Digital Forensics is the use of scientifically derived and proven methods toward the preservation, collection, validation, identification, analysis, interpretation, documentation, and presentation of digital evidence derived from digital devices.

1. DIGITAL FORENSICS WITH TOOLS
PRESENTED BY :- VISHNU.V
MASTER OF COMPUTER APPLICATION
DEPARTMENT OF COMPUTER APPLICATION
1

2. TYPES OF CRIMES
TRADITIONAL CRIMES
Traditional crimes are crimes which are done in earlier days without the help of
electronics or digital components.
Example : robbery , pick pocket ,kidnapping, Blackmail, theft etc….
DIGITAL CRIMES
Digital crimes are crimes which are done through digital world with the help of
Digital gadgets or devices.
Example : Hacking , dos attack ,malware, online financial theft etc…..
** NOW A DAYS MOST OF OUR DATA ARE IN THE FORM OF DIGITAL EVIDENCE **
2

3. INTRODUCTION
FORENSICS
Forensic science is the application of science to criminal and civil laws, mainly on
the criminal side during criminal investigation, as governed by the legal
standards of admissible evidence and criminal procedure .
DIGITAL FORENSICS
Digital Forensics is the use of scientifically derived and proven methods toward
the preservation, collection, validation, identification, analysis, interpretation,
documentation, and presentation of digital evidence derived from digital devices.
3

4. GRAPHICAL REPRESENTION OF CYBER CRIMES
4

5. MOST COMMON TYPES OF CYBER ATTACKS
5

6. HISTORY OF COMPUTER FORENSICS
• Michael Anderson
• “Father of computer forensics”
• special agent with IRS ( law enforcement agency)
• Meeting in 1988 (Portland, Oregon) • creation of IACIS, the International Association of
Computer Investigative Specialists •
• The first Seized Computer Evidence Recovery Specialists (SCERS) classes held.
6

7. WORKING PROCESS : METHOD OF HIDING DATA
Hard Drive/File System manipulation :
• Slack Space
• Partition waste space
• Hidden drive Space
• Bad sectors
• Extra Tracks
• Change file names and extensions
7

8. BRANCHES OF DIGITAL FORENSICS
The technical aspect of an investigation is divided into several sub-branches, relating to
the type of digital devices involved:
• Computer forensics
• Firewall Forensics
• Database Forensics
• Network forensics
• Forensic data analysis
• Mobile device forensics.
The typical forensic process encompasses the seizure, forensic imaging and
analysis of digital media and the production of a report into collected evidence.
8

9. TYPES OF DIGITAL FORENSICS
Digital forensics are classified into two :
LIVE DATA FORENSICS
Live data forensics is only focused on computer systems that are powered on. The main
purpose is to acquire volatile data that would otherwise get lost if the computer system is
turned off or would be overwritten if the computer system will stay turned on for a longer
period. Then go for the traditional forensics.
TRADITIONAL DATA FORENSICS
Live data forensics is only focused on computer systems that are powered off. But in case
of mobile phone if it is on keep it on, if it is off keep it off. If mobile phone is on change to
flight mode because of hash value will change continuously. Then crimes cant be proved.
9

10. STEPS IN DIGITAL FORENSICS
10

11. IDENTIFICATION
Identification is the most difficult step in digital forensics.
11

12. CENTRAL FORENSIC SCIENCE LABORATORY IN INDIA
The Central Forensic Science Laboratory (CFSL) is a wing of the Indian Ministry of
Home Affairs, which fulfills the forensic requirements in the country. It houses the only
DNA repository in South and Southeast Asia.
CFSL Hyderabad is a center of excellence in chemical sciences
CFSL Kolkata (the oldest laboratory in India) in biological sciences
CFSL Chandigarh in physical sciences.
CFSL New Delhi comes under the Central Bureau of Investigation, Delhi
12

13. KERALA POLICE CYBERDOME
13

14. KERALA CYBER FORENSICS LABS
The Kerala State Forensic Science laboratory was established in 1961 at the
Medical College Building, Thiruvananthapuram Dr. Thangavelu, the then Principal of
Medical College, Thiruvananthapuram was the first Honorary Director of the
laboratory.
At present, the laboratory consists of Headquarters lab situated in Police Head Quarters,
Thiruvananthapuram and two fully functional Regional Forensic Science Labs at Thrissur
and Kannur.
There are Nineteen District Mobile Forensic Labs(DMFL) in all Police Districts.
One new Regional FSL at Kochi has been sanctioned and is about to start its functioning.
The Headquarters lab at Thiruvananthapuram consists of eleven divisions such as
Physics, Ballistics, Biology, Serology, DNA, Documents, Documents- Civil, Cyber,
Chemistry, Explosives and Polygraph divisions. RFSLs have four major divisions such as
Physics, Chemistry, Biology and Documents.
14

15. EXAMPLES OF DIGITAL EVIDENCE
• e-mails
• digital photographs,
• ATM transaction logs
• Finger prints
• word processing documents
• Instant message histories
• files saved from accounting program
• spreadsheets
• internet browser histories
• Databases
• The contents of computer memory
• computer backups
• computer printouts
• Global Positioning System tracks,
• logs from a hotel’s electronic door locks
• digital video or audio files Types of Digital Evidence
15

16. STEPS FOR EVIDENCE PRESENTATION
• Format &Authenticity
• Hard Copy / Soft Copy
• Software used versions
• CV of the expert qualifications
• Hash results
• All storage media details
• Report should be in simple terms
• Supported by photographs
16

17. RULES OF EVIDENCE
• Admissible - Conform to legal rules in court.
• Authentic - Possible to prove the evidence genuine.
• Complete - Should reflect all aspects of the incident or crime.
• Reliable - Clarity about how the evidence was collected and handled.
• Believable - Must be readily believable and understandable by the court
17

18. HASHING
• Hashing is a mathematical model for authenticating any digital data.
• It uses a set of computations to generate a unique code for the input data.
• Any minute change in the input data will change the resultant hash value .
• .There are standard algorithms like MD5, SHA1 and SHA2 used for this.
• Hashing can be done using hardware solutions or software solutions.
** software hashes are not valuable at the court **
18

19. DEVICES USED IN DIGITAL FORENSICS
WRITE BLOCKER
Write blockers are devices that allow acquisition of information on a drive
without creating the possibility of accidentally damaging the drive contents.
They do this by allowing read commands to pass but by blocking write commands.
RAID - RAPID ACTION IMAGING DEVICE
RAID or Master Device is a complete set
Of tools within a box which can carry out
by investigation officers in scene of crime.
Write Blocker
19

20. DIGITAL FORENSICS SOFTWARE TOOLS
Some of the most common digital forensics software tools ;
• Disk Forensics tool :- Cyber Check 6.0 - Forensic Data Recovery & Analysis tool
• Live Forensics Tool :- Win-LiFT 3.0 – Windows Live Forensics Tool
• Network Forensics Tools:- Net Force Suite 3.0 - A comprehensive collection of Network Forensics tools
• Device Forensics Tools :- Mobile Check 3.1 - Cell phone Forensics tool
Third party Foreign Tools :
• FTK
• EnCase
• Magnet Axiom
• Autopsy – Open Source
• Cellebrite
• Oxygen
• XRY
20

21. ADVANTAGES OF DIGITAL FORENSICS
• The most important advantage, however, is that it is able to search through a
large and massive amount of data.
• it has the ability to do this very quickly.
• Digital forensics can be used in corporate fraud, breach of contract and asset
recovery, theft, and intellectual property disputes.
• IT can search in the hard drives in different languages, and this is beneficial
since cyber crimes have the ability to cross borders on the internet.
• The many valuable data that has been lost and deleted can be achieved
sufficiently .
• It can then become substantial evidence in court.
21

22. CHALLENGES FACED BY DIGITAL FORENSICS
• The increase of PC’s and internet access has made the exchange of
information quick and inexpensive.
• Easy availability of Hacking Tools.
• Lack of physical evidence makes crimes harder to prosecute.
• The large amount of storage space available to suspects .
• The rapid technological changes requires constant upgrade or changes to
solutions .
22

23. IT ACT IN INDIA
Section65-Tampering with computer source document
section 66-Hacking with computer system
section 66-Receiving stolen computer or communication device
section 66C-Using password of another person
section 66D-Cheating using computer resource
section 66E-Publishing private images of others
section 66F-Acts of cyber terrorism
section 67-Publishing information which is obscene in electronic form.
section 67A-Publishing images containing sexual acts
section 67B-Publishing child porn or predating children online
section 67C-Failure to maintain records
section 68-Failure/refusal to comply with orders
section 70-Securing access or attempting to secure access to a protected system
section 71-Misrepresentation
23

24. FEATURE SCOPE
• There is an increasing wide array of tools used to preserve and analyze digital evidence.
• The single approach to utilize single evidence such as hard drives will change as there
is increasing size of hundreds of Gigabytes and Terabytes to be used.
• Huge targets will require more sophisticated analysis techniques and equipment.
• There will also be better collaborative functions to allow forensics investigators to
perform investigations a lot more efficiently that they do presently.
24

25. SUGGESTIONS TO KEEP YOU SAFE
 Update your system software's on continues intervals
 Update all your applications
 Don’t try to install unknown applications
 Don’t even open your unknown links which received by means of social
media or by mail or sms .
 Don’t share your OTP or any keys with any one.
25

26. TOOLS DEMONSTRATION WITH WINDOWS 10.
• HASHING
• BROWSE ANALYSIS
26

27. KERALA POLICE CYBERDOME
Headed with :- MANOJ ABRAHAM IPS
Address :- Cyber dome, Thejaswini Annexe Building,
Techno park Campus, Thiruvananthapuram,
Kerala -695581.
Website :- www.cyberdome.kerala.gov.in
E-mail :- cyberdome.pol@kerala.gov.in
Facebook page :- https://www.facebook.com/KeralaPoliceCyberdome
27

28. CONCLUSION
• Digital forensics is important for solving crimes
 with digital devices
 against digital devices
 against people where evidence may reside in a device
• Several sound tools and techniques exist to search and analyze
digital data.
• Regardless of existing tools, evolving digital age and development of
technology requires heavier research in digital forensics.
28

29. REFERENCE
www.slideshare.net/cleverence1/digital-forensic-73189319
https://en.wikipedia.org/wiki/Digital_forensics
www.techopedia.com/definition/27805/digital-forensics
29

30. END OF THE PRESENTATION
THANK YOU
ITS YOUR TIME
30