a maximum size is reached.
     • Store logs at multiple locations (e.g., a syslog server) to prevent loss even if attackers attempt to delete them.

2. Identification:

   • Determine what to investigate based on the nature of the compromise:
     • For instance, if a fake Facebook profile is created, check the browser history.
     • If a file is deleted, investigate user login activities and executed commands.
   • Relevant files to check:
     • Copy

       .bash_history

       for user command history.
     • Copy

       auth.log

       for authentication and login records.
     • Note: Deleted commands from
       Copy

       .bash_history

       can still be found in
       Copy

       auth.log

       .

3. Extraction:

   • Extract the identified information while meticulously recording the process.
   • Ensure every step of the extraction is documented for legal admissibility in court.
   • Record tools used, steps taken, and capture screenshots throughout the process.

4. Documentation:

   • Maintain detailed records from the first step to the last.
   • Include:
     • Screenshots.
     • Permissions of files.
     • Timestamps.
     • Every activity or check performed.
   • Proper documentation ensures reliability and accuracy during investigations.

5. Interpretation:

   • Use the documentation to interpret the data and build a clear understanding of the case.
   • Thorough documentation is critical to prevent misinterpretations and ensure accurate conclusions.