Digital and Cyber Forensics Overview

Digital Forensics

• Recovers and analyzes data from digital devices (desktops, notebooks, tablets, smartphones)
• Is closely related to Cyber Forensics

Cyber Forensics

• Focuses on detecting and investigating cybercrimes
• Gathers and analyzes evidence within the cyber space

History of Forensics

• 1835: Henry Goddard uses physical analysis to connect a bullet to a murder weapon
• 1836: James Marsh develops a chemical test to detect arsenic, used in a murder trial
• 1930: Karl Landsteiner classifies human blood groups, earning him the Nobel Prize
• 1892: Sir Francis Galton establishes a system for classifying fingerprints
• 1984: The FBI establishes the Magnetic Media Program, later renamed to Computer Analysis and Response Team (CART), marking the beginning of computer forensics
• 1988: The International Association of Computer Investigative Specialists (IACIS) is formed, dedicated to training and certifying professionals in computer forensics
• 1995: The International Organization on Computer Evidence (IOCE) is formed
• 1997: G8 (Group of Eight Industrialized Nations) mandates training for law enforcement to address high-tech crimes
• 1998: The first INTERPOL Forensic Science Symposium is held
• 2000: The first FBI Regional Computer Forensic Laboratory is established

Cyberforensics Stages (AAEP)

• Acquire: Identification and preservation of digital evidence
• Analyze: Technical analysis of the evidence
• Evaluate: Legal interpretation and assessment of the evidence by lawyers
• Present: Presenting digital evidence in a legally acceptable manner for legal proceedings

OSSTMM (Open-Source Security Testing Methodology Manual)

• A peer-reviewed security auditing methodology for assessing against regulatory and industry requirements
• Primarily developed for penetration testing, security analysis, and operational security assessments

Cyberforensics Usage

• Intellectual Property Theft
• Industrial Espionage
• Employment Disputes
• Fraud Investigations
• Forgeries
• Bankruptcy Investigations
• Inappropriate Email and Internet Use in the Workplace
• Regulatory Compliance

Autopsy

• Open-source forensics platform used by professionals in law enforcement, national security, litigation support, and corporate investigations
• Runs on Linux, Windows, and Mac

File Carving

• Recovering hard drive data and deleted files using tools like TestDisk

Forensic Carving Tools

• MagicRescue: Identifies files using magic bytes (file patterns) and recovers data from corrupted drives or partitions
• Scalpel: A fast file carver that uses header and footer definitions to extract files from image files or raw device files
• Scrounge-NTFS: Recovers data for NTFS filesystems by rebuilding the directory structure from hard disk blocks

Forensic Imaging

• The process of making an exact copy of digital storage media to preserve its contents and structure for later analysis

Forensic Imaging Tool

• Guymager: A forensic imager supporting different image file formats and designed for fast, user-friendly operation

Python for Cyberforensics

• Python is a programming language known for its simplicity, readability, and versatility. It is widely used in cyberforensics for various tasks.

Python's Advantages

• Ease of Use: Python's simple syntax and abundance of libraries make it easy to learn and apply.
• Productivity: Python's concise nature allows developers to write code quickly and efficiently.
• Readability: Python's clear and structured syntax makes it easy to understand and maintain code.
• Natural Language Toolkit: Provides tools for processing and analyzing natural language data.
• AI Processing: Python facilitates both symbolic and statistical AI processing:
  • Symbolic: Uses Python's built-in data types for strings, lists, and more.
  • Statistical: Leverages Python's strong numeric processing capabilities for matrix operations, probability, and machine learning code.

Python Basics

• Whitespace Significance: Indentation and newlines are crucial in Python for defining code blocks.
• Comments: Begin comments with '#' (hash symbol). Documentation strings, used as the first line of functions and classes, are valuable for documentation and tool integration.

Python Data Types

• Dynamic Typing: Python determines data types automatically during execution, but enforces data type compatibility.
• Strong Typing: While Python is dynamic, it still enforces data type consistency after determining the type.

Python Naming Conventions

• Names are case-sensitive and cannot start with a number. They can contain letters, numbers, and underscores.

Python Interactive Shell

• IDLE (GUI) Provides a graphical environment for interacting with Python.
• Python (command line): Provides command-line access to the Python interpreter.

Python as a Calculator

• The interpreter acts as a calculator, executing basic arithmetic expressions directly.

Lists:

• Python uses lists as a versatile data structure for storing collections of items. They are written as comma-separated values enclosed in square brackets.

Python Challenges for Cyberforensics

• Task Automation: Automating file analysis, comparison, creation, and other cyberforensics tasks using Python scripts.
• Script Files: Cyberforensic personnel can write scripts to accept arguments and execute specific tasks.

Argument Parsing

• The argparse module in Python creates user-friendly command-line interfaces for scripts, enabling them to accept arguments.

Forensic Carving

• Forensic carving techniques involve identifying and extracting specific patterns (like file signatures) from data to recover files, even if they are deleted or fragmented.

Forensic Imaging

• Forensic imaging involves creating an exact copy of digital storage media to preserve its contents for analysis.