The document outlines an agenda for a session on electronic evidence and digital forensics. It discusses what digital forensics is, the evolution and basic process of digital forensics including identification, seizure, acquisition, analysis and presentation of digital evidence. It also covers different types of attacks, the steps involved in a digital forensics investigation from a crime occurring to storage and analysis of evidence. Finally, it discusses considerations around shutting down devices that may contain evidence and relevant sections of the Indian Evidence Act and IT Act.

1. ELECTRONIC
EVIDENCE
SESSION 2

2. AGENDA
 What is Digital forensics?
 Modern forensics
 Evolution
 Process
 Basic steps
 Different types of crimes
 To Pull the Plug or Not
 Case study 1: San Bernardino Attack
Sunday, August 6, 2017
Suresh Kumar K

3. WHAT IS DIGITAL
FORENSICS?
Digital forensics (sometimes known as digital forensic
science) is a branch of forensic science encompassing the
recovery and investigation of material found in digital
devices, often in relation to computer crime
Reactive not proactive
Forensics is not About finding the criminals / bad guys
Forensics is about finding evidence
Sunday, August 6, 2017
Suresh Kumar K

4. EVOLUTION
• Francis Galton (1822–1911) made the first recorded study of
fingerprints
• Leone Lattes (1887–1954) discovered blood groupings (A,
B,AB, and 0)
• Calvin Goddard (1891–1955) allowed firearms and bullet
comparison for solving many pending court cases
• Albert Osborn (1858–1946) developed essential features of
document examination
• Hans Gross (1847–1915) made use of scientific study to head
criminal investigations
Sunday, August 6, 2017
Suresh Kumar K

5. MODES OF ATTACK
• Insider attacks
• These involve a breach of trust from employees within an
organization
• External attacks
• These involve hackers hired by either an insider or an
external entity whose aim is to destroy a competitor’s
reputation.
Sunday, August 6, 2017
Suresh Kumar K

6. PROCESS OF DIGITAL
FORENSICS
Identification
Seizure
Acquisition
Authentication
Analysis
Presentation
Sunday, August 6, 2017
Suresh Kumar K

7. BASIC STEPS
Crime
happens
ID A crime
scene
Warrant
First
responder
Seize
evidence
Transport
Bit-by-Bit
Copy
Integrity
(MD5/SHA)
Chain of
custody
Storage Analysis Report
Court
Sunday, August 6, 2017
Suresh Kumar K

8. EVIDENCE
Whole
Admissible
Accurate
Authentic
Acceptable
Sunday, August 6, 2017
Suresh Kumar K

9. TO PULL THE PLUG OR NOT
Sunday, August 6, 2017
Suresh Kumar K

10. FOCUS
section 65 of IT Act 2000. Tampering with computer
source documents.
Section 65 in The Indian Evidence Act, 1872
Sunday, August 6, 2017
Suresh Kumar K

11. ANY QUESTION ?
Sunday, August 6, 2017
Suresh Kumar K

12. THANK YOU
Sunday, August 6, 2017
Suresh Kumar K