[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Guidelines for Evidence Collection and Archiving



The Internet Engineering Task Force (IETF) released the following Request for Comment (RFC) in
February 2002:

Guidelines for Evidence Collection and Archiving - (IETF RFC 3227)
http://www.ietf.org/rfc/rfc3227.txt
Dominique Brezinski and Tom Killalea

The document is meant to provide system administrators with guidelines on the collection and archiving
of evidence relevant to security-relevant system events in which the system's security policy is
disobeyed or otherwise breached.

Subscribers to this list will find many of the recommendations in the document to be quite familiar.
For example:

- Capture as accurate a picture of the system as possible.

- Keep detailed notes.

- Minimise changes to the data as you are collecting it.

- Remove external avenues for change.

- When confronted with a choice between collection and analysis you should do collection first and
analysis later. [Ok, so maybe this one isn't very good advice for an archivist.]

- For each device, a methodical approach should be adopted which follows the guidelines laid down in
your collection procedure.

- Proceed from the volatile to the less volatile [i.e. focus first on the fragile stuff].

- Do not intrude on people's privacy without strong justification.

- Make sure you have the backing of your company's established procedures in taking the steps you do
to collect evidence of an incident.

Finally, computer evidence needs to be:

- Admissible: It must conform to certain legal rules before it can be put before a court.

- Authentic: It must be possible to positively tie evidentiary material to the incident.

- Complete: It must tell the whole story and not just a particular perspective.

- Reliable: There must be nothing about how the evidence was collected and subsequently handled that
casts doubt about its authenticity and veracity.

- Believable: It must be readily believable and understandable by a court.

It's interesting to note that the two authors of the document work for a Central Intelligence Agency
contractor and a computer laboratory, respectively.  It would seem that those they acknowledge for
comments are all computer scientists, expect for Floyd Short, the Assistant U.S. Attorney Floyd
Short.  Not an archivist in the bunch.

=========================================================
 Cal Lee
 University of Michigan             Phone: 734-647-0505
 School of Information
 http://www-personal.si.umich.edu/~calz/
   "To the extent that archival organizations are concerned
    with current record practices and the content of future
    holdings, they cannot long delay plans for appraising,
    accessioning, and servicing this new [computer] media
    of communication."
                                  - Meyer Fishbein, 1970

A posting from the Archives & Archivists LISTSERV List!

To subscribe or unsubscribe, send e-mail to listserv@listserv.muohio.edu
      In body of message:  SUB ARCHIVES firstname lastname
                    *or*:  UNSUB ARCHIVES
To post a message, send e-mail to archives@listserv.muohio.edu

Or to do *anything* (and enjoy doing it!), use the web interface at
     http://listserv.muohio.edu/archives/archives.html

Problems?  Send e-mail to Robert F Schmidt <rschmidt@lib.muohio.edu>