• Identify digital evidence for examination and analysis in such a way as to avoid unintentional alteration. • Prepare digital media for imaging by ensuring data integrity (e.g., write blockers in accordance with standard operating procedures). • Examine recovered data for information of relevance to the issue at hand. • Use specialized equipment and techniques to catalog, document, extract, collect, package, and preserve digital evidence. • Identify digital evidence for examination and analysis in such a way as to avoid unintentional alteration. • Review forensic images and other data sources (e.g., volatile data) for recovery of potentially relevant information. • Document original condition of digital and/or associated evidence (e.g., via digital photographs, written reports, hash function checking). • Create a forensically sound duplicate of the evidence (i.e., forensic image) that ensures the original evidence is not unintentionally modified, to use for data recovery and analysis processes. This includes, but is not limited to, hard drives, floppy diskettes, CD, PDA, mobile phones, GPS, and all tape formats.

• Capture and analyze network traffic associated with malicious activities using network monitoring tools. • Conduct analysis of log files, evidence, and other information in order to determine best methods for identifying the perpetrator(s) of a network intrusion. • Perform dynamic analysis to boot an image of a drive (without necessarily having the original drive) to see the intrusion as the user may have seen it, in a native environment. • Perform hash comparison against established database. • Perform timeline analysis. • Perform static media analysis, perform static malware analysis. • Perform tier 1, 2, and 3 malware analysis. • Perform virus scanning on digital media. • Perform file system forensic analysis. • Perform static analysis to mount an image of a drive (without necessarily having the original drive).

• Confirm what is known about an intrusion and discover new information, if possible, after identifying intrusion via dynamic analysis. • Provide technical summary of findings in accordance with established reporting procedures. • Ensure chain of custody is followed for all digital media acquired in accordance with the Federal Rules of Evidence. • Provide technical assistance on digital evidence matters to appropriate personnel. • Recognize and accurately report forensic artifacts indicative of a particular operating system. • Write and publish cyber defense techniques, guidance, and reports on incident findings to appropriate constituencies.