computer forensics, involves the preservation, identification, extraction, and documentation of computer evidence stored as data or magnetically encoded information
CCS355 Neural Network & Deep Learning UNIT III notes and Question bank .pdfAsst.prof M.Gokilavani
More Related Content
Similar to computer forensics, involves the preservation, identification, extraction, and documentation of computer evidence stored as data or magnetically encoded information
Similar to computer forensics, involves the preservation, identification, extraction, and documentation of computer evidence stored as data or magnetically encoded information (20)
Application of Residue Theorem to evaluate real integrations.pptx
computer forensics, involves the preservation, identification, extraction, and documentation of computer evidence stored as data or magnetically encoded information
1. Objective and Priority
Objective of Computer Forensics
- To recovery, analyze and present computer based
material in such a way that is it usable as evidence in a
court of law
- Note that the definition is the following: “computer
forensics, involves the preservation, identification,
extraction, and documentation of computer evidence
stored as data or magnetically encoded information”, by
John Vacca
Priority
- Main priority is with forensics procedures, rules of
evidence and legal processes; computers are secondary
- Therefore accuracy is crucial
2. Accuracy vs Speed
Tradeoffs between accuracy and speed
- E.g., Taking 4 courses in a semester vs. 2 courses; more
likely to get Bs and not As
- Writing a report in a hurry means likely less accurate
Accuracy: Integrity and Security of the evidence is crucial
- No shortcuts, need to maintain high standards
Speed may have to be sacrificed for accuracy.
- But try to do it as fast as you can provided you do not
compromise accuracy
3. The Job of a Forensics Specialist
Determine the systems from which evidence is collected
Protect the systems from which evidence is collected
Discover the files and recover the data
Get the data ready for analysis
Carry out an analysis of the data
Produce a report
Provide expert consultation and/or testimony?
4. Applications: Law Enforcement
Important for the evidence to be handled by a forensic expert;
else it may get tainted
Need to choose an expert carefully
- What is his/her previous experience? Has he/she worked
on prior cases? Has he/she testified in court? What is
his/her training? Is he CISSP certified?
Forensic expert will be scrutinized/cross examined by the
defense lawyers
Defense lawyers may have their own possibly highly paid
experts?
5. Applications: Human Resources
To help the employer
- What web sites visited?
- What files downloaded
- Have attempts been made to conceal the evidence or
fabricate the evidence
- Emails sent/received
To help the employee
- Emails sent by employer – harassment
- Notes on discrimination
- Deleted files by employer
6. Applications: Other
Supporting criminals
- Gangs using computer forensics to find out about
members and subsequently determine their whereabouts
Support rogue governments and terrorists
- Terrorists using computer forensics to find out about
what we (the good guys) are doing
We and the law enforcement have to be one step ahead of the
bad guys
Understand the mind of the criminal
7. Services
Data Services
- Seizure, Duplication and preservation, recovery
Document and Media
- Document searched, Media conversion
Expert witness
Service options
Other services
8. Data Services
Data Seizure
- The expert should assist the law enforcement official in
collecting the data.
- Need to identify the disks that contain the data
Data Duplication and Preservation
- Data absolutely cannot be contaminated
- Copy of the data has to be made and need to work with
the copy and keep the original in a safe place
Data Recovery
- Once the device is seized (either local or remote) need to
use appropriate tools to recover the data
9. Data Services: Finding Hidden Data
When files are deleted, usually they can be recovered
The files are marked as deleted, but they are still residing in
the disk until they are overwritten
Files may also be hidden in different parts of the disk
The challenge is to piece the different part of the file together
to recover the original file
There is research on using statistical methods for file
recovery
http://www.cramsession.com/articles/files/finding-hidden-
data---how-9172003-1401.asp
http://www.devtarget.org/downloads/ca616-seufert-
wolfgarten-assignment2.pdf
10. Document and Media Services
Document Searches
- Efficient search of numerous documents
- Check for keywords and correlations
Media Conversion
- Legacy devices may contain unreadable data. This data
ahs to be converted using appropriate conversion tools
- Should be placed in appropriate storage for analysis
11. Expert Witness Services
Expert should explain computer terms and complicated processes in
an easy to understand manner to law enforcement, lawyers, judges
and jury
- Computer technologists and lawyers speak different languages
Expertise
- Computer knowledge and expertise in computer systems,
storage
- Knowledge on interacting with lawyers, criminology
- Domain knowledge such as embezzlement, child exploitation
Should the expert witness and the forencis specialist be one and the
same?
12. Service Options
Should provide various types of services
- Standard, Emergency, Priority, Weekend After hours
services
Onsite/Offsite services
Cost and risks – major consideration
Example: Computer Forensics Services Corporation
- http://www.computer-forensic.com/
- As stated in the above web site, this company provides
“expert, court approved, High Tech Investigations,
litigation support and IT Consulting.” They also
"Preserve, identify, extract, document and interpret
computer data. It is often more of an art than a science,
but as in any discipline, computer forensic specialists
follow clear, well-defined methodologies and procedures.”
13. Other Services
Computer forensics data analysis for criminal and civil
investigations/litigations
Analysis of company computers to determine employee
activity
- If he/she conducting his own business and/or
downloading pornography
- Surveillance for suspicious event detection
Produce timely reports
14. Benefits of using Professional services
Protecting the evidence
- Should prevent from damage and corruption
Secure the evidence
- Store in a secure place, also use encryption technologies
such as public/private keys
Ensure that the evidence is not harmed by virus
Document clearly who handled the data and when - auditing
Cleint/Attoney privilege
Freeze the scene of the crime – do not contaminate or change
15. Using the Evidence:
Criminal and Civil Proceedings
Criminal prosecutors
Civil litigation attorneys – harassment, discrimination,
embezzlement, divorce
Insurance companies
Computer forensics specialists to help corporations and
lawyers
Law enforcement officials
Individuals to sue a company
Also defense attorneys, and “the bad guys”
16. Issues and Problems that could occur
Computer Evidence MUST be
- Authentic: not tampered with
- Accurate: have high integrity
- Complete: no missing points
- Convincing: no holes
- Conform: rules and regulations
- Handle change: data may be volatile and time sensitive
- Handle technology changes: tapes to disks; MAC to PC
- Human readable: Binary to words
17. Legal tests
Countries with a common law tradition
- UK, US, Possibly Canada, Australia, New Zealand
Real evidence
- Comes from an inanimate object and can be examined by
the court
Testimonial evidence
- Live witness when cross examined
Hearsay
- Wiki entry “Hearsay in English law and Hearsay in United
States law, a legal principle concerning the admission of
evidence through repetition of out-of-court statements”
Are the following admissible in court?
- Data mining results, emails, printed documents
18. Traditional Forensics vs Computer Forensics
Traditional Forensics
- Materials tested and testing methods usually do not
change rapidly
- Blood, DNA, Drug, Explosive, Fabric
Computer Forensics
- Material tested and testing methods may change rapidly
- We did not have web logs in back in 1990
- We did not have RAID storage in 1980
19. Types of Acquisition
Static Acquisition
- Acquire data from the original media
- The data in the original media will not change
Live Acquisition
- Acquire data while the system is running
- A second live acquisition will not be the same
Will focus on static acquisition
20. Digital Evidence Storage Formats
Raw formats
- Bit by bit copying of the data from the disk
- Many tools could be used
Proprietary formats
- Vendors have special formats
Standards
- XML based formats for digital evidence
- Digital Evidence Markup Language
(Funded by National Institute of Justice)
- Experts have argued that technologies that allow disparate law
enforcement jurisdictions to share crime-related information will greatly
facilitate fighting crime. One of these technologies is the Global Justice
XML Data Model (GJXDM).
- http://ncfs.ucf.edu/digital_evd.html
21. Acquisition Methods
Disk to Image File
Disk to Disk
Logical acquisition
- Acquire only certain files if the disk is too large
Sparse acquisition
- Similar to logical acquisition but also collects fragments
of unallocated (i.e. deleted) data
22. Compression Methods
Compression methods are used for very large data storage
- E.g., Terabytes/Petabytes storage
Lossy vs Lossless compression
- Lossless data compression is a class of data
compression algorithms that allows the exact original
data to be reconstructed from the compressed data. The
term lossless is in contrast to lossy data compression,
which only allows an approximation of the original data to
be reconstructed, in exchange for better compression
rates.
23. Contingency Planning
Failure occurs during acquisition
- Recovery methods
Make multiple copies
- At least 2 copies
Encryption decryption techniques so that the evidence is not
corrupted