Computer forensics involves the collection, analysis and presentation of digital evidence for use in legal cases. It combines elements of law, computer science and forensic science. The goal is to identify, collect and analyze digital data in a way that preserves its integrity so it can be used as admissible evidence. This involves understanding storage technologies, file systems, data recovery techniques and tools for acquisition, discovery and analysis of both volatile and persistent data. Computer forensics practitioners must be aware of ethical standards to maintain impartiality and integrity in their investigations.

1. INTRODUCTION TO COMPUTER
FORENSIC

2. What is Computer Forensics?
• Forensics is the process of using scientific knowledge for
collecting, analyzing, and presenting evidence to the courts.
(The word forensics means “to bring to the court.” ).
• Forensics deals primarily with the recovery and analysis of
latent evidence.
• Latent evidence can take many forms, from fingerprints left
on a window to DNA evidence recovered from blood stains to
the files on a hard drive.

3. What is Computer Forensics? (cont)
• Because computer forensics is a new discipline, there
is little standardization and consistency across the
courts and industry.
• “We define computer forensics as the discipline that
combines elements of law and computer science to
collect and analyze data from computer systems,
networks, wireless communications, and storage
devices in a way that is admissible as evidence in a
court of law”.

4. Why is Computer Forensics
Important?
• From a technical standpoint, the main goal of
computer forensics is to identify, collect,
preserve, and analyze data in a way that
preserves the integrity of the evidence
collected so it can be used effectively in a legal
case.

5. TECHNOLOGY
• Understanding of
– storage technology
– operating system features
• Windows
• Linux
• Unix
• Mac OS
– file systems

6. TECHNOLOGY
• Knowledge of
– Slack space
– Host Protected Area (HPA)
– Device Configuration Overlay (DCO)
• Disk imaging
• Data recovery
• Total data deletion
• Handling encryption

7. COLLABORATION
• Computer Forensics investigation requires
collaboration of
– Law enforcement
– Attorneys
– Computer specialists
• In academia, collaborating units could be:
– Computer Science
– Criminal Justice
– Law
– Accounting & Finance

8. APPLICATIONS
• Email
– Lasts longer than people believe
– Businesses monitor employee emails
– Admissible in legal proceedings
– Protect using PGP
• E-commerce
– Exchange of confidential data
– Impersonation

9. APPLICATIONS
• Data backup
– Encrypt
– Secure transfer of backup media
– Periodic recovery

10. Security Issues
• Data hiding
• Image hiding
• Improper destruction of sensitive data
• Weak authentication tools
– Created, Accessed, Modified date
– Boot password
– Password cracking

11. What are some typical aspects of a
computer forensics investigation?
• First, those who investigate computers have to understand
the kind of potential evidence they are looking for in order to
structure their search.
• Crimes involving a computer can range across the spectrum
of criminal activity, from child pornography to theft of
personal data to destruction of intellectual property.
• Second, the investigator must pick the appropriate tools to
use. Files may have been deleted, damaged, or encrypted,
and the investigator must be familiar with an array of
methods and software to prevent further damage in the
recovery process.

12. NATURE OF FORENSIC EVIDENCE
• Two basic types of data are collected in computer forensics.
– Persistent data is the data that is stored on a local hard drive (or
another medium) and is preserved when the computer is turned off.
– Volatile data is any data that is stored in memory, or exists in transit,
that will be lost when the computer loses power or is turned off.
• Volatile data resides in registries, cache, and random access
memory (RAM). Since volatile data is ephemeral, it is
essential an investigator knows reliable ways to capture it.

13. NATURE OF FORENSIC EVIDENCE
(Cont’)
• Data must be relevant & reliable
• Reliability of evidence gathered by tools assessed by
judge in pre-trial hearing aka Daubert Hearing
• Assesses Methodology to gather evidence
– Sound scientific practices?
– Reliable evidence?

14. PRE-TRIAL HEARINGS
• Frye Test – past method
– Responsibility on scientific community
– Defined acceptable evidence gathering
procedures
– Used Peer Reviewed Journals
• Daubert Hearing – current method
– Offers additional methods to test quality of
evidence

15. DAUBERT HEARING PROCESS
• Testing – Is this procedure tested?
• Error Rate – What is the error rate of this
procedure?
• Publication – Has procedure been published
and reviewed by peers?
• Acceptance – Is the procedure generally
accepted within the relevant scientific
community?

16. TYPES OF FORENSIC SOFTWARE
• Acquisition Tools
• Data Discovery Tools
• Internet History Tools
• Image Viewers
• E-mail Viewers
• Password Cracking Tools
• Open Source Tools
• Mobile Device tools (PDA/Cell Phone)
• Large Storage Analysis Tools

17. MORE ABOUT ELECTRONIC DATA DISCOVERY
TOOLS
• Analyze data
• Retrieve data from different media
• Convert between different media and file
formats
• Extract text & data from documents
• Create images of the documents
• Print documents
• Archive documents

18. INTERNET HISTORY TOOLS
• Reads Information in Complete History
Database
• Displays List of Visited Sites
• Opens URLs in Internet Explorer
• Adds URLs to Favorites
• Copies URLs
• Prints URLS
• Saves Listing/Ranges as Text File

19. IMAGE & E-MAIL VIEWERS
• Views Files
• Converts Files
• Catalogs Files
• Side by Side File
Comparisons

20. PASSWORD CRACKING TOOLS
• Password Recovery
• Allows access to computers
• 3 Methods to Crack Passwords
– Dictionary Attack
– Hybrid Attack
– Brute Force Attack
Source: http://www-128.ibm.com/developerworks/library/s-crack/

21. OPEN SOURCE TOOLS
• Free tools available to Computer Forensic
Specialists
• Cover entire scope of forensic tools in use
• May more clearly and comprehensively meet
the Daubert guidelines than closed source tools
• Among the most widely used
Source:
http://software.newsforge.com/software/05/04/05/2052235.shtml?tid=129&tid=136&t

22. MOBILE DEVICE TOOLS
• Number and variety of toolkits considerably
more limited than for computers
• Require examiner to have full access to device
• Most tools focus on a single function
• Deleted data remains on PDA until successful
HotSync with computer
Sources: http://csrc.nist.gov/publications/nistir/nistir-7100-PDAForensics.pdf
http://www.cs.ucf.edu/courses/cgs5132/spring2002/presentation/weiss.ppt#5

23. FORENSIC TOOL SUITES
– Parben
• Provide a lower cost way to
– The Coroner’s
maximize the tools
Toolkit (TCT)
• Typically include the most – The Sleuth Kit
often used tools (TSK)
– EnCase
– Forensic Toolkit
(FTK)
– Maresware

24. OVERVIEW OF SYSTEMS SECURITY
• Ten guidelines:
– Remove personally identifiable data from storage media
– Store an identical copy of any evidentiary media given to
law enforcement
– Limit search to goal of investigation
– Handle time stamped events in strictest confidence
– On networks, packet acknowledgement be via the use of
tokens than IP addresses

25. OVERVIEW OF SYSTEMS SECURITY
(Cont’)
• Safe storage of all internal logs
• Preservation of event logs in external nodes
• Put policies in place for actionable items related to
attacks
• Put policies in place for safeguarding backed up
data related to an investigation
• Handle disposal of sensitive data in a secure
manner

26. COMPUTER FORENSICS AS A
PROFESSION?
• Attitudes to computer forensics
– Academic
– Application of computer science
– Application of forensic science
– Narrow specialism
– Aligned to computer security
– Core discipline

27. ETHICAL BEHAVIOUR IN COMPUTER
FORENSICS
• There is a very fine line between what is
acceptable and what is deemed to be
malpractice
• Computer Forensics exists in an ethical grey
area
• Often need to balance self motivation
versus legal constraints and procedural
considerations

28. Ethical Behaviour in Computer
Forensics
• Need to understand the ethical responsibility
in Computer Forensics work is to:
– Self
– Profession
– Clients
– Subjects
– Courts
– Society

29. COMPUTER FORENSICS ETHICAL
STANDARDS
• What is worse?
– Failing to convict the guilty
– Convicting the innocent
• The role of the investigator is to expose the
evidence from a neutral point of view
• The Auld Report states that
– “It is the duty of an expert to help the court on the
matters within his expertise. The duty overrides
any obligation to the person from whom he has
received instruction or by whom he is paid”

30. PSYCHOLOGY OF INVESTIGATION
• Evaluate the allegation
– Who made it ?
– Is there a hidden agenda ?
• Avoid presumption of guilt
• Avoid desire to win
• Show all the evidence both contrary and
supporting the accusation

31. PSYCHOLOGY OF INVESTIGATION
• Ask yourself the questions
– Could the person be innocent ?
– Could someone else have done it ?
• Keep an open mind
• Be impartial
• Be rigorous and professional

32. COMPUTER FORENSICS PRACTITIONERS
REQUIRE AWARENESS
• To help in making decisions about “doing
the right thing”.
• To provide material in defending or
justifying a particular position.
• To protect you as a practitioner.
• To consider in terms of practitioner and
system liability.
• To maintain evidential integrity.

33. QUESTIONING THE LAW
• Is the law always ethical ?
• Is the law good and just ?
• Was apartheid legislation ethical ?
• Just because an act or set of circumstances
is permitted in computing does not mean
that it is ethical.

34. AREAS OF KNOWLEDGE
• What laws to consider ?
• What impact the laws might have on a
particular activity
• Critical analysis
– Are the laws appropriate ?
– Are there contradictions in legal provision?
– Can the laws be applied to computer
forensics ?
– Should the laws be challenged ?

35. EXAMPLE OF REGULATIONS TO
CONSIDER
• Data Protection Act 1998
– Right of access, Right to prevent processing,
Right to compensation
• Computer Misuse Act 1990 and Computer
Misuse (Amendment) Act 2002
• Regulation of Investigatory Powers Act
2000

36. Example of Regulations to
Consider
• Human Rights Act 1998
• Disability Discrimination Act (1995) and
Special Educational Needs and Disability
Act 2001

37. Example of Regulations to
Consider
• Anti-terrorism, Crime and Security Act 2001
– ISPs (Internet Service Providers) keep track of
their customers’ activities over a period of 12
months
• Freedom of Information Act 2000 and
Freedom of Information (Scotland) Act
2002

38. Example of Regulations to
Consider
• Theft Act 1968, 1978
• Protection from Harassment Act 1997
• Obscene Publications Act 1959
• Protection of Children Act 1978
• Criminal Justice Act 1988

39. EXAMPLE OF REGULATIONS TO
CONSIDER
• Sexual Offences Act 2003
• Anti-terrorism, Crime and Security Act 2001
• Patents Act 1977 and the Copyright,
Designs and Patents Act 1988
– Intellectual Property, Copyright Law, Patent
Law, Trademarks and Passing-off
• Design Right (Semiconductor Regulations)
1989

40. PROFESSIONAL BEHAVIOUR IN
COMPUTER FORENSICS
• Enhance the resolution of crime involving
computers and reduce cyber crime
• Ensure robust, reliable, valid and safe
processes and procedures
• Comply with ethical and legal expectations

41. PROFESSIONAL BEHAVIOUR IN
COMPUTER FORENSICS
• Enhance public confidence in computer
forensics
• Enhance computer security
• Promote awareness and understanding
• Requires the ability and competence to
make appropriate decisions

42. AREAS OF PROFESSIONAL
RESPONSIBILITY
• Litigation and Liability
• Certification and Licence to practice
• Compliance
– For example web sites with Disability Discrimination Act
• Audit
• Dealing with contradictions
• Professional and ethical responsibility
• Organisational regulation and policy
– computing action may be legal but against company policy,
e.g. Internet transactions on work computers, e-mail
language