Introduction to Computer Forensics

Forensic Analysis for Computer Systems - Course Plan

• The course covers forensic analysis for computer systems
• It includes an introduction to the subject
• It details the evolution of computer forensics
• It covers computer forensics processes
• It discusses computer forensics techniques and tools
• It outlines different types of computer forensics
• It examines forensic readiness

Course 1: Introduction

• 1.1 Overview:

  • The internet and its services are experiencing great progress and improvement
  • These improvements have created opportunities for e-commerce, distance learning, cloud computing, education, research, and public discourse
  • Worldwide connectivity has improved live, work, and communications; surpassing traditional telecommunication limitations
  • There has been increased automation of printing, introduction of digital mass media, and storage
  • This has greatly enhanced information sharing

• 1.1 Overview (continued):

  • This digital progress led to criminal innovation
  • Creating new forums for terrorist activities and criminal behaviors by adapting new technologies like wireless communications, social networking, and smart phones.
  • This complicated investigative scope, exacerbating vulnerabilities of governments, organizations, institutions, and individuals

• 1.2 Definitions:

  • Digital forensics is the art of recovering and analyzing contents on digital devices like desktops, notebooks/netbooks, tablets, and smartphones
  • With increased cybercrime assaults and adoption of digital devices, this branch gained importance for recovering and analyzing biological and chemical evidence in criminal investigations

• 1.2 Definitions (continued):

  • Forensic analysis examines for digital evidence in media to understand behaviors, to remedy incidents, and to support informed decisions
  • It's a process of using scientific techniques to identify, collect, examine, and report evidence to the court
  • The evidence is digital traces or artifacts that provide a factual scenario of events and answer plaintiff's questions

• 1.3 Computer Forensics History and Scope:

  • Important landmarks in computer forensics history include Hans Gross, the FBI, the Florida Computer Crime Act, Francis Galton, the International Organization on Computer Evidence (IOCE), and the FBI's Regional Computer Forensic Laboratory.
  • The Scientific Working Group on Digital Evidence (SWGDE) published the first book on best practices for computer forensics in 2002
  • Simson Garfinkel identified issues facing digital investigations in 2010
  • Organizations use computer forensics in cases like intellectual property theft, industrial espionage, employment secret disputes, fraud investigations, inappropriate internet/email use in the workplace, forgery matters, and bankruptcy investigations

• 1.3 Computer Forensics History and Scope (continued):

  • The scope of computer forensics extends beyond investigating crimes; it's also used for data recovery, log monitoring, data acquisition (from retired/damaged devices), and achieving compliance needs

• 1.4 Cyber Crime:

  • Any crime that involves a computer and network, the computer being for committing or targeting the crime
  • Dr. Debarati Halder defines cybercrimes as offences that intentionally harm the reputation or cause physical or mental harm/loss, using modern communication networks
  • Such crimes menace nation's security and financial health because both governmental and non-state actors engage in cybercrimes
  • These crimes include espionage, financial theft, and other cross-border crimes, sometimes known as cyberwarfare

• 1.4 Cyber Crime (continued):

  • Cybercrimes are conducted purely on computers (e.g., cyberbullying or spam) or facilitated by computers.
  • Classic example of facilitated cybercrime is fraud where computers are used to communicate with other fraudsters or to create fraudulent documents.
  • Criminal activities might be combined with criminal behavior in some digital investigations.
  • Forensic scenarios such as data-stealing cases in organizations

• 1.5 Objectives and Advantages of Computer Forensics:

  • Computer forensics help recover, analyze, and preserve materials to support legal investigations
  • To postulate the crime's motive and identify perpetrators
  • Ensure digital evidence's integrity at the crime scene
  • Recover deleted files/partitions, validate digital evidence, evaluate the malicious activity's impact, and produce complete detailed reports, and maintain proper evidence handling through the chain of custody.

• 1.5 Advantages of Computer Forensics (continued):

  • Clients may use it to find answers, make informed decisions, and resume the company activity
  • Computer forensics potentially leads to: discovery of new Indicators of Compromise (IOCs), consolidation of Threat Intelligence, and prevention of attacks

• 1.5 In brief:

  • Computer forensics is a process managing preservation, identification, extraction, and documentation of digital evidence usable in court cases. It's a science using tools to solve complex digital cases, like using computers, mobile phones, servers and networks to find evidence.

• 1.5 (additional information):

  • Digital forensics is helpful to analyze, inspect, identify and preserve the digital evidence from different devices (computers, mobile phones, etc).
  • Importance of Windows artifacts in digital forensics contexts, such as file systems, network shares, operating system information, user accounts, and event logs
  • The practice of collecting, analyzing and reporting digital evidence to legally admissible court is known as forensic examiners and investigators.

• What is IOC?

  • Indicators of compromise (IOCs) are digital evidence of a previous attack. Identifying these helps information security professionals detect intrusion attempts and other malicious activities
  • IOCs are related to suspicious system activities, abnormal file operations, applications or processes; as well as suspicious log entries.
  • IOC tools help mitigate cybersecurity threats.

• What is threat intelligence?

  • Threat intelligence is analyzed data about threat actors' motives, targets, and activities to make faster security decisions

• What is compliance?

  • Compliance is the state of being in accordance with guidelines or specifications, and it's important for organizations, concerning industry and government regulation requirements.