Your SlideShare is downloading. ×
  • Like
Computer forensics   libin
Upcoming SlideShare
Loading in...5
×

Thanks for flagging this SlideShare!

Oops! An error has occurred.

×

Now you can save presentations on your phone or tablet

Available for both IPhone and Android

Text the download link to your phone

Standard text messaging rates apply

Computer forensics libin

  • 1,081 views
Published

Very Important information about Computer Forensics

Very Important information about Computer Forensics

Published in Technology
  • Full Name Full Name Comment goes here.
    Are you sure you want to
    Your message goes here
    Be the first to comment
No Downloads

Views

Total Views
1,081
On SlideShare
0
From Embeds
0
Number of Embeds
0

Actions

Shares
Downloads
98
Comments
0
Likes
1

Embeds 0

No embeds

Report content

Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
    No notes for slide

Transcript

  • 1. LIBIN P BABU
  • 2. WHAT ALL NEWSES WE SEE TODAY..?
  • 3. WHAT IS COMPUTER FORENSICS A process of applying scientific and analytical techniques to computer Operating Systems and File Structures to determining the potential Legal Evidence.
  • 4.  IT IS THE PRACTICE OF LAWFULLY ESTABLISHING EVIDENCE AND FACTS.  This is science involving legal evidence THAT IS FOUND IN DIGITAL STORAGE MEDIUMS AND IN COMPUTERS.  Subdivisions: -  DISK FORENSICS  Network forensics  MOBILE FORENSICS
  • 5. TYPES OF CYBER CRIMES FORGERY BREECH OF COMPUTER SECURITY FRAUD/THEFT COPYRIGHT VIOLATIONS IDENTITY THEFT THREATS BURGLARY HOMICIDE ADMINISTRATIVE INVESTIGATIONS CYBER TERRORISM SALES AND INVESTMENT FRAUD ELECTRONIC FUND TRANSFER FRAUD
  • 6. CYBER CRIME : TOP 20 COUNTRIES
  • 7. SOURCE OF EVIDENCE  SLACK, FREE, SWAP, RECYCLE BIN  EVENT LOGS  REGISTRY  APPLICATION FILES, TEMP FILES  E-MAIL  BROWSER HISTORY AND CACHE
  • 8. DIGITAL EVIDENCE •“ANY DATA THAT IS RECORDED OR PRESERVED ON ANY MEDIUM IN OR BY A COMPUTER SYSTEM OR OTHER SIMILAR DEVICE, THAT CAN BE READ OR UNDERSTAND BY A PERSON OR A COMPUTER SYSTEM OR OTHER SIMILAR DEVICE. IT INCLUDES A DISPLAY, PRINT OUT OR OTHER OUTPUT OF THAT DATA.”
  • 9. TYPES OF DIGITAL EVIDENCE 1) PERSISTANT DATA Meaning data that remains intact when the computer is turned off. E.G. Hard drives, disk drives and removable storage devices (such as USB drives or flash drives). 2) VOLATILE DATA, Meaning data that would be lost if the computer is turned off. E.G. Deleted files, computer history, the computer's registry, temporary files and web browsing history.
  • 10. FORENSIC TOOLS •BLACKLIGHT - Windows, mac and ios forensics analysis software •INTERNET EVIDENCE FINDER - Forensic tool that recovers internet related communications (chat, social networking, webmail, cloud, web history, and more), including deleted data •SANS INVESTIGATIVE FORENSICS TOOLKIT (SIFT) - Multi- purpose forensic operating system •REGISTRY RECON - Forensics tool that rebuilds windows registries from anywhere on a hard drive and parses them for deep analysis.
  • 11. MOBILE DEVICE FORENSICS •CELLEBRITE MOBILE FORENSICS - Universal forensics extraction device - hardware and software •MICROSYSTEMATION XRY/XACT - Hardware/software package, specialises in deleted data •ELCOMSOFT IOS FORENSIC TOOLKIT (EIFT) - Acquires bit- precise images of apple ios devices in real time •ELCOMSOFT PHONE PASSWORD BREAKER - Enables forensic access to password-protected backups for smartphones and portable devices based on RIM blackberry and apple ios platforms,
  • 12. FORENSICS PROCEDURES 1) Make a digital copy of the original evidence. Investigators make a copy of the evidence and work with the copy to reduce the possibility of inadvertently changing the original evidence. 2) Authenticate that the copy of the evidence. Investigators must verify the copy of the evidence is exactly the same as the original. 3) Analyze the digital copy. The specific procedures performed in an investigation are determined by the specific circumstances under which the investigation is occurring.
  • 13. CREATING A FORENSIC IMAGE •Use a write blocker to ensure that no data is written back to the subject’s hard drive •Connect the disk to forensic server. •Create the image of disk using commands or specific applications •Verify the image using md5 sum
  • 14. ANALYSIS OF A FORENSIC IMAGE •Logical and Physical analysis •Logical – Conventional way of accessing files using file explorer, image viewers e.t.c. Analyses allocated space •Physical – Using hex editors. Analyses unallocated and slack space • Mount image • Search for files using keywords, type e.t.c
  • 15. TO REDUCE SEARCH SIZE •HASH ANALYSIS •SIGNATURE ANALYSIS
  • 16. SEARCHING FOR EVIDENCE •Emails •Windows swap file - A swap file is virtual memory that is used as an extension of the computer systems RAM •Cookies - cookies are pieces of information generated by a web server and stored in the user's computer, ready for future access •INDEX.DAT
  • 17. index.dat FILE •Every time a user uses windows explorer or internet explorer access a file or web site, digital traces of these activities are placed on the hard drive. •index.dat files are binary files •Pasco is a small open source application that parses the contents of index.dat files, and outputs the results into a tab delimited file •Containing informations Files accessed and opened via windows explorer (rows 4 through 9) Keywords used in searches over the internet (rows 10 and 11) Urls visited via internet explorer (rows 12 through 15)
  • 18. WHAT HAPPENS WHEN A FILE IS DELETED..? Consider fat file system •Constructed with 1. The boot record is the 1st sector of the disk 2. 1st file allocation table 3. 2nd file allocation table (a backup to the first) 4. Root directory 5. Data area
  • 19. When file is deleted •The first character of the file’s name in the root directory is changed to e5h. •The fat entries are set to 0.
  • 20. COMPUTER FORENSICS METHODOLOGY 1) SHUT DOWN THE COMPUTER 2) DOCUMENT THE HARDWARE CONFIGURATION OF THE SYSTEM 3) TRANSPORT THE COMPUTER SYSTEM TO A SECURE LOCATION 4) MAKE BIT STREAM BACKUPS OF HARD DISKS AND FLOPPY DISKS 5) MATHEMATICALLY VERIFY DATA ON ALL STORAGE DEVICES 6) DOCUMENT THE SYSTEM DATE AND TIME 7) MAKE A LIST OF KEY SEARCH WORDS
  • 21. 8) EVALUATE THE WINDOWS SWAP FILE 9) EVALUATE FILE SLACK 10) EVALUATE UNALLOCATED SPACE (ERASED FILES) 11) SEARCH FILES, FILE SLACK AND UNALLOCATED SPACE FOR KEY WORDS 12) DOCUMENT FILE NAMES, DATES AND TIMES 13) IDENTIFY FILE, PROGRAM AND STORAGE ANOMALIES 14) EVALUATE PROGRAM FUNCTIONALITY 15) DOCUMENT YOUR FINDINGS
  • 22. APPLICATIONS •FINANCIAL FRAUD DETECTION •CRIMINAL PROSECUTION •CIVIL LITIGATION •“CORPORATE SECURITY POLICY AND VIOLATIONS”
  • 23. WHO USES COMPUTER FORENSICS CRIMINAL PROSECUTORS RELY ON EVIDENCE OBTAINED FROM A COMPUTER TO PROSECUTE SUSPECTS AND USE AS EVIDENCE. CIVIL LITIGATIONS PERSONAL AND BUSINESS DATA DISCOVERED ON A COMPUTER CAN BE USED IN FRAUD, HARASSMENT, OR DISCRIMINATION CASES. PRIVATE CORPORATIONS OBTAINED EVIDENCE FROM EMPLOYEE COMPUTERS CAN BE USED AS EVIDENCE IN HARASSMENT, FRAUD, AND EMBEZZLEMENT CASES.
  • 24. LAW ENFORCEMENT OFFICIALS RELY ON COMPUTER FORENSICS TO BACKUP SEARCH WARRANTS AND POST-SEIZURE HANDLING. INDIVIDUAL/PRIVATE CITIZENS OBTAIN THE SERVICES OF PROFESSIONAL COMPUTER FORENSIC SPECIALISTS TO SUPPORT CLAIMS OF HARASSMENT, ABUSE, OR WRONGFUL TERMINATION FROM EMPLOYMENT.
  • 25. THANK YOU