Forensic Science assignment (2)
Forensic Science assignment (2)
SUBMITTED TO:
DR. SHEFALI DIXIT
(ASSISTANT PROFESSOR OF LAW)
1|Page
ACKNOWLEDGEMENT
DECLARATION
I hereby declare that this project work is original and is neither published nor
underconsideration anywhere else.
2|Page
TABLE OF CONTENT
ACKNOWLEDGEMENT......................................................2
DECLARATION...................................................................2
ABSTRACT............................................................................4
RESEARCH METHODOLOGY............................................4
AIMS AND OBJECTIVES....................................................5
INTRODUCTION..................................................................6
HISTORY OF CYBERFORENSIC.......................................7
CYBERCRIME......................................................................8
KINDS OF CYBERCRIME....................................................8
ROLE OF CYBERFORENSIC IN INVESTIGATION IN
INVESTIGATION OF CRIME.............................................12
FURTHER STEPS INVOLVED IN INVESTIGATION.......14
CASELAWS...........................................................................15
CONCLUSION........................................................................17
BIBLIOGRAPHY.....................................................................18
3|Page
ABSTRACT
Cyber forensics refers to the use of technological expertise to address legal challenges. It
encompasses the investigation, analysis, authentication, and retrieval of digital evidence from
devices or mediums involved in criminal activities. While technological advancements have
made digital access faster and more convenient, they have also led to a significant rise in
cybercrime, posing a serious threat to society that requires effective resolution. Legislations
such as the IT Act, 2000, and the Indian Evidence Act, 1872, provide a legal framework to
penalize cybercriminals. However, the rapid evolution of technology and the ingenuity of
offenders often create loopholes. Despite this, criminals invariably leave behind digital traces.
Cyber forensic experts specialize in tracking these digital footprints, uncovering the origins of
crimes committed in cyberspace, and contributing to justice.
This assignment explores cyber forensics, also referred to as computer forensics, a branch of
digital forensic science focused on uncovering evidence within computers and digital storage
devices. The primary goal of cyber forensics is to conduct forensically sound investigations
of digital media to identify, preserve, recover, analyze, and present facts and expert opinions
about digital information. Although commonly associated with investigating cybercrimes,
computer forensics also finds application in civil cases. Evidence gathered through cyber
forensic analysis follows rigorous procedures and often complements other forms of digital
evidence. With advancements in this field, the focus has been on ensuring user protection and
maintaining a citizen-centric approach. However, further research is necessary to understand
the broader implications of cyber forensic methods and enhance the detection of cybercrimes.
RESEARCH METHODOLOGY
This study will employ a purely doctrinal and analytical research approach. It will draw upon
a range of reports, articles, legal provisions, and case laws to develop the analysis. Both
primary and secondary data sources will be utilized. Primary data will include constitutions,
legislative documents, judicial decisions from various countries, and international
conventions. Secondary data will encompass resources such as books, national and
international journals, articles, and online materials.
4|Page
AIMS & OBJECTIVES
5|Page
INTRODUCTION
As internet technologies become increasingly integrated into daily life, they open up both
new and existing online opportunities. One such opportunity lies in the field of cyber
forensics—a specialized process involving the identification, preservation, analysis, and
presentation of digital evidence in a way that is legally admissible. According to *The
American Heritage Dictionary*, forensics is defined as "relating to the use of science or
technology in the investigation and establishment of facts or evidence in a court of law." 1
Cyber forensics involves the identification, documentation, and interpretation of computer
media for using them as evidence and/or to rebuild the crime scenario.2 According to
computer forensics defined as the process of identifying, collecting, preserving, analysing and
presenting the computer-related evidence in a manner that is legally acceptable by court.3
Cyber forensics is a discipline that combines aspects of computer science and law to analyze
and extract digital evidence from computer systems, networks, wireless communications, and
storage devices in a manner admissible in court. It can be defined as the systematic process of
identifying, collecting, preserving, analyzing, and reporting digital evidence from electronic
devices such as computers, hard drives, and mobile phones, often used in the commission of
crimes.
Cyber forensic experts utilize various techniques and tools to uncover data stored on digital
devices involved in cybercrimes. They can recover encrypted, deleted, or damaged files and
extract critical information. This recovered data is pivotal in solving crimes and is frequently
used in legal proceedings. Following the recovery of hidden or deleted files, forensic experts
create a comprehensive analysis that highlights patterns or anomalies in the computer system.
These findings are then presented as part of investigations or litigation, where the expert may
also serve as a consultant.
1
Kruse W.G, and Heiser J.G, Computer Forensics Incident Response Essentials, 2002, Addison Wesley Pearson
Education, Boston
2
Ibrahim M. Baggily, Richard Mislan, Marcus Rogers, Mobile Phone Forensics Tool Testing: A Database
Driven Approach, International Journal of Digital Evidence Fall 2007, Volume 6, Issue 2.
3
Caloyannides, Michael A, Computer Forensics and Privacy. Artech House, Inc. 2001.
6|Page
HISTORY OF CYBERFORENSICS
Until the late 1990s, what is now known as cyber forensics was typically referred to as
"computer forensics." The first cyber forensic technicians were law enforcement officers with
a passion for computers. In 1984, the FBI established the Computer Analysis and Response
Team (CART) in the United States. A year later, the Metropolitan Police in the UK created a
computer crime unit under John Austen within the Fraud Squad.
A significant shift occurred in the early 1990s when investigators and technical experts within
UK law enforcement, along with external specialists, recognized the need for standardized
techniques, protocols, and procedures in cyber forensics. While there were some informal
guidelines, formalized processes were urgently needed. To address this, a series of
conferences organized by the Serious Fraud Office and the Inland Revenue took place at the
Police Staff College at Bramshill in 1994 and 1995. These gatherings led to the development
of the modern British cyber forensic methodology.
Cyber forensics is valuable to a wide range of professionals, including those in the military,
private sector, industry, academia, and law. These sectors have diverse needs, such as data
protection, acquisition, imaging, extraction, interrogation, normalization, analysis, and
reporting. For professionals in this growing field, it is essential to have a standardized lexicon
with terms like "bookmarks," "cookies," and "web hits" consistently used across the
profession and industry. International guidelines, key terms, and tools for cyber forensics are
compiled in the cyber forensics field manual.5
4
Benjamin Turnbull, Jill Slay, Wireless Forensic Analysis Tools for use in the Electronic Evidence Collection,
IEEE Proceedings of the 40th Annual Hawaii International Conference on System Sciences-2007 (HICSS’07).
5
Ashley Brinson, Abigail Robinson, Marcus Rogers, a cyber-forensics ontology: Creating a new approach to
studying cyber forensics, Digital Instigation, Elsevier, 2006.
7|Page
CYBERCRIME
We can define “Cyber Crime” as any malefactor or other offences where electronic
communications or information systems, including any device or the Internet or both or more
of them are involved1.6
The term "Cyber Crime" was first introduced by Sussman and Heuston in 1995. Cybercrime
cannot be defined by a single description; rather, it is best understood as a range of actions or
behaviors centered around offenses that impact computer data or systems.7 These illegal
activities involve digital devices or information systems as either tools, targets, or both.
Cybercrime is also referred to as electronic crime, computer-related crime, e-crime, high-tech
crime, or information age crime.8 In simple terms, cybercrime refers to offenses that occur
through electronic communication or information systems. These crimes typically involve
computers and networks.
With the growth of the internet, cybercrime has increased significantly, as criminals no
longer need to be physically present to commit their offenses.9 A distinct feature of
cybercrime is that the victim and the offender may never interact directly. Cybercriminals
often operate from countries with weak or non-existent cybercrime laws to reduce the risk of
detection and prosecution. There's a common misconception that cybercrimes only occur
within cyberspace or the internet.
The 21st century has seen the emergence of new trends in computer and cybercrime. The first
decade of the millennium was marked by sophisticated crime methods, such as "phishing," 10
"botnet attacks,"11 and the use of technologies like "Voice over IP (VoIP)" 12 and "cloud
computing,"13 which present new challenges for law enforcement to investigate. It's not just
the methods that have evolved, but also the impact, as offenders have been able to automate
6
https://cybercrime.org.za/definition
7
https://www.tutorialspoint.com/information_security_ cyber law/introduction.htm
8
http://www.academia.edu/7781826/IMPACT_OF_SOCI AL_MEDIA_ON_SOCIETY_and_CYBER_LAW
9
https://www.ijarcsse.com/docs/papers/Volume_3/5_ May2013/V3I5-0374.pdf
10
The term “phishing” describes an act that is carried out to make the victim disclose personal/secret
information. The term originally described the use of e-mails to “phish” for passwords and financial data from
a sea of Internet users. The use of “ph.” linked to popular hacker naming conventions
11
Botnets is a short term for a group of compromised computers running a software that are under external
control. For more details, see Wilson, Botnets, Cybercrime, and Cyberterrorism: Vulnerabilities and
Policy Issues for Congress, 2007, page 4
12
Simon/Slay, Voice over IP: Forensic Computing Implications, 2006
13
Velasco San Martin, Jurisdictional Aspects of Cloud Computing, 2009; Gercke, Impact of Cloud
Computing on Cybercrime Investigation, published in Taeger/Wiebe, Inside the Cloud, 2009, page 499.
8|Page
attacks, leading to an increase in the number of offenses. In response to these growing
challenges, countries and international organizations have prioritized addressing cybercrime.
KINDS OF CYBERCRIME
Sexually explicit content was among the first types of material to be commercially distributed
online. The internet provides significant advantages for retailers of erotic and pornographic
content, including:
-Efficient Media Exchange: Digital distribution of media (such as images, videos, or live
streams) eliminates the need for costly shipping methods.
-Global Reach**: The internet enables access to a worldwide17 audience, vastly expanding
the customer base compared to traditional retail stores.
14
In the early years of IT development, the term “hacking” was used to describe the attempt to get more out of a
system (software or hardware) than it was designed for. Within this context, the term “hacking” was often used
to describe a constructive activity.
15
See Levy, Hackers, 1984; Hacking Offences, Australian Institute of Criminology, 2005, available at:
www.aic.gov.au/publications/htcb/htcb005.pdf.
16
Sieber, Council of Europe Organized Crime Report 2004, page 65.
17
http://cyber.law.harvard.edu/filtering/.
9|Page
-Perceived Anonymity: Many consumers of pornography value the anonymity provided by
the internet, especially given societal attitudes toward such material.
-Legal Variations Across Countries: The legality of erotic and pornographic material varies
widely18. In some nations, the exchange of such content is permitted among consenting
adults, with regulations focusing on protecting minors from accessing it. Studies suggest that
exposure to pornography may have adverse effects on the development of children, leading to
the implementation of “adult verification systems” to restrict access. Conversely, other
countries impose stricter laws, criminalizing any exchange of pornographic material,
regardless of the audience.
Child pornography:
The internet has increasingly become a tool for the sexual exploitation of children, who are
particularly vulnerable to cybercrime. With computers and internet access now a staple in
most households, children have easy and frequent access to the online world, including
exposure to pornographic content.
Pedophiles exploit this access by distributing explicit material to lure children and then
attempt to meet them in person for sexual purposes or to take explicit photographs, often
involving sexually suggestive poses. In many cases, pedophiles pose as teenagers or peers in
online chat rooms to build trust and form friendships with children. Gradually, they engage in
sexual conversations to lower the child's inhibitions and arrange face-to-face meetings.
The exploitation intensifies when pedophiles manipulate children with offers of money or
false promises of opportunities, leading to their abuse. This abuse may involve using the
children as sexual objects or capturing explicit images, which are then sold online, further
perpetuating the cycle of exploitation.
Cyberstalking:
18
One example for this approach can be found in Sec. 184 German Criminal Code (Strafgesetzbuch): Section
184 Dissemination of Pornographic Writings (1) Whoever, in relation to pornographic writings (Section 11
subsection (3)): 1. offers, gives or makes them accessible to a person under eighteen years of age; […]
10 | P a g
Cyberstalking, on the other hand, involves repeated harassment or threatening behavior by a
perpetrator using internet-based services. Cyberstalks often gather personal information about
the victim, such as their name, family background, and phone numbers. The stalker could be
someone known to the victim or a complete stranger.
If the stalker is an acquaintance, they may already have easy access to the victim's personal
details. If they are a stranger, they might collect this information from online sources, such as
profiles filled out by the victim when creating email or chat accounts, or registering on
websites. Using this information, the stalker can harass the victim through methods like
phone calls, emails, or other online interactions.
Identity theft:
It refers to impersonating a person in order to steal important data about that person such as
credit card information, banking details etc. Identify thrives can use someone else's name
whenever they commit a crime like drug trafficking, money laundering, smuggling or any
cyber-crime.
According to section 66C of the Information Technology Act, 2000, A person who
fraudulently or dishonestly, uses someone else's electronic signature, password or any other
unique identification feature, shall be punished with imprisonment for a term, which may
extend to three years and shall also be liable to fine which may extend to one lakh rupees.
Further, section 378 r/w section 379 i.e., 'theft', section 405 r/w section 406, i.e., 'criminal
breach of trust' and section 420 i.e., 'cheating and dishonestly inducing delivery of property'
under the Indian Penal Code, 1860, is also applicable for the offence.
Ransomware:
It refers to the malicious use of software that blocks the victims data or threatens to publish
the confidential data unless a ransom is paid to the person committing the crime.
Ransomware attacks are carried out by injecting a Trojan disguised as a legitimate file which
the user is tricked into opening or downloading.
Phishing:
Phishing is a cybercrime in which the victims are lured into providing their sensitive
information such as banking details, credit card details, passwords etc. by masquerading as a
11 | P a g
reliable entity in an electronic communication. It's one of the oldest types of cyberattacks and
is becoming increasingly sophisticated with time.
In the age of Digital India, rapid advancements in technology and ongoing innovations have
transformed various aspects of life. However, alongside these technological developments,
technology-related crimes have also seen a significant rise. Numerous cases have been
registered under the IT Act of 2008, which was later amended in 2010. These cases include
offenses such as data theft, hacking, unauthorized access, pornography, intellectual property
theft, cyber terrorism, and the spread of viruses, among others. Cybercrime has emerged as a
major threat, affecting businesses, national security, and everyday individuals.19 The
following outlines the methodology used in cybercrime investigations.
Search and Seizure: The search and seizure should be done with compliance to the
provisions as established in the code of criminal procedure and IT act, 2000. A police
officer, not below the rank of an inspector may enter any public place, and further,
search and arrest without warrant.20 The cyber forensic expert handles the technical
details, while the investigating officer i.e., the police handle the legal formalities on
site. First, the set-up is labelled and photographed so as to aid legal and technical
process. All the connectors and plugs should be labelled properly so as to ensure easy
and accurate re-assembly. Thereafter, the system should be checked if turned on or on
sleeping mode and thereafter be powered down through operating system and then
unplugged, so as to protect it from any loss of e-evidence. After turning off, the
device should be disconnected from any network connections. Thereafter, the device
is be dismantled into separate components. Lastly, seizure of the device, its software,
operating system etc., should be accomplished.
19
Gupta AK, Gupta MK. E-governance initiative in cyber law making. International Archive of Applied
Sciences and Technology. 2012 Jun; 3(2):97-101.
20
Section 80 IT Act,2000.
12 | P a g
Acquisition: Once the device and data is recovered, the expert images, duplicates,
and replicates it. The duplication is usually done via a write blocking device and is
known as acquisition or imaging. The software ISSN: 2456-9704 Role of Forensic
Experts Forensic experts are able to decrypt the password protected 3. imaging tools
such as TrueBack, EnCase, FTK Imager etc., are used for duplication and further the
image is verified using hash function or SHA.
Analysis: Analysis involves recovery of e-evidence through different techniques and
tools such as Encase, FTK etc., Different types of data such as, chats, images, internet
history, email, recovered, or documents can be from within the operating system,
depending upon the nature of investigation. Keywords, type of files, deleted spaces
analysis 120 9. etc., Further, gives clues conclusions reached via the recovered data.
Reporting: The final step of investigation is the preparation of report of the acquired
e evidence and further submitting it to the authority, who prepares a charge sheet to be
submitted in the court. The forensic expert also acts as an expert witness and present
and explains the evidence in court. According to Section 65-A, the contents of
electronic records can be proved and is admissible in accordance with the provisions
of Section 65-B (2), which lays down the requirements to be fulfilled for electronic
evidence to be admissible in the court of law.21
In the era of Digital India, significant technological advancements and ongoing innovations
are shaping the modern landscape. However, with the rise of technology, there has also been
a surge in technology-related crimes. Numerous cases have been registered under the IT Act
of 2008, which was subsequently amended in 2010. These cases include offenses such as data
theft, hacking, unauthorized access, distribution of pornography, intellectual property theft,
cyber terrorism, and the spread of viruses, among others.
Cybercrime has become a serious threat, impacting businesses, national security, and the
general public. The following outlines the methodology for investigating cybercrime cases.22
21
Dr. Avtar Singh. 22nd Edition. Central law publications. Principles of the Law of evidence, p 323
22
Gupta AK, Gupta MK. E-governance initiative in cyber law making. International Archive of Applied
Sciences and Technology. 2012 Jun; 3(2):97-101.
13 | P a g
QUESTIONING: Trying to collect the information about the crime, why it has done
who committed and how to precede the investigation.
GATHERING INFORMATION: By checking web cameras, wire taps etc.,
sometimes the evidence is collected from the hacker’s computers also.
COMPUTER FORENSICS: Following the initial steps of questioning and
information collection, forensic tools are employed to gather evidence. It is crucial to
handle the collected evidence meticulously, as it must be presented in court. Common
techniques used in cybercrime investigations include:
- Identifying the responsible individual or entity.
- Tracking IP addresses.
- Analysing web server logs.
- Monitoring email accounts.
- Attempting to recover deleted data.
- Cracking passwords.
- Uncovering hidden data.
A computer forensic investigator should adhere to specific investigative methodologies
to uncover the truth effectively.
14 | P a g
CASES ON CYBERFORENSIC AND CYBERCRIME
There have been several high-profile cases of cybercrime in India that have been dealt with
by the Indian courts. Some of the notable cases include:
In this case, the Supreme Court was tasked with examining the validity of Section 66A of the
IT Act. The Supreme Court's ruling was guided by three key concepts: discussion, advocacy,
and incitement. The Court noted that mere discussion or advocacy of any cause, regardless of
its popularity, lies at the core of the right to freedom of speech and expression. It determined
that Section 66A had the potential to restrict all types of communication, failing to
differentiate between simple advocacy or discussion of a controversial issue and words that
incite actions with a direct link to public disorder, security, health, or similar concerns.
In this case, the accused appealed to the Supreme Court after the High Court dismissed their
application to present a Compact Disc as evidence in defense and have it verified by the
Forensic Science Laboratory.
The Supreme Court ruled that a Compact Disc qualifies as a document. It also clarified that
under Section 294(1) of the CrPC, it is not mandatory to seek admission or denial of a
document directly from the accused, complainant, or witness.
It was held Section 2(1)(i) of the IT Act defines a “computer” as any electronic, magnetic,
optical, or other high-speed data processing device or system that performs logical,
arithmetic, and memory functions through manipulation of electronic, magnetic, or optical
impulses. This definition includes all input, output, processing, storage, computer software, or
communication facilities connected or related to a computer system or network. Therefore, a
telephone handset falls within the definition of a "computer" under Section 2(1)(i) of the IT
Act.
23
(2013) 12 SCC 73
24
2015 SCC OnLine SC 1242
25
2005 CriLJ 4314
15 | P a g
26
(2008) 150 DLT 769
16 | P a g
The Court observed that Mr. Bajaj was not directly involved in the broadcasting of
pornographic material, and the material in question could not be accessed directly on the
Bazee.com platform. However, Bazee.com earned commissions from sales and generated
revenue through advertisements displayed on its web pages.
The Court further noted that the evidence collected pointed to the offense of cyber
pornography being linked to another individual, not Bazee.com. As a result, the Court
granted bail to Mr. Bajaj on the condition of furnishing two sureties of ₹1 lakh each.
Nevertheless, the accused bears the responsibility of proving that he acted solely as a service
provider and was not involved in the creation or provision of the content.
17 | P a g
CONCLUSION
Cyber forensics is an evolving field in today’s digital age. This paper provides an overview of
cyber forensics, highlighting how its procedures differ from those of traditional forensics.
The research discusses various definitions and phases of cyber forensics, as well as
methodologies and tools used at each stage. The field continues to develop and remains a
prominent topic of interest. Data security faces numerous threats, making advancements in
cyber forensics essential. This paper also explores current research trends in the domain,
emphasizing the need for a comprehensive review of the existing legislative framework
governing the use and admissibility of cyber forensic evidence in criminal investigations and
trials.
Furthermore, the methodologies and techniques employed in disk and device forensics should
be critically examined to enhance their effectiveness. By refining these tools and approaches,
criminal investigations and judicial processes can become more efficient and reliable.
We are living in a digital age and cyberspace is not limited to one's boundaries, rather it
covers an entire world. As a result, cybercrime is increasing day by day in all the countries
including India. The biggest challenge relates to cybercrime being its dynamic nature because
of the ongoing evolution of digital technology. As a result, new cybercrime methods and
techniques come into practice. Therefore, cybercrime should be given as much importance as
other crime happening in our society be it theft, rape, murder etc
18 | P a g
19 | P a g
BIBLIOGRAPHY
Indian Journal of Law and Legal Research, Vol. 2, Issue 1 (June-July 2021), pp. 1-13.
International Journal of Law Management & Humanities, Vol. 6 Issue 2, pp.
1244- 1257
Indian Journal of Integrated Research in Law, Vol. 3 Part 2, Issue 4 (July-
August 2023), pp. 1-7
International Journal of Law Management & Humanities, Vol. 1, Issue 4
(October- November 2018), pp. 8-22
Nishesh Sharma, ‘Cyber Forensics in India – A Legal perspective’, Universal
Law Publishing
110 | P a