Computer Forensic and its uses:- Computer your computer forensics experts should be able

Forensics is a scientific method of to safely recover and analyse otherwise

investigation and analysis in order to gather inaccessible evidence. 4.DOCUMENT
evidence from digital devices or computer SEARCHES: Computer forensics experts
networks and components which is suitable for should also be able to search over 200,000
presentation in a court of law or legal body. It electronic documents in seconds rather than
involves performing a structured investigation hours.5.MEDIA CONVERSION: Computer
while maintaining a documented chain of forensics experts should extract the relevant data
evidence to find out exactly what happened on from old and un-readable devices, convert it into
a computer and who was responsible for it. readable formats, and place it onto new storage
TYPES:-Disk Forensics: It deals with media for analysis. 6. EXPERT WITNESS
extracting raw data from the primary or SERVICES: Computer forensics experts should
secondary storage of the device by searching be able to explain complex technical processes
active, modified, or deleted files. Network in an easy-to- understand fashion
Forensics: It is a sub-branch of Computer 7.COMPUTER EVIDENCE SERVICE
Forensics that involves monitoring and OPTIONS Computer forensics experts should
analysing the computer network traffic. offer various levels of service, each designed to
Database Forensics: It deals with the study and suit your individual investigative needs like
examination of databases and their related Standard service and On-site service.
metadata. Malware Forensics: It deals with the Steps taken by Computer Forensic
identification of suspicious code and studying Specialists:- The computer forensics specialist
viruses, worms, etc. Email Forensics: It deals should take several careful steps to identify and
with emails and their recovery and analysis, attempt to retrieve possible evidence that may
including deleted emails, calendars, and exist on a subject’s computer system. For
contacts. Memory Forensics: Deals with example, the following steps should be taken: 1.
collecting data from system memory (system Protect the subject computer system during the
registers, cache, RAM) in raw form and then forensic examination from any possible
analysing it for further investigation. Mobile alteration, damage, data corruption, or virus
Phone Forensics: It mainly deals with the introduction. 2. Discover all files on the subject
examination and analysis of phones and system. This includes existing normal files,
smartphones and helps to retrieve contacts, call deleted yet remaining files, hidden files,
logs, incoming, and outgoing SMS, etc., and password-protected files, and encrypted files. 3.
other data present in it. USES:- Track Recover all of discovered deleted files. 4.
computer use, discover critical data, and make Reveal the contents of hidden files as well as
copies of information that will be used in court, temporary or swap files used by both the
it helps the government agencies as well as application programs and the operating system. 5.
private enterprises to control their risk and Access the contents of protected or encrypted
maximize security. Computer forensics is also files. 6. Analyze all possibly relevant data found
used to know about the extent of a data breach or in special areas of a disk. This includes but is not
any attack on the network. With the right tools, limited to what is called unallocated space on a
police or concerned authorities can uncover disk, as well as slack space in a file 7. Print out
critical or criminal files on the devices. With an overall analysis of the subject computer
computer forensics, one can track the hacking or system, as well as a listing of all possibly
attacks to know their source or origin. relevant files and discovered file data. 8.
Computer Forensic Services:-Computer Provide an opinion of the system layout, the file
forensics professionals should be able to structures discovered, any attempts to hide,
successfully perform complex evidence recovery delete, protect, and encrypt information; and
procedures with the skill and. For example, they anything else that appears to be relevant to the
should be able to perform the following services: overall computer system examination. 9.
1.DATA SEIZURE:Following federal Provide expert consultation and testimony, as
guidelines, computer forensics experts should required.
act as the representative, using their knowledge Types of Computer Forensic technology:-
of data storage technologies to track down 1)TYPES OF MILITARY COMPUTER
evidence.2.DATA DUPLICATION:By making FORENSIC TECHNOLOGY:-Real-time
an exact duplicate of the needed data the tracking of potentially malicious activity is
computer forensics experts should acknowledge especially difficult when the pertinent
the concerns that are important while seizing the information has been intentionally hidden,
data. When experts works on the duplicate data, destroyed, or modified in order to elude
the integrity of the original is maintained. 3. discovery. The Computer Forensics Experiment
DATA RECOVERY: Using proprietary tools, 2000 (CFX-2000) resulted from the partnership
of information directorate and NIJ. CFX-2000 is (DIRT) is a powerful remote control monitoring
an integrated forensic analysis framework. The tool that allows stealth monitoring of all activity
central hypothesis of CFX-2000 is that it is on one or more target computers simultaneously
possible to accurately determine the motives, from a remote command centre, No physical
intent, targets, sophistication, identity, and access is necessary. 2.CREATING
location of cyber criminals and cyber terrorists TRACKABLE ELECTRONIC
by deploying an integrated forensic analysis DOCUMENTS: Binary Audit Identification
framework. The cyber forensic tools involved in Transfer (BAIT) is a powerful intrusion
CFX-2000 consisted of off-the-shelf software detection tool that allows users to create
and R&D prototypes. CFX includes SI-FI trackable electronic documents. BAIT identifies
integration environment. (including their location) unauthorized intruders
TYPES OF LAW ENFORCEMENT who access, download, and view these tagged
COMPUTER FORENSIC TECHNOLOGY:- documents. BAIT also allows security personnel
Computer Evidence Processing Procedures:- to trace the chain of custody and chain of
Processing procedures and methodologies command of all who possess the stolen
should conform to federal computer evidence electronic documents. 3. THEFT RECOVERY
processing standards. 1. Preservation of SOFTWARE FOR LAPTOPS AND PCS: PC
Evidence:- Computer evidence can be useful in PhoneHome is a software application that will
criminal cases, civil disputes, and human track and locate a lost or stolen PC or laptop
resources/ employment proceedings. Black box any-where in the world. If your PC PhoneHome-
computer forensics software tools are good for protected computer is lost or stolen, all you need
some basic investigation tasks, but they do not to do is make a report to the local police and call
offer a full computer forensics solution. CD’s 24-hour command center. CD’s recovery
SafeBack software overcomes some of the specialists will assist local law enforcement in
evidence weaknesses inherent in black box the recovery of your property.
computer forensics approaches. 2. Disk Computer Forensic Evidence and Capture:-
Structure Computer forensic experts must Data Recovery Defined:- Data recovery is the
understand how computer hard disks and floppy process in which highly trained engineers
diskettes are structured and how computer evaluate and extract data from damaged media
evidence can reside at various levels within the and return it in an intact format. The Role of
structure of the disk. 3. Data Encryption Back-up in Data Recovery: The role of Back-
Computer forensic experts should become up has changed: The role of backup now
familiar with the use of software to crack includes the responsibility for recovering user
security associated with the different file errors and ensuring that good data has been
structures.4. Matching a Diskette to a saved and can quickly be restored. The Data
Computer Specialized techniques and tools that Recovery Solution: The complex systems that
make it possible to conclusively tie a diskette to have evolved over the past 30 years must be
a computer that was used to create or edit files monitored, managed, controlled, and optimized.
stored on it. Computer forensic experts should Backups often take place while an application is
become familiar how to use special software running. Evaluate your preparation: If all of
tools to complete this process. 5. Data the resources (image copies, change
Compression Computer forensic experts should accumulations, and logs) are available at
become familiar with how compression works recovery time, these preparations certainly allow
and how compression programs can be used to for a standard recovery. Finding out at recovery
hide and disguise sensitive data and also learn time that some critical resource is missing can be
how password- protected compressed files can disastrous! Checking your assets to make sure
be broken. 6. Erased Files Computer forensic they’re ready should be part of your plan.
experts should become familiar with how Automated Recovery: With proper planning
previously erased files can be recovered by using and automation, recovery is made possible,
DOS programs and by manually using data- reliance on specific personnel is reduced, and the
recovery technique & familiar with cluster human-error factor is nearly eliminated. In the
chaining. 7. Internet Abuse Identification and event of a disaster, the Information Management
Detection Computer forensic experts should System (IMS) recovery control (RECON) data
become familiar with how to use specialized sets must be modified in preparation for the
software to identify how a targeted computer has recovery. Make Recoveries Efficient:
been used on the Internet. Multithreading tasks shorten the recovery
TYPES OF BUSINESS COMPUTER process. Recovering multiple databases with one
FORENSIC TECHNOLOGY:- 1. REMOTE pass through your log data certainly will save
MONITORING OF TARGET COMPUTERS time. Take Back-ups: The first step to a
Data Interception by Remote Transmission successful recovery is the backup of your data.
Your goal in backing up data is to do so quickly, identify those responsible. Any paper trail of
efficiently, and usually with minimal impact to computer records they may leave can be easily
your customers. modified or destroyed, or may be only
BACK-UP AND RECOVERY SOLUTION:- temporary. Auditing programs may
BMC software has developed a model called the automatically destroy the records left when
Back-up and Recovery Solution (BRS) for the computer transactions are finished with them.
Information Management System (IMS) product. Investigating electronic crimes will always be
Image Copy: BRS contains an Image Copy difficult because of the ease of altering the data
component to help manage your image copy and the fact that transactions may be done
process. Change Accumulation: The BRS anonymously.
Change Accumulation component takes Types of Evidence: Collecting the shreds of
advantage of multiple engines, large virtual evidence is really important in any
storage resources, and high-speed channels and investigation to support the claims in court.
controllers that are available in many Below are some major types of evidence. Real
environments. Recovery: The BRS Recovery Evidence: These pieces of evidence involve
component, which functionally replaces the IMS physical evidence such as flash drives, hard
Database Recovery utility for null- function drives, documents, etc. an eyewitness can also
(DL/I) databases and data-entry databases be considered as a shred of tangible evidence.
(DEDBs), allow recovery of multiple databases Hearsay Evidence: These pieces of evidence
with one pass of the log and change are referred to as out-of-court statements.
accumulation data sets while dynamically These are made in courts to prove the truth of
allocating all data sets required for recovery. the matter. Original Evidence: These are the
POINTER CHECKING: BRS offers the pieces of evidence of a statement that is made
capability to verify the validity of database by a person who is not a testifying witness. It
pointers through the Concurrent Pointer is done in order to prove that the statement was
Checking function. INDEX REBUILD: If made rather than to prove its truth.
indexes are ever damaged or lost, the Index Testimony: Testimony is when a witness takes
Rebuild function of BRS allows you rebuild oath in a court of law and gives their statement
them rather than recover them. RECOVERY in court. The shreds of evidence presented
ADVISOR: The Recovery Advisor component should be authentic, accurate, reliable, and
of BRS allows you to monitor the frequency of admissible as they can be challenged in court.
your image copies and change accumulations. It Rules of Evidence:1. Admissible: Admissible is
helps you to determine whether all your the most basic rule. The evidence must be able
databases are being backed-up. to be used in court. 2.Authentic: You must be
able to show that the evidence relates to the
UNIT 4 incident in a relevant way. 3. Complete: It’s not
Collect evidence, Collection options & enough to collect evidence that just shows one
obstacles: Collect Evidence: Future Prevention: perspective of the incident. 4. Reliable: Your
Without knowing what happened, you have no evidence collection and analysis procedures
hope of ever being able to stop someone else must not cast doubt on the evidence’s
from doing it again. Responsibility: The attacker authenticity and veracity. 5. Believable: The
is responsible for the damage done, and the only evidence you present should be clearly
way to bring him to justice is with proper understandable and believable to a jury.
evidence to prove his actions. Information Volatile Evidence, General Procedure &
gathered after a compromise can be examined Methods of Collection: Volatile Evidence:
and used by others to prevent further attacks. Always try to collect the most volatile evidence
Collection Options: a)Pull the system off the first. Order of volatility would be: 1. Registers
network and begin collecting evidence: In this and cache 2. Routing tables 3. Arp cache. 4.
case you may find that you have insufficient Process table 5. Kernel statistics and modules 6.
evidence or, worse, that the attacker left a dead Main memory 7. Temporary file systems 8.
man switch that destroys any evidence once the Secondary memory 9. Router configuration 10.
system detects that its offline.b)Leave it online Network topology. General Procedure :
and attempt to monitor the intruder: you may Identification of Evidence: You must be able to
accidentally alert the intruder while monitoring distinguish between evidence and junk data.
and cause him to wipe his tracks any way Preservation of Evidence: The evidence you
necessary, destroying evidence as he goes. find must be preserved as close as possible to its
Obstacles: Computer transactions are fast, they original state. Analysis of Evidence: Analysis
can be conducted from anywhere, can be requires in-depth knowledge of what you are
encrypted and have no intrinsic identifying looking for and how to get it. Presentation of
features such as handwriting and signatures to Evidence: The manner of presentation is
important, and it must be understandable by a The following items are included in reporting: A
layman to be effective. Methods of Collection: statement about the Chain of Custody. The
There are two basic forms of collection: freezing various tools that were used are explained. A
the scene and honey-potting. a)Freezing the description of how various data sources were
Scene: It involves taking a snapshot of the analysed. Issues have been identified.
system in its compromised state. You should Vulnerabilities have been discovered. Additional
then start to collect whatever data is important forensics measures that can be taken are
onto removable non-volatile media in a standard suggested. The procedure for establishing the
format. b)Honey-potting: It is the process of Chain of Custody: A series of steps must be
creating a replica system and luring the attacker followed in order to ensure the chain of
into it for further monitoring. The placement of custody's authenticity. It's worth noting that the
misleading information and the attacker’s more information a forensic expert obtains about
response to it is a good method for determining the evidence, the more reliable the chain of
the attacker’s motives. custody created becomes. According to the chain
Collection Steps of Evidence: 1.Find the of custody for electronic devices, you should
Evidence: Use a checklist. Not only does it help ensure that the following procedure is followed:
you to collect evidence, but it also can be used to Save the original files. Photograph the physical
double-check that everything you are looking for evidence. Taking screenshots of the digital
is there. 2. Find the Relevant Data: Once evidence is a good idea. Date, time, and any
you’ve found the evidence, you must figure out other information about the evidence's receipt
what part of it is relevant to the case. 3. Create should be documented. Inject forensic computers
an Order of Volatility: The order of volatility with a bit-for-bit clone of digital evidence
for your system is a good guide and ensures that content. To authenticate the working clone,
you minimize loss of uncorrupted evidence. 4. perform a hash test analysis.
Remove external avenues of change: It is Computer evidence processing steps: The
essential that you avoid alterations to the original following are general computer evidence
data. 5. Collect the Evidence: Collect the processing steps: 1. Shut down the computer:
evidence using the appropriate tools for the job. Depending on the computer OS, this usually
6. Document everything: Collection procedures involves pulling the plug or shutting down a
may be questioned later, so it is important that network computer using relevant commands
you document everything you do. Timestamps, required by the network involved. 2. Document
digital signatures, and signed statements are all the hardware configuration of the system:
important. Before dismantling the computer, it is important
Chain of Custody: Chain of custody means that pictures are taken of the computer from all
documentation that identifies all changes in the angles to document the system hardware
control, handling, custody and ownership of a components and how they are connected. 3.
piece of evidence. The gathered evidences Transport the computer system to a secure
should store in a tamper-proof manner means location: A seized computer left unattended can
that evidence cannot be accessed by easily be compromised. Don’t leave the
unauthorized person, it helps in maintain the computer unattended unless it is locked up in a
chain of custody. For each obtained item a secure location. 4. Make bit stream backups of
complete chain-of-custody record is kept. hard disks and floppy disks: All evidence
Process: 1. Data collection: It is the first step in processing should be done on a restored copy of
the chain of custody process. It entails the the bit stream backup rather than on the original
identification labelling, recording, and computer. Bit stream backups are much like an
acquisition of data from all relevant sources insurance policy and are essential for any serious
while maintaining the data and evidence's computer evidence processing. 5.
integrity. 2.Examination: During this step, the Mathematically authenticate data on all
chain of custody information is documented, as storage devices: You want to be able to prove
well as the forensic procedure that was followed. that you did not alter any of the evidence after
It's critical to take screenshots throughout the the computer came into your possession. Since
process to demonstrate the tasks that have been 1989, law enforcement and military agencies
completed and the evidence that has have used a 32- bit mathematical process to do
been discovered. 3.Analysis: The result of the the authentication process. 6. Make a list of key
examination stage is the analysis stage. In the search words:Gathering information from
Analysis stage, legally justifiable methods and individuals familiar with the case to help
techniques are used to gather useful information compile a list of relevant keywords is important.
in order to respond the questions posed in the Such keywords can be used in the search of all
case. 4.Reporting: In the Examination and computer hard disk drives and floppy diskettes
Analysis stage, this is the documentation phase. using automated soft-ware. 7. Evaluate the
Windows swap file: The Windows swap file is persons had access to the evidence, it could
a potentially valuable source of evidence and easily be declared inadmissible.
leads. When the computer is turned off, the swap
file is erased. But the content of the swap file UNIT 5
can easily be captured and evaluated. 8. Validating Forensic Data: Validating digital
Evaluate unallocated space (erased files): evidence is one of the most important
Unallocated space should be evaluated for components of computer forensics since it is
relevant keywords to supplement the keywords necessary to ensure the integrity of the data you
identified in the previous steps. 9. Document gather in order to present evidence in court. In
file names, dates, and times: From an evidence addition, forensic hashing methods are utilised to
standpoint, file names, creation dates, and last validate captured images before further analysis.
modified dates and times can be relevant. 10. Automated hashing of picture files is offered by
Identify file, program, and storage anomalies: the majority of computer forensic products
Encrypted, compressed, and graphic files store including ProDiscover, X-Ways Forensics, FTK,
data in binary format. As a result, text data and Encase. For instance. ProDiscover performs
stored in these file formats cannot be identified hash when it imports an image file and compares
by a text search program. Manual evaluation of the result to the hash that was created when the
these files is required. 11. Evaluate program picture was initially obtained. When the Auto
functionality: Depending on the application Image Checksum Verification dialogue box
software involved, running programs to learn appears when you load an image file in
their purpose may be necessary. When ProDiscover, you might recall seeing this
destructive processes that are tied to relevant function. To maintain data integrity, it is vital to
evidence are discovered, this can be used to understand how to utilise complex hexadecimal
prove wilfulness. editors since computer forensics programmes
Evidence Collection Procedure: 1)Do not rush: have some limits when it comes to hashing.
The investigation team will need a copy of their Data hiding Techniques: Data hiding involves
incident-handling procedure, an evidence changing or manipulating a file to conceal
collection notebook, and evidence identification information. Data-hiding techniques include
tags. They may also need to bring tools to changing file extensions, setting file attributes to
produce reliable copies of electronic evidence, hidden, bit-shifting, using encryption, etc. Some
including media to use in the copying process. of these techniques are discussed in the
2)The Incident Coordinator: will contact the following sections. 1) Hiding Partitions: One
other members of the response when an incident way to hide partitions is to create a partition and
is reported. will be responsible for ensuring that then use a disk editor, such as Norton Disk Edit,
every detail of the incident-handling procedure to delete any reference to it manually. To access
is followed, upon arrival at the incident site. the deleted partition, users can edit the partition
3)The Evidence Notebook: One team member table to re-create the links, and then the hidden
will be assigned the task of maintaining the partition re-appears when the computer is
evidence note-book. This person will record the restarted. Another way to hide partitions is with
who, what, where, when, and how of the a disk-partitioning utility, such as G Disk,
investigation process. At a minimum, items to be Partition Magic, System Commander, or Linux
recorded in the notebook include the following Grand Unified Boot loader (GRUB), which
task. This notebook is a crucial element in provides a start-up menu where you can select
maintaining chain of custody. Therefore, it must an OS. The system then ignores other bootable
be as detailed as possible to assist in maintaining partitions. 2) Marking Bad Clusters: Another
this chain. 4)Evidence Collection: Another data-hiding technique, more common in FAT
team member will be assigned the task of file systems, is placing sensitive or incriminating
evidence collection. To avoid confusion, the data in free or slack space on disk partition
number of people assigned this task should be clusters. This technique involves using a disk
kept to a minimum. This member should also be editor, such as Norton Disk Edit, to mark good
highly proficient with copying and analysis tools. clusters as bad clusters. The OS then considers
This person will tag all evidence and work with these clusters unusable. The only way they can
the person responsible for the evidence notebook be accessed from the OS is by changing them to
to ensure that this information is properly good clusters with a disk editor. 3) Bit-Shifting:
recorded. 5)Storage and Analysis of Data: The Some home computer users developed the skill
lab must provide some form of access control; a of programming in the computer manufacturer’s
log should be kept detailing entrance and exit assembly language and learned how to create a
times of all individuals. It is important that low-level encryption program that changes the
evidence never be left in an unsecured area. If a order of binary data, making the altered data
defense lawyer can show that unauthorized
unreadable when accessed with a text editor or Next, copy the physical memory (RAM).
word processor. Microsoft has built-in tools for this task, or you
Performance Remote Acquisition: Runtime can use available freeware tools, such as mem
Software offers the following shareware fetch and Back Track. The next step varies,
programs for remote acquisitions: 1.Disk depending on the incident you’re investigating.
Explorer for FAT 2.Disk Explorer for NTFS With an intrusion, for example, you might want
3.HDHOST. Remember that they’re designed to to see whether a rootkit is present by using a tool
be file system specific, so there are Disk such as Root Kit Revealer. You can also access
Explorer versions for both FAT and NTFS that the system’s firmware to see whether it has
you can use to create raw format image files or changed, create an image of the drive over the
segmented image files for archiving purposes. network, or shut the system down and make a
HDHOST is a remote access program for static acquisition later. Be sure to get a
communication between two computers. The forensically sound digital hash value of all files
connection is established by using the Disk you recover during the live acquisition to make
Explorer program (FAT or NTFS) corresponding sure they aren’t altered later.
to the suspect (remote) computer’s file system. Securing a Computer Incident or Crime
Network Forensic: a)Network Forensics Scene: Investigators secure an incident or crime
Overview: Network forensics is the process of scene to preserve the evidence and to keep
collecting and analysing raw network data and information about the incident or crime
tracking network traffic systematically to confidential. Information made public could
ascertain how an attack was carried out or how jeopardize the investigation. If you’re in charge
an event occurred on a network. Because of securing a computer incident or crime scene,
network attacks are on the rise, there’s more use yellow barrier tape to prevent bystanders
focus on this field and an increasing demand for from accidentally entering the scene. Use police
skilled technicians. Network forensics can also officers or security guards to prevent others from
help you determine whether a network is truly entering the scene. Legal authority for a
under attack or a user has inadvertently installed corporate incident scene includes trespassing
an untested patch or custom program.Network violations; for a crime scene, it includes
forensics examiners must establish standard obstructing justice or failing to comply with a
procedures for how to acquire data after an police officer. Access to the scene should be
attack or intrusion incident. b)Securing a restricted to only those people who have a
Network: Network forensics is used to specific reason to be there. The reason for the
determine how a security breach occurred; standard practice of securing an incident or
however, steps must be taken to harden networks crime scene is to expand the area of control
before a security breach happens. Hardening beyond the scene’s immediate location. In this
includes a range of tasks, from applying the way, you avoid overlooking an area that might
latest patches to using a layered network defence be part of the scene. Shrinking the scene’s
strategy, which sets up layers of protection to perimeter is easier than expanding it. For major
hide the most valuable data at the innermost part crime scenes, computer investigators aren’t
of the network. It also ensures that the deeper usually responsible for defining a scene’s
into the network an attacker gets, the more security perimeter. These cases involve other
difficult access becomes and the more specialists and detectives who are collecting
safeguards are in place. The National Security physical evidence and recording the scene. For
Agency (NSA) developed a similar approach, incidents primarily involving computers, the
called the defense in depth (DiD) strategy. DiD computers can be a crime scene within a crime
have three modes of protection: 1.People 2. scene, containing evidence to be processed.
Technology 3.Operations . Seizing Digital Evidence at the Scene: With
Performing Live Acquisitions: Create or proper search warrants, law enforcement can
download a bootable forensic CD, and test it seize all computing systems and peripherals. In
before using it on a suspect drive. If the suspect corporate investigations, you might have similar
system is on your network and you can access it authority; however, you might have the authority
remotely, add the appropriate network forensics only to make an image of the suspect’s drive.
tools to your workstation. If not, insert the Depending on company policies, corporate
bootable forensics CD in the suspect system. investigators rarely have the authority to seize all
Make sure you keep a log of all your actions; computers and peripherals. When seizing
documenting your actions and reasons for these computer evidence in criminal investigations,
actions is critical. A network drive is ideal as a follow the U.S. DOJ standards for seizing digital
place to send the information you collect. If you data. For civil investigations, follow the same
don’t have one available, connect a USB thumb rules of evidence as for criminal investigation.
drive to the suspect system for collecting data. You might be looking for specific evidence,
such a particular e-mail message or spreadsheet. systems, DIBS Advanced Forensic Workstations,
In a criminal matter, investigators seize entire etc. Software Forensics Tools are grouped into
drives to preserve as much information as command-line applications and GUI applications.
possible and ensure that no evidence is Some tools are specialized to perform one task,
overlooked. such as Safe Back, a command-line disk
Storing Digital Evidence: With digital evidence, acquisition tool from New Technologies, Inc.
you need to consider how and on what type of (NTI). Other tools are designed to perform many
media to save it and what type of storage device different tasks. For example, Technology
is recommended to secure it. The media you use Pathways Pro- Discover, X-Ways Forensics,
to store digital Evidence usually depends on how Guidance Software En Case, and Access Data
long you need to keep it. If you investigate FTK are GUI tools designed to perform most
criminal matters, store the evidence as long as computer forensics acquisition and analysis
you can. The ideal media on which to store functions. Software forensics tools are
digital data are CDRs or DVDs. These media commonly used to copy data from a suspect’s
have long lives, but copying data to them takes a drive to an image file. Many GUI acquisition
long time. Older CDs had lives up to five years. tools can read all structures in an image file as
Today’s larger drives demand more storage though the image were the original drive.
capacity; 200 GB drives are common, and DVDs Validating & Testing Forensic Software: To
can store up to only 17 GB of data. You can also make sure the evidence you recover and analyze
use magnetic tape to preserve evidence data. The can be admitted in court. To do this, you must
4-mm DAT magnetic tapes store between 40 to test and validate your software. The bellow we
72 GB or more of data, but like CD-Rs, they are discuss validation tools available at the time of
slow at reading and writing data. If you’re using this writing and how to develop your own
these tapes, test your data by copying the validation protocols. The National Institute of
contents from the tape back to a disk drive. Then Standards and Technology (NIST) publishes
verify that the data is good by examining it with articles, provides tools, and creates procedures
your computer forensics tools or doing an MD5 for testing and validating computer forensics
hash comparison of the original data set and the software. Establish categories for computer
newly restored dataset. If a 30-year lifespan for forensics tools—Group computer forensics
data storage is acceptable for your digital software according to categories, such as
evidence, older DLT magnetic tape cartridge forensics tools designed to retrieve and trace e-
systems are a good choice. DLT systems have mail. Identify computer forensics category
been used with mainframe computers for several requirements—For each category, describe the
decades and are reliable data-archiving systems. technical features or functions a forensics tool
Depending on the size of the DLT cartridge, one must have. Develop test assertions—Based on
cartridge can store up to 80 GB of data in the requirements, create tests that prove or
compressed mode. Speed of data transfer from diSprove the tool’s capability to meet the
your hard drive to a DLT tape is also faster than requirements. Identify test cases—Find or create
transferring data to a CD-R or DVD. Recently, types of cases to investigate with the forensics
manufacturers have introduced a high-speed, tool, and identify information to retrieve from a
high-capacity tape cartridge drive system called sample drive or other media. Establish a test
Super Digital Linear Tape (Super-DLT or method—Considering the tool’s purpose and
SLDT). These systems are specifically designed design, specify how to test it. Report test
for large RAID data backups and can store more results—Describe the test results in a report that
than 1 TB of data. complies with ISO 17025, which requires
accurate, clear, unambiguous, and objective test
UNIT 6 reports. Another standards document, ISO 5725,
Types of Computer Forensic Tools: Computer demands accuracy for all aspects of the testing
forensics tools are divided into two major pro- cess, so results must be repeatable and
categories: hardware and software. The reproducible.
following sections outline basic features required E-Mail Investigation: a)The Role of E-mail in
and expected of most computer forensics tools. Investigations:- E-mail evidence has become an
Hardware Forensics Tools range from simple, important part of many computing investigations,
single purpose components to complete so computer forensics investigators must know
computer systems and servers. Single-purpose how e-mail is processed to collect this essential
components can be devices, such as the ACARD evidence. In addition, with the increase in e-mail
Ultra Wide SCSI-to-IDE Bridge, which is scams and fraud attempts with phishing or
designed to write-block an IDE drive connected spoofing, investigators need to know how to
to a SCSI cable. Some examples of complete examine and interpret the unique content of e-
systems are Digital Intelligence F.R.E.D. mail messages. As a computing investigator, you
might be called on to examine a phishing e-mail available in the mail program. 4. View the mail
to see whether it’s authentic. Later, in tracing an header: To check the mail header, Open your
E-mail Message, you learn about resources for mail. Right click on your mail. After right click
looking up e-mail and Web addresses to verify menus will display. Click on view full header.
whether they’re associated with a spoofed The file header will get opened.5. Examine the
message. One of the most noteworthy e-mail email header: The email header contains the
scams was 419, or the Nigerian Scam, which message header and the subject body. The email
originated as a chain letter from Nigeria, Africa. header contains the information of the email
Unlike newer, more sophisticated phishing e- origin. It also gives the return path, and the
mail frauds, 419 messages have certain receiver mail id. 6. Examine the attachments:
characteristic ploys and a typical writing style. If the mail contains any attachment then copy
For example, the sender asks for access to your that attachment and also take the print of the
bank account so that he can transfer his money attachment. 7. Trace the Email: The IP address
to it as a way to prevent corrupt government of the origination computer machine tells the
officials in his homeland from confiscating it. owner of the email address which has been used
The sender often promises to reward you in the possible crime that is being investigated. It
financially if you make a minor payment or may be possible that this information may be
allow access to your bank account. The fake. So it's important to validate the evidence
messages are usually in uppercase letters and use which you uncover.
poor grammar. b)The Roles of the Client and Computer Forensic Software Tools: 1. SANS
Server in E-mail: You can send and receive e- SIFT: The SANS Investigative Forensic Toolkit
mail in two environments: via the Internet or an (SIFT) is an Ubuntu based Live CD which
intranet (an internal network). In both e-mail includes all the tools you need to conduct an in-
environments, messages are distributed from a depth forensic or incident response investigation.
central server to many connected client 2. Crowd Strike Crowd Response: Crowd
computers, a configuration called client/server Response is a lightweight console application
architecture. The server runs an e-mail server that can be used as part of an incident response
program, such as Microsoft Exchange Server or scenario to gather contextual information such as
Novell GroupWise to provide e-mail services. a process list scheduled tasks, or Shim Cache. 3.
Client computers use e-mail programs (also Volatility: Volatility is a memory forensics
called e-mail clients), to contact the e-mail framework for incident response and malware
server and send and retrieve e-mail messages. analysis that allows you to extract digital
Regardless of the OS or e-mail program, users artifacts from volatile memory (RAM) dumps. 4.
access their e-mail based on permissions the e- The Sleuth Kit (+Autopsy): The Sleuth Kit is an
mail server administrator grants. These open source digital forensics toolkit that can be
permissions prevent users from accessing each used to perform in-depth analysis of various file
other’s e-mail. To retrieve messages from the e- systems. Autopsy is essentially a GUI that sits
mail server, users identify themselves to the on top of The Sleuth Kit . 5. ExifTool: ExifTool
server, as when logging on to the network. Then is a command-line application used to read,
e-mails are delivered to their computers. E-mail write or edit file metadata information. It is fast,
services on both the Internet and an intranet use powerful and supports a large range of file
a client/server architecture, but they differ in formats. 6. Free Hex Editor Neo: Free Hex
how client accounts are assigned, used, and Editor Neo is a basic hex editor that was
managed and in how users access their e-mail. designed to handle very large files. 7. Bulk
Overall, an intranet e-mail system is for the Extractor: bulk extractor is a computer forensics
private use of network users, and Internet e-mail tool that scans a disk image, file, or directory of
systems are for public use. c)Investigating E- files and extracts information such as credit card
mail Crimes and Violations: 1. Examine the numbers, domains, e-mail addresses. URLS, and
email: When it is come into the light that email ZIP files. 8. Last Activity View: Last Activity
crime has happened then it is necessary to View allows you to view what actions were
collect the evidence which is required to prove taken by a user and what events occurred on the
the crime in the court of law. Evidence is the machine.
mail which the victim received. First take the
image of 'machines hard drive. Obtain the
victims machine password to open the encrypted
file. Take the printed copy of the crime mail
(including header). Examine the IP address of
the sender's server. 2. Copy the email message
into the USB key. 3. Take the printout of the
email message by using the print option