SlideShare a Scribd company logo
Mumbai | Pune | Hyderabad | New Delhi | Chennai | Bengaluru
DIGITAL FORENSIC
A practitioners perspective
Forensic Accounting Conference
ICAI Bangalore Branch
Feb 2016
© 2015 SKP Business Consulting LLP. All rights reserved.
WE AND THE DIGITAL WORLD
© 2015 SKP Business Consulting LLP. All rights reserved.
DATA DEVICES & TYPES
Digital Devices
Devices that we use on a daily
basis
Digital Applications
Applications/ Software's we use
on a daily basis
Actions/ Activities
We assist in collating necessary
evidence for litigations
© 2015 SKP Business Consulting LLP. All rights reserved.
Digital Devices
Popular Types
1. Laptop / Desktop
2. Hard-disk
3. Pen drive
4. Printer
5. Projector
6. Mobile
Where do we use them?
Digital devices are used by Business,
professionals and individuals spread over
various fields.
Homes, Offices, Schools and even Trains
stations or Airports, Digital devices are
being used for education, entertainment
or just for sharing of information
DATA DEVICES & TYPES
© 2015 SKP Business Consulting LLP. All rights reserved.
Digital Applications
Popular Types
1. ERP
2. Mobile App
3. Web Browsers
4. Social Media
5. Skype / Chatting
6. E-mail
How do we use them?
Applications are developed to make
human life simpler.
Distance and efforts are reduced.
Thereby work which would have taken
days is completed in mere hours.
DATA DEVICES & TYPES
© 2015 SKP Business Consulting LLP. All rights reserved.
Actions/ Activities
Popular Types
1. Update
2. Converse
3. Account checking
4. News
5. Browsing
6. Banking
Why do we use them?
Information that surround us needs to be
constantly monitored for either updating,
modification or simple knowledge
purposes.
Creating, Deleting, Updating, Modifying
or Formatting are some purposes for
which applications are used.
DATA DEVICES & TYPES
© 2015 SKP Business Consulting LLP. All rights reserved.
WHAT DATA IS STORED?
- Web Browsers
- E-Mails
- Image Editors
- Message Logs
- Event Logs
- Transaction Logs
Stores raw data
Stores application
Stores logs of use of application/
data
- Created
- Modified
- Deleted
© 2015 SKP Business Consulting LLP. All rights reserved.
HOW DATA IS STORED?
A. Track
B. Geometrical sector
C. Track sector
D. Cluster
Source: https://en.wikipedia.org/wiki/Disk_sector
Updates happen based on FAT 32
The data stored in sectors
© 2015 SKP Business Consulting LLP. All rights reserved.
DIGITAL FORENSIC EVIDENCES
Start
Reports and
documents
Applications installed
eg. software used to
wipe information
Emails
Internet
activity Chat Log
Media info
(Photo, scan
doc, video etc)
Usage of
USB
WiFi usage
Specific
Folders
Secured
information
Draft
agreements
Deleted
Information
Personal
Identity
info
Network
information
Downloaded
content
Hard disk / OS
information
Access logs/
windows event
logs
© 2015 SKP Business Consulting LLP. All rights reserved.
DIGITAL FORENSIC EVIDENCES
Internet history/
activities
Key chat
exchanges
Mails/files
downloaded to
mobile
Search history/
flagged places
Files uploaded/
downloaded from
storage sites
Contact list and
frequently
contacted
indications
Social media cache
memory
Call and text history
© 2015 SKP Business Consulting LLP. All rights reserved.
EVIDENCE COLLECTION GUIDELINE
Determine the necessary
equipment to take to the scene.
Review the legal authority to collect
the evidence, ensuring any
restrictions are noted.
Individuals who may have
relevant information should be
identified and interviewed.
When evidence cannot be
removed, it should be copied or
imaged on-site.
Consult with the investigator.
Source: SWEDGE guideline
© 2015 SKP Business Consulting LLP. All rights reserved.
Document the condition of Photograph
and/or make a sketch of the computer connections
and surrounding area.
EVIDENCE HANDLING GUIDELINE
Document the external component connections.
Determine if the computer is in stand-by mode and
follow procedures as if it was powered on.
Source: SWEDGE guideline
© 2015 SKP Business Consulting LLP. All rights reserved.
EVIDENCE EXAMINATION GUIDELINE
Review documentation
Examination of the media
should be completed
Review the legal authority
Examination on the
original evidence media
should be avoided if
possible
Appropriate controls and
standards should be used
Evidence
Source: SWEDGE guideline
© 2015 SKP Business Consulting LLP. All rights reserved.
APPROACH FOR EVIDENCE EXAMINATION
Evidence is
available
Evidence is
extractible
Evidence is
admissible
Understandi
ng the
subject
Preliminary
Profiling
Pattern/
Exception
Analysis
Key Word
Searches
Revisit
Profiling &
Analysis
Evidence
Principles
• Contextual knowledge about the subject and the environment
• Understanding the folder structure/ email pattern and broader understanding
use of digital device
• Broad nature, response time, approach towards communication
• Understanding the extent of private conversations and the nature of the
information shared in private communications
• Inconsistent nature of communication received with reference to role, ‘Bcc’
communication, information shared with private email addresses, unusual
pattern of conversations with external domains
• Evaluate the number of search hits, the nature of outcomes in those search
hits for preliminary key words
• Use GREP, Whole word, Case Sensitive and Boolean searches as required
• Revisit the procedures based on the outcomes after the keyword searches
• Consolidate timeline and red flags together
© 2015 SKP Business Consulting LLP. All rights reserved.
TOOLS IN DIGITAL FORENSIC
Imaging tool (write protector)Tableu
Imaging and processing toolEncase
Mobile forensic toolOxygen
Key word search toolIntella, Nuix
Email review platformClearwell
© 2015 SKP Business Consulting LLP. All rights reserved.
PRACTICAL APPLICATIONS
Data theft
Procurement fraud
Senior management fraud/
financial statement fraud
• System logs
• Access data
• Lynk files
• Emails
• Excel workings
• Transactional data
• Communications
• Excel workings
© 2015 SKP Business Consulting LLP. All rights reserved.
CHALLENGES - IN DIGITAL FORENSIC
Evidence
Deletion/ formatting of
data
Privacy and other
issuesEncryption
Damaged hard disk
Overwriting of dataInadmissible evidence
© 2015 SKP Business Consulting LLP. All rights reserved.
THE FUTURE
Emerging digital devices
And many more
Smart WatchesDrones
GPS coordinates
Emerging
Digital Services
CONTACT US
19 Adi Marzban Path
Ballard Estate
Fort
Mumbai 400 001
India
t: +91 22 6730 9000
Mumbai
VEN Business Centre
Baner-Pashan Link Road
Pashan
Pune 411 021
India
t: +91 20 6720 3800
Pune
6-3-249/3/1 SSK Building
Ranga Raju Lane
Road 1, Banjara Hills
Hyderabad 500 034
India
t: +91 40 2338 6912
Hyderabad
B-376
Nirman Vihar
New Delhi 110 092
India
t: + 91 11 2242 8454
New Delhi
3 Crown Court
128 Cathedral Road
Chennai 600 086
India
t: +91 44 4208 0337
Chennai
312/313 Barton Centre
Mahatma Gandhi Road
Bengaluru 560 001
India
t: +91 80 4140 0131
Bengaluru
269 The East Mall
Toronto ON
M9B 3Z1
Canada
t: +1 647 707 5066
Toronto
www.skpgroup.com
skpgrp.info@skpgroup.com
Connect with us
Subscribe
© 2015 SKP Business Consulting LLP. All rights reserved.
The contents herein are solely meant for communicating information and not
as professional advice. It may contain confidential or legally privileged
information. The addressee is hereby notified that any disclosure, copy, or
distribution of this material or the contents there of may be unlawful and is
strictly prohibited. Also the contents can not be considered as any
opinion/advice and should not be used basis for any decision. Before taking
any decision/advice please consult a qualified professional adviser. While due
care has been taken to ensure the accuracy of the information contained
herein, no warranty, express or implied, is being made by us as regards the
accuracy and adequacy of the information contained herein. SKP Business
Consulting LLP shall not be responsible for any loss whatsoever sustained by
any person who relies on this material.
DISCLAIMER
© 2015 SKP Business Consulting LLP. All rights reserved.
Credits:
Icon and Shape
www.flaticon.com
www.duarte.com

More Related Content

What's hot

The Future of Digital Forensics
The Future of Digital ForensicsThe Future of Digital Forensics
The Future of Digital Forensics
00heights
 
Digital forensics ahmed emam
Digital forensics   ahmed emamDigital forensics   ahmed emam
Digital forensics ahmed emam
ahmad abdelhafeez
 
[❤PDF❤] The Basics of Digital Forensics The Primer for Getting Started in Dig...
[❤PDF❤] The Basics of Digital Forensics The Primer for Getting Started in Dig...[❤PDF❤] The Basics of Digital Forensics The Primer for Getting Started in Dig...
[❤PDF❤] The Basics of Digital Forensics The Primer for Getting Started in Dig...
AngelinaJacobs2
 
Sued or Suing: Introduction to Digital Forensics
Sued or Suing: Introduction to Digital ForensicsSued or Suing: Introduction to Digital Forensics
Sued or Suing: Introduction to Digital Forensics
Anyck Turgeon, CFE/GRCP/CEFI/CCIP/C|CISO/CBA
 
Computer forensics
Computer  forensicsComputer  forensics
Computer forensics
Lalit Garg
 
Digital Forensics best practices with the use of open source tools and admiss...
Digital Forensics best practices with the use of open source tools and admiss...Digital Forensics best practices with the use of open source tools and admiss...
Digital Forensics best practices with the use of open source tools and admiss...Sagar Rahurkar
 
Digital Forensics
Digital ForensicsDigital Forensics
Digital Forensics
Vikas Jain
 
Digital forensics
Digital forensicsDigital forensics
Digital forensics
dentpress
 
Cyber forensic standard operating procedures
Cyber forensic standard operating proceduresCyber forensic standard operating procedures
Cyber forensic standard operating proceduresSoumen Debgupta
 
Digital forensics
Digital forensicsDigital forensics
Digital forensics
Roberto Ellis
 
Digital Forensics Workshop
Digital Forensics WorkshopDigital Forensics Workshop
Digital Forensics Workshop
Tim Fletcher
 
Fundamental digital forensik
Fundamental digital forensikFundamental digital forensik
Fundamental digital forensik
newbie2019
 
Digital investigation
Digital investigationDigital investigation
Digital investigation
unnilala11
 
Computer Forensic Softwares
Computer Forensic SoftwaresComputer Forensic Softwares
Computer Forensic Softwares
Dhruv Seth
 
Computer forensics
Computer forensicsComputer forensics
Computer forensics
Shreya Singireddy
 
Deep Web and Digital Investigations
Deep Web and Digital Investigations Deep Web and Digital Investigations
Deep Web and Digital Investigations
Damir Delija
 
Digital forensic principles and procedure
Digital forensic principles and procedureDigital forensic principles and procedure
Digital forensic principles and procedure
newbie2019
 

What's hot (20)

Digital forensics
Digital forensics Digital forensics
Digital forensics
 
Computer Forensic
Computer ForensicComputer Forensic
Computer Forensic
 
The Future of Digital Forensics
The Future of Digital ForensicsThe Future of Digital Forensics
The Future of Digital Forensics
 
Digital forensics
Digital forensicsDigital forensics
Digital forensics
 
Digital forensics ahmed emam
Digital forensics   ahmed emamDigital forensics   ahmed emam
Digital forensics ahmed emam
 
[❤PDF❤] The Basics of Digital Forensics The Primer for Getting Started in Dig...
[❤PDF❤] The Basics of Digital Forensics The Primer for Getting Started in Dig...[❤PDF❤] The Basics of Digital Forensics The Primer for Getting Started in Dig...
[❤PDF❤] The Basics of Digital Forensics The Primer for Getting Started in Dig...
 
Sued or Suing: Introduction to Digital Forensics
Sued or Suing: Introduction to Digital ForensicsSued or Suing: Introduction to Digital Forensics
Sued or Suing: Introduction to Digital Forensics
 
Computer forensics
Computer  forensicsComputer  forensics
Computer forensics
 
Digital Forensics best practices with the use of open source tools and admiss...
Digital Forensics best practices with the use of open source tools and admiss...Digital Forensics best practices with the use of open source tools and admiss...
Digital Forensics best practices with the use of open source tools and admiss...
 
Digital Forensics
Digital ForensicsDigital Forensics
Digital Forensics
 
Digital forensics
Digital forensicsDigital forensics
Digital forensics
 
Cyber forensic standard operating procedures
Cyber forensic standard operating proceduresCyber forensic standard operating procedures
Cyber forensic standard operating procedures
 
Digital forensics
Digital forensicsDigital forensics
Digital forensics
 
Digital Forensics Workshop
Digital Forensics WorkshopDigital Forensics Workshop
Digital Forensics Workshop
 
Fundamental digital forensik
Fundamental digital forensikFundamental digital forensik
Fundamental digital forensik
 
Digital investigation
Digital investigationDigital investigation
Digital investigation
 
Computer Forensic Softwares
Computer Forensic SoftwaresComputer Forensic Softwares
Computer Forensic Softwares
 
Computer forensics
Computer forensicsComputer forensics
Computer forensics
 
Deep Web and Digital Investigations
Deep Web and Digital Investigations Deep Web and Digital Investigations
Deep Web and Digital Investigations
 
Digital forensic principles and procedure
Digital forensic principles and procedureDigital forensic principles and procedure
Digital forensic principles and procedure
 

Viewers also liked

Identifying and Collecting Digital Evidence Webinar
Identifying and Collecting Digital Evidence WebinarIdentifying and Collecting Digital Evidence Webinar
Identifying and Collecting Digital Evidence WebinarCase IQ
 
Emirates Forensic Presentation
Emirates Forensic PresentationEmirates Forensic Presentation
Emirates Forensic PresentationEmirates Forensic
 
BDO Digital Forensic
BDO Digital ForensicBDO Digital Forensic
BDO Digital Forensic
BDO Indonesia
 
Kush wadhwa _mining_digital_evidence_in_windows - ClubHack2009
Kush wadhwa _mining_digital_evidence_in_windows - ClubHack2009Kush wadhwa _mining_digital_evidence_in_windows - ClubHack2009
Kush wadhwa _mining_digital_evidence_in_windows - ClubHack2009ClubHack
 
Dracos forensic flavor
Dracos forensic flavorDracos forensic flavor
Dracos forensic flavor
Satria Ady Pradana
 
Digital forensic upload
Digital forensic uploadDigital forensic upload
Digital forensic upload
Setia Juli Irzal Ismail
 
Cyber forensic readiness cybercon2012 adv j fick
Cyber forensic readiness cybercon2012 adv j fickCyber forensic readiness cybercon2012 adv j fick
Cyber forensic readiness cybercon2012 adv j fick
Jacqueline Fick
 
BDO Forensic Services
BDO Forensic ServicesBDO Forensic Services
BDO Forensic Services
BDO Indonesia
 
MobilePolicing –Investing in Mobile Technology to Produce an Efficient and Ag...
MobilePolicing –Investing in Mobile Technology to Produce an Efficient and Ag...MobilePolicing –Investing in Mobile Technology to Produce an Efficient and Ag...
MobilePolicing –Investing in Mobile Technology to Produce an Efficient and Ag...
Govnet Events
 
Raising performance in composites bonding - Highlight
Raising performance in composites bonding - HighlightRaising performance in composites bonding - Highlight
Raising performance in composites bonding - Highlight
Huntsman Advanced Materials Europe
 
M.Tech. Cyber Security & Incident Response
M.Tech. Cyber Security & Incident ResponseM.Tech. Cyber Security & Incident Response
M.Tech. Cyber Security & Incident Response
Nilay Mistry ACE, ISMS LA, OSFCE
 
EC-Council Computer Hacking Forensic Investigator v9
EC-Council Computer Hacking Forensic Investigator v9EC-Council Computer Hacking Forensic Investigator v9
EC-Council Computer Hacking Forensic Investigator v9
ITpreneurs
 
Workshop Digital Forensic - Cyber Security Community
Workshop Digital Forensic - Cyber Security CommunityWorkshop Digital Forensic - Cyber Security Community
Workshop Digital Forensic - Cyber Security Community
Antonio Andre
 
Real time trade surveillance in financial markets
Real time trade surveillance in financial marketsReal time trade surveillance in financial markets
Real time trade surveillance in financial markets
Hortonworks
 
Utilizing Internet for Fraud Examination and Investigation
Utilizing Internet for Fraud Examination and InvestigationUtilizing Internet for Fraud Examination and Investigation
Utilizing Internet for Fraud Examination and Investigation
Goutama Bachtiar
 
Securing the Internet from Cyber Criminals
Securing the Internet from Cyber CriminalsSecuring the Internet from Cyber Criminals
Securing the Internet from Cyber Criminals
Narudom Roongsiriwong, CISSP
 
Lect 1 computer forensics
Lect 1 computer forensicsLect 1 computer forensics
Lect 1 computer forensics
Kabul Education University
 
Cybersecurity Risk Management for Financial Institutions
Cybersecurity Risk Management for Financial InstitutionsCybersecurity Risk Management for Financial Institutions
Cybersecurity Risk Management for Financial Institutions
Sarah Cirelli
 
Digital Evidence in Computer Forensic Investigations
Digital Evidence in Computer Forensic InvestigationsDigital Evidence in Computer Forensic Investigations
Digital Evidence in Computer Forensic Investigations
Filip Maertens
 

Viewers also liked (20)

Identifying and Collecting Digital Evidence Webinar
Identifying and Collecting Digital Evidence WebinarIdentifying and Collecting Digital Evidence Webinar
Identifying and Collecting Digital Evidence Webinar
 
Emirates Forensic Presentation
Emirates Forensic PresentationEmirates Forensic Presentation
Emirates Forensic Presentation
 
BDO Digital Forensic
BDO Digital ForensicBDO Digital Forensic
BDO Digital Forensic
 
Kush wadhwa _mining_digital_evidence_in_windows - ClubHack2009
Kush wadhwa _mining_digital_evidence_in_windows - ClubHack2009Kush wadhwa _mining_digital_evidence_in_windows - ClubHack2009
Kush wadhwa _mining_digital_evidence_in_windows - ClubHack2009
 
Dracos forensic flavor
Dracos forensic flavorDracos forensic flavor
Dracos forensic flavor
 
Digital forensic upload
Digital forensic uploadDigital forensic upload
Digital forensic upload
 
Cyber forensic readiness cybercon2012 adv j fick
Cyber forensic readiness cybercon2012 adv j fickCyber forensic readiness cybercon2012 adv j fick
Cyber forensic readiness cybercon2012 adv j fick
 
BDO Forensic Services
BDO Forensic ServicesBDO Forensic Services
BDO Forensic Services
 
MobilePolicing –Investing in Mobile Technology to Produce an Efficient and Ag...
MobilePolicing –Investing in Mobile Technology to Produce an Efficient and Ag...MobilePolicing –Investing in Mobile Technology to Produce an Efficient and Ag...
MobilePolicing –Investing in Mobile Technology to Produce an Efficient and Ag...
 
Raising performance in composites bonding - Highlight
Raising performance in composites bonding - HighlightRaising performance in composites bonding - Highlight
Raising performance in composites bonding - Highlight
 
M.Tech. Cyber Security & Incident Response
M.Tech. Cyber Security & Incident ResponseM.Tech. Cyber Security & Incident Response
M.Tech. Cyber Security & Incident Response
 
EC-Council Computer Hacking Forensic Investigator v9
EC-Council Computer Hacking Forensic Investigator v9EC-Council Computer Hacking Forensic Investigator v9
EC-Council Computer Hacking Forensic Investigator v9
 
Cyber fraud in banks
Cyber fraud in banksCyber fraud in banks
Cyber fraud in banks
 
Workshop Digital Forensic - Cyber Security Community
Workshop Digital Forensic - Cyber Security CommunityWorkshop Digital Forensic - Cyber Security Community
Workshop Digital Forensic - Cyber Security Community
 
Real time trade surveillance in financial markets
Real time trade surveillance in financial marketsReal time trade surveillance in financial markets
Real time trade surveillance in financial markets
 
Utilizing Internet for Fraud Examination and Investigation
Utilizing Internet for Fraud Examination and InvestigationUtilizing Internet for Fraud Examination and Investigation
Utilizing Internet for Fraud Examination and Investigation
 
Securing the Internet from Cyber Criminals
Securing the Internet from Cyber CriminalsSecuring the Internet from Cyber Criminals
Securing the Internet from Cyber Criminals
 
Lect 1 computer forensics
Lect 1 computer forensicsLect 1 computer forensics
Lect 1 computer forensics
 
Cybersecurity Risk Management for Financial Institutions
Cybersecurity Risk Management for Financial InstitutionsCybersecurity Risk Management for Financial Institutions
Cybersecurity Risk Management for Financial Institutions
 
Digital Evidence in Computer Forensic Investigations
Digital Evidence in Computer Forensic InvestigationsDigital Evidence in Computer Forensic Investigations
Digital Evidence in Computer Forensic Investigations
 

Similar to Digital Forensic

Taking Control of SharePoint in the Cloud
Taking Control of SharePoint in the CloudTaking Control of SharePoint in the Cloud
Taking Control of SharePoint in the Cloud
SherWeb
 
Cv k i attree-primary
Cv k i attree-primaryCv k i attree-primary
Cv k i attree-primaryKelly Ian
 
Don’t Mention The “A” Word – Trends In Continuing Business And IT Misalignment
Don’t Mention The “A” Word – Trends In Continuing Business And IT MisalignmentDon’t Mention The “A” Word – Trends In Continuing Business And IT Misalignment
Don’t Mention The “A” Word – Trends In Continuing Business And IT Misalignment
Alan McSweeney
 
How SMBs Research Applications and Other Tech
How SMBs Research Applications and Other TechHow SMBs Research Applications and Other Tech
How SMBs Research Applications and Other Tech
Bredin, Inc.
 
Vendor Profile: DocuSign
Vendor Profile: DocuSignVendor Profile: DocuSign
Vendor Profile: DocuSign
Demand Metric
 
Bitkom Trendkongress 2014: NTT DATA Innovationworkshop about how the IoT requ...
Bitkom Trendkongress 2014: NTT DATA Innovationworkshop about how the IoT requ...Bitkom Trendkongress 2014: NTT DATA Innovationworkshop about how the IoT requ...
Bitkom Trendkongress 2014: NTT DATA Innovationworkshop about how the IoT requ...
Thomas Stoecker
 
Does the Internet of Things make or break your business model?
Does the Internet of Things make or break your business model?Does the Internet of Things make or break your business model?
Does the Internet of Things make or break your business model?
Oliver Koeth
 
Sevajothi trust profile18
Sevajothi trust profile18Sevajothi trust profile18
Sevajothi trust profile18
Sevajothi Crafts
 
Remote Working in a 2.0 World
Remote Working in a 2.0 WorldRemote Working in a 2.0 World
Remote Working in a 2.0 World
Marieke Guy
 
Bhadale group of companies big data qa guidelines
Bhadale group of companies big data qa guidelinesBhadale group of companies big data qa guidelines
Bhadale group of companies big data qa guidelines
Vijayananda Mohire
 
Splunk Financial Services Forum Boston June, 2017
Splunk Financial Services Forum Boston June, 2017Splunk Financial Services Forum Boston June, 2017
Splunk Financial Services Forum Boston June, 2017
Splunk
 
Take the Big Data Challenge - Take Advantage of ALL of Your Data 16 Sept 2014
Take the Big Data Challenge - Take Advantage of ALL of Your Data 16 Sept 2014Take the Big Data Challenge - Take Advantage of ALL of Your Data 16 Sept 2014
Take the Big Data Challenge - Take Advantage of ALL of Your Data 16 Sept 2014
pietvz
 
PD Overview - Powerpoint
PD Overview - PowerpointPD Overview - Powerpoint
PD Overview - PowerpointIavanie van Zyl
 
Computational Intelligence Unconference Jul 2014 Data to Knowledge
Computational Intelligence Unconference Jul 2014 Data to Knowledge Computational Intelligence Unconference Jul 2014 Data to Knowledge
Computational Intelligence Unconference Jul 2014 Data to Knowledge
John Morton
 
Turning big data to business outcomes
Turning big data to business outcomes Turning big data to business outcomes
Turning big data to business outcomes
Rolta
 
Export marketing
Export marketingExport marketing
ICT's role in Successful Studiies
ICT's role in Successful StudiiesICT's role in Successful Studiies
ICT's role in Successful Studiiesakinwunmi adelanwa
 
Bhadale group of companies data science Q&A guidelines
Bhadale group of companies data science Q&A guidelinesBhadale group of companies data science Q&A guidelines
Bhadale group of companies data science Q&A guidelines
Vijayananda Mohire
 

Similar to Digital Forensic (20)

Taking Control of SharePoint in the Cloud
Taking Control of SharePoint in the CloudTaking Control of SharePoint in the Cloud
Taking Control of SharePoint in the Cloud
 
Cv k i attree-primary
Cv k i attree-primaryCv k i attree-primary
Cv k i attree-primary
 
Don’t Mention The “A” Word – Trends In Continuing Business And IT Misalignment
Don’t Mention The “A” Word – Trends In Continuing Business And IT MisalignmentDon’t Mention The “A” Word – Trends In Continuing Business And IT Misalignment
Don’t Mention The “A” Word – Trends In Continuing Business And IT Misalignment
 
How SMBs Research Applications and Other Tech
How SMBs Research Applications and Other TechHow SMBs Research Applications and Other Tech
How SMBs Research Applications and Other Tech
 
Vendor Profile: DocuSign
Vendor Profile: DocuSignVendor Profile: DocuSign
Vendor Profile: DocuSign
 
Bitkom Trendkongress 2014: NTT DATA Innovationworkshop about how the IoT requ...
Bitkom Trendkongress 2014: NTT DATA Innovationworkshop about how the IoT requ...Bitkom Trendkongress 2014: NTT DATA Innovationworkshop about how the IoT requ...
Bitkom Trendkongress 2014: NTT DATA Innovationworkshop about how the IoT requ...
 
Does the Internet of Things make or break your business model?
Does the Internet of Things make or break your business model?Does the Internet of Things make or break your business model?
Does the Internet of Things make or break your business model?
 
Sevajothi trust profile18
Sevajothi trust profile18Sevajothi trust profile18
Sevajothi trust profile18
 
tinashe cv 2017
tinashe cv 2017tinashe cv 2017
tinashe cv 2017
 
Remote Working in a 2.0 World
Remote Working in a 2.0 WorldRemote Working in a 2.0 World
Remote Working in a 2.0 World
 
Bhadale group of companies big data qa guidelines
Bhadale group of companies big data qa guidelinesBhadale group of companies big data qa guidelines
Bhadale group of companies big data qa guidelines
 
Splunk Financial Services Forum Boston June, 2017
Splunk Financial Services Forum Boston June, 2017Splunk Financial Services Forum Boston June, 2017
Splunk Financial Services Forum Boston June, 2017
 
Take the Big Data Challenge - Take Advantage of ALL of Your Data 16 Sept 2014
Take the Big Data Challenge - Take Advantage of ALL of Your Data 16 Sept 2014Take the Big Data Challenge - Take Advantage of ALL of Your Data 16 Sept 2014
Take the Big Data Challenge - Take Advantage of ALL of Your Data 16 Sept 2014
 
PD Overview - Powerpoint
PD Overview - PowerpointPD Overview - Powerpoint
PD Overview - Powerpoint
 
CV_Piriya_Utamachant_2016
CV_Piriya_Utamachant_2016CV_Piriya_Utamachant_2016
CV_Piriya_Utamachant_2016
 
Computational Intelligence Unconference Jul 2014 Data to Knowledge
Computational Intelligence Unconference Jul 2014 Data to Knowledge Computational Intelligence Unconference Jul 2014 Data to Knowledge
Computational Intelligence Unconference Jul 2014 Data to Knowledge
 
Turning big data to business outcomes
Turning big data to business outcomes Turning big data to business outcomes
Turning big data to business outcomes
 
Export marketing
Export marketingExport marketing
Export marketing
 
ICT's role in Successful Studiies
ICT's role in Successful StudiiesICT's role in Successful Studiies
ICT's role in Successful Studiies
 
Bhadale group of companies data science Q&A guidelines
Bhadale group of companies data science Q&A guidelinesBhadale group of companies data science Q&A guidelines
Bhadale group of companies data science Q&A guidelines
 

Recently uploaded

Accpac to QuickBooks Conversion Navigating the Transition with Online Account...
Accpac to QuickBooks Conversion Navigating the Transition with Online Account...Accpac to QuickBooks Conversion Navigating the Transition with Online Account...
Accpac to QuickBooks Conversion Navigating the Transition with Online Account...
PaulBryant58
 
Digital Transformation in PLM - WHAT and HOW - for distribution.pdf
Digital Transformation in PLM - WHAT and HOW - for distribution.pdfDigital Transformation in PLM - WHAT and HOW - for distribution.pdf
Digital Transformation in PLM - WHAT and HOW - for distribution.pdf
Jos Voskuil
 
Filing Your Delaware Franchise Tax A Detailed Guide
Filing Your Delaware Franchise Tax A Detailed GuideFiling Your Delaware Franchise Tax A Detailed Guide
Filing Your Delaware Franchise Tax A Detailed Guide
YourLegal Accounting
 
The-McKinsey-7S-Framework. strategic management
The-McKinsey-7S-Framework. strategic managementThe-McKinsey-7S-Framework. strategic management
The-McKinsey-7S-Framework. strategic management
Bojamma2
 
What is the TDS Return Filing Due Date for FY 2024-25.pdf
What is the TDS Return Filing Due Date for FY 2024-25.pdfWhat is the TDS Return Filing Due Date for FY 2024-25.pdf
What is the TDS Return Filing Due Date for FY 2024-25.pdf
seoforlegalpillers
 
April 2024 Nostalgia Products Newsletter
April 2024 Nostalgia Products NewsletterApril 2024 Nostalgia Products Newsletter
April 2024 Nostalgia Products Newsletter
NathanBaughman3
 
Brand Analysis for an artist named Struan
Brand Analysis for an artist named StruanBrand Analysis for an artist named Struan
Brand Analysis for an artist named Struan
sarahvanessa51503
 
India Orthopedic Devices Market: Unlocking Growth Secrets, Trends and Develop...
India Orthopedic Devices Market: Unlocking Growth Secrets, Trends and Develop...India Orthopedic Devices Market: Unlocking Growth Secrets, Trends and Develop...
India Orthopedic Devices Market: Unlocking Growth Secrets, Trends and Develop...
Kumar Satyam
 
Meas_Dylan_DMBS_PB1_2024-05XX_Revised.pdf
Meas_Dylan_DMBS_PB1_2024-05XX_Revised.pdfMeas_Dylan_DMBS_PB1_2024-05XX_Revised.pdf
Meas_Dylan_DMBS_PB1_2024-05XX_Revised.pdf
dylandmeas
 
RMD24 | Debunking the non-endemic revenue myth Marvin Vacquier Droop | First ...
RMD24 | Debunking the non-endemic revenue myth Marvin Vacquier Droop | First ...RMD24 | Debunking the non-endemic revenue myth Marvin Vacquier Droop | First ...
RMD24 | Debunking the non-endemic revenue myth Marvin Vacquier Droop | First ...
BBPMedia1
 
Cree_Rey_BrandIdentityKit.PDF_PersonalBd
Cree_Rey_BrandIdentityKit.PDF_PersonalBdCree_Rey_BrandIdentityKit.PDF_PersonalBd
Cree_Rey_BrandIdentityKit.PDF_PersonalBd
creerey
 
Memorandum Of Association Constitution of Company.ppt
Memorandum Of Association Constitution of Company.pptMemorandum Of Association Constitution of Company.ppt
Memorandum Of Association Constitution of Company.ppt
seri bangash
 
The Parable of the Pipeline a book every new businessman or business student ...
The Parable of the Pipeline a book every new businessman or business student ...The Parable of the Pipeline a book every new businessman or business student ...
The Parable of the Pipeline a book every new businessman or business student ...
awaisafdar
 
一比一原版加拿大渥太华大学毕业证(uottawa毕业证书)如何办理
一比一原版加拿大渥太华大学毕业证(uottawa毕业证书)如何办理一比一原版加拿大渥太华大学毕业证(uottawa毕业证书)如何办理
一比一原版加拿大渥太华大学毕业证(uottawa毕业证书)如何办理
taqyed
 
What are the main advantages of using HR recruiter services.pdf
What are the main advantages of using HR recruiter services.pdfWhat are the main advantages of using HR recruiter services.pdf
What are the main advantages of using HR recruiter services.pdf
HumanResourceDimensi1
 
Putting the SPARK into Virtual Training.pptx
Putting the SPARK into Virtual Training.pptxPutting the SPARK into Virtual Training.pptx
Putting the SPARK into Virtual Training.pptx
Cynthia Clay
 
Lookback Analysis
Lookback AnalysisLookback Analysis
Lookback Analysis
Safe PaaS
 
Skye Residences | Extended Stay Residences Near Toronto Airport
Skye Residences | Extended Stay Residences Near Toronto AirportSkye Residences | Extended Stay Residences Near Toronto Airport
Skye Residences | Extended Stay Residences Near Toronto Airport
marketingjdass
 
Introduction to Amazon company 111111111111
Introduction to Amazon company 111111111111Introduction to Amazon company 111111111111
Introduction to Amazon company 111111111111
zoyaansari11365
 
3.0 Project 2_ Developing My Brand Identity Kit.pptx
3.0 Project 2_ Developing My Brand Identity Kit.pptx3.0 Project 2_ Developing My Brand Identity Kit.pptx
3.0 Project 2_ Developing My Brand Identity Kit.pptx
tanyjahb
 

Recently uploaded (20)

Accpac to QuickBooks Conversion Navigating the Transition with Online Account...
Accpac to QuickBooks Conversion Navigating the Transition with Online Account...Accpac to QuickBooks Conversion Navigating the Transition with Online Account...
Accpac to QuickBooks Conversion Navigating the Transition with Online Account...
 
Digital Transformation in PLM - WHAT and HOW - for distribution.pdf
Digital Transformation in PLM - WHAT and HOW - for distribution.pdfDigital Transformation in PLM - WHAT and HOW - for distribution.pdf
Digital Transformation in PLM - WHAT and HOW - for distribution.pdf
 
Filing Your Delaware Franchise Tax A Detailed Guide
Filing Your Delaware Franchise Tax A Detailed GuideFiling Your Delaware Franchise Tax A Detailed Guide
Filing Your Delaware Franchise Tax A Detailed Guide
 
The-McKinsey-7S-Framework. strategic management
The-McKinsey-7S-Framework. strategic managementThe-McKinsey-7S-Framework. strategic management
The-McKinsey-7S-Framework. strategic management
 
What is the TDS Return Filing Due Date for FY 2024-25.pdf
What is the TDS Return Filing Due Date for FY 2024-25.pdfWhat is the TDS Return Filing Due Date for FY 2024-25.pdf
What is the TDS Return Filing Due Date for FY 2024-25.pdf
 
April 2024 Nostalgia Products Newsletter
April 2024 Nostalgia Products NewsletterApril 2024 Nostalgia Products Newsletter
April 2024 Nostalgia Products Newsletter
 
Brand Analysis for an artist named Struan
Brand Analysis for an artist named StruanBrand Analysis for an artist named Struan
Brand Analysis for an artist named Struan
 
India Orthopedic Devices Market: Unlocking Growth Secrets, Trends and Develop...
India Orthopedic Devices Market: Unlocking Growth Secrets, Trends and Develop...India Orthopedic Devices Market: Unlocking Growth Secrets, Trends and Develop...
India Orthopedic Devices Market: Unlocking Growth Secrets, Trends and Develop...
 
Meas_Dylan_DMBS_PB1_2024-05XX_Revised.pdf
Meas_Dylan_DMBS_PB1_2024-05XX_Revised.pdfMeas_Dylan_DMBS_PB1_2024-05XX_Revised.pdf
Meas_Dylan_DMBS_PB1_2024-05XX_Revised.pdf
 
RMD24 | Debunking the non-endemic revenue myth Marvin Vacquier Droop | First ...
RMD24 | Debunking the non-endemic revenue myth Marvin Vacquier Droop | First ...RMD24 | Debunking the non-endemic revenue myth Marvin Vacquier Droop | First ...
RMD24 | Debunking the non-endemic revenue myth Marvin Vacquier Droop | First ...
 
Cree_Rey_BrandIdentityKit.PDF_PersonalBd
Cree_Rey_BrandIdentityKit.PDF_PersonalBdCree_Rey_BrandIdentityKit.PDF_PersonalBd
Cree_Rey_BrandIdentityKit.PDF_PersonalBd
 
Memorandum Of Association Constitution of Company.ppt
Memorandum Of Association Constitution of Company.pptMemorandum Of Association Constitution of Company.ppt
Memorandum Of Association Constitution of Company.ppt
 
The Parable of the Pipeline a book every new businessman or business student ...
The Parable of the Pipeline a book every new businessman or business student ...The Parable of the Pipeline a book every new businessman or business student ...
The Parable of the Pipeline a book every new businessman or business student ...
 
一比一原版加拿大渥太华大学毕业证(uottawa毕业证书)如何办理
一比一原版加拿大渥太华大学毕业证(uottawa毕业证书)如何办理一比一原版加拿大渥太华大学毕业证(uottawa毕业证书)如何办理
一比一原版加拿大渥太华大学毕业证(uottawa毕业证书)如何办理
 
What are the main advantages of using HR recruiter services.pdf
What are the main advantages of using HR recruiter services.pdfWhat are the main advantages of using HR recruiter services.pdf
What are the main advantages of using HR recruiter services.pdf
 
Putting the SPARK into Virtual Training.pptx
Putting the SPARK into Virtual Training.pptxPutting the SPARK into Virtual Training.pptx
Putting the SPARK into Virtual Training.pptx
 
Lookback Analysis
Lookback AnalysisLookback Analysis
Lookback Analysis
 
Skye Residences | Extended Stay Residences Near Toronto Airport
Skye Residences | Extended Stay Residences Near Toronto AirportSkye Residences | Extended Stay Residences Near Toronto Airport
Skye Residences | Extended Stay Residences Near Toronto Airport
 
Introduction to Amazon company 111111111111
Introduction to Amazon company 111111111111Introduction to Amazon company 111111111111
Introduction to Amazon company 111111111111
 
3.0 Project 2_ Developing My Brand Identity Kit.pptx
3.0 Project 2_ Developing My Brand Identity Kit.pptx3.0 Project 2_ Developing My Brand Identity Kit.pptx
3.0 Project 2_ Developing My Brand Identity Kit.pptx
 

Digital Forensic

  • 1. Mumbai | Pune | Hyderabad | New Delhi | Chennai | Bengaluru DIGITAL FORENSIC A practitioners perspective Forensic Accounting Conference ICAI Bangalore Branch Feb 2016
  • 2. © 2015 SKP Business Consulting LLP. All rights reserved. WE AND THE DIGITAL WORLD
  • 3. © 2015 SKP Business Consulting LLP. All rights reserved. DATA DEVICES & TYPES Digital Devices Devices that we use on a daily basis Digital Applications Applications/ Software's we use on a daily basis Actions/ Activities We assist in collating necessary evidence for litigations
  • 4. © 2015 SKP Business Consulting LLP. All rights reserved. Digital Devices Popular Types 1. Laptop / Desktop 2. Hard-disk 3. Pen drive 4. Printer 5. Projector 6. Mobile Where do we use them? Digital devices are used by Business, professionals and individuals spread over various fields. Homes, Offices, Schools and even Trains stations or Airports, Digital devices are being used for education, entertainment or just for sharing of information DATA DEVICES & TYPES
  • 5. © 2015 SKP Business Consulting LLP. All rights reserved. Digital Applications Popular Types 1. ERP 2. Mobile App 3. Web Browsers 4. Social Media 5. Skype / Chatting 6. E-mail How do we use them? Applications are developed to make human life simpler. Distance and efforts are reduced. Thereby work which would have taken days is completed in mere hours. DATA DEVICES & TYPES
  • 6. © 2015 SKP Business Consulting LLP. All rights reserved. Actions/ Activities Popular Types 1. Update 2. Converse 3. Account checking 4. News 5. Browsing 6. Banking Why do we use them? Information that surround us needs to be constantly monitored for either updating, modification or simple knowledge purposes. Creating, Deleting, Updating, Modifying or Formatting are some purposes for which applications are used. DATA DEVICES & TYPES
  • 7. © 2015 SKP Business Consulting LLP. All rights reserved. WHAT DATA IS STORED? - Web Browsers - E-Mails - Image Editors - Message Logs - Event Logs - Transaction Logs Stores raw data Stores application Stores logs of use of application/ data - Created - Modified - Deleted
  • 8. © 2015 SKP Business Consulting LLP. All rights reserved. HOW DATA IS STORED? A. Track B. Geometrical sector C. Track sector D. Cluster Source: https://en.wikipedia.org/wiki/Disk_sector Updates happen based on FAT 32 The data stored in sectors
  • 9. © 2015 SKP Business Consulting LLP. All rights reserved. DIGITAL FORENSIC EVIDENCES Start Reports and documents Applications installed eg. software used to wipe information Emails Internet activity Chat Log Media info (Photo, scan doc, video etc) Usage of USB WiFi usage Specific Folders Secured information Draft agreements Deleted Information Personal Identity info Network information Downloaded content Hard disk / OS information Access logs/ windows event logs
  • 10. © 2015 SKP Business Consulting LLP. All rights reserved. DIGITAL FORENSIC EVIDENCES Internet history/ activities Key chat exchanges Mails/files downloaded to mobile Search history/ flagged places Files uploaded/ downloaded from storage sites Contact list and frequently contacted indications Social media cache memory Call and text history
  • 11. © 2015 SKP Business Consulting LLP. All rights reserved. EVIDENCE COLLECTION GUIDELINE Determine the necessary equipment to take to the scene. Review the legal authority to collect the evidence, ensuring any restrictions are noted. Individuals who may have relevant information should be identified and interviewed. When evidence cannot be removed, it should be copied or imaged on-site. Consult with the investigator. Source: SWEDGE guideline
  • 12. © 2015 SKP Business Consulting LLP. All rights reserved. Document the condition of Photograph and/or make a sketch of the computer connections and surrounding area. EVIDENCE HANDLING GUIDELINE Document the external component connections. Determine if the computer is in stand-by mode and follow procedures as if it was powered on. Source: SWEDGE guideline
  • 13. © 2015 SKP Business Consulting LLP. All rights reserved. EVIDENCE EXAMINATION GUIDELINE Review documentation Examination of the media should be completed Review the legal authority Examination on the original evidence media should be avoided if possible Appropriate controls and standards should be used Evidence Source: SWEDGE guideline
  • 14. © 2015 SKP Business Consulting LLP. All rights reserved. APPROACH FOR EVIDENCE EXAMINATION Evidence is available Evidence is extractible Evidence is admissible Understandi ng the subject Preliminary Profiling Pattern/ Exception Analysis Key Word Searches Revisit Profiling & Analysis Evidence Principles • Contextual knowledge about the subject and the environment • Understanding the folder structure/ email pattern and broader understanding use of digital device • Broad nature, response time, approach towards communication • Understanding the extent of private conversations and the nature of the information shared in private communications • Inconsistent nature of communication received with reference to role, ‘Bcc’ communication, information shared with private email addresses, unusual pattern of conversations with external domains • Evaluate the number of search hits, the nature of outcomes in those search hits for preliminary key words • Use GREP, Whole word, Case Sensitive and Boolean searches as required • Revisit the procedures based on the outcomes after the keyword searches • Consolidate timeline and red flags together
  • 15. © 2015 SKP Business Consulting LLP. All rights reserved. TOOLS IN DIGITAL FORENSIC Imaging tool (write protector)Tableu Imaging and processing toolEncase Mobile forensic toolOxygen Key word search toolIntella, Nuix Email review platformClearwell
  • 16. © 2015 SKP Business Consulting LLP. All rights reserved. PRACTICAL APPLICATIONS Data theft Procurement fraud Senior management fraud/ financial statement fraud • System logs • Access data • Lynk files • Emails • Excel workings • Transactional data • Communications • Excel workings
  • 17. © 2015 SKP Business Consulting LLP. All rights reserved. CHALLENGES - IN DIGITAL FORENSIC Evidence Deletion/ formatting of data Privacy and other issuesEncryption Damaged hard disk Overwriting of dataInadmissible evidence
  • 18. © 2015 SKP Business Consulting LLP. All rights reserved. THE FUTURE Emerging digital devices And many more Smart WatchesDrones GPS coordinates Emerging Digital Services
  • 19. CONTACT US 19 Adi Marzban Path Ballard Estate Fort Mumbai 400 001 India t: +91 22 6730 9000 Mumbai VEN Business Centre Baner-Pashan Link Road Pashan Pune 411 021 India t: +91 20 6720 3800 Pune 6-3-249/3/1 SSK Building Ranga Raju Lane Road 1, Banjara Hills Hyderabad 500 034 India t: +91 40 2338 6912 Hyderabad B-376 Nirman Vihar New Delhi 110 092 India t: + 91 11 2242 8454 New Delhi 3 Crown Court 128 Cathedral Road Chennai 600 086 India t: +91 44 4208 0337 Chennai 312/313 Barton Centre Mahatma Gandhi Road Bengaluru 560 001 India t: +91 80 4140 0131 Bengaluru 269 The East Mall Toronto ON M9B 3Z1 Canada t: +1 647 707 5066 Toronto www.skpgroup.com skpgrp.info@skpgroup.com Connect with us Subscribe © 2015 SKP Business Consulting LLP. All rights reserved.
  • 20. The contents herein are solely meant for communicating information and not as professional advice. It may contain confidential or legally privileged information. The addressee is hereby notified that any disclosure, copy, or distribution of this material or the contents there of may be unlawful and is strictly prohibited. Also the contents can not be considered as any opinion/advice and should not be used basis for any decision. Before taking any decision/advice please consult a qualified professional adviser. While due care has been taken to ensure the accuracy of the information contained herein, no warranty, express or implied, is being made by us as regards the accuracy and adequacy of the information contained herein. SKP Business Consulting LLP shall not be responsible for any loss whatsoever sustained by any person who relies on this material. DISCLAIMER © 2015 SKP Business Consulting LLP. All rights reserved. Credits: Icon and Shape www.flaticon.com www.duarte.com