Introduction to Digital Forensics

Digital Forensics

• Digital forensics is the application of forensic science to legal matters, focusing on computer operations, software, files (digital and electronic), and technology-based appliances/storage devices.
• Forensic evidence adheres to stringent standards of reliability and scientific integrity to be admissible in court.

Crime Context

• Crimes can be categorized into non-cyber and cyber crimes.
• Non-cyber crimes occur in environments with digital technologies.
• Cyber crimes use digital technology to commit the crime.
• Several examples of non-cybercrimes: sexual abuse of children, fraud, murder, stalking, ID theft, and extortion.

Cyber Crimes

• Cyber crimes arise from computer use
• Malware is malicious code that includes viruses, logic bombs, and worms.
• Hacking/Cracking, two forms of internet and computer privacy/copyright breaches, are usually malicious.
• Software Piracy - the illegal copying, distribution, or use of software.
• Telecommunications Fraud involves theft of telecommunication services or using them to commit other kinds of fraud.
• Victims include consumers, businesses, and communication service providers.
• Online Stalking is cyberstalking through the internet or electronic means to stalk or harass.
• Online Auction Fraud schemes misrepresent products advertised for sale via internet auction sites or non-delivery after purchase.

Indicators as Evidence Sources

• Evidence of a crime varies based on the type.
• Common evidence sources: address book, chat logs, cheques, credit card data, databases, diaries and calendars, digital camera/image editing software, disk and traffic encryption software, email, encrypted, file sequences, financial records, hacking tools, internet history, or multiple accounts.

Malware Types

• A virus replicates by inserting itself into other computer programs and may carry a malicious payload.
• A trojan masquerades as legitimate software to trick users into installing it.
• A worm propagates itself across a network with or without a payload, potentially causing significant harm.

Additional Malware Types

• A rootkit hides that an operating system has been comprised, sometimes replacing executes.
• Backdoors bypass authentication for remote access to a system, which is normally undetected.
• It can take the form of installed programs like Back Orifice.
• Spyware is installed without the owner's knowledge to collect private data.
• Adware displays unwanted ads, redirects search requests, and collects marketing data.
• Scareware tricks users into buying useless or dangerous software.
• Ransomware threatens to publish or block access to a victim's data until a ransom is paid.
• Rogue security software deceives users into paying for fake malware removal.
• Advanced Persistent Threat (APT) is a prolonged, undetected network attack to gain unauthorized access.
• Botnets, networks of infected devices running bots, are used for DDoS attacks, data theft, spam, and unauthorized device access.

Malware Analysis Techniques

• Malware analysis involves static and dynamic techniques.
• Static analysis examines inactive malware and is basic and quick.
• It is mostly ineffective against sophisticated malware and may miss behaviors.
• Dynamic analysis executes the malware to analyze real-time activities.
• It understands functionality and can detect technical indicators to reveal signatures, domain names, IP addresses, file paths, registry keys etc.

Hacking Definitions

• The word "hacking" can refer to hobbyist work with how computer systems work at a basic level.
• It can refer to breaking into computer systems, a definition commonly used over the first definition.

Denial of Service (DoS)

• A DoS attack deprives users or organizations of expected resource services via distributed systems.
• DoS attack methods include bandwidth or processor exhaustion, resource unavailability, and network exclusion.

Software Piracy

• Virtually all software programs now use an end-user license agreement, which needs to be agreed to by the user.
• Software piracy is violating the EULA agreement.
• Copyright infringement, occurs in unauthorized copies of music/movies.
• P2P file-sharing, while legal, is mostly used to distribute copyrighted material.
• High-quality versions of media become available shortly after release.

General Forensics Principles

• Crime scene must be "frozen" to prevent contamination when collected.
• There must be a chain of custody.
• All examination procedures must be auditable for expert review.

ACPO Principles of Digital Forensics

• Principle 1: Do not alter data that may be relied upon in court.
• Principle 2: Accessing original data must be performed by a competent person giving evidence explaining relevance.
• Principle 3: An audit trail of all processes of digital evidence needs to be created and maintained.
• An independent third party should be able to reexamine and achieve the same results.
• Principle 4: The investigator is responsible for law adherence.

Why Digital Forensics is needed

• Technology increases, so crimes involving technology with evidence will continue to do the same.
• The average bank robbery nets $7,500, and 80% of offenders get jailed.
• White-collar crimes annually earn about $10 billion with less than 5% of offenders in jail.
• Digital access is ubiquitous as non-violent crimes are considered by juries.

Securing the Crime Scene

• A scene, in the event of digital evidence, may lead to crimes such as: murder, gambling, kidnapping, bond scams, rape, confidence games, web defacement, auto theft, child exploitation etc.
• Forensic investigators can operate in a hostile environment with access to the evidence.
• It is clear to protect the physical evidence in electronic environments.

Admissibility of Evidence

• Edmond Locard built the first crime lab in 1910.
• LOCARD's Exchange Principle is that every contact leaves a trace.
• The Frye v. U.S. (1923) case set the first acceptance of scientific evidence meaning expert testimony is is admissible if underlying, scientific principles have general acceptance.
• The Daubert v. Merrell Dow (1993) case set a new standard for evidentiary reliability on accepting scientific evidence

Daubert Test

• A judge determines evidence admissibility based on testing, error rate, publication, and acceptance.

Digital Forensics Process

• The digital forensic process uses multiple techniques to analyze and report information.
• Identification focuses on what incident has occurred.
• Preservation maintains the evidentiary chain.
• Collection has the forensically correct copy of a media, creating a mirror image
• Examination is a gathering or pertinent data from files, deleted files, etc.
• Analysis interprets the findings and reconstructs a picture of relevant information.
• Presentation involves reporting the results.

Digital Forensics Examinations

• Computer and network evidence alone doesn't convict a suspect, but it can solidify a behavior pattern.
• Computer and forensic analysis can counter false defenses.
• Digital forensic analysis must be tied to the investigation.
• You can’t ignore both incriminating and exculpatory evidence.
• As part of the investigating team, examiners need to know what the investigator needs like pictures/browser history.
• Digital forensic examiners must bring knowledge to the investigation but are note private investigators.