_____________________________

IJoFCS (2018) 1, 22-28

The International Journal of
FORENSIC COMPUTER SCIENCE
_____________________________
www.IJoFCS.org
DOI: 10.5769/J201801002 or http://dx.doi.org/10.5769/J201801002

Comprehensive study of digital forensics branches and

tools
Prachi Ankush Zinge1, Madhumita Chatterjee 2
(1) Department of Computer Engineering, PCE, New Panvel, University of Mumbai, Email: [email protected]
(2) Department of Computer Engineering, PCE, New Panvel, University of Mumbai, Email:
[email protected]

Abstract: In today’s world, digital devices are being integral part of our life and these digital
devices are evolving with new technology. Some people make use of new technology for their
personal gain. Cybercrimes are growing rapidly due to evolving technology. Digital forensics is the
science which encompasses, identify, analyze, recover and investigate digital evidences found in
digital devices. To make the forensic process effective the discipline is subdivided into various
branches, where specialized tools are available for a particular branch. Every forensic tool is
associated with some of the limitations which disturb the investigation process. Hence, proper forensic
tool which satisfies the requirement of the case is required to be used.

Key words: Digital Forensics, digital forensic branches, digital forensics tool

I. Introduction Forensics, Small Scale Device Forensics or

Mobile Device Forensics and Android Forensic
In today’s modern era, a lot of cybercrimes take according to attributes of computing and the type
place due to increased use of computers. These of device used. Many computer parts such as
crimes include various types of frauds, ponzi hard disks, cell phones, iPods, pen drives, digital
schemes and money transfer by unknown cameras, CDs, DVDs, floppies, computer
claimants to their accounts. The computers are networks, the Internet etc. contains digital
interconnected with each other in the form of evidence. Digital evidence can be hidden in
networks and exchange huge amount of data pictures (Steganography), encrypted files,
responsible for cyber fraud and cybercrime. password protected files, deleted files, formatted
Cyber criminals use IT infrastructure or hard disks, deleted emails, chat transcripts etc.
technology that has led to the emergence of Digital evidence is useful relating to crimes such
Digital Forensic to deal with such crimes. as online banking frauds, online share trading
fraud, source code theft, credit card fraud, tax
evasion, virus attacks, cyber sabotage, phishing
2. Digital Forensic attacks, email hijacking, denial of service,
hacking, murder cases, organized crime, terrorist
Digital Forensic expanded to various sub-
operations, defamation, pornography, extortion,
disciplines, namely Computer Forensics, Memory
smuggling etc.
Forensics, multimedia Forensics, Network

___________________________________
Paper submitted on: May 14th, 2018
 ____________________________________________ Prachi Ankush Zinge, and Madhumita Chatterjee 23
Digital Forensics is “the use of scientifically preserved to maintain and guarantee the Chain of
derived and proven methods for the Custody. For this, service providers are needed
preservation, collection, validation, identification, who will ensure that the evidence offered in court
analysis, interpretation and presentation of digital is the same as that was collected and there was
evidence for the purpose of facilitating or no tampering with it while it was in the custody.
furthering the reconstruction of events of a
criminal nature or helping to facilitate the Analysis: Analysis phase plays an
unauthorized actions shown to be disruptive to important role because the result obtained after
planned actions”[11]. Nowadays, significant the analysis of the evidences using digital
changes have taken place in the digital forensics forensic tools helps the investigators to identify
process. the cause of the incident and provide them
effective results sufficient to be submitted in the
court for justice. This phase includes recovery of
deleted content and examining the system
2.1 Objective of Digital Forensic content.

With the advancement of the computer, there is a Presentation: This phase consists of
revolution in the way humans live, work and play. coming to the conclusions on the basis of
Businesses are growing with the help of the evidences obtained from the forensic
computers rapidly. But there is a dark side of investigation. In this phase, acquired data is
computers also. Cybercriminals use them to carry processed to derive relevant information as per
out malicious assaults. These assaults are need and is based entirely on policy and law.
varying from fraud and identity theft to hacking,
The above process is generally recognized and
embezzlement and many such activities.
followed across the world in the investigation of
Evidence can be derived from computers and
cybercrimes
used in a court against suspected accused.
Initially, the judges accepted such computer
evidence as any other type of evidence smoothly.
But, as data became more ambiguous with the
3.BRANCHES OF DIGITAL FORENSICS
advancement of digital devices, computer-derived Digital Forensics emerged because of the
evidence lost its reliability gradually. cybercrimes carried out by use of IT infrastructure
or technology by cyber criminals. Below are given
Hence, for preserving the integrity of the evidence it’s subdisplines.
and to have a subject matter expert opinion,
cybercrimes are investigated for identifying,
generating, analyzing, verifying and presenting Computer
forensic
digital evidences in the court using standard
tools. As a precaution, certain policies,
guidelines, standards, laws which are acceptable
Mobile Memory
to the jurisdictional process are followed for forensic forensic
getting hold of the criminal. It generally comprises Digital
forensic
of four major processes:

Acquisition: In this first phase of

investigation, the digital devices are identified for
Network Multimedi
digital evidences, and then collected in such a forensic a forensic
way that the original state or content of the
evidences remains the same and any deletion or
addition cannot be in any possible manner. Figure 1 : Types of Digital Forensic
Preservation: The evidences collected
from the suspicious machines should be
 ____________________________________________ Prachi Ankush Zinge, and Madhumita Chatterjee 24
The digital devices contain sensitive personal • To recover, analyze, and preserve
information. So it is risky if they are lost or stolen. computer related materials to be
Forensic analysis of these devices by developers presented as evidence in a court of law
and the users can make them more aware of how • To identify the evidence quickly, estimate
and which data to store or not to store. Sensitive the potential impact of the crime on the
information can be used by the attacker to spoof victim, and assess the internet and
the real identity of a person. identify the culprit.
Digital forensics plays a very crucial role in the 3.2 Memory Forensics
cybercrime investigations. To submit any digital Memory forensics or memory analysis deals with
or cyber trails as evidence in the court of law, the the analysis of volatile data in a computer’s
digital evidences must follow the four Daubert’s memory dump. Information security professionals
guidelines to be accepted in the court of law, conduct memory forensics to investigate and
which are: identify attacks or malicious behaviors that do not
1. Testing- All the tools taken in identifying, leave easily detectable tracks on hard drive data.
generating and verifying the digital evidence must Memory forensics can provide a way into the
be scientifically tested and proven efficient and runtime system activity, including open network
reliable acceptable by any court of law. connections and recently executed commands or
processes. In many cases, critical data pertaining
2. Error Rate- A known error of the process is to attacks or threats exist solely in system
identified. The error rate for any tool is calculated memory – namely network connections, account
on the basis of the number and severity of bugs credentials, chat messages, encryption keys,
produced in the system. running processes, injected code fragments, and
internet history which is non-cacheable. Any
3. Publication- The tools used during the program – malicious or otherwise – must be
investigation process must be common with loaded in memory to execute, makes memory
experts able to work with those tools. The forensics important for identifying obfuscated
publication guideline ensures that the procedure attacks.
has been documented and has undergone
several peer reviews to assure quality and work. 3.3 Multimedia Forensics
4. Acceptability - The tools and the results Multimedia forensics deals with the analysis of
generated using them should be acceptable by media files (images, audio, video files, documents
the digital forensics community. and various file types) which are used to hide
information using Steganography.
Steganography is a technique of hiding a secret
message within an ordinary message and
3.1 Computer Forensics extracting it at the destination to maintain
confidentiality of data. Criminals have become
Computer forensics as defined by the CSI is “The more aware so it has also been used as a mode
preservation, identification, extraction, of communication to hide confidential data and
interpretation and documentation of computer send it across to the intended audience in several
evidence, to include the rules of evidence, legal cases.
processes, integrity of evidence, factual reporting
of information found, and providing an expert 3.4 Network Forensics
opinion in a court of law or other legal and /or Network forensics deals with the data found
administrative proceedings so as to what was across a network connection mostly incoming and
found[21]. outgoing traffic within the host in the Network and
analyze the traffic data logged through firewalls or
The main goals of a computer forensic
IDS or at network devices like routers. The goal
investigation are:
 ____________________________________________ Prachi Ankush Zinge, and Madhumita Chatterjee 25
of network forensic is to trace the source of the risk that one forensic tool can be good for a
attack to prosecute the cyber criminals. specific version may not work for the successor
version. Sometimes the power consumption may
Network forensics is defined as “The use of lead to vanishing of the information available on
scientifically proven techniques to collect, fuse, these devices as they are power constrained.
identify, examine, correlate, analyze, and This can occur during one the-fly data acquisition
document digital evidence from multiple, actively from the volatile memory. Lack of standard
processing and transmitting digital sources for the hardware and software interface further poses
purpose of uncovering facts related to the challenge in MDF for the practitioners.
planned intent, or measured success of Sometimes the storage is damaged or corrupt
unauthorized activities meant to disrupt, corrupt, and taking data out of it is very challenging.
and or compromise system components as well Variety of applications for the same task on the
as providing information to assist in response to same mobile platform also put challenge, for
or recovery from these activities”[7]. example web browsers forensic is also in demand
and there are different types of browsers for
Network investigation includes the reformation android platforms, which are different from each
and analysis of data from computer networks
other in many respects.
associated with having been alternated or got to
in an unauthorized manner. Its purpose is to
permit specialists to reason about the
circumstances or the activity and to submit proof
in front of a court of law [7]. 4. FORENSIC TOOLS
4.1 Forensic toolkit (FTK)[12]: FTK Imager is a f
ree tool that can be downloaded from Access Dat
a on its website. FTK is used to acquire, analyze,
3.5 Mobile Forensics and to image hard disk drive. It calculates MD5 h
ash values and confirms data integrity, includes a
The unlimited use of Mobile Phones, these days
variety of tools that include recover deleted files,
have made it inevitable source for forensic
analyze email data searching and password crac
analysis, from criminal and noncriminal point of
king [25]. Another characteristic of FTK Imager is
view. Mobile forensics is the science of
that it makes a bit-for-bit duplicate image of the m
recovering digital evidence from a non-tampered
edia, thereby avoiding accidental manipulation of
mobile device under forensically sound conditions
the original evidence. The installation of FTK Ima
using legally accepted methods.
ger is very simple and the option of using the tradi
Today mobile Phones have become so pervasive tional version, with the need to install the product
that they rule us in many ways which includes; hard disk is available. It has the benefit of allowin
they are not only helping us to make and attend g FTK Imager to run directly from a USB key [13].
a call, but also many business activities, financial
transactions, social networking, SMS, MMS,
video calls, photography, electronic mail, Web 4.2Autopsy[13] : Autopsy® is a digital forensics
browsing, multimedia capturing, basic editing and platform and graphical interface to The Sleuth
playback, electronic document previewing, store Kit® and other digital forensics tools. It displays
and manage Personal Information via Persona system events in a graphical interface to help
Information Management (PIM) applications (e.g. identify activity and extracts web activity from
Contacts, calendar, etc.). common browsers to help identify user
activity[26]. It uses RegRipper to identify recently
These flexibilities create significant challenges for accessed documents and USB devices and
mobile forensic tool manufacturers and identifies short cuts and accessed documents.
examiners in hunting at the right location and Autopsy analyzes disk images, local drives, or a
right technique inside the phone. These variations folder of local files[13]. Tool groups files by their
and changes are so fast that there is always the
 ____________________________________________ Prachi Ankush Zinge, and Madhumita Chatterjee 26
type to find all images or documents and the Hex Workshop, you can edit, cut, copy, paste,
examiner can view videos and images in the insert, fill and delete binary data. It allows to jump
application and not require an external viewer. It to file or sector location, find or replace data,
displays thumbnail of images to help quick view perform arithmetic, bitwise, and logical
pictures. It filters out known good files operations, binary compare files, generate
using NSRL and flag known bad files using checksums and digests, view character
custom hash sets in Hash Keeper, md5sum, and distributions and export data to RTF or HTML for
Encase formats and also tag files with arbitrary publishing. Hex Workshop includes a Sector
tag names, such as 'bookmark' or 'suspicious', Editor with disk imaging tools, a Base Converter
and add comments. The Tool Extracts strings for converting between hex, decimal and binary
from unallocated space and unknown file types in data types, a Hex Calculator supporting
many languages. It displays file system and arithmetic and bitwise operations, an expression
meta-data structure details. calculator supporting variables, conditionals,
iteration and arithmetic and bitwise operations,
and a data visualizer designed to help you
visually identify patterns and interesting data from
4.3 Winhex[14]: It is made by X-Ways Software
rendered images.
Technology AG of Germany, is a powerful tool for
data analysis, editing, and recovery. WinHex is a
global hexadecimal editor, useful in the field of 4.6 QuickStego[17]: QuickStego is a freeware
computer forensics, low level data processing, that is used for image steganography forensics.
data recovery, and IT security[14]. It scrutinizes QuickStego lets you hide text in pictures so that
and edits all sorts of files, recover missing data or only other users of QuickStego can retrieve and
deleted files from digital devices. Also, it is a RAM read the hidden secret messages[28]. Once text
editor, data interpreter. WinHex is in its core a is hidden in an image the saved picture is still a
universal hexadecimal editor, particularly helpful 'picture', it will load just like any other image and
in the realm of computer forensics, data recovery, appear as it did before[28]. The image can be
low-level data processing, and IT security and saved, emailed, uploaded to the web as before,
inspects and edit all kinds of files, recover deleted the only difference will be that it contains hidden
files or lost data from hard drives with corrupt file text. The larger the image, the more text that can
systems or from digital camera cards[27]. It is a be concealed within and QuickStego will tell you
disk editor for hard disks, floppy disks, CD-ROM how many characters of text you must lose if you
& DVD,ZIP,Smart Media,Compact Flash,etc. go over this limit per picture[28]. In practice a lot
Winhex has various data recovery techniques. of secret text can be hidden in even a small
Random-number generator Supports files of any image. QuickStego imperceptibly alters the pixels
size. Very fast. Easy to use. Extensive program (individual picture elements) of the image,
help. encoding the secret text by adding small
variations in color to the image. In practice, to the
human eye, these small differences do not
4.4 Mandiant Redline[15] - Mandiant RedLine is appear to change the image.
a popular tool for memory and file analysis. It
collects information about running processes on a 4.7 Wireshark[18] : Wireshark is a traffic
host, drivers from memory and gathers other data capturing and sniffing tool. It uses Winpcap to
like meta data, registry data, tasks, services, capture packets, so it can only capture the
network information and Internet history to build a packets on the networks supported by winpcap.
proper report. Captures live network traffic from Ethernet, IEEE
802.11, PPP/HDLC, ATM, Bluetooth, USB, Token
4.5 Hex Workshop[16]: Hex Workshop Ring, Frame relay, FDDI networks[29]. Captured
integrates advanced binary editing and data files can be programmatically edited via
interpretation and visualization with the ease and command line. Wireshark captures live packet
flexibility of a modern word processor[16]. With data from a network interface and open files
 ____________________________________________ Prachi Ankush Zinge, and Madhumita Chatterjee 27
containing packet data captured with data files, passwords, and data from apps such
tcpdump/WinDump, Wireshark, and a number of as Skype, Dropbox, Evernote, Facebook,
other packet capture programs[18]. It import whatsapp, Viber, Signal, wechat and many
packets from text files containing hex dumps of others[20].
packet data and also displays packets with very
detailed protocol information and save packet 4.10 FonePaw Android Data Recovery[21] :
data captured. Export some or all packets in a The deleted information still exists on the phone
number of capture file formats and filter packets and you cannot find them only because it is
on many criteria and search for packets on many hidden[21]. To get them back, you need to make
criteria[18]. Wireshark colorize packet display sure that you do not factory reset the phone, or
based on filters and create various statistics. add new operations to it. That is, make sure that
the deleted files have not been overwritten. More
4.8 Network Miner[19] : Network miner is a important, you need a professional recovery tool,
network forensic analysis tool (NFAT) for for instance, FonePaw Android Data Recovery.
windows that is used as a passive network Wrongly delete contacts, photos or messages,
sniffer/packet capturing tool in order to detect whatever your phone's symptoms, FonePaw
operating systems, sessions, hostnames, open Android Data Recovery has prescribed. The
ports etc. without putting any traffic on the recoverable files include deleted/lost photos,
network which extracts files and certificates contacts, text messages, WhatsApp messages
transferred over the network by parsing a pcap and photos, videos, music, voice recordings,
file by sniffing traffic directly from the network[19]. document files and more[21]. This program is
NetworkMiner makes it easy to perform advanced easy to operate and efficiently. FonePaw Android
Network Traffic Analysis (NTA) by providing Data Recovery is a risk-free, allowing you to
extracted artifacts in an intuitive user interface. scan, preview and recover what have been lost
The way data are presented not only makes the from your Android phone securely[21]. Photos
analysis simpler, it also saves valuable time for and videos that are captured and downloaded
the analyst or forensic investigator and this can be easily retrieved. You can select file types
functionality can be used to extract and save to scan and regain at will. But you are required to
media files (such as audio or video files) which make sure your deleted files have not been
stream across a network of websites such as overwritten before recovery. So if data loss
YouTube[19]. User credentials (usernames and happens, stop using mobile phone.
passwords) for support protocols are extracted by
NetworkMiner and displayed under the
"Credentials" tab[29].
5. Conclusions
4.9 MOBILedit[20]: MOBILedit[20] supports
extraction and viewing data from different sources In today’s digital world, it is important to secure
such as; Contact book, call history, text and our digital devices and data from cybercriminals.
multimedia messages, files, calendars, notes, Digital forensic tools play a vital role to recover
reminders, raw application data, IMEI, operating deleted data as well as help to find perpetrators
systems, firmware including SIM details (IMSI), by analyzing evidence. There are so many tools
ICCID and location area information. Wherever of forensic and each tool has different operation.
possible MOBILedit based forensic is also able to So it becomes difficult to choose the appropriate
retrieve data deleted from phone memory and tool for respective incident. The above study tells
can bypass the passcode, PIN and phone backup you about different forensic tools for different
encryption techniques too. With MOBILedit forensic branches.
Forensic Express, you can extract all the data
from a phone with only a few clicks. This includes
deleted data, call history, contacts, text
messages, multimedia messages, photos, videos,
recordings, calendar items, reminders, notes,
 ____________________________________________ Prachi Ankush Zinge, and Madhumita Chatterjee 28
[11] E. Casey, Digital Evidence and Computer Crime:
References Forensic Science, Computers, and the Internet,
Academic Press,ELSEVIER, 2011.
[1] Monali P. Mohite, S. B. Ardhapurkar, Design and
implementation of a cloud based computer forensic [12]https://accessdata.com/product-download/ftk-
tool,2015th fifth International Conference on imager-version-3.2.0/
Communication Systems and Network Technologies,
IEEE, 2015. [13]https://www.sleuthkit.org/autopsy/download.php

[2] Lianhai Wang, Ruichao Zhang, Shuhui Zhang, A [14]http://www.winhex.com/winhex/hex-editor.html

model of computer live forensics based on physical
memory analysis, The 1st International Conference on [15]https://www.fireeye.com/content/dam/fireeye-
Information Science and Engineering, IEEE, 2009. www/services/freeware/ug-redline.pdf

[3] Rob Witteman, Arjen Meijer, M-T.Kechadi, Nhien- [16] http://www.hexworkshop.com/overview.html

An Le-Khae, Toward a new tool to extract the
evidence from a memory card of mobile phones, 4 th [17] http://quick-stego.software.informer.com/1.2/
International Symposium on digital forensics and
security, IEEE, 2016. [18] https://www.wireshark.org/download.html

[4] Mohammad Wazid, Avita Katal, R H Goudar, [19] http://www.netresec.com/?page=NetworkMiner

Sreenivas Rao, Hacktivism Trends, Digital Forensic
[20] http://www.mobiledit.com/downloads/#forensic
Tools and Challenges: A Survey, Preceedings of 2013
IEEE Conference on Information and Communication [21] https://www.fonepaw.com/android-data-recovery/
Technologies(ICT 2013), IEEE, 2013.
[22] http://csisite.net/forensics.htm
[5] Ebru Celikel Cankaya, Brad Kupka, A survey of
digital forensics tools for database extraction, FTC [23] Nihar Ranjan Roy, Anshul Kanchan Khanna,
2016- Future technologies conference 2016, IEEE, Leesha Aneja, Android phone forensic: tools and
2016. techniques International conference on computing,
communication and automation, IEEE, 2016.
[6] Sriram Raghavan, S V Raghavan, A study of
forensics and analysis tools, IEEE, 2013. [24]https://www.eccouncil.org/programs/computer-
hacking-forensic-investigator-chfi/
[7] Mrunal H. Mate,Smita R. Kapse, Network Forensic
Tool- Concept and Architecture, 2015 fifth International [25] Nilakshi Jain1 , Dr. Dhananjay R Kalbande, A
Conference on Communication Systems and Network Comparative Study based Digital Forensic Tool:
Technologies, IEEE,2015. Complete Automated Tool, The International Journal of
FORENSIC COMPUTER SCIENCE,
[8] Radhika Padmanabhan, Karen Lobo, Mrunali www.IJoFCS.org,2015.
Ghelani, Dhanika Sujan, Mahesh Shirole, Comparative
analysis of commercial and open source mobile device [26] http://resources.infosecinstitute.com/7-best-
forensic tools, IEEE, 2016. computer-forensics-tools
[27]https://www.computersecuritystudent.com/FOREN
[9] Noble Kumari, A. K. Mohopatra, An insight into
SICS/Windows/Miscellaneous/lesson3/index.html
digital forensics branches and tools, 2016 International
Conference on Computational Techniques in [28] http://www.quickcrypto.com/free-steganography-
Information and Communication Technologies, IEEE, software.html
2016.
[29] http://www.forensicswiki.org/wiki/Wireshark
[10] Neelam Maurya, Jyoti Awasthi, Raghavendra
Pratap Singh, Dr. Abhishek Vaish, International
Journal of Advanced Engineering and Global
Technology, Vol-03, Issue-07, July 2015.