Computer Forensics and Digital Investigation

Computer Forensics and Digital Investigation

• Computer forensics uses scientific investigation and analysis to gather evidence from digital devices or networks.
• The evidence obtained is suitable for presentation in a court of law.
• Digital forensics is applied to devices like cell phones, tablets, gaming consoles, and computers.
• Digital forensics is used to fight computer crimes, and originated in law enforcement, computer security, and national defense.
• Digital forensics is valuable to legal professionals, law enforcement, policymakers, business community, education, and government.
• It is used in both criminal law and private investigations.

Computer Forensics History

• Computer forensics traces back to the 1980s with the increase in personal computers and their use in criminal activity.
• New 'computer crimes’ were recognized during that time.
• Computer crimes and related crimes have since grown.
• Internet crimes increased by 69% in 2020 compared to 2019.
• Initially, computer forensics was used primarily in law enforcement investigations
• Computer forensics expanded to include corporate investigations, civil litigation, cyber stalking, murder, fraud, etc.

Cyber Security

• Computer forensics is sometimes confused with cyber security.
• Cyber security focuses on prevention and protection.
• Computer forensics is more reactionary and involves tracking and exposing threats.
• System security usually encompasses both cyber security and computer forensics teams, which work together.
• Cyber security teams create systems and programs to protect data.
• Computer forensics teams recover data, investigate intrusion and theft.
• Information security focuses on protecting information and assets.
• Both computer forensics and cyber security require knowledge of computer science.

Definition of Computer Forensics

• Computer forensics is also known as computer forensic science.
• Computer forensics is a branch of digital forensic science.
• It involves extracting data and information from computer systems to function as digital evidence.
• Computer forensics provides forensic practices, legal processes, and ethical principles.
• These ensure reliable and detailed digital evidence that can be used for courtroom needs.
• Computer forensics guarantees a well-structured investigation and follow-up processes.
• This serves the purpose of resolving incidents and malfunctions in an organization.

Objectives of Computer Forensics

• Recover, analyze, and preserve computer and related materials.
• Postulate the motive behind the crime and identity of the main culprit.
• Design procedures at crime scenes to prevent digital evidence from being corrupted.
• Data acquisition and duplication: Recover deleted files and partitions to extract and validate evidence.
• Identify evidence quickly to estimate the potential impact of malicious activity on the victim.
• Produce a comprehensive computer forensic report.
• Preserve evidence by following the chain of custody.

Characteristics of Digital Forensics

• Identification: Identifying what evidence is present, where it is stored, and how it is stored.
• Preservation: Data is isolated, secured, and preserved.
• Analysis: Forensic lab personnel reconstruct data fragments and draw conclusions based on evidence.
• Documentation: Create a record of all visible data and findings from investigations.
• Presentation: Produce documented findings in court for further investigations.

Digital Forensics Procedure

• Identification: Determine the purpose of investigation & resources needed.
• Preservation: Isolate, secure and preserve data.
• Analysis: Identify tools and techniques, process data, and interpret results.
• Documentation: Document the crime scene, including photographs, sketches, and crime-scene mapping.
• Presentation: Summarize and explain conclusions based on gathered facts.

Advantages of Computer Forensics

• Produce evidence that can lead to the punishment of the culprit.
• Helps companies gather important information on their computer systems and networks.
• Efficiently tracks down cyber criminals globally.
• Protects an organization's money and time.
• Extracts, processes, and interprets factual evidence, proving cybercriminal actions in court.

Disadvantages of Computer Forensics

• Before digital evidence is accepted in court, it must be proved that it has not been tampered.
• Producing and keeping electronic records safe is expensive.
• Legal practitioners must have extensive computer knowledge.
• It is necessary to produce authentic and convincing evidence.
• If the tool used for digital forensics does not meet specified standards, the evidence can be rejected.
• Lack of technical knowledge by the investigating officer may not produce the desired result.

Limitations of Digital Forensic Investigation

• Need to produce convincing evidence:
• The examiner must comply with standards required for evidence in court.
• The investigator needs complete knowledge of legal requirements, evidence handling, and procedures.
• Lack of technical knowledge among the audience:
• Some are not familiar with computer forensics.
• Investigators must communicate findings clearly so that everyone understands.
• Cost: Producing and preserving digital evidence is costly.

Applications of Digital Forensics

• Criminal Law
• Evidence is collected to support or oppose a hypothesis in court.
• Procedures used are similar to those in criminal investigations but with different legal requirements.
• Private Investigation
• The corporate world uses digital forensics for private investigations.
• Digital forensics can be used if there is suspicion that employees are performing illegal activities that are against company policy.

Digital Forensics Application

• Commonly Used in Commercial Applications:
• Intellectual Property theft
• Industrial espionage
• Employment disputes
• Fraud investigations
• Inappropriate use of the Internet and email in the workplace

Case 1: Intellectual Property Theft

• It is based on stealing an idea, creative expression, or invention from a person or company.
• Most intellectual property theft cases are federal crimes.
• Copyrighted material is covered under this.
• Trademarks consist of "words, phrases, symbols, or designs.”

Digital Forensics

• It is a process of conducting an analysis on a doubtful device before giving it to law enforcement.
• It is conducted across several media or devices, such as mobile phones, computers, servers, and networks.
• Types of forensics are categorized by device being investigated.

Disk Forensics

• Involves extracting raw data from primary or secondary storage.
• Data extraction focuses on active, modified, or deleted files.
• Disk forensics is a science of extracting forensic information from digital storage media.
• Examples of digital storage media include: Hard disks, USB devices, Firewire devices, CDs, DVDs, Flash drives, and Floppy disks.

Process of Disk Forensics

• Identify Digital Evidence
• Identify storage devices at the scene of crime: IDE/ SATA,/SCSI, CD, DVD, Floppy disk, Mobiles.
• Authenticate the evidence
• Occurs in cyber forensics labs.
• Hash values of both source and destination media is compared to ensure they match.
• Seize & Acquire the evidence
• The hash value is a unique signature generated by hashing algorithms based on storage media content.
• The storage media is then secured and taken for processing after the hash value is computed.
• Preserve the evidence
• Original evidence is stored in a secure storage to avoid tampered electronic evidence.
• Analyze the evidence
• The important step of verification comes before the forensics process
• Analysis is done by collecting digital evidence from storage media
• Report the findings
• the report must be prepared bason the nature of the exam that’s being requested by the court or an investigation.
• Documenting
• It’s important to perform documentations for every step in the forensics process

Network Forensics

• Investigation and analysis of all traffic across a network.
• Can be applied to a spread of data-stealing malware or the analysis of cyber attacks.
• Falls under the digital forensics umbrella.
• Network forensics is related to the investigation of evidence left behind on a network after a cyber attack.
• Catch it as you can method
• Captures all network traffic for analysis, but requires a long process and a lot of storage.
• Stop, look and listen method
• Analyzing each data packet flowing across the network.
• This method Only captures what's deemed suspicious and worthy, requires high processing but less storage.

Examination of Network Forensics

• Recognition identification process has a vital effect on subsequent steps identifying and assessing an incident based on network indicators and this is covered in these steps
• Safeguarding Examiners must isolate the data for preservation and security, to prevent from accessing tampering
• Accumulating Documenting the physical scene and duplicating evidence by using standardization.
• Observation Keeping track of visible data.
• Investigation Investigation Agents can reconstruct data
• Documentation Forensic is a legal term: brings forensics to the court Procedure summarizes the overall conclusion.
• Incident Response Information is gathered to validate and assess incidents to intrusion detection

Database Forensics

• Refers to the branch of digital forensic science.
• Specifically related to the study of databases and their related metadata.
• Examines database access and actions performed.
• Criminal investigators examine large data security breaches for related information.
• A forensic examination of a database may investigate the timestamps.
• It helps relating to the update time of the row.
• This verifies, actions of a particular action user.
• Intervention of a database forensics specialist is required if there has been failure or corrupted information
• Also if there are inconsistencies on database related activities

Database Forensics (Continued)

• Use a read-only method or an identical forensic copy of data.
• Copy provides no data compromises when interfacing with a regular database. Diagnostic tools must be setup in a certain range
• Create a forensic replica to start analysis
• Reconstruct the data logs and files that are associated with the damage
• Decipher data in order to assess what caused corruption
• A forensic examination of a database may investigate the timestamps.
• Audit trails which are associated with user behavior, actions and the process, will isolate suspicious and illegal transactions

Malware Forensics

• Finding, analyzing, and investigating various properties of malware.
• Purpose: determine culprits and reason for attack.
• Method also includes checking out malicious code.
• Determining the entry, method of propagation, affect the system
• Tools and investigation are used to conduct investigations.

Types of Malware

• Backdoor
• Botnet
• Downloader
• Launcher
• Ransomware
• Rootkit

Ransomware

• Disables victim's access to data until ransom is paid.
• Ryuk ransomware has been targeting organizations with sophisticated ecime operations.
• This has been going on since August 2018
• Ryuk signals that large organizations have to pay if they use and operate with WIZARD SPIDER’S systems

Botnet

• Is a type of malicious that infects multiple internet connected devices.
• Turns them into networks or bots.
• A single attacker will perform large scale malicious actions, such as spam etc.
• Every infected device must be called as "bot"
• It's the same as an compromised computer acting as a remote controller agent.
• Common activities includes ddos attacks.
• With the use of overwhelming traffic targets they harvest personal information, log in and control it.
• They must receive harvesting through personal information like login and credentials.
• They will also use cryptojacking compute power to compromise users

Symptoms of Infected Systems

• The system will become unstable, so there will be utilization that affects data.
• Unknown new files or executables
• Unexpected and corrupted traffic to the site that is not expected.
• Alter the homepage with the approval of the user.
• Pop up randomly

Ways Malware Invades

• Instant Messaging Applications
• Chats like Internet Chat Relay (IRC)
• Devices such as External or Flash drives
• Attachments and Links in the emails
• Through file sharing (NeTBios)
• Fake programs
• Unstrusted websites

Conclusion

• Digital investigations and analyses should include: disk forensics, network forensics, database forensics and malware forensics.