Attachment_11_-_IT_Forensics_and_EDiscovery_Plan_Template.pdf

Revised 12/8/2014 1 v2.27

IT FORENSICS & EDISCOVERY PLAN

Execution Date:

1.0 SCOPE

1.1 Purpose. The Division of Enforcement, U.S. Securities and Exchange Commission (SEC) requires onsite technical and forensic support of .

1.2 Program Point of Contact:

1.3 Assigned Storage Device(s) or Computing Device(s): Estimated Quantity:

1.4 Sub-Contractor Contact Information (if applicable):

1.5 Site Location and Point of Contact (Site location details to be provided under separate cover):

1.6 Primary IT Forensics Point of Contact (Forensic Analyst):

1.7 Secondary IT Forensics Point of Contact (Team Leads):

1.8 Primary Point of Contact for all Deliverables (Evidence Custodian):

1.9 Secondary Point of Contact for all Deliverables (Lab Manager):

1.10 Prime Contractor Point of Contact:

2.0 ASSUMPTIONS

2.1 Contractor shall have completed and submitted an individual Non-Disclosure Agreement for all parties involved in the performance of this work prior to commencing work.

2.2 The Contractor shall identify, inventory, and confirm accessibility to the item(s) contained in 1.3 upon arrival at the worksite where the Electronic Stored Information (“ESI”) and Electronic Storage Device(s) (“ESD”) are located. The Contractor shall immediately notify the party identified in 1.6 or 1.2 should any issues arise barring execution of work contained herein.

Contractor shall not interfere in the conduct of business of the entity.

2.3 Contractor shall inventory, image encryption key(s), record passwords, and provide credentials necessary to decrypt documents associated with the item(s) identified in 1.3. If software

Revised 12/8/2014 2 v2.27 encryption keys are stored locally on the same device being imaged in 1.3 then production of such keys shall be considered delivered upon independent and successful verification of the forensic image(s).

2.4 The Contractor shall contact the party in 1.7 in the event the party in 1.6 is not available.

2.5 Sample forms are attached and should be utilized in documenting the work. Contractor is permitted to use exemplar forms provided the requisite information is provided. Additional copies of the attached forms are available upon request from parties identified in 1.2 and 1.6.

3.0 REQUIREMENTS

3.1 Examiner Qualifications

Each Contractor performing the work outlined in this document shall possess at least one of the following certifications:

EnCase® Certified Examiner (EnCE) Certified Forensic Computer Examiner (IACIS® CFCE) Seized Computer Evidence Recovery Specialist (SCERS)

In addition, each Contractor imaging a handheld device shall possess at least one of the following certifications:

Certified Cellebrite® UFED Mobile Device Examiner Mobile Forensics Certified Examiner (MFCE) Paraben® Certified Mobile Examiner (PCME)

The Curriculum Vitae (CV) for each Contractor employee performing the work outlined in this document shall be verified by Contractor management and submitted with the final proposal. The Contractor can substitute equivalent experience and/or training in lieu of the preceding certification requirements by requesting a waiver from the party identified in 1.2.

3.2 Resources

The Contractor shall provide adequate resources and bring to the worksite all equipment necessary to timely and properly perform the forensic preservation of ESI, ESD, and/or computerized information system(s) (“CIS”). The Contractor identified in 1.4 shall make available proof and documentation of software and hardware validation including but not limited to test standards and results for tools utilized for the work contained herein. The Contractor identified in 1.4 shall utilize only software and hardware that has been successfully validated in accordance with Contractor testing protocols, consistent with ISO 17025, and meet SEC acceptance. All imaging software utilized by the Contractor shall have been specifically developed for the forensic preservation of ESI, ESD, and/or CIS.

At a minimum, and upon request, the Contractor shall provide (1) Qualifications of personnel performing the validation, (2) Qualifications of approving authority, (3) Summary of validation plan, and (4) Name and description of assertions utilized and test script used for each assertion.

At a minimum, test assertion reports must include the following (1) Test Date, (2) Person Performing Test, (3) Assertion or Purpose, (4) Instrument/Tool, Calibration Type, (5) Verification or Exceptions. (6) Impact Statement, (7) Relevant Comments. (8) Pass/Fail, and (9) Signatures.

3.3 Imaging.

http://www.google.com/pagead/iclk?sa=l&ai=B-UIhvbRORI38BoHwwQKZ09WwArfGzBHhz-O4Abai9wSw6gEQBhgGIKVOKAYwAUicOVDq7uvM-_____8BoAGIkYf_A6oBEGNvbWNhc3RwY19wb3J0YWzIAQGVAihgUAo&num=6&adurl=http://www.wisegeek.com/how-can-i-write-an-effective-resume.htm%3Freferrer%3Dadwords_campaign%3Dresume_ad%3D009471%26_search_kw%3Dcurriculum%2520vitae

Revised 12/8/2014 3 v2.27

The Contractor shall preserve all original ESD or designated ESI; independently verify all preserved data; establish, using quality assurance checks to ensure image integrity, operational functionality, sector accountability, and ensure data is encrypted prior to leaving the work site.

The Contractor shall determine the existence of encryption prior to preservation and deliver all associated security credentials or devices under separate cover. The Contractor shall deliver all credentials and passwords necessary to decrypt and access ESI, ESD, and/or CIS to the parties in

1.2 and 1.6 via email (or removable media).

The Contractor shall provide a Verification Report of the source and acquisition hash values (i.e., RSA MD5, or NIST SHA1) for each ESI, ESD, and/or CIS; the report shall be produced and placed in the directory at the root of the storage device containing the image file segment(s). In the event that the device hash does not properly verify, a partition hash(s) and the corresponding sector range(s) shall be used and recorded as prescribed in 3.4. Acceptable forensic image file formats include E01, L01, dd, or AD1 unless otherwise specified by the party in 1.6. The Contractor shall ensure that the operating system has committed all transactions prior to independently hashing and verification of images contained on each storage destination media.

Compression may be used. Converted images and clones are not acceptable for any submission.

3.3.1 Work Process Deviation

In the event of work stoppage, unsuitable or unsafe onsite conditions, the inability to properly preserve ESI, ESD, and/or CIS, or other exceptions arise relevant to performing the work contained herein, the Contractor shall immediately notify the party identified in 1.6 or 1.2. In the event that any procedural or technical requirement set forth in this agreement cannot be met, the Contractor shall immediately notify the parties identified in 1.6 and 1.7.

3.3.2 Destination Storage Media

The Contractor shall forensically wipe, utilizing 00h, and properly verify storage destination media used to store and preserve image files.

3.3.3 Encryption

The Contractor shall encrypt each storage destination media using a NIST FIPS 140-1 or FIPS 140-2 approved mechanism. The security credentials shall be submitted separately from the image files to the parties in 1.8 and 1.9 via email (or removable media).

3.4 Image Inventory Hash Summary

The Image Inventory Hash Summary shall be completed and shipped with the storage device containing the images. The sector ranges and corresponding hashes shall be recorded as prescribed by 3.3.

3.5 Process Control Standards

To ensure digital evidence is properly preserved, collected, and transported, ESI, ESD, and/or CIS shall be handled in a manner, which safeguards and establishes the integrity of the evidence.

The Contractor shall maintain an effective quality system for the execution of relevant work. The Contractor shall employ procedures that are generally accepted in the field of digital forensics and are supported by data gathered and recorded in a scientific manner. Digital evidence processing, laboratory standards, and management methodologies shall conform to accepted protocols in the digital evidence community. Such protocols shall conform to the most recent version of ISO/IEC 17025, ISO 19011, and laboratory accreditation criteria (e.g., ASCLD/LAB). The Contractor shall maintain formal policies and a written organizational record of relevant technical, Revised 12/8/2014 4 v2.27 administrative, and quality procedures. Upon request, the Contractor shall make available to the party in 1.2 such policies and organizational record(s) for inspection.

3.6 Communications

All collateral, subsequent, and relevant communications, related to this work, shall have the Matter#, identified in 1.1, readily and discretely identified (e.g., shipping labels, email subject line, correspondence, etc). The Contractor shall be proactive in communicating with the party in

1.6 or 1.7 to include status updates while in the performance of the work contained herein. At a minimum, status updates consist of (1) confirmation of arrival at the work site, (2) issues requiring attention, collaboration, or clarity during work performance, and (3) upon completion of work objectives achieved. Status updates to 1.6 and 1.7 shall be completed via email when possible and ITFL@sec.gov shall be copied.

3.7 Code of Ethics

The Contractor shall maintain and employ the highest level of honesty, integrity, and impartiality in the performance of work associated with the Matter identified in 1.1. The Contractor shall exercise the required due diligence and thoroughness in the execution and performance of work performed herein. The Contractor shall carry out assessments based upon trustworthy and authenticated principles. The Contractor shall never misrepresent qualifications, education, training, knowledge, or status. The Contractor shall properly render the reporting of facts in a manner that is established and grounded by an unbiased and foundational basis. The Contractor shall not participate in any work contained herein where the Contractor (including household or immediate family) has a financial interest.

3.8 Confidentiality

All aspects of this Matter are subject to the terms and conditions as set forth in the Nondisclosure Agreement (NDA) and other provisions of this agreement. Any individual participating in this work shall have a completed NDA on file prior to execution of any work contained herein. Liability and obligations assented to by the Contractor extend to all of Contractor’s employees, sub-contractors, independent contractors and agents having any association with the preservation of ESI, ESD, and/or CIS. All persons performing under the terms of this agreement are subject to prior approval by the parties in 1.2 of this agreement.

Approved parties are presumed to have assented to the terms contained in the NDA and other provisions of this agreement. In addition, the Contractor shall maintain policies and procedures designed to prevent employees, persons, and/or entities whether associated or unassociated with Contractor from trading in the securities of subjects or subject entities while aware of material, nonpublic information, and pursuant to Federal Law.

3.9 Risk Assessment

The Contractor shall conduct and provide an initial written assessment of existing or potential threats related to the capability of providing the required support, deliverables, and services. The risk assessment shall include business and technical categories of risk. In the event of a changed environment which impacts the Contractor’s performance and provision of the required deliverables and services, the Contractor shall advise and submit to the party in 1.2 a revised risk assessment.

3.10 Due Diligence

Due diligence in the execution of the tasks contained herein, is the process that takes place when the requirements of a forensic process or collateral task(s) are evaluated, checked and verified.

This process includes environmental scanning, management of operations, and the verification of material facts that are essential to the investigative process performed by those relevant parties, mailto:ITFL@sec.gov

Revised 12/8/2014 5 v2.27 agent(s), or a third party for or on behalf of a party of the SEC. The Contractor shall exercise due diligence in preserving and protecting the source data, associated hardware, and image file(s) and the execution and performance of work provided. The Contractor shall properly acquire a forensic image of each ESI, ESD, and/or CIS (sector by sector) utilizing successfully validated resources.

The Contractor shall maintain operational control of all ESI, ESD, and/or CIS subject to the work scope contained herein. This includes but is not be limited to transactional “cause and effect” factors, third party access, and data alteration. Contractor shall act to preclude spoliation or damage to ESI, ESD, and/or CIS sources by protecting the source, input, process, and output relevant to the terms of work contained herein. The Contractor shall evaluate steps necessary to ensure these obligations. This includes the planning, designing, organizing, directing, analyzing, and executing life cycle activities with which to evaluate the benefits and risks involved.

3.11 Quality and Performance Standard

The Contractor shall properly manage its processes, activities, and deliverables in a manner to transform requirements and inputs into a deliverable (product or service) that satisfies quality requirements, complies with regulations, ethics and code of conduct standards expected and meets the objectives of the SEC. The Contractor shall demonstrate the tenants and principles of ISO 9001, which define the processes to provide deliverables consistent with the necessary quality, applicable statutory, contractual or regulatory requirements. Principles include a focus on the customer’s requirements, leadership, and proper involvement of human resources, process approach, system approach to management, continual improvement, and factual approach to decision making and mutual cooperation.

The parties identified in 1.2 and/or 1.9 reserves the right of inspection and final approval of deliverables, deliverable quality, and satisfaction of work performed. Acceptance will be based upon timeliness, quality, cost management, reporting accuracy, and adherence to standards and terms of work contained herein.

4.0 DELIVERABLES

4.1 General

Except where otherwise indicated, all of the deliverable item(s) identified herein shall be delivered to the party identified in 1.8 or 1.9. The NDA, identified in 2.1, shall be completed and submitted prior to execution. The Risk Assessment, identified in 3.9, shall be delivered to the parties identified in 1.2 and 1.6.

4.1.1 Shipping and Delivery

The Contractor shall produce all deliverables directly to the SEC or ship via FedEx® or UPS® standard overnight to the party identified in 1.8 or 1.9 unless otherwise specified in this document.

4.1.2 Labeling and Disposition

Labels shall be applied discretely as to not conceal device information nor interfere with the operation of the device. All storage destination media shall be uniquely identified and have a label attached that contains the Matter# from 1.1 and Contractor’s initials. The Matter# shall be preceded with the letters “SEC.” The Contractor shall, as appropriate, enter the Matter# from 1.1 as the volume label of the storage device containing the forensic images.

4.2 Chain of Custody

Revised 12/8/2014 6 v2.27

The Contractor shall produce a completed and authenticated chain of custody (“COC”) for each tangible item collected. An original COC shall accompany the associated item collected and transferred. Issues arising relevant to the COC, not addressed in this document, shall be addressed with the party identified in 1.2, 1.6 or 1.7.

4.3 Photographs

Contractor shall, as appropriate, photograph each source computing and storage device necessary to identify condition, integrity, and identity of the ESI collected. Digital photographs shall be placed in a subfolder of the directory root of the storage media containing the image segments.

The photographs shall capture all identifying information such as, manufacturer names, model numbers, serial numbers, bar coding, and any other information that uniquely identifies the ESI, ESD, and/or CIS.

4.4 Storage Device Containment for Images

The forensic image derived from each source ESI, ESD, and/or CIS shall be stored on storage destination media commercially defined as “new” or not previously used. Refurbished or rebuilt materials are not acceptable. Handling and shipping of each storage destination media shall be managed in a manner to prevent deleterious change to the image(s). The storage device(s) containing the forensic images shall be delivered to the party identified 1.8 or 1.9.

4.4.1 Copy One Disposition

Copy One is the first independently verified preservation image of the source. Converted images and clones are unacceptable. Copy One includes the storage destination media containing image files, Verification Report, COC, photographs, Media Acquisition Worksheet(s), Image Inventory Hash Summary, Materials and Hardware Inventory Shipment. The deliverables shall be properly packaged, security sealed, and hand delivered or delivered via FedEx® or UPS® standard overnight to the party identified in 1.8 or 1.9 no later than two (2) business days from completion of imaging. Documentation for each shipping container shall be completed as prescribed by 4.6.

(The Contractor shall maintain a backup copy of the items contained in this paragraph pending receipt and acceptance by the SEC. Upon acceptance by the SEC, the Contractor shall destroy the backup copy.)

4.5 Media Acquisition Worksheet

The Media Acquisition Worksheet shall be used to record information for the processing of computing devices and media. One Media Acquisition Worksheet is to be used for each system or device.

4.6 Packaging and Materials and Hardware Inventory Shipment Transmittal All ESI, ESD, storage destination media, and/or CIS not hand delivered shall be packaged in Pelican® cases with foam inserts or commercially similar product. FedEx® or UPS® baggage tags shall be utilized in lieu of direct attached gum labels and all FedEx® or UPS® documentation shall include the Matter number identified in 1.1. Packaging materials shall be selected and used in a manner that will prevent spoliation or deleterious change to the shipment contents. Each Pelican® case utilized for shipment shall be security sealed with appropriate devices specifically designed for single use and unique identification. Unique identifier(s) contained on the security seal shall be recorded by the Contractor prior to shipment and provided under separate cover to the party identified in 1.8 or 1.9.

Each container utilized to ship deliverables shall contain the Materials and Hardware Inventory Shipment Transmittal. The Materials and Hardware Inventory Shipment Transmittal shall include all tangible items being shipped in the designated container. Hand delivery of the

Revised 12/8/2014 7 v2.27 deliverables by the Contractor to the party in 1.8 or 1.9 is permitted provided prior arrangements have been made.

4.7 Declaration

The Contractor shall complete a declaration. The declaration shall be completed by any participating employee, sub-contractor, independent contractor and agents attesting to the facts surrounding the acquisition and production of the imaged file(s) and delivered to the party identified in 1.8 or 1.9. The declaration shall be made pursuant to 28 U.S.C. Section 1746 (Unsworn Declarations Under Penalty of Perjury). The declaration shall include only the facts relevant to the preservation, collection, and production. In addition, The Contractor’s declaration shall indicate any hardware and/or software tools used to image any ESD and/or ESI to include manufacturer, model and software/firmware version as applicable. The Contractor shall deliver the completed declaration no later than five (5) business days, from completion of imaging, to the party identified in 1.8 or 1.9.

4.8 Supplemental Instructions and Superseding Authority (Only checked items apply to this SOW)

File Structure Report and File Listing:

For each ESI, ESD, and/or CIS identified in section 1.3, a ‘Folder Structure Report’ shall be delivered to the party in 1.8 or 1.9 to include a graphical representation of the media’s directory structure and a comma delimited text file containing the following information for each file:

File Name, File Extension, File Type, File Category, Signature, Description, Is Deleted, Last Accessed, File Created, Last Written, Entry Modified, File Deleted Logical Size, Physical Size, Starting Extent, File Extents, Physical Location, Physical Sector, Image File, File Identifier, Hash Value, Full Path, Short File Name, Unique Name, Original Path

Alternate Imaging Location:

The imaging of ESI, ESD, and/or CIS may occur off site from the site location identified in 1.5 in an area under the control of the Contractor. The Contractor shall take custody of the computer systems and securely transport them to a temporary work site, and complete all required work prescribed and contained herein. The Contractor shall perform the pre-processing of the ESI, ESD, and/or CIS, acquire forensic images of each computing device, independently verify the images, and return the computer systems to the site location identified in 1.5. The Contractor shall maintain physical custody and control of the items(s) identified in 1.3 at all times and maintains the COC.

Maps:

A premises map shall be prepared. The premises map shall be an as-built drawing or sketch of the site location and shall accurately identify the location, layout, and placement of all ESD imaged.

Network(s) and Exchange E mail Collection:

The Contractor shall coordinate with the appropriate entity IT staff to locate, identify, and document the network ESI, ESD, CIS, and/or volumes onsite. The Contractor shall make a forensic image of the appropriate system volume, network volume(s), and Exchange Server Volume(s) using properly validated tools that will produce image files in E01, L01, dd, or AD1 formats.

Handheld Devices:

Revised 12/8/2014 8 v2.27

In the case of handheld devices (e.g., cell phones, personal digital assistants (PDA), smart phones, etc.), verifiable forensic images shall conform to SEC accepted standards. Prior to processing any handheld device, the Contractor shall ensure that the device is isolated from the network.

Once isolation has been verified the preservation and collection shall be accomplished. Incidental and as appropriate, the following imaging methods (listed in order of priority) shall be employed for each handheld device:

(1) Physical extraction

(2) Advanced logical extraction (iOS devices)

(3) File system (Logical) extraction

(4) Phone data extraction

(5) SIM/USIM data extraction

(6) Backup and/or synchronization files (i.e., iTunes backup)

The Contractor shall properly assess the limitations of each of the following techniques and employ the requisite process controls to isolate the handheld device from the network and ensure data is not placed at risk: (1) Power off the device (2) Airplane mode (3) RF shielding (4) Radio Isolation Card (RIC). The Contractor shall ensure power is maintained to the handheld device during the preservation effort. The Contractor shall perform a physical acquisition before a logical acquisition if possible. The Contractor may need to use one or more acquisition methods based on the following order of forensic preference: (1) Cable (2) Photograph (3) IrDA or (4) Bluetooth.

For all handheld devices that require a SIM, the Contractor shall process the SIM twice; installed and uninstalled from the handset. If the device is inactive (powered off) remove the SIM and acquire its data with a validated tool first. If the handheld device is active (powered on) data should be acquired from the device using a validated tool before removing the SIM. An assessment shall be conducted based on the model and type of handheld device. The output file format shall be coordinated with the party in 1.6. Handheld device imaging and processing tools developed by Cellebrite, Inc. are to be employed. If the use of these tools is not technically feasible, then alternative methods/tools may be employed with prior approval from the parties listed in 1.2 and 1.6.

The Contractor shall provide a Verification Report that includes the reference and verification hash values (i.e., RSA MD5, NIST SHA1 or NIST SHA2) for each image file generated as a result of imaging the handheld device(s); the report shall be produced and placed in the directory at the root of the storage device containing the image file(s). In the event that an image hash fails to properly verify, the Contractor shall make every effort to identify and correct the issue including reimaging the device utilizing a different tool, process or methodology, if necessary. Any anomalies and/or error messages noted during imaging shall be fully documented in the Notes section of the Media Acquisition Worksheet and immediately communicated to the party identified in 1.6 or 1.7.

The Contractor shall record a listing of all data content types extracted (e.g., email messages, SMS/MMS messages, call logs, phonebook, calendar, contacts, pictures, video files, audio files), as reported by the imaging tool or application, in the Notes section of the Media Acquisition Worksheet.

As appropriate, the Contractor shall note the make, model, operating system/version, provider name (i.e., carrier), International Mobile Subscriber Identity (IMSI), Integrated Circuit Card Identifier (ICCID), International Mobile Equipment Identifier (IMEI) on the Media Acquisition Worksheet. Include the date and time the device was isolated from the network. Record the

Revised 12/8/2014 9 v2.27 password and/or PIN. Indicate the condition and state of the handheld device and whether more than one SIM Card or a Media Card(s) are present. In the event the source handheld device is collected the relevant cables, software, and credentials shall be preserved. Media Cards shall be imaged.

Collect and Take Custody of the Following ESD(s):

Other:

Revised 12/8/2014 10 v2.27

5.0 DEFINITIONS

Assertion A statement of behavior, action, or condition that can be tested or measured. Each assertion is an independent, complete, testable statement for a requirement in the specification.

Assumption Within the context of the scope of work includes assertions about some attribute of the tasks to be performed and which underlies task accomplishment.

Basic Input/Output System

(“BIOS”)

Computer instructions stored on a ROM chip that are used by the system to identify and interact with various core system hardware devices such as the CPU, motherboard, video card, expansion slots, and RAID controllers.

Calibration Type Bias: testing for differences in values or outputs.

Discrete: looking for a specific value or output.

Deviation: making a determination or not if the values or outputs are within an acceptable or unacceptable range

Chain of Custody

(“COC”)

The matter of jurisprudence which applies to the handling of digital evidence, media, collateral materials to ensure integrity. Refers to the document or paper trail, showing the collection, seizure, custody, control, transfer, analysis, and disposition of physical and electronic evidence. Items subject to chain of custody be maintained, handled in a meticulous manner to avoid deleterious change, alteration or spoliation.

Computerized Information Systems (“CIS”)

A collective system of entities such as people, procedures, controls, data, software, and hardware that are used to manage data and information.

Confidentiality The act or process to manage information which is accessible only to those authorized to have access. Party(ies) shall maintain policies and procedures designed to prevent its employees from securities trading while aware of material, nonpublic information, and pursuant to Federal Law. All aspects of this work require the utmost confidentiality. The Contractor and all employees of the Contractor (if any) involved in any aspect of this work shall be required to sign the attached non-disclosure agreement as prescribed herein.

Curriculum Vitae (“CV”) "Course of one's life”. A curriculum vitae is a written description of one’s work experience, educational background, and skills. A CV is more detailed than a resume.

Custodian Owner of the ESD/ESI. May also be the main user profile. Person having control of a network, computer or specific electronic files.

Due diligence

Due Diligence is the process of investigation, auditing, and evaluation that takes place when the requirements of a forensic process are checked and verified. Examination of operations, environment, process, management, and the verification of material facts are checked. It is insufficient that the normal standard of care was taken but a stricter standard. The party (ies) must show that they took every reasonable precaution. See 3.10.

Electronic Storage Device

(“ESD”)

Electronic devices used to store ESI. i.e., Hard disk drive, USB thumb drive, CD/DVD, etc.

Electronically Stored Information (“ESI”)

Data compilations from which information can be obtained [and] translated, if necessary, by the respondent through detection devices into [a] reasonably usable form. Information stored in an electronic form.

Encryption Process (or state) of transforming information to make it unreadable or concealed to anyone except those possessing special access, usually referred to as a key.

Encryption key Data value (digital certificates) used to encrypt/decrypt data.

File System Extraction Cellebrite UFED option used to create an image of a handheld device’s logical file system as a directory structure, which does not include unallocated space or decoding for deleted files.

Forensically wipe The process of removing any residual data on an electronic device achieved by overwriting each byte with a hex value 00h.

Image Exact copy of an entire physical storage media (hard drive, CDROM, DVD ROM, tape, etc.), including all active and residual data and unallocated space on the media. Sector by sector/bit by bit copy of a hard drive. A Bit Stream Back up is an exact copy of a hard drive, preserving all latent data in addition to the files and directory structures.

Imaging anomalies The lack of having a complete image or proper verification of digital signatures cannot be obtained.

Integrated Circuit Card Identifier (“ICCID”)

Serial number of the subscriber identification module (SIM).

International Mobile Equipment Identifier (“IMEI”)

Unique identifier to identify the device.

International Mobile Subscriber Identity (“IMSI”)

A unique number to identify a subscriber on a Global System for Mobile Communications (GSM) network. Contains the Mobile Country Code, Mobile Network Code, and the Mobile Subscriber Identity Number.

ISO 19011 An international standard that sets forth guidelines for quality management systems auditing.

http://www.mywiseowl.com/articles/Jurisprudence http://www.google.com/pagead/iclk?sa=l&ai=B-UIhvbRORI38BoHwwQKZ09WwArfGzBHhz-O4Abai9wSw6gEQBhgGIKVOKAYwAUicOVDq7uvM-_____8BoAGIkYf_A6oBEGNvbWNhc3RwY19wb3J0YWzIAQGVAihgUAo&num=6&adurl=http://www.wisegeek.com/how-can-i-write-an-effective-resume.htm%3Freferrer%3Dadwords_campaign%3Dresume_ad%3D009471%26_search_kw%3Dcurriculum%2520vitae http://en.wikipedia.org/wiki/Information http://en.wikipedia.org/wiki/Key_%28cryptography%29 http://en.wikipedia.org/wiki/Quality http://en.wikipedia.org/wiki/Management_systems http://en.wikipedia.org/wiki/Auditing

Revised 12/8/2014 11 v2.27

Defined as the most recent specification.

ISO 9001 Standard for a quality management system which defines how the Contractor fulfils quality requirements and criteria, applicable regulatory requirements, while aiming to enhance SEC’s satisfaction, and achieve continual improvement of its performance in pursuit of these objectives.

ISO 9660 International standard which defines the file system of CD ROM media. The standard is designed to be interoperable with different computer. The Joliet format is an extension of the ISO 9660 which adds support for long file names and non ASCII character set. Defined as the most recent specification.

ISO/IEC 17025 Standard specifies the general management and technical requirements for the laboratory’s competence to carry out tests and/or calibrations. It is used by laboratories in developing their management system for quality, administrative and technical operations which govern the laboratory. Competence is recognized by conformance to the requirements. Defined as the most recent specification.

Life Cycle Succession of process stages, activities, and strategies employed during the investigative process. Lifecycle stages Include (1) Case Intake, (2) Acquisition, (3) Examination, (4) Presentation, (5) Disposition.

NIST SHA1 Secure Hash Algorithm.

Non-Disclosure Agreement

(“NDA”)

Parties agree not to disclose information covered by the agreement. The NDA creates a confidential relationship between the parties to protect disclosure and protect non-public information.

Phone Data Extraction Cellebrite UFED option used to extract call logs, contacts, SMS text messages, pictures, audio, video, calendar, notes, tasks, MMS multimedia messages, instant messages and ringtones from a handheld device.

Physical Data Extraction Cellebrite UFED option used to create a physical image of the flash memory or entire address range of a handheld device, including unallocated space. Unlike a logical extraction process, the physical extraction method will bypass the handheld device’s operating system.

Plain text Refers to files in identifiable text or other human readable or recognizable form Process Control Standards Control process for maintaining proper standards and controls devoted to the execution of tasks associated with this e-Discovery plan.

Properly verify wipe Search the media for any value other than 00 hex.

Reference Hash The original hash value of the source ESI or ESD being imaged. Also referred to as the acquisition hash.

Requirements Documented needs of what a particular product or service necessary to meet an objective(s) Risk Assessment Technical: potential threats to providing the required support, deliverables, and execution of tasks at the expected level of quality for a specific scope of work (engagement).

Business: potential threats to operation and survivability of business, such as threats caused by environment, financial, legal, technology, humans, organizations and politics.

RSA MD5 A cryptographic hash function with a 128 bit hash value. As an Internet standard (RFC 1321), MD5 has been used to check the integrity of files.

Scope The sum of all tasks contained within this IT Forensics EDISCOVERY PLAN to include constraints, limitations, inclusions, measures, responsibilities, and objectives.

Sector accountability A validation of the number of sectors reported by the forensic software matches the number of sectors reported by the manufacturer.

SIM/USIM Data Extraction Cellebrite UFED option used to extract data from a subscriber identity module (SIM) card or universal subscriber identity module (USIM) card such as ICCID, IMSI, location information, SMS, deleted SMS, deleted call history and phonebook entries.

Universal Forensic Extraction Device (“UFED")

Hardware-based data extraction and imaging tool for handheld devices manufactured by the Cellebrite Corporation

Unused area Space on an ESD that has not been partitioned or formatted for storing data.

Validation Process of applying procedural objectivity. Structured and repeated testing. Process of checking if something satisfies a certain criterion. Validation is ensuring "you built the right widget."

Verification Process or testing, proving or disproving the correctness of intended algorithms or procedure underlying a system with respect to a certain formal specification or property. Verification is ensuring "you built the widget correct."

Verification Hash Post-acquisition hash value of a forensic image. This value is compared to the reference hash in order to verify that the evidence was not changed during the imaging process.

http://en.wikipedia.org/wiki/CD-ROM http://en.wikipedia.org/wiki/Cryptographic_hash_function http://en.wikipedia.org/wiki/Bit http://en.wikipedia.org/wiki/Internet http://tools.ietf.org/html/rfc1321 http://tools.ietf.org/html/rfc1321 http://en.wikipedia.org/wiki/Computer_file http://en.wikipedia.org/wiki/Mathematical_proof http://en.wikipedia.org/wiki/Correctness http://en.wikipedia.org/wiki/Algorithms

Revised 12/8/2014 12 v2.27

Revised 12/8/2014 13 v2.27

Media Acquisition Worksheet U.S. Securities and Exchange Commission - Division of Enforcement IT Forensic Branch Media Acquisition Worksheet (Please use one Worksheet for each computing device – for data items not represented please use the notes block or attach an addendum)

Matter#:

Date: Contractor Examiner First and Last Name:

Location of Computer:

COMPUTER DESCRIPTION

Make:

Model: Serial #:

Case Type: Tower Desktop Laptop Rack/Server RAID Handheld Device Other System Shutdown Method: Hard Normal Unknown Date/Time of Shutdown:

BIOS Date: BIOS Time: LAN Present: Yes No Type:

Current Local Date: Current Local Time:

Verified Time/Date: NIST NOAC

RAID Controller Information: RAID Level: Stripe/Block Size: LH/RH Striping

DRIVE INFORMATION

HDD #1:

Model:

Serial #

Evidence#:

HDD #2:

HDD #3:

ACQUISITION

Encase Helix Field Hardware Paraben FTK Imager AccessData MPE Other: ________________ For Handheld Devices: As appropriate, please note the make, model, provider name (e.g., carrier), International Mobile Subscriber Identity (IMSI), Integrated Circuit Card Identifier (ICCID), or International Mobile Equipment Identifier (IMEI). Also include the date and time the device was isolated from the network. Record the password and/or PIN. Indicate whether the SIM Card or Media Card is present.

Notes:

Revised 12/8/2014 14 v2.27

Materials and Hardware Inventory Shipment Transmittal (Sample)

Matter Number: HO 12345 FedEx® or UPS® Tracking # (or Attach copy of Receipt) Site Address (Collection Point): 123 Main Street, Suite 200 Somewhere, NY 123456

Unique Identifier (Bar Code) Item Description (e.g., custodian)

Collection Date

Location (Room#)

SEC44843890457475700

IBM Laptop with power cord (John Smith –

CEO) S/N 567809753

5/5/06 204

SEC54886586567488600

USB Ztec HW Security Key (in evidence bag) S/N 146809753 for IBM Laptop (John Smith

CEO

5/5/06 204

SEC56598654767567500

Dell Desktop XL400 (Bob Veepee CFO) S/N D3290514

5/5/06 206

SEC45745747547547500

External Hard Drive (attached to CFO's Dell

XL400)

SEC44095784753403900

Compaq Laptop C756 (Mary Snow Secretary) S/N 209348576

5/5/06 203

SEC47434777477765700

120 gig IDE Maxtor (contains E01 files for John Smith's Laptop) S/N D3290678

SEC87878785465654355

80 gig IDE Maxtor (contains dd files from Bob's Veepee Dell Desktop) S/N D9087456

SEC86967747574574763

80 gig IDE Maxtor (contains E01 files from Mary Snow Laptop) S/N B1830493

5/5/06 203

Declaration (Acquisition and Collection) Hard Copy

5/5/06

SEC89086775757509548

CD (contains Photos, reports, e copy of declaration and Examination Report)) 5/5/06

Chain of Custody (Facts surrounding the collection)

FedEx® Receipt (Copy)

Examination Report (contains detailed account of collection, naming conventions, admin notes, etc.)

***AND NO OTHERS****

Revised 12/8/2014 15 v2.27

Image Inventory Hash Summary (Sample)

Matter Number: HO 12345 FedEx® or UPS® Tracking # (or Attach copy of Receipt) Site Address (Collection Point): 123 Main Street, Suite 200 Somewhere, NY 123456

Image Name Unique Identifier (Bar Code) Device Sector Range Hash Value Verified

Y/N Compressed

Y/N Smith_Dell_HDD.EO1 SEC 12345 FA 001 (Copy 1) Device 1 : 0 1934567890 ee107d9d562bb6826bd81d3542a419d6 Y N

Smith_Dell_HDD.EO1 SEC 12345 FA 002 (Copy 2) Device 1 : 0 1934567890 ee107d9d562bb6826bd81d3542a419d6 Y Y

Veepee_Dell_HDD.EO1 SEC 12345 FA 003 (Copy 1) Device 2: 0 1934568974 be226699562bb6840 9294d3542a4191 N N

Partition C: 63 1432493400 4562349d562bb6826bd8abfe5793403

Partition D: 1432493463 1934461230 cf4567df1234b6826bd080501dd12344

Veepee_Dell_HDD.EO1 SEC 12345 FA 004 (Copy 2) Device 2: 0 1934568974 be226699562bb6840 9294d3542a4191 Y

Snow_Dell_HDD.EO1 SEC 12345 FA 003 (Copy 1) Device 3: 0 1934563435 fcc4567d562bb6826bd81d3508641607 N Y

Partition C: 63 1432493400 ffe107d9d562bb6826bd81d354265432

Partition D: 1432493463 1934461230 ee107d9d562bb6826bd81d3542a419d

Snow_Dell_HDD.EO1 SEC 12345 FA 004 (Copy 2) Device 3: 0 1934563435 fcc4567d562bb6826bd81d3508641607 Y N

No others.

Note: Reference 3.3 regarding partition hashing

Revised 12/8/2014 16 v2.27

[Sample Acquisition and Imaging Declaration]

Contractor Letter Head

[Matter # ]

DECLARATION OF [INSERT FULL NAME]

Pursuant to 28 U.S.C. Section 1746, the undersigned states as follows:

1. My name is [Enter Name]. I am over twenty one years of age and have personal knowledge of the matters set forth herein. Other parties present include [ENTER NAMES]

2. I am assigned as a [ENTER JOB TITLE] and was contracted by [ENTER PRIME CONTRACTOR], Prime Contractor to the U.S. Securities and Exchange Commission’s Division of Enforcement in Washington, D.C. under a current government contract. As part of my duties I was tasked to conduct a [forensic image, forensic exam, privilege review].

3. In support of Matter number [insert number], and at the direction of my supervisor, I was tasked to conduct forensic imaging of the following media:

[Named entity #1) [Named entity #2) [Named entity #3) or

I was tasked to conduct data recovery operations of the following: One [insert manufacturer and model of personal computer] computer identified as [Serial #], containing [insert quantity of hard drives and manufacturer and model of each hard drive] hard drive(s) identified as Serial #(s) [Serial #]. This [computer or device] was identified by [entity or custodian of record] as belonging to “[assigned user].”

or [if more than one device then list] [Manufacturer] [Model#] [Serial#] [computer/device] [identifier] [Assignee] [Custodian]

4. On [insert date], utilizing [Software] [version #], I made a bitstream image of [quantity] physical hard drive(s) on site at [location and legal address].

5. I ascertained the time and date settings of [quantity] computers. The computer time and date was verified to be, as indicated below, and the real time and date was verified to be GMT (NIST or Naval Observatory Atomic Clock) as indicated below. The bit stream images were stored on a hard drive and tagged with [insert investigation number with appended identified]. Employing a RSA 128 bit MD5 Hash algorithm, validation was conducted between the source media and the bit stream image. The results of the validation per hard drive are as follows

[Item number] [Computer Identifier] BIOS Time/Date [GMT Values]: Verified [NIST or NOAC] [GMT Values] [Item number] Hard Drive Device Acquisition Hash: Device Verification Hash:

Device Quantity of Sectors Sector Count Reported:

Partition(s)[identifier] Hash Device Acquisition Hash:

Partition(s) [identifier] Hash

[Insert the following paragraph only if appropriate.] No reliable MD5 Hash value could be obtained due to read errors of the following sectors originating from the source device): [List sectors per hard drive and separate by a semi colon].

Revised 12/8/2014 17 v2.27

[Item number] Hard Drive Device Acquisition Hash: Device Verification Hash:

Device Quantity of Sectors Sector Count Reported:

Partition [identifier] Hash Partition [identifier] Hash

[Insert the following paragraph only if appropriate.] No reliable MD5 Hash value could be obtained due to read errors of the following sectors originating from the source device): [List sectors per hard drive and separate by

[Item number] Hard Drive Device Acquisition Hash: Device Verification Hash:

Device Quantity of Sectors Sector Count Reported:

Partition [identifier] Hash Partition [identifier] Hash

[Insert the following paragraph only if appropriate.] No reliable MD5 Hash value could be obtained due to read errors of the following sectors originating from the source device): [List sectors per hard drive and separate by

On [insert date], the following storage hard drive(s), identified with tag number [tag number], model [model#] and serial number [serial number], containing the forensic images of the media identified in paragraph 1, was forensically wiped and verified prior to production and conveyed as follows:

Item# Tag# Model# Serial Number Image name Produced to:

[Item#] [Tag#] [Model#] [Serial Number] [Image name] [Conveyed to address]

I declare under penalty of perjury that the foregoing is true, correct, and made in good faith.

Contractor Signature

[Contractor Printed First and Last Name]

Executed on this [DATE] day of [Month], [Year]