Computer forensics toolkit


Published on

Published in: Technology
  • Be the first to comment

No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide
  • *European Union Convention on Cyber Crimes
  • Computer forensics toolkit

    1. 1. Computer Forensics: A Brief Overview  Scientific process of preserving, identifying, extracting, documenting, and interpreting data on computer  The field of computer forensics began to evolve more than 30 years ago in the United States.  With the growth of the Internet and increasing usage of technology devices connected to the Internet, computer crimes are increasing at a great speed.
    2. 2. Computer Crimes Pure computer crime Compute r crimes Computer is the medium of a crime Computer content related crime •Illegal access to a system or network •Illegal transmission of data •Data deletion, damage, alteration •Serious hindrance to computer •Identity theft •Fraud •E-theft •Incriminating information stored in computer •Child pornography •Information that unleashes hostility/violence
    3. 3. Tools for Computer Forensics Integrated GUI based tools Compute r forensic tools Specialized single task tools •Process information •Network connection information • List of processes •Process to port mapping •Service/driver information •Registry analysis •Executable file analysis
    4. 4. Three Branches  Network forensics  Database forensics  Mobile Device forensics
    5. 5. Network Forensics  Network Forensics is the capture, recording, and analysis of network events in order to discover the source of security attacks or other problem incidents.  Two Systems: 1"Catch-it-as-you-can" systems, in which all packets passing through a certain traffic point are captured and written to storage with analysis being done subsequently in batch mode. This approach requires large amounts of storage, usually involving a RAID system. 2"Stop, look and listen" systems, in which each packet is analyzed in a rudimentary way in memory and only certain information saved for future analysis. This approach requires less storage but may require a faster processor to keep up with incoming traffic.
    6. 6. Database forensics  Forensic study of databases  Currently many database software tools are in general not reliable and precise enough to be used for forensic work
    7. 7. Mobile Device forensics  Using such things as cell phones, digital cameras, psp’s, and I pods to find stored evidence.  Mobile devices can be used to save several types of personal information like contacts, photos, calendar and notes.  Therefore it can be supposed that these devices will play an important role in forensics.
    8. 8. Computer Forensic Companies  AccessData  Computer Forensics  ACR Data Recovery, Inc.  Burgess Consulting and  Forensics  Center for Computer Forensics  Computer Forensics Associates    International Cyber Evidence Digital Mountain, Inc. Global Digital Forensics ManTech Security & Mission Assurance
    9. 9. When is it used?  In legal cases, computer forensic techniques are frequently     used to analyze computer systems belonging to defendants (in criminal cases) or litigants (in civil cases). To recover data in the event of a hardware or software failure. To analyze a computer system after a break-in, for example, to determine how the attacker gained access and what the attacker did. To gather evidence against an employee that an organization wishes to terminate. To gain information about how computer systems work for the purpose of debugging, performance optimization, or reverse-engineering.
    10. 10. Common cases  Financial crimes  Drug crimes  Child Pornography  Adultery  Murders/ Suicides
    11. 11. How it is Preformed  There are Five basic steps to the computer forensics  1. Preparation (of the investigator, not the data)  2. Collection (the data)  3. Examination  4. Analysis  5. Reporting
    12. 12. Preparation  The Investigator must have the proper training or the specific     operations of the investigation. Tools that are used to generate reports for court should be validated. There are many tools that are used in the field and the investigator needs determine the proper tool to be used based on the case. An interview with the user can yield valuable information about the system configuration, applications, encryption keys and methodology. In an investigation in which the owner of the digital evidence has not given consent to have his or her media examined special care must be taken to ensure that the forensic specialist has the legal authority to seize, copy, and examine the data. Sometimes authority stems from a search warrant.
    13. 13. Collection  Collection sources include computers, cell phones, digital cameras, hard drives, CD-ROM, and USB memory devices  Other sources include settings of digital thermometers, black boxes inside automobiles, RFID tags, and web pages  Special care must be taken when handling computer evidence. Most digital information is easily changed, and once changed it is usually impossible to detect that a change has taken place
    14. 14. Collection Practices  Imaging computer media using a write blocking tool to ensure that no data is added to the suspect device.  Establish and maintain the chain of custody.  Documenting everything that has been done.  Only use tools and methods that have been tested and evaluated to validate their accuracy and reliability.
    15. 15. Examination  Computer evidence represented by physical items such as chips, boards, central processing units, storage media, monitors, and printers can be described easily and correctly as a unique form of physical evidence  Forensic laboratories have detailed plans describing acceptable methods for handling physical evidence  Evidence, while stored in these physical items, is latent and exists only in a metaphysical electronic form  Procedures and techniques are software and hardware solutions to specific forensic problems
    16. 16. Procedures and techniques  Procedures are step by step instructions  A laboratory may require that examinations be conducted, if possible and practical, on copies of the original evidence  Digital evidence can be duplicated exactly to create a copy that is true and accurate  Examiner must make a decision as to how to implement this principle on a case-by-case basis.
    17. 17. Analysis  All digital evidence must be analyzed to determine the type of information that is stored upon it  Specialty tools are used that can display information  Analysis tools include: AccessData's FTK, Guidance Software's EnCase, Technology Pathways' ProDiscover, Dr. Golden Richard III's file carving tool Scalpel, and Brian Carrier's Sleuth Kit  Typical forensic analysis includes a manual review of material on the media, reviewing the Windows registry for suspect information, discovering and cracking passwords, keyword searches for topics related to the crime, and extracting e-mail and pictures for review
    18. 18. Reporting  Once the analysis is complete, a report is generated.  This report may be a written report, oral testimony, or some combination of the two.
    19. 19. What tools are needed and what do they do?  CRCMD5  DIBS Forensic     Workstation DRIVESPY FileList FILTER/Filter I NTI-DOC
    20. 20. CRCMDS 5  Mathematically creates a unique signature for the contents of one, multiple or all files on a given storage device  Signatures such as these are used to identify whether or not the contents of one or more computer files have changed  This forensics tool relies upon 128 bit accuracy and can easily be run from a floppy diskette to benchmark the files on a specific storage device  Bench marking can help computer specialists isolate problems and deal with computer incidents after they occur ( such as altered evidence and modifications )
    21. 21. Other tools used            DiskSearch 32 DiskSig DM EnCase FileCNVT ForensiX FRED FREDDIE GetFree TCT TextSearch Plus            GetSlack IMAGE NTAView OnLineDFSTM PART Password Recovery Kit PDBLOCK ProDiscover DFT PTable Seized ShowFL
    22. 22. Hardware & Software Hardware Software  A Forensic Machine  Forensic Examination (GUI )  Write Blocker  Forensic Examination ( DOS  Media Reader  External Image Device       Base) Disk Editor Password Cracking Imaging Wiping Hash Routines Internet History
    23. 23. Forensic Machine  Includes USB, firewire, media reader, removable hard drive bays, internal write blocker, cd/dvd burner, floppy drive, connections for labtops, and lots of memory  Type: FRED-Digital Intelligence
    24. 24. Write Blocker  Devices that allow acquisition of information on a drive without creating the possibility of accidentally damaging the drive contents  They do this by allowing read commands to pass but by blocking write commands, hence their name  Types: Fast Block, Fire Fly, Tableau, My Key, and USB Write Blocker
    25. 25. Additional Items  Printer- to produce professional looking reports and good       Images Digital Camera and several Memory Cards DVD’S- for achieving case Hard Drives- several big ones Floppy Diskettes Electrical Wire Labels- used to label connections of cables to hard drives for easy reconnection after removing hard drive to Image Tool Kit- containing a screw driver with many heads, needle nose pliers, tweezers, flashlight, ect….
    26. 26. Forensic Examination GUI DOS Base  Encase  DriveSpy  FTK  Byteback  Ultimate toolkit  Maresware
    27. 27. Password Cracking  Process of recovering passwords from data that has been stored in or transmitted by a computer system  Types: Revelation, Password Recovery Toolkit, and Advanced Password Recovery Toolkit
    28. 28. Email  Email Examiner  DBXtract  Mailbag Assistant  Data Lifter  Neo Trace Pro (to help trace emails)  Visual Route (to help trace emails)
    29. 29. Internet History  Net Analysis  Data Lifter  Quick View Plus
    30. 30. Insurance  Yergey Insurance  A family owned and operated agency  Specialize in Private Investigators and Private Detectives, Background Investigators, Process Servers, Security Consultants, Security Guards, Technology and Computer Related Firms  nce.html
    31. 31. Related websites     Keycomputernetwork.              com Computer