Introduction to Computer Forensics

Introduction to Computer Forensics

• Computer forensics is the scientific discipline of collecting, preserving, analyzing, and presenting digital evidence for legal proceedings.
• It involves dealing with digital traces left on computers, phones, and networks, similar to a detective's work but with digital evidence.
• Computer forensics experts are trained to find, interpret, and present digital evidence in a way that stands up in court.

Scope of Computer Forensics

• Computer forensics is used in various situations, not just for catching hackers.
• Usage includes cybercrime, corporate investigations, civil litigation, and accident/incident reconstruction.
• Cybercrime: Investigating crimes like hacking, malware attacks, fraud, and online scams.
• Corporate Investigations: Investigating employee misconduct, data breaches, or intellectual property theft.
• Civil Litigation: Gathering evidence related to contracts, intellectual property, or other disputes in lawsuits.
• Accident and Incident Reconstruction: Investigating accidents involving technology, like car crashes.

Purpose of Computer Forensics

• The goal of computer forensics is to answer questions.
• These question include identifying who is responsible for a crime, recovering stolen information, preventing future incidents, and building a case for prosecution.

Laws Governing Digital Evidence

• Fourth Amendment: Protects people from unreasonable searches and seizures, requiring a warrant or probable cause for investigators to search a computer.
• Electronic Communications Privacy Act (ECPA): Regulates how law enforcement can access electronic communications like emails, texts, and phone calls to ensure privacy.
• Computer Fraud and Abuse Act (CFAA): Makes it illegal to access computer systems without authorization.
• Digital Millennium Copyright Act (DMCA): Protects copyrighted materials from being copied or distributed illegally.
• Child Protection Act: Prohibits the production, distribution, and possession of child pornography.

Ethical Guidelines for Forensic Investigators

• Includes integrity to preserve evidence, objectivity to remain impartial, confidentiality to protect information, transparency to document all actions, and respect for privacy to avoid violating rights.

Types of Digital Evidence

• Common evidence types include files (documents, spreadsheets, presentations, images, videos), emails, browsing history, system logs, and network traffic.

Chain of Custody

• The chain of custody is a detailed diary of evidence's journey, documenting who collected, handled, or analyzed the evidence, when actions were taken, where the evidence was located, and what changes were made.
• It helps prove authenticity, establish a clear link between evidence and the crime, and avoid legal challenges based on tampering.

Common Cybercrimes

• Common cybercrimes include hacking, malware, fraud, identity theft, and child pornography.
• Hacking involves unauthorized access to computer systems and networks to steal data or disrupt services.
• Malware involves using malicious software to damage, steal, or disrupt computer systems.
• Fraud involves using computers to commit financial crimes like identity theft or online scams.
• Identity theft involves stealing someone's personal information to impersonate them and commit fraud.
• Child pornography involves producing, distributing, or possessing sexually explicit images of children.

Digital Evidence Collection and Preservation: Live Acquisition

• Live acquisition is the process of capturing data from a running computer system, including volatile data that could be lost if the system is powered down.

Live Acquisition Basics

• Live acquisition refers to capturing data from a running computer system including volatile data that could be lost if the system is powered down.
• It preserves the system’s state and activity at a specific moment.
• Live acquisition is necessary to preserve volatile data like RAM contents, running processes, open network connections, and registry settings.
• It helps prevent tampering by capturing the system's state before any modifications occur and enables real-time analysis to understand ongoing cyberattacks.

Tools and Techniques

• Memory Dumps: Capture system's RAM to preserve running processes and open files, requires tools like Volatility or WinDbg.
• Process Tracing: Analyzes running processes to identify suspicious activity by examining process lists, memory usage, and network activity.
• Network Traffic Analysis: Monitors and captures network communication to identify suspicious connections and data transfer using packet analyzers like Wireshark.
• Live Disk Imaging: Creates a snapshot of the entire running system with specialized tools and expertise, allowing for complete snapshot without interrupting the system.

Preserving Volatile Data

• Because failing to capture volatile data can result in a loss of critical evidence, making it difficult to reconstruct events.
• Strategies for capturing and analyzing memory contents:
• Memory Dumps: Extracts and analyzes RAM contents using tools like Volatility or WinDbg.
• Process Dumps: Capture specific processes in memory to examine their activity.
• Memory Analysis Tools: Identifies malware, analyzes the system’s state, and recovers deleted/corrupted files using specialized software.

Hands-on: Live Acquisition

• Use a Virtual Machine or a Practice Environment:
• Practical experience is essential for developing skills with live acquisitions.
• Set up a virtual machine to practice live acquisition techniques without risking damage to a real system.
• For example, VMware Workstation or VirtualBox to create a virtual machine running Windows or Linux.
• It is important to choose a suitable tool for live acquisition, like Volatility, WinDbg, or a specialized live imaging tool, like Volatility.
• Practice with chosen tools to perform live acquisition tasks on the virtual machine.
• It is also important to analyze/document the results of live acquisition and document findings.

Key Takeaways

• Live acquisition is critical for preserving volatile data, preventing tampering, and gaining real-time insights into system activity.
• Understanding how to perform live acquisitions effectively is essential for computer forensic investigators.
• Experiementing using virtual machines is crucial for developing skills and knowledge.

Project Ideas

• Live Acquisition Case Study: Simulation that involves performing live acquisition on a virtual machine to identify real time evidence after a cyberattack incident.
• Comparison of Live Acquisition Tools: Compare different tools based on features, capabilities, and suitable scenarios.

Digital Evidence Collection & Preservation: Static Acquisition

• Static acquisition involves creating a pristine copy of a storage device to ensure integrity/authenticity for investigation.

Static Acquisition Basics

• Static acquisition involves creating a bit-by-bit copy of a powered-down system/storage device (like a hard drive, SSD, USB drive).
• Why is Static Acquisition Essential?
• Preservation of Evidence: Safeguards original evidence by creating a separate copy to prevent alteration/modification.
• Investigation Without Affecting the Original: Image can be analyzed extensively without compromising the original device.
• Chain of Custody: Creating a forensic image is a critical step that is documented throughout an investigation.

Tools for Static Acquisition

• EnCase provides features to create forensic images, analyze file systems, and identify hidden/deleted data.
• FTK (Forensic Toolkit) offers features for disk imaging, data recovery, file system analysis, and reporting.
• Using dd (Command Line Utility) creates bit-by-bit copies of disk drives for forensic imaging.
• Sleuth Kit's range of tools provides for disk imaging, file system analysis.

Hashing

• Hashing is a cryptographic process that generates a unique, fixed-length string (hash value) for any input data, serving as a fingerprint.
• Hashing helps verify image integrity, establish authenticity, and document chain of custody by using hash values.
• It is important to Verification of Image Integrity by comparing the hash value of the original data and the hash value of the forensic image, investigators can ensure that the image is an exact copy and that no changes were made during the acquisition process.
• Algorithms include Message Digest Algorithm (MD5), Secure Hash Algorithm 1 (SHA-1), Secure Hash Algorithm 256 (SHA-256), and SHA-512.

Hands-on: Disk Imaging and Hashing

• Practical experience with disk imaging/hashing is essential for real-world investigations.
• Set up virtual/physical computer environment for forensic training.
• Choose a tool (EnCase, FTK, or dd).
• Create a forensic image.
• Calculate hash values using the same/separate hashing tool (md5sum or sha256sum).
• Lastly, compare the hash values.

Key Takeaways

• Static acquisition is a fundmental technique for preserving digital evidence, ensuring the integrity and authenticity.
• Hashing is crucial for verifying the integrity of forensic images and establishing the chain of custody.
• Practice with forensic imaging tools/hashing utilities is essential.

Data Recovery and Reconstruction

• The ability to recover/reconstruct data from damaged/deleted files is crucial for uncovering evidence/building a strong case.

File System Analysis

• File system analysis involves examining organization of data on storage device, such as metadata like names, sizes, location, timestamps and attributes.
• Understanding of file system, file system structure, and metadata.
• Identifying deleted files, hidden data.
• Key concepts include NTFS, FAT32, ext2/ext3/ext4 and what each file system provides.
• Tools like EnCase, FTK, and Sleuth Kit are used to examine file system structures and recover hidden data.

File Carving

• File carving recovers deleted files by searching raw disk data for headers/footers.
• Process - file signatures: headers/footers that identify format and type. Then forensic tools scan to identify potential deleted files.
• The tool reconstructs the deleted files by extracting the data between the header and footer.

Hands-on: Using Forensics Tools for File Carving

• Establish a practice environment using a virtual machine/controlled system containing deleted files.
• Use forensic tools like EnCase, FTK, or Sleuth Kit that have file carving capabilities.
• Perform file carving on the target disk/partition to recover deleted files.

Data Recovery from Damaged Devices

• Data recovery from damaged storage devices can be challenging because of physical, logical damage, to the file system.
• Data corruption occurs to power failures, malware attacks, or other events, making data recovery a complex task.
• Tools like Specialized Data Recovery Software handle various file systems, data corruption scenarios, and physical damage.
• Or by Disk Imaging and File Carving create a forensic image of the damaged device and use file carving techniques to extract files.

Data Reconstruction

• Data reconstruction involves piecing fragmented/incomplete data to restore file or set of files.
• Key techniques involve file system analysis, metadata, and file carving for signatures.
• You can also use data recovery software to reconstruct fragmented/corrupted files.

Case Study: Recovering Data from a Corrupted Hard Drive:

• Company computer hard drive corrupted due to power surge.

1. Create a forensic image.
2. Analyze the file system.
3. File Carving.
4. Data Reconstruction.
5. Verification.

Email and Internet Analysis

• Email / Internet Analysis helps analyze email messages and metadata to uncover evidence of fraud and other illigal activity.

Email Forensics

• The process of examining email messages & metadata to uncover criminal activity or misconduct.
• It analyzes email headers, attachments, content, time stamps, senders and recipients.
• Email Headers: Provide details like the origin, destination, and routing, can be used to trace the email's path and identify its origin.
• Email Content: Can reveal intentions, communication patterns, or evidence of criminal activity if scanned.
• Emails content must be scanned for Malware, Malicious Documents, or Stolen data.
• Email Spoofing: Disguising the email's origin to appear legitimate.
• Phishing: A form of social engineering that uses deceptive emails to trick recipients into providing sensitive information, such as login credentials or financial details.
• Tools: Specialized software tools like EnCase, FTK, etc.

Internet Forensics

• It analyzes Browsing history, cookies, cache data to reconstruct/ identify evidence of cybercrime.
• Browsing History: Websites visited, search queries, and pages viewed can reveal users' online patterns.
• Activity: To watch for Malware, phishing attempts, or data exfiltration.

Steps for Email / Internet Analysis

• Set up a practical environment with a dataset.
• Use tools like Encase, FTK or MailXaminer as brower forensics software.
• Be sure to analyze the email data and use a browser forensics tool to scan website visits and data.

Network Forensics

• Network forensics involves examining network traffic to identify evidence of cybercrime.

Capturing/Analyzing Network Traffic using Packet Analyzers

• Packet Analyzers, like Wireshark, capture/analyze network packets to understand communication flow, identify suspicious activity.
• Network Traffic Capture has uses for capturing network traffic from interfaces, taps, or capture files.
• Traffic Analysis: Using Wireshark’s looking for patterns and anomalies.
• Identify: Unusual Traffic Volumes and Protocol Anomalies can indicate malicious activity/network problems.
• Tools: Wireshark, tcpdump, Network Security Monitoring, Security Information and Event Management Systems.

Hands-on: Using Wireshark to Capture and Analyze

• Capture traffic from a network interface/packet capture file.
• Filter traffic.
• Examine the contents of captured packets for intrusions.

Network Protocols

• Network protocols provide forensic evidence through Protocol Headers, Protocol Interactions, Protocol Anomalies.

Key Takeaways

• Packet analyzers (Wireshark) are essential tools for capturing & analyzing network traffic.
• Understanding the protocols & data provides valuable insights.
• Practical experience with Wireshark is crucial.

Malware Analysis

• Analyzing to protect against malicious software is crucial to stopping the threats.

Malware Types and Behavior

• Viruses: Programs that spread by attaching themselves to executable files.
• Worms: Self-replicating programs that spread across networks.
• Trojans: Malicious programs disguised as legitimate software.
• Malware: Data encryption, attackers seeking payment.
• Spyware: Secretly monitors user activity.
• Rootkits: Hides its presence on the system and gives attackers persistent access by manipulating system files.

How Malware Operates

• Injection such as email attachments, malicious websites, infected files or vulnerabilities in software.
• To stop it you need to recognize the infection rate, modification of system processes, modification of registry settings, creating hidden files.
• Command and control servers, peer-to-peer networks or hidden channels within the system.

Malware Analysis Techniques

• Static Analysis: Examining code without executing it to understand capabilities and intentions.
• Tools like Disassemblers convert machine code into assembly.
• Dynamic Analysis: Executing malware in a controlled environment to observe its behavior.
• Monitor the network traffic for any potential malicious actions.

To analyze a suspected malware sample…

• Set up your environment using specialized software or Virtual Machines.
• Load a malware sample. Isolate it properly! Then, monitor the activity / analyze findings of what that malware did.

Key Takeaways

• Static/dynamic analysis techniques provide insights.
• Sandbox environments safely analyze malware.

Hashing, Digital Signatures, and Steganography

Hashing Algorithms

• Mathematical functions take an input (data) of any size and produce a fixed-size output called a hash value or digest. Example MD and SHA.

Properties of Hash Functions

• One-way, Deterministic, Collision Resistance.
• Has uses for Data Integrity Checks, Passwords, and Digital Signatures.

Digital Signature Verification

• Authenticates & gives integrity to digital documents.
• Process is hashing, encryption, attachment, verification, comparison.
• Give benefits of Authenticity, Integrity, Repudiation.

Steganography

• Unlike cryptography, which focuses on encrypting data to make it unreadable, steganography aims to hide the very existence of the secret data.
• Hidden by Least Significant Bit (LSB) Insertion, Text Encoding, Spread Spectrum Techniques.
• Used to hide secret communication, protect sensitive information, digital water marking