Ics Notesm5
Ics Notesm5
MODULE 5
UNDERSTANDING COMPUTER FORENSICS
5.1 INTRODUCTION
Cyberforensics is the use of forensic techniques in the investigation of Cybercrimes.
Cyberforensics plays a key role in investigation of Cybercrime.
Cyber Forensics, Digital Forensics and Computer Forensics are used interchangeably.
6. The widespread use of computer forensics is the result of two factors: the increasing dependence
of law enforcement on digital evidence and the ubiquity of computers that followed from the
microcomputer revolution.
7. The media, on which clues related to cybercrime reside, would vary from case to case.
8. There are many challenges for the forensics investigator because storage devices are getting
miniaturized due to advances in electronic technology.
Network forensics is the study of network traffic to search for truth in civil, criminal, and
administrative matters to protect users and resources from exploitation, invasion of privacy
and any other crime fostered by the continual expansion of network connectivity.
Open network is the source of many network based cyber attacks.
In a survey conducted by a leading IT business it revealed that 50% of the Wi Fi internet
connection in the city continued to be unprotected.
Wireless forensics is a discipline included within the network forensics field.
The goal of Wireless forensics is to provide the methodology and tools required to collect
and analyze network traffic that can be presented as a valid evidence in the court of law.
The evidence collected can correspond to plain data or with the broad usage of VoIP
technologies, especially over wireless , can include voice conversations.
The wireless forensics process involves capturing all data moving over Wi Fi network and
analyzing network events to uncover network anomalies, discover the source of security
attacks and investigate breaches on computers and wireless networks to determine whether
they are or have been used for illegal or unauthorized activities.
5.6.3 Following are some guidelines for the evidence collection phase:
1. Adhere to your site’s security policy and engage the appropriate incident handling and law
enforcement personnel.
2. Capture a picture of the system as accurately as possible.
3. Keep detailed notes with dates and times. If possible, generate an automatic transcript. Notes
and printouts must be signed and dated.
4. Note the difference between the system clock and coordinated universal time (UTC). For each
time stamp provided, indicate whether UTC or local time is used.
5. Be prepared to testify outlining all actions you took and at what times. Detailed notes will be
vital.
6. Minimize changes to the data as you are collecting it. This is not limited to content changes;
avoid updating file or directory access times.
7. When confronted with a choice between collection and analysis you should do collection first
and analysis later.
8. Needless to say, your procedures should be implementable. As with any aspect of an incident
response policy, procedures should be tested to ensure feasibility, particularly, in a crisis.
9. For each device, a systematic approach should be adopted to follow the guidelines laid down in
your collection procedure.
10. Speed will often be critical; therefore, where there are a number of devices requiring
examination, it may appropriate to spread the work among the team to collect the evidences in
parallel.
11. Proceed from the volatile to the less volatile; order of volatility is as follows:
Registers, cache (most volatile i.e, contents lost as soon as the power is turned off).
Routing table, address resolution protocol (ARP) cache, process table, kernel statistics,
memory;
Temporary file system;
Disk;
Remote logging and monitoring data that is relevant to the system in question;
Physical configuration and network topology;
Archival media (least volatile, i.e., holds data even after power is turned off).
12. You should make a bit-level copy of the system’s media. If you wish to do forensic analysis
you should make a bit-level copy of your evidence copy for that purpose, as your analysis will
almost certainly alter file access times. Try to avoid doing forensics on the evidence copy.
Analysis, Interpretation and Attribution of evidence are the most difficult aspects encountered by
most forensics analysts.
Basically all digital evidence must be analyzed to determine the type of information that is
stored upon it.
For this purpose special tools are used that can display information in a format useful to
investigators.
6. Reporting
Once the analysis is completed a report is generated.
The report may be in the written form or an oral testimony or it may be a combination of the
two.
The following are the broad level elements of the report.
1. Identity of the reporting agency.
2. Case identifier or submission number.
3. Case Investigator.
4. Identity of the submitter.
5. Date of receipt.
6. Date of report.
7. Descriptive list of items submitted for examination, including serial number, make and
model.
8. Identity and signature of the examiner.
9. Brief description of the steps taken during examination, such as string searches, graphics
image searches and recovering erased files.
10. Results/ conclusions.
7. Testfying
This phase involves presentation and cross examination of expert witnesses.
Digital forensics evidence is normally introduced by expert witnesses.
Only expert witnesses can address issues based on scientific, technical or other specialized
knowledge.
This analysis does not consider any partitions or other operating system (OS) specific data
structures.
If the storage device uses a fixed size unit, such as a sector then it can be used in this analysis.
2. Media Management Analysis:
It is the analysis of the management system used to organize media.
This typically involves partitions and may include volume management or redundant array of
independent disks systems that merge data from multiple storage devices into a single storage
device.
3. File System Analysis:
It is the analysis of file system data inside a partition or disk.
This typically involves processing the data to extract contents of a file or to recover the contents
of a deleted file.
4. Application Analysis:
It is the analysis of the data inside a file.
Files are created by the users and applications.
The format of the contents is application specific.
5. Network Analysis:
It is the analysis of data on the communication network.
OS analysis: An OS is an application. This analysis examines the configuration files and the
output data of the OS to determine what events may be occurred.
Executable analysis: Executables are digital objects that can cause events to occur and they are
frequently examined during intrusion investigations because the investigator needs to determine
what events the executable could cause.
6. Image Analysis:
Digital images are the target of many digital investigations.
This type of analysis looks for information about where the picture was taken and who or what is
in the picture.
Image analysis also includes examining images for evidence of steagnography
7. Video Analysis:
Digital video is used in security camera and in personal video cameras and webcams.
This type of analysis examines the video for the identification of objects in the video and the
location where it was shot.
Special measures should be taken while conducting a forensics investigation if it is desired for the
results to be used in a court of law.
In order to comply with the need to maintain the integrity of digital evidence, certain rules must be
complied with. In general the following principles are applicable.
1. Principle 1: No action taken by law enforcement agencies or their agents should change data
held on a computer or storage media, which may subsequently be relied upon in court.
3. Principle 3: An audit trail or other record of all processes applied to computer based
electronic evidence should be created and preserved. An independent third party should be
able to examine those processes and achieve the same result.
4. Principle 4: The person in charge of the investigation has overall responsibility for ensuring
that the law and these principles are adhered to.
IMPORTANT QUESTIONS
1. What is the difference between “digital forensics” and “computer forensics” Explain?
2. Can a Cyber Crime investigation be done without involving a forensics expert? Explain with
reasons.
3. Explain how chain of custody concept applies in computer/ digital forensics.
4. Explain the role of digital forensics.
5. Explain the best practices in handling digital evidence, Explain what “rules of evidence” are.
6. What are the phases and activities involved in the life cycle of a digital forensics investigation
process?
7. What are the typical elements of a digital forensics investigation report?
8. What are the different types of digital analysis that can be performed on the captured forensics
evidence?
9. What are the precautions to be taken while collecting electronic evidence?
10. What is the nature of evidence collected for network forensics?