Digital Forensics: Module 1: Computer Forensics and Investigation
Digital Forensics: Module 1: Computer Forensics and Investigation
What is digital
forensics?
There is no standard definition
Digital forensics is a branch of forensic
science encompassing the recovery and
investigation of material found in digital
devices, often in relation to computer
crime
ISO standards for digital forensics are
available
An acceptable definition
According to Nelson et al. digital
forensics is “the application of computer
science and investigative procedures for
a legal purpose involving the analysis of
digital evidence after proper search
authority, chain of custody, validation
with mathematics, use of validated tools,
repeatability, reporting, and possible
expert presentation.”
recovery
https://en.wikipedia.org/wiki/ILOVEYOU
The outbreak was later estimated to have caused US$5.5–
8.7 billion in damages worldwide, and estimated to cost
US$15 billion to remove the worm.
Since there were no laws in the origin country against
writing malware at that time, perpetrators were released
with all charges against them dropped by state prosecutors
https://www.nytimes.com/2013/05/10/nyregion/e
ight-charged-in-45-million-global-cyber-bank-
thefts.html
Digital evidence
For digital crimes, it is necessary to secure digital evidence. So
Digital Evidence First Responders and Digital Evidence Specialists
become important.
The digital evidence first responder is usually the first person to
encounter a crime scene.
The first responder is responsible for determining the order of
magnitude of the crime and range of the crime scene. He/she must
secure the crime scene, and maintain the digital evidence.
responders
There are many guidelines for digital evidence first responders.
For e.g.
https://www.iacpcybercenter.org/wp-
content/uploads/2015/04/digitalevidence-booklet-051215.pdf
https://resources.sei.cmu.edu/asset_files/Handbook/2005_002_001_
14429.pdf
https://www.ncjrs.gov/pdffiles1/nij/219941.pdf
SWGDE
The Scientific Working Group on Digital Evidence (SWGDE)
brings together organizations actively engaged in the field
of digital and multimedia evidence to foster communication
and cooperation as well as to ensure quality and
consistency within the forensic community.
https://www.swgde.org/home
Policies
Private sector companies should bring out acceptable use policies
for their resources such as computers, networks, servers, printers
etc.
They should have a well-defined “Line of authority” i.e. who in
the company has the legal right to originate an investigation, who
can take ownership of digital evidence, and who can have access
to such evidence
Warning employees
Employees have to be informed that the company has the right to
inspect computer systems and networks for misuse. However,
companies have to be careful not to encroach on the privacy of their
employees.
Warning employees
Exercise
Do employees have a right to privacy at work?
How businesses observe privacy in the workplace?
What laws protect employee privacy?
What are the privacy concerns over employer access to
employee social media?
investigation
Collect evidence
The purpose of collecting evidence is to prove that a suspect
committed a crime or violated a company policy as the case may be
depending on whether it is a criminal case or a civil case
Preserve the evidence
Maintain the chain of custody
Chain of custody
Chain of custody in legal contexts, is the chronological
documentation or paper trail that records the sequence
of custody, control, transfer, analysis, and disposition of
physical or electronic evidence.
What is the importance of the chain of custody?
What happens when chain of custody is broken?
Exercise
Name various sources of digital evidence
What are computer crimes? Give distinct examples.
Give example of company policy violations.
Mention a systematic approach for dealing with a digital forensics
case.
How to plan for an investigation? What are the steps to be
followed?
References
Bill Nelson, Amelia Philips, Christopher Steuart, “
Guide to Computer Forensics and
Investigations”, Fifth Edition, 2015
Wikipedia