Investigation of Cyber                         Crimes & Forensics                       Biju Pattnaik State Police Academy...
Agenda1. The possible reliefs to a cybercrime     victim and strategy adoption2.   The preparation for prosecution3.   Adm...
Possible reliefs to a cybercrime    victim- strategy adoption     A victim of cybercrime needs to immediately report the ...
Before lodging a cybercrime case     Important parameters-     Gather ample evidence admissible in a court of law     F...
The criminal prosecution pyramid                                    Conviction                                     /acquit...
Preparation for prosecution     Collect all evidence available & saving snapshots of evidence     Seek a cyberlaw expert...
Government Initiative    • The Cyber Crime Investigation cell (CCIC) of       the CBI, notified in September 1999, started...
The Indian Computer Emergency Response    Team (CERT-In) IT Amendment ACT 2008.    “70A. (1) The Indian Computer Emergenc...
Cognizability and Bailability    As per IT Amendment Act 2008    Offences which have not less than 3 years    punishment a...
Power of Police to Investigate        Section 156 Cr.P.C. : Power to        investigate cognizable offences.        Sectio...
Power of Police to investigate (contd.)        Section 165 Cr.P.C. : Search by police        officer.        Section 93 Cr...
Amendments- Indian Evidence    Act 1872 Section 3 of the Evidence Act amended to take care of  admissibility of ER as evi...
Societe Des products Nestle SA case                  2006 (33 ) PTC 469 By virtue of provision of Section 65A, the conten...
State v Navjot Sandhu     (2005)11 SCC 600      Held, while examining Section 65 B Evidence Act, it        may be that ce...
Presumptions in law- Section 85 B     Indian Evidence Act      The law also presumes that in any proceedings, involving s...
Presumption as to electronic messages-Section 88A of Evidence Act      The court may treat electronic messages received a...
IT Amendment Act 2008-Section 79A  Section 79A empowers the Central govt to appoint any   department, body or agency as e...
Probable activities for defense by an     accused in a cybercrime case        Preparation of chain of events table       ...
Sec 69: Decryption of information      Ingredients        Controller issues order to Government agency to         interc...
Sec 70 Protected System      Ingredients        Securing unauthorised access or attempting to secure         unauthorise...
Computer Forensics and CyberforensicsComputer forensics is considered to be the use of analyticaland                  inve...
Handling of Evidences by Cyber Analysts                          Collect, Obs   Analyze and     Identify               erv...
Incident Response – a precursor to Techniques of     Cyber investigation & forensic tools      „Incident response‟ could ...
Six steps of Incident response                                           Detection   of incidents                Pre inci...
Techniques of cyber investigation-     Cyber forensics      Computer forensics, also called cyber forensics, is the      ...
6 A‟s of digital forensics                             Assessment                             Acquisition                 ...
Rules of evidence                             Computer forensic                              components-                 ...
FBI handbook of forensic investigation-techniques for computer forensicsExamine type of content in              Comparison...
Sources of Evidence         Existing Files         Deleted Files         Logs         Special system files (registry e...
Cyberforensics in accounting frauds      Use of CAAT –computer assisted audit techniques-         spreadsheets, excel, MS...
Establishment and maintenance of „Chain of     Custody      Tools required:      - Evidence notebook      - Tamper evid...
Maintaining Chain Of Custody                             Take pictures of the evidence                             - Doc...
E-mail forensics      E-mail composed of two parts- header and body      Examine headers      Request information from ...
Computer forensic analysis within the forensictradition.  Alphonse Bertillon- [freezing the scene]: in 1879   introduce a...
Key Principal of Forensics  Edmond Locard articulated one of the forensic     science‟s key rules, known as Locard’s Exch...
Stakeholders:  National security  Custom & Excise  Law enforcement agents  Businesses                 (embezzlement,  ...
Problems In Indian Context.  No     Standard       for   Computer   Forensic   is    yet     developed.  No      Guideli...
Over All Scenario  To date, computer forensics has been primarily driven by vendors and applied technologies with very li...
CONTD..  Commercial software tools are also a problem because software developers need to protect their code to prevent c...
CONTD.. The specialized tools used by a computer forensic expert are viewed as intolerably expensive by many corporations...
Legal Aspects      The growing demand for security and certainty in        cyber space leads to more stringent laws.     ...
Computer Forensic Tools           Forensic Tool Kit:     FTK is developed by     Access Data Corporation     (USA); it ena...
TYPICAL TOOLS      EMAIL TRACER      TRUEBACK      CYBERCHECK      MANUAL43   Dr. Tabrez Ahmad
Current and Emerging Cyber Forensic Tools of Law Enforcement44   Dr. Tabrez Ahmad
ENCASE FORENSIC:     Encase Forensic developed by Guidance     Software USA is the industry standard in     computer foren...
 Encase Forensic is very useful forensic solution      but it lacks following important feature:      In  Encase forensi...
EMAIL TRACER FORENSIC TOOL47   Dr. Tabrez Ahmad
FEATURES OF EMAIL TRACER •Display of Actual Mail Content for Outlook Express, Eudora, MS Outlook and mail clients with MBO...
EMAIL TRACING OVER WEB                        AS A PRE-EMPTIVE TOOL49   Dr. Tabrez Ahmad
EMAIL TRACING SERVICE      Users can submit their tracing task to Email       Tracer through web.      Tracing IP Addres...
51   Dr. Tabrez Ahmad
52   Dr. Tabrez Ahmad
53   Dr. Tabrez Ahmad
SEIZURE & ACQUISITION TOOL                        TRUEBACK54   Dr. Tabrez Ahmad
FEATURES OF TRUE BACK         DOS application with event based            Windowing System.           Self-integrity che...
Disk imaging through Parallel port. Disk imaging using Network Interface Card.  Block by Block acquisition with data inte...
ANALYSIS TOOL                          CYBER CHECK57   Dr. Tabrez Ahmad
Cyber Check Suites:      The IT Act 2000 is Indias first attempt to     combat cyber crime. To assist in the     enforceme...
CyberCheck - Features     Standard Windows application.     Self-integrity check.     Minimum system configuration check. ...
CyberCheck– Features (Contd …) Creates log of each analysis session and Analyzing officer‟s details. Block by block data i...
CyberCheck– Features (Contd …) Graphical representation of the following views of an evidence file:                  Disk ...
CyberCheck– Features (Contd …) Display of cluster chain of a file. Single and Multiple Keyword search. Extraction of Disk,...
CyberCheck– Features (Contd …)     File search based on file extension.     File search based on hash value.     Exclusion...
CyberCheck– Features (Contd …) Local preview of storage media. Network preview of storage media using cross-over cable. Bo...
CyberCheck– Features (Contd …)          Registry viewer.          Hash set of system files.          Identification of enc...
CyberCheck– Features (Contd …)             Exported content of text file and slack information.             Includes pictu...
PASSWORD CRACKING                GRID Enabled Password Cracker67    Dr. Tabrez Ahmad
PASSWORD CRACKING OF ZIP FILES USING GRID      CYBER FORENSICS LAB                                          INTERNET      ...
PASSWORD CRACKING OF ZIP FILES USING GRID                                          4. GRID SERVER SENDS       3. CLIENTS C...
WHO’S AT THE KEYBOARD?      BIOMETRICS      A software driver associated with the keyboard       records the user’s rhyt...
WHO’S AT THE KEYBOARD?      FORENSIC STYLISTICS      A qualitative approach to authorship assesses       errors and “idi...
WHO’S AT THE KEYBOARD?      STYLOMETRY      It is quantitative and computational        method, focusing on readily comp...
Comparison between Encase Version 6.0, FTK, and Cyber Check Suite.73   Dr. Tabrez Ahmad
MULTI DIMENSIONAL CHALLENGES74   Dr. Tabrez Ahmad
TECHNICAL      Ubiquity Of Computers         Crimes Occur In All Jurisdictions      Training Law Enforcement Agencies B...
OPERATIONAL      ALL DATA MUST BE GATHERED AND        EXAMINED FOR EVIDENCE            GIGABYTES OF DATA            PRO...
SOCIAL      IT RESULTS IN         UNCERTAINITIES ABOUT EFFECTIVENESS OF          CURRENT INVESTIGATION TECHNIQUES       ...
LEGAL      USES & BOUNDARIES OF DIGITAL EVIDENCE       IN LEGAL PROCEDURES STILL UNCLEAR      CURRENT TOOLS & TECHNIQUES...
Challenges faced by Law EnforcementAwareness: Technology is changing very rapidly. So does the increase inCyber crimes, No...
 Technical Issues: Large amount of storage space      required for storing the imaged evidences and also for      storing...
Software and Hardware Issues: The growth of Cyber crime as given rise to numerous Forensic software vendors. The challenge...
Recently China has been manufacturing mobile      phones that have cloned IME numbers which is a      current challenge fa...
Inadequate Training and Funds: Due to the growing of cyber forensic tools law enforcement does not get adequate training a...
 Global Issues: Most of the IP addresses retrieved during        investigation leads to servers or computers located abro...
References  Computer forensics by Michael Sheetz published by John     Wiley and Sons  Cyber crime Impact in the new mil...
Future Course of Action Mumbai Cyber lab is a joint initiative of Mumbai police and     NASSCOM –more exchange and coordi...
Do you have any question?87   Dr. Tabrez Ahmad
88   Dr. Tabrez Ahmad
Upcoming SlideShare
Loading in...5
×

Cybercrime investigation

9,862

Published on

Presentation made by Dr Tabrez Ahmad in Biju Pattanaik State Police Academy Bhubaneswar. To train DSP,s on Cyber Crime Investigation and Cyber Forensics.

Published in: Education, Technology
1 Comment
12 Likes
Statistics
Notes
  • excellent team
    -
    Vivek Badlani cyber crime follower
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here
No Downloads
Views
Total Views
9,862
On Slideshare
0
From Embeds
0
Number of Embeds
2
Actions
Shares
0
Downloads
0
Comments
1
Likes
12
Embeds 0
No embeds

No notes for slide

Cybercrime investigation

  1. 1. Investigation of Cyber Crimes & Forensics Biju Pattnaik State Police Academy Bhubaneswar By Dr. Tabrez Ahmad Professor of Law www.technolexindia.com1 Dr. Tabrez Ahmad http://technolexindia.blogspot.com
  2. 2. Agenda1. The possible reliefs to a cybercrime victim and strategy adoption2. The preparation for prosecution3. Admissibility of digital evidence in courts4. Defending an accused in a computer related crime5. The techniques of cyber investigation and forensic tools6. Future course of action2 Dr. Tabrez Ahmad
  3. 3. Possible reliefs to a cybercrime victim- strategy adoption  A victim of cybercrime needs to immediately report the matter to his local police station and to the nearest cybercrime cell  Depending on the nature of crime there may be civil and criminal remedies.  In civil remedies , injunction and restraint orders may be sought, together with damages, delivery up of infringing matter and/or account for profits.  In criminal remedies, a cybercrime case will be registered by police if the offence is cognisable and if the same is non cognisable, a complaint should be filed with metropolitan magistrate  For certain offences, both civil and criminal remedies may be available to the victim3 Dr. Tabrez Ahmad
  4. 4. Before lodging a cybercrime case  Important parameters-  Gather ample evidence admissible in a court of law  Fulfill the criteria of the pecuniary ,territorial and subject matter jurisdiction of a court.  Determine jurisdiction – case may be filed where the offence is committed or where effect of the offence is felt ( S. 177 to 179, CrPc)4 Dr. Tabrez Ahmad
  5. 5. The criminal prosecution pyramid Conviction /acquittal Trial Contents of charge Issue of process –summons, warrant Examine the witnesses Examine the complainant on oath Initiation of criminal proceedings-cognizance of offences by magistrates5 Dr. Tabrez Ahmad
  6. 6. Preparation for prosecution  Collect all evidence available & saving snapshots of evidence  Seek a cyberlaw expert‟s immediate assistance for advice on preparing for prosecution  Prepare a background history of facts chronologically as per facts  Pen down names and addresses of suspected accused.  Form a draft of complaint and remedies a victim seeks  Cyberlaw expert & police could assist in gathering further evidence e.g tracing the IP in case of e-mails, search & seizure or arrest as appropriate to the situation  A cyber forensic study of the hardware/equipment/ network server related to the cybercrime is generally essential6 Dr. Tabrez Ahmad
  7. 7. Government Initiative • The Cyber Crime Investigation cell (CCIC) of the CBI, notified in September 1999, started functioning from 3 March 2000. • It is located in New Delhi, Mumbai, Chennai and Bangalore. • Jurisdiction of the cell is all over India. • Any incident of the cyber crime can be reported to a police station, irrespective of whether it maintains a separate cell or not.7 Dr. Tabrez Ahmad
  8. 8. The Indian Computer Emergency Response Team (CERT-In) IT Amendment ACT 2008. “70A. (1) The Indian Computer Emergency Response Team (CERT-In) shall serve as the national nodal agency in respect of Critical Information Infrastructure for coordinating all actions relating to information security practices, procedures, guidelines, incident prevention, response and report. (2) For the purposes of sub-section (1), the Director of the Indian Computer Emergency Response Team may call for information pertaining to cyber security from the service providers, intermediaries or any other person.8 Dr. Tabrez Ahmad
  9. 9. Cognizability and Bailability As per IT Amendment Act 2008 Offences which have not less than 3 years punishment are cognizable and bailable9 Dr. Tabrez Ahmad 9
  10. 10. Power of Police to Investigate Section 156 Cr.P.C. : Power to investigate cognizable offences. Section 155 Cr.P.C. : Power to investigate non cognizable offences. Section 91 Cr.P.C. : Summon to produce documents. Section 160 Cr.P.C. : Summon to require attendance of witnesses.10 Dr. Tabrez Ahmad
  11. 11. Power of Police to investigate (contd.) Section 165 Cr.P.C. : Search by police officer. Section 93 Cr.P.C : General provision as to search warrants. Section 47 Cr.P.C. : Search to arrest the accused. Section 78 of IT Act, 2000 : Power to investigate offences-not below rank of Inspector. Section 80 of IT Act, 2000 : Power of police officer to enter any public place and search & arrest.11 Dr. Tabrez Ahmad
  12. 12. Amendments- Indian Evidence Act 1872 Section 3 of the Evidence Act amended to take care of admissibility of ER as evidence along with the paper based records as part of the documents which can be produced before the court for inspection. Section 4 of IT Act confers legal recognition to electronic records Dr. Tabrez Ahmad 12
  13. 13. Societe Des products Nestle SA case 2006 (33 ) PTC 469 By virtue of provision of Section 65A, the contents of electronic records may be proved in evidence by parties in accordance with provision of 65B. Held- Sub section (1) of section 65B makes admissible as a document, paper print out of electronic records stored in optical or magnetic media produced by a computer subject to fulfillment of conditions specified in subsection 2 of Section 65B .a) The computer from which the record is generated was regularly used to store or process information in respect of activity regularly carried on by person having lawful control over the period, and relates to the period over which the computer was regularly used.b) Information was fed in the computer in the ordinary course of the activities of the person having lawful control over the computer.c) The computer was operating properly, and if not, was not such as to affect the electronic record or its accuracy.d) Information reproduced is such as is fed into computer in the ordinary course of activity. State v Mohd Afzal, 2003 (7) AD (Delhi)113 Dr. Tabrez Ahmad
  14. 14. State v Navjot Sandhu (2005)11 SCC 600  Held, while examining Section 65 B Evidence Act, it may be that certificate containing details of subsection 4 of Section 65 is not filed, but that does not mean that secondary evidence cannot be given.  Section 63 & 65 of the Indian Evidence Act enables secondary evidence of contents of a document to be adduced if original is of such a nature as not to be easily movable.14 Dr. Tabrez Ahmad
  15. 15. Presumptions in law- Section 85 B Indian Evidence Act  The law also presumes that in any proceedings, involving secure digital signature, the court shall presume, unless the contrary is proved, that the secure digital signature is affixed by the subscriber with the intention of signing or approving the electronic record  In any proceedings involving a secure electronic record, the court shall presume, unless contrary is proved, that the secure electronic record has not been altered since the specific point of time, to which the secure status relates15 Dr. Tabrez Ahmad
  16. 16. Presumption as to electronic messages-Section 88A of Evidence Act  The court may treat electronic messages received as if they were sent by the originator, with the exception that a presumption is not to be made as to the person by whom such message was sent.  It must be proved that the message has been forwarded from the electronic mail server to the person ( addressee ) to whom such message purports to have been addressed  An electronic message is primary evidence of the fact that the same was delivered to the addressee on date and time indicated.16 Dr. Tabrez Ahmad
  17. 17. IT Amendment Act 2008-Section 79A  Section 79A empowers the Central govt to appoint any department, body or agency as examiner of electronic evidence for proving expert opinion on electronic form evidence before any court or authority.  Till now, government forensic lab of hyderabad was considered of evidentiary value in courts- CFSIL  Statutory status to an agency as per Section 79A will be of vital importance in criminal prosecution of cybercrime cases in India17 Dr. Tabrez Ahmad
  18. 18. Probable activities for defense by an accused in a cybercrime case  Preparation of chain of events table  Probing where evidence could be traced? E-mail inbox/files/folders/ web history  Has the accused used any erase evidence software/tools  Forensically screening the hardware/data/files /print outs / camera/mobile/pendrives of evidentiary value  Formatting may not be a solution  Apply for anticipatory bail  Challenge evidence produced by opposite party and look for loopholes  Filing of a cross complaint if appropriate18 Dr. Tabrez Ahmad
  19. 19. Sec 69: Decryption of information  Ingredients  Controller issues order to Government agency to intercept any information transmitted through any computer resource.  Order is issued in the interest of the  sovereignty or integrity of India,  the security of the State,  friendly relations with foreign States,  public order or  preventing incitement for commission of a cognizable offence  Person in charge of the computer resource fails to extend all facilities and technical assistance to decrypt the information-punishment upto 7 years.19 Dr. Tabrez Ahmad
  20. 20. Sec 70 Protected System  Ingredients  Securing unauthorised access or attempting to secure unauthorised access  to „protected system‟  Acts covered by this section:  Switching computer on / off  Using installed software / hardware  Installing software / hardware  Port scanning  Punishment  Imprisonment up to 10 years and fine  Cognizable, Non-Bailable, Court of Sessions20 Dr. Tabrez Ahmad
  21. 21. Computer Forensics and CyberforensicsComputer forensics is considered to be the use of analyticaland investigative techniques toidentify, collect, examine, preserve and present evidence orinformation which is magnetically stored or encodedA better definition for law enforcement would be the scientificmethod of examining and analyzing data from computer storagemedia so that the data can be used as evidence in court.Media = computers, mobile phones, PDA, digital camera, etc.21 Dr. Tabrez Ahmad
  22. 22. Handling of Evidences by Cyber Analysts Collect, Obs Analyze and Identify erve & Verify Organize Preserve Four major tasks for working with digital evidenceIdentify: Any digital information or artifacts that can beused as evidence.Collect, observe and preserve the evidenceAnalyze, identify and organize the evidence.Rebuild the evidence or repeat a situation to verify thesame results every time. Checking the hash value.22 Dr. Tabrez Ahmad
  23. 23. Incident Response – a precursor to Techniques of Cyber investigation & forensic tools  „Incident response‟ could be defined as a precise set of actions to handle any security incident in a responsible ,meaningful and timely manner.  Goals of incident response-  To confirm whether an incident has occurred  To promote accumulation of accurate information  Educate senior management  Help in detection/prevention of such incidents in the future,  To provide rapid detection and containment  Minimize disruption to business and network operations  To facilitate for criminal action against perpetrators23 Dr. Tabrez Ahmad
  24. 24. Six steps of Incident response Detection of incidents Pre incident preparation Resolution Initial response Investigate the incident Reporting24 Dr. Tabrez Ahmad
  25. 25. Techniques of cyber investigation- Cyber forensics  Computer forensics, also called cyber forensics, is the application of computer investigation and analysis techniques to gather evidence suitable for presentation in a court of law.  The goal of computer forensics is to perform a structured investigation while maintaining a documented chain of evidence to find out exactly what happened on a computer and who was responsible for it.25 Dr. Tabrez Ahmad
  26. 26. 6 A‟s of digital forensics Assessment Acquisition Authentication Analysis Articulation26 Dr. Tabrez Ahmad
  27. 27. Rules of evidence  Computer forensic components-  Identifying  Preserving  Analysing  Presenting evidence in a legally admissible manner Dr. Tabrez Ahmad 27
  28. 28. FBI handbook of forensic investigation-techniques for computer forensicsExamine type of content in Comparison of data filescomputerTransactions-to know time Data files can be extractedand sequence when data files from computerwere createdDeleted data files can be Data files can be convertedrecovered from the computer from one format to the otherKey word searching passwordsLimited source code can be Storage media withanalysed and compared standalone word processors can be examined Dr. Tabrez Ahmad 28
  29. 29. Sources of Evidence  Existing Files  Deleted Files  Logs  Special system files (registry etc.)  Email archives, printer spools  Administrative settings  Internet History  Chat archives  Misnamed Files  Encrypted Files / Password Protected files etc.29 Dr. Tabrez Ahmad
  30. 30. Cyberforensics in accounting frauds  Use of CAAT –computer assisted audit techniques- spreadsheets, excel, MS access  Generalized audit software-PC based file interrogation software- IDEA,ACL  Help detect fictitious suppliers, duplicate payments, theft of inventory  Tender manipulation, secret commissions  False financial reporting  Expense account misuse  Insider trading30 Dr. Tabrez Ahmad
  31. 31. Establishment and maintenance of „Chain of Custody  Tools required:  - Evidence notebook  - Tamper evident labels  - Permanent ink pen  - Camera  Document the following:  - Who reported the incident along with critical date and times  - Details leading up to formal investigation  - Names of all people conducting investigation  - Establish and maintain detailed „activity log‟31 Dr. Tabrez Ahmad
  32. 32. Maintaining Chain Of Custody  Take pictures of the evidence  - Document „crime scene‟ details  Document identifiable markings on evidence  Catalog the system contents  Document serial numbers, model numbers, asset tags  “Bag” it!  Maintain Chain Of Custody on tamperproof  evidence bag  Take a picture! Dr. Tabrez Ahmad 32
  33. 33. E-mail forensics  E-mail composed of two parts- header and body  Examine headers  Request information from ISP  Trace the IP  Tools-Encase,FTK,Final email  Sawmill groupwise  Audimation for logging  Cracking the password- brute force attack, smart search, dictionary search, date search, customised search, guaranteed decryption, plaintext attack  Passware, ultimate zip cracker,office recovery enterprise,etc33 Dr. Tabrez Ahmad
  34. 34. Computer forensic analysis within the forensictradition.  Alphonse Bertillon- [freezing the scene]: in 1879 introduce a methodical way of documenting the scene by photographing, for example, bodies, items, footprints, bloodstains in situ with relative measurements of location, position, and size Bertillon is thus the first known forensic photographer.  Bertillonage : system of identifying individuals over 200 separate body measurements, was in use till 1910 and was only rendered obsolete by the discovery that fingerprints were unique.34 Dr. Tabrez Ahmad
  35. 35. Key Principal of Forensics  Edmond Locard articulated one of the forensic science‟s key rules, known as Locard’s Exchange Principle.  “The principle states that when two items or persons come into contact, there will be an exchange of physical traces. Something is brought, and something is taken away, so that suspects can be tied to a crime scene by detecting these traces”.35 Dr. Tabrez Ahmad
  36. 36. Stakeholders:  National security  Custom & Excise  Law enforcement agents  Businesses (embezzlement, industrial espionage, stealing confidential information, and racial or sexual harassment).  Corporate crime [according to report the accountants and auditors for Enron not only used e-mail to communicate but also subsequently deleted these e-mails]36 Dr. Tabrez Ahmad
  37. 37. Problems In Indian Context.  No Standard for Computer Forensic is yet developed.  No Guidelines for Companies dealing with electronic data, during disputes.  No recognition to any of the forensics tool.  Issues related to anti-forensics are not talked about. ………………37 Dr. Tabrez Ahmad
  38. 38. Over All Scenario  To date, computer forensics has been primarily driven by vendors and applied technologies with very little consideration being given to establishing a sound theoretical foundation  The national and international judiciary has already begun to question the ‘‘scientific’’ validity of many of the ad hoc procedures and methodologies and is demanding proof of some sort of theoretical foundation and scientific rigor.38 Dr. Tabrez Ahmad
  39. 39. CONTD..  Commercial software tools are also a problem because software developers need to protect their code to prevent competitors from stealing their product. However, since most of the code is not made public, it is very difficult for the developers to verify error rates of the software, and so reliability of performance is still questionable .39 Dr. Tabrez Ahmad
  40. 40. CONTD.. The specialized tools used by a computer forensic expert are viewed as intolerably expensive by many corporations, and as a result many corporations simply choose not to invest any meaningful money into computer forensics. This trend amplifies cyber crime rates Open source software‟s were also not been tested or verified for the effectiveness to serve the above purposes (Open for research)40 Dr. Tabrez Ahmad
  41. 41. Legal Aspects  The growing demand for security and certainty in cyber space leads to more stringent laws.  The violation and maintaining of these laws (cyber laws) must be distinguished from classical criminal activities and criminal law enforcement.  The dynamics between these different forms of law violation and law enforcement is important and shall be addressed.41 Dr. Tabrez Ahmad
  42. 42. Computer Forensic Tools Forensic Tool Kit: FTK is developed by Access Data Corporation (USA); it enables law enforcement and corporate security professionals to perform complete and in-depth computer forensic analysis.42 Dr. Tabrez Ahmad Main Window of FTK
  43. 43. TYPICAL TOOLS  EMAIL TRACER  TRUEBACK  CYBERCHECK  MANUAL43 Dr. Tabrez Ahmad
  44. 44. Current and Emerging Cyber Forensic Tools of Law Enforcement44 Dr. Tabrez Ahmad
  45. 45. ENCASE FORENSIC: Encase Forensic developed by Guidance Software USA is the industry standard in computer forensic investigation technology. With an intuitive Graphical User Interface (GUI), superior analytics, enhanced email/Internet support and a powerful scripting engine, EnCase provides investigators with a single robust tool, capable of conducting large-scale and very complex investigations from beginning to end.45 Dr. Tabrez Ahmad Main Window of Encase
  46. 46.  Encase Forensic is very useful forensic solution but it lacks following important feature:  In Encase forensic there is no password cracking/recovery facility. So if during investigation process the examiner detected any password protected files then he had to rely on third party tools.46 Dr. Tabrez Ahmad
  47. 47. EMAIL TRACER FORENSIC TOOL47 Dr. Tabrez Ahmad
  48. 48. FEATURES OF EMAIL TRACER •Display of Actual Mail Content for Outlook Express, Eudora, MS Outlook and mail clients with MBOX mailbox. •Display the Mail Content (HTML / Text) •Display the Mail Attributes for Outlook Express. •Display of extracted E-mail header information •Save Mail Content as .EML file. •Display of all Email attachments and Extraction. •Display of E-mail route. •IP trace to the sender’s system. •Domain name look up. •Display of geographical location of the sender’s gateway on a world map. •Mail server log analysis for evidence collection. •Access to Database of Country code list along with IP address information.48 Dr. Tabrez Ahmad
  49. 49. EMAIL TRACING OVER WEB AS A PRE-EMPTIVE TOOL49 Dr. Tabrez Ahmad
  50. 50. EMAIL TRACING SERVICE  Users can submit their tracing task to Email Tracer through web.  Tracing IP Address upto city level (non-spoofed)  Detection of spoofed mail  Detailed report50 Dr. Tabrez Ahmad
  51. 51. 51 Dr. Tabrez Ahmad
  52. 52. 52 Dr. Tabrez Ahmad
  53. 53. 53 Dr. Tabrez Ahmad
  54. 54. SEIZURE & ACQUISITION TOOL TRUEBACK54 Dr. Tabrez Ahmad
  55. 55. FEATURES OF TRUE BACK  DOS application with event based Windowing System.  Self-integrity check.  Minimum system configuration check.  Extraction of system information  Three modes of operation: - Seize - Acquire - Seize and Acquire55 Dr. Tabrez Ahmad
  56. 56. Disk imaging through Parallel port. Disk imaging using Network Interface Card.  Block by Block acquisition with data integrity check on each block.  IDE/SCSI, USB, CD and Floppy acquisition.  Acquisition of floppies and CDs in Batch mode.  Write protection on all storage media except destination media.  Checking for sterile destination media.  Progress Bar display on all modes of operation.  Report generation on all modes of operation. BIOS and ATA mode acquisition56 Dr. Tabrez Ahmad
  57. 57. ANALYSIS TOOL CYBER CHECK57 Dr. Tabrez Ahmad
  58. 58. Cyber Check Suites: The IT Act 2000 is Indias first attempt to combat cyber crime. To assist in the enforcement of the IT Act, the Department of Information Technology, Ministry of Communications and Information Technology, has setup a Technical Resource Centre for Cyber Forensics at C- DAC, Thiruvananthapuram. Cyber Check is a forensic analysis tool developed by C-DAC Thiruvanathapuram,58 Dr. Tabrez Ahmad Probe Window of Cyber Check Suite
  59. 59. CyberCheck - Features Standard Windows application. Self-integrity check. Minimum system configuration check. Analyses evidence file containing FAT12, FAT16, FAT32, NTFS and EXT2FS file system. Analyses evidence files created by the following disk imaging tools: TrueBack LinkMasster Encase User login facilities.59 Dr. Tabrez Ahmad
  60. 60. CyberCheck– Features (Contd …) Creates log of each analysis session and Analyzing officer‟s details. Block by block data integrity verification while loading evidence file. Explorer type view of contents of the whole evidence file. Display of folders and files with all attributes. Show/Hide system files. Sorting of files based on file attributes. Text/Hex view of the content of a file. Picture view of an image file. GalleryTabrez Ahmadimages.60 Dr. view of
  61. 61. CyberCheck– Features (Contd …) Graphical representation of the following views of an evidence file: Disk View. Cluster View. Block view. Timeline view of: All files Deleted files. Time anomaly files. Signature mismatched files. Files created within a time frame.61 Dr. Tabrez Ahmad
  62. 62. CyberCheck– Features (Contd …) Display of cluster chain of a file. Single and Multiple Keyword search. Extraction of Disk, Partition, File and MBR slacks. Exclusive search in slack space. Extraction of unused unallocated clusters and exclusion from search space. Exclusive search in used unallocated clusters . Extraction of lost clusters. Exclusive search in data extracted from lost clusters. Extraction of Swap files. Exclusive search in data extracted from Swap files.62 Dr. Tabrez Ahmad
  63. 63. CyberCheck– Features (Contd …) File search based on file extension. File search based on hash value. Exclusion of system files from search space. Data recovery from deleted files, slack space, used unallocated clusters and lost clusters. Recovery of formatted partitions. Recovery of deleted partitions. Exporting files, folders and slack content. Exporting folder structure including file names into a file. Exporting files on to external viewer.63 Dr. Tabrez Ahmad
  64. 64. CyberCheck– Features (Contd …) Local preview of storage media. Network preview of storage media using cross-over cable. Book marking of folders, files and data. Adding book marked items into report. Restoration of storage media. Creating raw image. Raw image analysis. Facility for viewing Mailbox files of Microsoft Outlook Express, Microsoft Outlook, Eudora and Linux Mail clients.64 Dr. Tabrez Ahmad
  65. 65. CyberCheck– Features (Contd …) Registry viewer. Hash set of system files. Identification of encrypted & password protected files. Identification of steganographed image files. Generation of analysis report with the following features. Complete information of the evidence file system. Complete information of the partitions and drive geometry. Hash verification details. User login and logout information.65 Dr. Tabrez Ahmad
  66. 66. CyberCheck– Features (Contd …) Exported content of text file and slack information. Includes picture file as image. Saving report, search hits and book marked items for later use. Password protection of report. Print report.66 Dr. Tabrez Ahmad
  67. 67. PASSWORD CRACKING GRID Enabled Password Cracker67 Dr. Tabrez Ahmad
  68. 68. PASSWORD CRACKING OF ZIP FILES USING GRID CYBER FORENSICS LAB INTERNET GRID GRID SERVER FSL CBI POLICE CRIME CELL68 Dr. Tabrez Ahmad
  69. 69. PASSWORD CRACKING OF ZIP FILES USING GRID 4. GRID SERVER SENDS 3. CLIENTS COMPUTES AND RESULTS OVER INTERNET SEND RESULTS TO SERVER INTERNET GRID GRID SERVER 1.ZIPPED FILE SUBMISSION FSL CBI 2. SERVER RECEIVES AND DISTRIBUTES TO POLICE CRIME CELL GRID CLIENTS69 Dr. Tabrez Ahmad
  70. 70. WHO’S AT THE KEYBOARD?  BIOMETRICS  A software driver associated with the keyboard records the user’s rhythm in typing.  These rhythms are then used to generate a profile of the authentic user.70 Dr. Tabrez Ahmad
  71. 71. WHO’S AT THE KEYBOARD?  FORENSIC STYLISTICS  A qualitative approach to authorship assesses errors and “idiosyncrasies” based on the examiner’s experience.  This approach could be quantified through Databasing.71 Dr. Tabrez Ahmad
  72. 72. WHO’S AT THE KEYBOARD?  STYLOMETRY  It is quantitative and computational method, focusing on readily computable and countable language features, e.g. word length, phrase length, sentence length, vocabulary frequency, distribution of words of different lengths.72 Dr. Tabrez Ahmad
  73. 73. Comparison between Encase Version 6.0, FTK, and Cyber Check Suite.73 Dr. Tabrez Ahmad
  74. 74. MULTI DIMENSIONAL CHALLENGES74 Dr. Tabrez Ahmad
  75. 75. TECHNICAL  Ubiquity Of Computers  Crimes Occur In All Jurisdictions  Training Law Enforcement Agencies Becomes a Challenge  Technology Revolution Leads To Newer Systems, Devices Etc..75 Dr. Tabrez Ahmad
  76. 76. OPERATIONAL  ALL DATA MUST BE GATHERED AND EXAMINED FOR EVIDENCE  GIGABYTES OF DATA  PROBLEMS OF o STORAGE o ANALYSIS o PRESENTATION..  NO STANDARD SOLUTION AS YET76 Dr. Tabrez Ahmad
  77. 77. SOCIAL  IT RESULTS IN  UNCERTAINITIES ABOUT EFFECTIVENESS OF CURRENT INVESTIGATION TECHNIQUES  SUB OPTIMAL USE OF RESOURCES  PRIVACY CONCERNS77 Dr. Tabrez Ahmad
  78. 78. LEGAL  USES & BOUNDARIES OF DIGITAL EVIDENCE IN LEGAL PROCEDURES STILL UNCLEAR  CURRENT TOOLS & TECHNIQUES NOT RIGOROUSLY USED / CONTESTED IN COURT78 Dr. Tabrez Ahmad
  79. 79. Challenges faced by Law EnforcementAwareness: Technology is changing very rapidly. So does the increase inCyber crimes, No proper awareness shared with regard to crime and latesttools. People are so ignorant that makes it effortless for cyber criminals toattack. People fear to report crimes and some crimes are not properlyrecorded. The reason behind this is that the victim is either scared of policeharassment or wrong media publicity. For minority and marginalised groupswho already bear the brunt of media bias, reporting online harassment tothe police may simply draw further unwanted attention. The public is notaware of the resources and services that law enforcement could providethem if being a victim of crime or witness.79 Dr. Tabrez Ahmad
  80. 80.  Technical Issues: Large amount of storage space required for storing the imaged evidences and also for storing retrieved evidence after analysis. Retrieved evidence might contain documents, pictures, videos and audio files which takes up a lot of space. Technical issues can further be categorised into software and hardware issues.80 Dr. Tabrez Ahmad
  81. 81. Software and Hardware Issues: The growth of Cyber crime as given rise to numerous Forensic software vendors. The challenge being to choose among them and no single forensic tool solves the entire case, there are loads of third party tools available. So is the case with Hardware tools, Most common and liable h/w tool is the FRED. But when it comes to Mobile forensics it is a challenge to decide the compatibility of different phones and which h/w to rely on..81 Dr. Tabrez Ahmad
  82. 82. Recently China has been manufacturing mobile phones that have cloned IME numbers which is a current challenge faced in Mobile forensics.  Information sharing: Information sharing is a best practice and can be accomplished by a variety of means such as interacting with industry groups, attending briefings, meetings, seminars and conferences, and working actively with forensic bodies like CDAC..82 Dr. Tabrez Ahmad
  83. 83. Inadequate Training and Funds: Due to the growing of cyber forensic tools law enforcement does not get adequate training and awareness on innovative tools. Training bodies are limited and are pricey. Insufficient funding in order to send officers for training and investing on future enhancements. Transfers and recruiting officers adds to the loss of experienced staff and spending for training the newcomers. Cases become pending in such circumstances.83 Dr. Tabrez Ahmad
  84. 84.  Global Issues: Most of the IP addresses retrieved during investigation leads to servers or computers located abroad which have no identity, hence further investigations are blocked and closed. Correspondence with bodies such as Google, Yahoo, Hotmail is quite time consuming and prolong the investigations.  Wireless or Wi-Fi, Bluetooth, Infrared Issues: Latest wireless technologies which provide internet connections causes exploitation especially when it is not secured. This is the present technology terrorists and radical activists exploit. This is another vulnerability that law enforcement faces.84 Dr. Tabrez Ahmad
  85. 85. References  Computer forensics by Michael Sheetz published by John Wiley and Sons  Cyber crime Impact in the new millennium by R.C Mishra.  Roadmap for digital forensic Research [Report From the First Digital Forensic Research Workshop]  Forensic Corpora: A Challenge for Forensic Research Simson L. Garfinkel April 10, 2007  Computer and Intrusion Forensics by Mohay,Anderson Collie,Devel Published by Artech House.85 Dr. Tabrez Ahmad
  86. 86. Future Course of Action Mumbai Cyber lab is a joint initiative of Mumbai police and NASSCOM –more exchange and coordination of this kind More Public awareness campaigns Training of police officers to effectively combat cyber crimes More Cyber crime police cells set up across the country Effective E-surveillance Websites aid in creating awareness and encouraging reporting of cyber crime cases. Specialised Training of forensic investigators and experts Active coordination between police and other law enforcement agencies and authorities is required.86 Dr. Tabrez Ahmad
  87. 87. Do you have any question?87 Dr. Tabrez Ahmad
  88. 88. 88 Dr. Tabrez Ahmad

×