Cloud computing, serverless computing, microservices architecture, increased API use, and IoT and industrial IoT (IIoT) “smart” devices pose new challenges to digital forensic investigations. In these cases, traditional methods of collecting and acquiring forensic evidence are often challenged by the storage on the server or the fact that the client doesn’t necessarily capture all of the components of a transaction — or at least not all in one place. Performing accurate, comprehensive digital forensics in situations where APIs are integral to the event timeline requires a multi-level approach.
API Forensics
Adding one or more APIs into an incident timeline raises the level of difficulty in digital forensics.
Tackling new forensics challenges on the digital frontier.
API forensics can be framed within a set of six phases:
IDENTIFICATION
Conducting a search for, recognition of, and documentation of the physical devices potentially containing digital evidence.
COLLECTION
Collecting devices identified in the previous phase and transferring them to an analysis facility (physically or virtually).
ACQUISITION
Capturing an image of a source of potential evidence identical to the original.
PRESERVATION
Preserving physical and logical evidence integrity.
ANALYSIS
Interpreting the data from the acquired evidence.
REPORTING
Communicating and/or disseminating the results of the investigation.
Rule4 applies its computer science background and forensics analysis credentials to perform thorough forensic analyses of unique API ecosystems.
If necessary, we construct custom scripts for data extraction and preservation as part of the engagement so that independent analysis of our results is possible. We have provided expert testimony in numerous court cases and have an impeccable reputation for delivering comprehensive, accurate forensic reports.
We’re on the case!
Rule4 is here to help with even your most challenging digital forensic investigations.
CONTACT US
CONTACT US
