SlideShare a Scribd company logo
Intro to Computer Forensics
Mr. Islahuddin Jalal
MS (Cyber Security) – UKM Malaysia
Research Title – 3C-CSIRT Model for Afghanistan
BAKHTAR UNIVERSITY ‫باخترپوهنتون‬ ‫د‬
Outline
• CF Investigation Process
• Secure the Evidence
• Acquire and Analyze the Data
• Assess Evidence and Case
• Prepare the Final Report
• Testify in the court as an Expert witness
• Computer Forensics Service Providers
Secure the Evidence
• Secure the evidence without damaging the evidence’s integrity
• Place the evidence in a secured site by not allowing any intruders to access
it
• Maintain the chain of custody to properly track the evidence
• Identify digital and non digital artifacts to separate the evidence according
to their behavior
• Maintain a log book at the entrance of the lab to log in the timings and
name of the person visited
• Place an intrusion alarm system in the entrance of the forensic lab
• Contact law enforcement agencies to know how to preserve the evidence
Chain of custody
• Chain of custody is a legal document that demonstrates the
progression of evidence as it travels from original evidence location to
the forensic laboratory
Acquire the Data
Note…………….
• Original Evidence should not be used for analysis
Note…………………………..
• Duplicate the Data
Hash the Evidence
Recovery……… if Necessary
• Tools of Recovery
• Recover my files
• Digital Rescue premium
• EASEUS data recovery wizard
• PC inspector file Recovery
• Advanced Disk Recovery
• Total Recall
Analyze the Data
• Thoroughly analyze the acquired data to draw conclusions related to
the case
• Data analysis techniques depend on the scope of the case or client’s
requirements
• Analysis of the file’s content, date and time of file creation and
modification, users associated with file creation access and file
modification, and physical storage location of the file
• Identify and categorize data in order of relevance
Tools for Analysis
• Forensic tools help in sorting and analysis of a large volume of data
to draw meaningful conclusions.
• Tools
• AccessData’s FTK
• Guidance Software’s Encase Forensics
• Brain Carrier’s the Sleuth Kit
Evidence Assessment
• Conduct a complete assessment by reviewing the
• Search warrant
• Legal authorization
• Case detail
• Nature of the hardware and software
• Potential evidence
• Circumstances surrounding the acquisition of the evidence to be examined
Case Assessment [CHFI]
Prepare the final Report
• Report Writing is a crucial stage in the outcome of the investigation
• The report should be clear, concise and written for the appropriate
audience
Continued…… [CHFI]
Continued… [CHFI]
Expert Witness
• An expert witness is a person who has a thorough knowledge of a
subject and whose credentials can convince others to believe his or
her opinions on that subject in a court of law
Testifying in the court
• Presenting digital evidence in the court requires knowledge of new,
specialized, evolving and sometimes complex technology
Computer forensics Service Providers
• www.compforensics.com
• www.forensic.com
• www.burgessforensics.com
• Global digital forensics
• etc
Thank You
For Your Patience

More Related Content

What's hot

computer forensics
computer forensicscomputer forensics
computer forensics
shivi123456
 
Computer forensics
Computer forensicsComputer forensics
Computer forensics
Shreya Singireddy
 
Lect 1 computer forensics
Lect 1 computer forensicsLect 1 computer forensics
Lect 1 computer forensics
Kabul Education University
 
Ce hv6 module 57 computer forensics and incident handling
Ce hv6 module 57 computer forensics and incident handlingCe hv6 module 57 computer forensics and incident handling
Ce hv6 module 57 computer forensics and incident handling
Vi Tính Hoàng Nam
 
Digital forensics
Digital forensicsDigital forensics
Digital forensics
dentpress
 
Computer forensics
Computer forensicsComputer forensics
Computer forensics
Hiren Selani
 
Computer Forensics
Computer ForensicsComputer Forensics
Computer Forensics
Daksh Verma
 
Sued or Suing: Introduction to Digital Forensics
Sued or Suing: Introduction to Digital ForensicsSued or Suing: Introduction to Digital Forensics
Sued or Suing: Introduction to Digital Forensics
Anyck Turgeon, CFE/GRCP/CEFI/CCIP/C|CISO/CBA
 
Computer Forensic
Computer ForensicComputer Forensic
Computer Forensic
Novizul Evendi
 
Computer Forensics: You can run but you can't hide
Computer Forensics: You can run but you can't hideComputer Forensics: You can run but you can't hide
Computer Forensics: You can run but you can't hide
Antonio Sanz Alcober
 
Computer forensic 101 - OWASP Khartoum
Computer forensic 101 - OWASP KhartoumComputer forensic 101 - OWASP Khartoum
Computer forensic 101 - OWASP Khartoum
OWASP Khartoum
 
Computer Forensics
Computer ForensicsComputer Forensics
Computer Forensics
Neilg42
 
Chap 1 general introduction to computer forensics
Chap 1  general introduction to computer forensicsChap 1  general introduction to computer forensics
Chap 1 general introduction to computer forensics
Malobe Lottin Cyrille Marcel
 
Computer forensic
Computer forensicComputer forensic
Computer forensic
Singgih Prasetya
 
Computer Forensic
Computer ForensicComputer Forensic
Computer Forensic
Tawhidur Rahman
 
Computer forensics powerpoint presentation
Computer forensics powerpoint presentationComputer forensics powerpoint presentation
Computer forensics powerpoint presentation
Somya Johri
 
Cyber forensic standard operating procedures
Cyber forensic standard operating proceduresCyber forensic standard operating procedures
Cyber forensic standard operating procedures
Soumen Debgupta
 
Codebits 2010
Codebits 2010Codebits 2010
Codebits 2010
Tiago Henriques
 
Cyber forensic investigation & Analysis
Cyber forensic investigation & AnalysisCyber forensic investigation & Analysis
Cyber forensic investigation & Analysis
Anshul Tayal
 

What's hot (19)

computer forensics
computer forensicscomputer forensics
computer forensics
 
Computer forensics
Computer forensicsComputer forensics
Computer forensics
 
Lect 1 computer forensics
Lect 1 computer forensicsLect 1 computer forensics
Lect 1 computer forensics
 
Ce hv6 module 57 computer forensics and incident handling
Ce hv6 module 57 computer forensics and incident handlingCe hv6 module 57 computer forensics and incident handling
Ce hv6 module 57 computer forensics and incident handling
 
Digital forensics
Digital forensicsDigital forensics
Digital forensics
 
Computer forensics
Computer forensicsComputer forensics
Computer forensics
 
Computer Forensics
Computer ForensicsComputer Forensics
Computer Forensics
 
Sued or Suing: Introduction to Digital Forensics
Sued or Suing: Introduction to Digital ForensicsSued or Suing: Introduction to Digital Forensics
Sued or Suing: Introduction to Digital Forensics
 
Computer Forensic
Computer ForensicComputer Forensic
Computer Forensic
 
Computer Forensics: You can run but you can't hide
Computer Forensics: You can run but you can't hideComputer Forensics: You can run but you can't hide
Computer Forensics: You can run but you can't hide
 
Computer forensic 101 - OWASP Khartoum
Computer forensic 101 - OWASP KhartoumComputer forensic 101 - OWASP Khartoum
Computer forensic 101 - OWASP Khartoum
 
Computer Forensics
Computer ForensicsComputer Forensics
Computer Forensics
 
Chap 1 general introduction to computer forensics
Chap 1  general introduction to computer forensicsChap 1  general introduction to computer forensics
Chap 1 general introduction to computer forensics
 
Computer forensic
Computer forensicComputer forensic
Computer forensic
 
Computer Forensic
Computer ForensicComputer Forensic
Computer Forensic
 
Computer forensics powerpoint presentation
Computer forensics powerpoint presentationComputer forensics powerpoint presentation
Computer forensics powerpoint presentation
 
Cyber forensic standard operating procedures
Cyber forensic standard operating proceduresCyber forensic standard operating procedures
Cyber forensic standard operating procedures
 
Codebits 2010
Codebits 2010Codebits 2010
Codebits 2010
 
Cyber forensic investigation & Analysis
Cyber forensic investigation & AnalysisCyber forensic investigation & Analysis
Cyber forensic investigation & Analysis
 

Similar to Lect 4 computer forensics

Introduction to computer forensic
Introduction to computer forensicIntroduction to computer forensic
Introduction to computer forensic
Online
 
digital forensics related to windows.pdf
digital forensics related to windows.pdfdigital forensics related to windows.pdf
digital forensics related to windows.pdf
muhammadosama0121
 
Digital Forensics Readiness - CommSec
Digital Forensics Readiness - CommSecDigital Forensics Readiness - CommSec
Digital Forensics Readiness - CommSec
DarraghCommsec
 
Digital emerging trends in computer engineering Evidences.pptx
Digital emerging trends in computer engineering Evidences.pptxDigital emerging trends in computer engineering Evidences.pptx
Digital emerging trends in computer engineering Evidences.pptx
ShubhamKadam807802
 
Digital emerging trends in computer engineering Evidences.pptx
Digital emerging trends in computer engineering Evidences.pptxDigital emerging trends in computer engineering Evidences.pptx
Digital emerging trends in computer engineering Evidences.pptx
ShubhamKadam807802
 
Collecting and preserving digital evidence
Collecting and preserving digital evidenceCollecting and preserving digital evidence
Collecting and preserving digital evidence
Online
 
Processing Crimes and Incident Scenes
Processing Crimes and Incident ScenesProcessing Crimes and Incident Scenes
Processing Crimes and Incident Scenes
primeteacher32
 
Computer Forensics (1).pptx
Computer Forensics (1).pptxComputer Forensics (1).pptx
Computer Forensics (1).pptx
Gautam708801
 
Forensic science in pakistan
Forensic science in pakistanForensic science in pakistan
Forensic science in pakistan
awaisajaz
 
forensicscienceinpakistan-150214040113-conversion-gate01 (1).pdf
forensicscienceinpakistan-150214040113-conversion-gate01 (1).pdfforensicscienceinpakistan-150214040113-conversion-gate01 (1).pdf
forensicscienceinpakistan-150214040113-conversion-gate01 (1).pdf
alizain9604
 
Electronic Forensic Protocols and Working with Computer Forensic Examiners
Electronic Forensic Protocols and Working with Computer Forensic ExaminersElectronic Forensic Protocols and Working with Computer Forensic Examiners
Electronic Forensic Protocols and Working with Computer Forensic Examiners
BoyarMiller
 
Cyber forensics and investigations
Cyber forensics and investigationsCyber forensics and investigations
Cyber forensics and investigations
Jay Mehta
 
644205e3-8f85-43da-95ac-e4cbb6a7a406-150917105917-lva1-app6892.pdf
644205e3-8f85-43da-95ac-e4cbb6a7a406-150917105917-lva1-app6892.pdf644205e3-8f85-43da-95ac-e4cbb6a7a406-150917105917-lva1-app6892.pdf
644205e3-8f85-43da-95ac-e4cbb6a7a406-150917105917-lva1-app6892.pdf
Gnanavi2
 
CF.ppt
CF.pptCF.ppt
CF.ppt
KhusThakkar
 
Digital Forensics
Digital ForensicsDigital Forensics
Digital Forensics
Nicholas Davis
 
Digital forensics
Digital forensicsDigital forensics
Digital forensics
Nicholas Davis
 
Avoiding e discovery disputes
Avoiding e discovery disputesAvoiding e discovery disputes
Avoiding e discovery disputes
David Harvey
 
Ch 3C Processing Crime and Incident Scenes.ppt
Ch 3C Processing Crime and Incident Scenes.pptCh 3C Processing Crime and Incident Scenes.ppt
Ch 3C Processing Crime and Incident Scenes.ppt
whbwi21Basri
 
File000176
File000176File000176
File000176
Desmond Devendran
 
Cyber forensics and auditing
Cyber forensics and auditingCyber forensics and auditing
Cyber forensics and auditing
Sweta Kumari Barnwal
 

Similar to Lect 4 computer forensics (20)

Introduction to computer forensic
Introduction to computer forensicIntroduction to computer forensic
Introduction to computer forensic
 
digital forensics related to windows.pdf
digital forensics related to windows.pdfdigital forensics related to windows.pdf
digital forensics related to windows.pdf
 
Digital Forensics Readiness - CommSec
Digital Forensics Readiness - CommSecDigital Forensics Readiness - CommSec
Digital Forensics Readiness - CommSec
 
Digital emerging trends in computer engineering Evidences.pptx
Digital emerging trends in computer engineering Evidences.pptxDigital emerging trends in computer engineering Evidences.pptx
Digital emerging trends in computer engineering Evidences.pptx
 
Digital emerging trends in computer engineering Evidences.pptx
Digital emerging trends in computer engineering Evidences.pptxDigital emerging trends in computer engineering Evidences.pptx
Digital emerging trends in computer engineering Evidences.pptx
 
Collecting and preserving digital evidence
Collecting and preserving digital evidenceCollecting and preserving digital evidence
Collecting and preserving digital evidence
 
Processing Crimes and Incident Scenes
Processing Crimes and Incident ScenesProcessing Crimes and Incident Scenes
Processing Crimes and Incident Scenes
 
Computer Forensics (1).pptx
Computer Forensics (1).pptxComputer Forensics (1).pptx
Computer Forensics (1).pptx
 
Forensic science in pakistan
Forensic science in pakistanForensic science in pakistan
Forensic science in pakistan
 
forensicscienceinpakistan-150214040113-conversion-gate01 (1).pdf
forensicscienceinpakistan-150214040113-conversion-gate01 (1).pdfforensicscienceinpakistan-150214040113-conversion-gate01 (1).pdf
forensicscienceinpakistan-150214040113-conversion-gate01 (1).pdf
 
Electronic Forensic Protocols and Working with Computer Forensic Examiners
Electronic Forensic Protocols and Working with Computer Forensic ExaminersElectronic Forensic Protocols and Working with Computer Forensic Examiners
Electronic Forensic Protocols and Working with Computer Forensic Examiners
 
Cyber forensics and investigations
Cyber forensics and investigationsCyber forensics and investigations
Cyber forensics and investigations
 
644205e3-8f85-43da-95ac-e4cbb6a7a406-150917105917-lva1-app6892.pdf
644205e3-8f85-43da-95ac-e4cbb6a7a406-150917105917-lva1-app6892.pdf644205e3-8f85-43da-95ac-e4cbb6a7a406-150917105917-lva1-app6892.pdf
644205e3-8f85-43da-95ac-e4cbb6a7a406-150917105917-lva1-app6892.pdf
 
CF.ppt
CF.pptCF.ppt
CF.ppt
 
Digital Forensics
Digital ForensicsDigital Forensics
Digital Forensics
 
Digital forensics
Digital forensicsDigital forensics
Digital forensics
 
Avoiding e discovery disputes
Avoiding e discovery disputesAvoiding e discovery disputes
Avoiding e discovery disputes
 
Ch 3C Processing Crime and Incident Scenes.ppt
Ch 3C Processing Crime and Incident Scenes.pptCh 3C Processing Crime and Incident Scenes.ppt
Ch 3C Processing Crime and Incident Scenes.ppt
 
File000176
File000176File000176
File000176
 
Cyber forensics and auditing
Cyber forensics and auditingCyber forensics and auditing
Cyber forensics and auditing
 

More from Kabul Education University

Cryptography and Network security # Lecture 8
Cryptography and Network security # Lecture 8Cryptography and Network security # Lecture 8
Cryptography and Network security # Lecture 8
Kabul Education University
 
ITIL # Lecture 9
ITIL # Lecture 9ITIL # Lecture 9
ITIL # Lecture 9
Kabul Education University
 
Cryptography and Network security # Lecture 7
Cryptography and Network security # Lecture 7Cryptography and Network security # Lecture 7
Cryptography and Network security # Lecture 7
Kabul Education University
 
ITIL # Lecture 8
ITIL # Lecture 8ITIL # Lecture 8
ITIL # Lecture 8
Kabul Education University
 
Cryptography and Network security # Lecture 6
Cryptography and Network security # Lecture 6Cryptography and Network security # Lecture 6
Cryptography and Network security # Lecture 6
Kabul Education University
 
ITIL # Lecture 7
ITIL # Lecture 7ITIL # Lecture 7
ITIL # Lecture 7
Kabul Education University
 
Cryptography and Network security # Lecture 5
Cryptography and Network security # Lecture 5Cryptography and Network security # Lecture 5
Cryptography and Network security # Lecture 5
Kabul Education University
 
Cyber Security # Lec 5
Cyber Security # Lec 5Cyber Security # Lec 5
Cyber Security # Lec 5
Kabul Education University
 
ITIL # Lecture 6
ITIL # Lecture 6ITIL # Lecture 6
ITIL # Lecture 6
Kabul Education University
 
Cyber Security # Lec 4
Cyber Security # Lec 4 Cyber Security # Lec 4
Cyber Security # Lec 4
Kabul Education University
 
ITIL # Lecture 5
ITIL # Lecture 5ITIL # Lecture 5
ITIL # Lecture 5
Kabul Education University
 
Cyber Security # Lec 3
Cyber Security # Lec 3 Cyber Security # Lec 3
Cyber Security # Lec 3
Kabul Education University
 
ITIL # Lecture 4
ITIL # Lecture 4ITIL # Lecture 4
ITIL # Lecture 4
Kabul Education University
 
Cryptography and Network security # Lecture 4
Cryptography and Network security # Lecture 4Cryptography and Network security # Lecture 4
Cryptography and Network security # Lecture 4
Kabul Education University
 
Cyber Security # Lec 2
Cyber Security # Lec 2Cyber Security # Lec 2
Cyber Security # Lec 2
Kabul Education University
 
ITIL # Lecture 3
ITIL # Lecture 3ITIL # Lecture 3
ITIL # Lecture 3
Kabul Education University
 
Cryptography and Network security # Lecture 3
Cryptography and Network security # Lecture 3Cryptography and Network security # Lecture 3
Cryptography and Network security # Lecture 3
Kabul Education University
 
ITIL # Lecture 2
ITIL # Lecture 2ITIL # Lecture 2
ITIL # Lecture 2
Kabul Education University
 
Cryptography and Network Security # Lecture 2
Cryptography and Network Security # Lecture 2Cryptography and Network Security # Lecture 2
Cryptography and Network Security # Lecture 2
Kabul Education University
 
ITIL # Lecture 1
ITIL # Lecture 1ITIL # Lecture 1
ITIL # Lecture 1
Kabul Education University
 

More from Kabul Education University (20)

Cryptography and Network security # Lecture 8
Cryptography and Network security # Lecture 8Cryptography and Network security # Lecture 8
Cryptography and Network security # Lecture 8
 
ITIL # Lecture 9
ITIL # Lecture 9ITIL # Lecture 9
ITIL # Lecture 9
 
Cryptography and Network security # Lecture 7
Cryptography and Network security # Lecture 7Cryptography and Network security # Lecture 7
Cryptography and Network security # Lecture 7
 
ITIL # Lecture 8
ITIL # Lecture 8ITIL # Lecture 8
ITIL # Lecture 8
 
Cryptography and Network security # Lecture 6
Cryptography and Network security # Lecture 6Cryptography and Network security # Lecture 6
Cryptography and Network security # Lecture 6
 
ITIL # Lecture 7
ITIL # Lecture 7ITIL # Lecture 7
ITIL # Lecture 7
 
Cryptography and Network security # Lecture 5
Cryptography and Network security # Lecture 5Cryptography and Network security # Lecture 5
Cryptography and Network security # Lecture 5
 
Cyber Security # Lec 5
Cyber Security # Lec 5Cyber Security # Lec 5
Cyber Security # Lec 5
 
ITIL # Lecture 6
ITIL # Lecture 6ITIL # Lecture 6
ITIL # Lecture 6
 
Cyber Security # Lec 4
Cyber Security # Lec 4 Cyber Security # Lec 4
Cyber Security # Lec 4
 
ITIL # Lecture 5
ITIL # Lecture 5ITIL # Lecture 5
ITIL # Lecture 5
 
Cyber Security # Lec 3
Cyber Security # Lec 3 Cyber Security # Lec 3
Cyber Security # Lec 3
 
ITIL # Lecture 4
ITIL # Lecture 4ITIL # Lecture 4
ITIL # Lecture 4
 
Cryptography and Network security # Lecture 4
Cryptography and Network security # Lecture 4Cryptography and Network security # Lecture 4
Cryptography and Network security # Lecture 4
 
Cyber Security # Lec 2
Cyber Security # Lec 2Cyber Security # Lec 2
Cyber Security # Lec 2
 
ITIL # Lecture 3
ITIL # Lecture 3ITIL # Lecture 3
ITIL # Lecture 3
 
Cryptography and Network security # Lecture 3
Cryptography and Network security # Lecture 3Cryptography and Network security # Lecture 3
Cryptography and Network security # Lecture 3
 
ITIL # Lecture 2
ITIL # Lecture 2ITIL # Lecture 2
ITIL # Lecture 2
 
Cryptography and Network Security # Lecture 2
Cryptography and Network Security # Lecture 2Cryptography and Network Security # Lecture 2
Cryptography and Network Security # Lecture 2
 
ITIL # Lecture 1
ITIL # Lecture 1ITIL # Lecture 1
ITIL # Lecture 1
 

Recently uploaded

办(uts毕业证书)悉尼科技大学毕业证学历证书原版一模一样
办(uts毕业证书)悉尼科技大学毕业证学历证书原版一模一样办(uts毕业证书)悉尼科技大学毕业证学历证书原版一模一样
办(uts毕业证书)悉尼科技大学毕业证学历证书原版一模一样
apvysm8
 
Beyond the Basics of A/B Tests: Highly Innovative Experimentation Tactics You...
Beyond the Basics of A/B Tests: Highly Innovative Experimentation Tactics You...Beyond the Basics of A/B Tests: Highly Innovative Experimentation Tactics You...
Beyond the Basics of A/B Tests: Highly Innovative Experimentation Tactics You...
Aggregage
 
Palo Alto Cortex XDR presentation .......
Palo Alto Cortex XDR presentation .......Palo Alto Cortex XDR presentation .......
Palo Alto Cortex XDR presentation .......
Sachin Paul
 
一比一原版(GWU,GW文凭证书)乔治·华盛顿大学毕业证如何办理
一比一原版(GWU,GW文凭证书)乔治·华盛顿大学毕业证如何办理一比一原版(GWU,GW文凭证书)乔治·华盛顿大学毕业证如何办理
一比一原版(GWU,GW文凭证书)乔治·华盛顿大学毕业证如何办理
bopyb
 
Udemy_2024_Global_Learning_Skills_Trends_Report (1).pdf
Udemy_2024_Global_Learning_Skills_Trends_Report (1).pdfUdemy_2024_Global_Learning_Skills_Trends_Report (1).pdf
Udemy_2024_Global_Learning_Skills_Trends_Report (1).pdf
Fernanda Palhano
 
The Building Blocks of QuestDB, a Time Series Database
The Building Blocks of QuestDB, a Time Series DatabaseThe Building Blocks of QuestDB, a Time Series Database
The Building Blocks of QuestDB, a Time Series Database
javier ramirez
 
一比一原版(爱大毕业证书)爱丁堡大学毕业证如何办理
一比一原版(爱大毕业证书)爱丁堡大学毕业证如何办理一比一原版(爱大毕业证书)爱丁堡大学毕业证如何办理
一比一原版(爱大毕业证书)爱丁堡大学毕业证如何办理
g4dpvqap0
 
一比一原版(Harvard毕业证书)哈佛大学毕业证如何办理
一比一原版(Harvard毕业证书)哈佛大学毕业证如何办理一比一原版(Harvard毕业证书)哈佛大学毕业证如何办理
一比一原版(Harvard毕业证书)哈佛大学毕业证如何办理
zsjl4mimo
 
ViewShift: Hassle-free Dynamic Policy Enforcement for Every Data Lake
ViewShift: Hassle-free Dynamic Policy Enforcement for Every Data LakeViewShift: Hassle-free Dynamic Policy Enforcement for Every Data Lake
ViewShift: Hassle-free Dynamic Policy Enforcement for Every Data Lake
Walaa Eldin Moustafa
 
Global Situational Awareness of A.I. and where its headed
Global Situational Awareness of A.I. and where its headedGlobal Situational Awareness of A.I. and where its headed
Global Situational Awareness of A.I. and where its headed
vikram sood
 
一比一原版(UO毕业证)渥太华大学毕业证如何办理
一比一原版(UO毕业证)渥太华大学毕业证如何办理一比一原版(UO毕业证)渥太华大学毕业证如何办理
一比一原版(UO毕业证)渥太华大学毕业证如何办理
aqzctr7x
 
一比一原版(Chester毕业证书)切斯特大学毕业证如何办理
一比一原版(Chester毕业证书)切斯特大学毕业证如何办理一比一原版(Chester毕业证书)切斯特大学毕业证如何办理
一比一原版(Chester毕业证书)切斯特大学毕业证如何办理
74nqk8xf
 
一比一原版(Coventry毕业证书)考文垂大学毕业证如何办理
一比一原版(Coventry毕业证书)考文垂大学毕业证如何办理一比一原版(Coventry毕业证书)考文垂大学毕业证如何办理
一比一原版(Coventry毕业证书)考文垂大学毕业证如何办理
74nqk8xf
 
End-to-end pipeline agility - Berlin Buzzwords 2024
End-to-end pipeline agility - Berlin Buzzwords 2024End-to-end pipeline agility - Berlin Buzzwords 2024
End-to-end pipeline agility - Berlin Buzzwords 2024
Lars Albertsson
 
Predictably Improve Your B2B Tech Company's Performance by Leveraging Data
Predictably Improve Your B2B Tech Company's Performance by Leveraging DataPredictably Improve Your B2B Tech Company's Performance by Leveraging Data
Predictably Improve Your B2B Tech Company's Performance by Leveraging Data
Kiwi Creative
 
一比一原版(UCSF文凭证书)旧金山分校毕业证如何办理
一比一原版(UCSF文凭证书)旧金山分校毕业证如何办理一比一原版(UCSF文凭证书)旧金山分校毕业证如何办理
一比一原版(UCSF文凭证书)旧金山分校毕业证如何办理
nuttdpt
 
Learn SQL from basic queries to Advance queries
Learn SQL from basic queries to Advance queriesLearn SQL from basic queries to Advance queries
Learn SQL from basic queries to Advance queries
manishkhaire30
 
一比一原版(牛布毕业证书)牛津布鲁克斯大学毕业证如何办理
一比一原版(牛布毕业证书)牛津布鲁克斯大学毕业证如何办理一比一原版(牛布毕业证书)牛津布鲁克斯大学毕业证如何办理
一比一原版(牛布毕业证书)牛津布鲁克斯大学毕业证如何办理
74nqk8xf
 
一比一原版(UMN文凭证书)明尼苏达大学毕业证如何办理
一比一原版(UMN文凭证书)明尼苏达大学毕业证如何办理一比一原版(UMN文凭证书)明尼苏达大学毕业证如何办理
一比一原版(UMN文凭证书)明尼苏达大学毕业证如何办理
nyfuhyz
 
DSSML24_tspann_CodelessGenerativeAIPipelines
DSSML24_tspann_CodelessGenerativeAIPipelinesDSSML24_tspann_CodelessGenerativeAIPipelines
DSSML24_tspann_CodelessGenerativeAIPipelines
Timothy Spann
 

Recently uploaded (20)

办(uts毕业证书)悉尼科技大学毕业证学历证书原版一模一样
办(uts毕业证书)悉尼科技大学毕业证学历证书原版一模一样办(uts毕业证书)悉尼科技大学毕业证学历证书原版一模一样
办(uts毕业证书)悉尼科技大学毕业证学历证书原版一模一样
 
Beyond the Basics of A/B Tests: Highly Innovative Experimentation Tactics You...
Beyond the Basics of A/B Tests: Highly Innovative Experimentation Tactics You...Beyond the Basics of A/B Tests: Highly Innovative Experimentation Tactics You...
Beyond the Basics of A/B Tests: Highly Innovative Experimentation Tactics You...
 
Palo Alto Cortex XDR presentation .......
Palo Alto Cortex XDR presentation .......Palo Alto Cortex XDR presentation .......
Palo Alto Cortex XDR presentation .......
 
一比一原版(GWU,GW文凭证书)乔治·华盛顿大学毕业证如何办理
一比一原版(GWU,GW文凭证书)乔治·华盛顿大学毕业证如何办理一比一原版(GWU,GW文凭证书)乔治·华盛顿大学毕业证如何办理
一比一原版(GWU,GW文凭证书)乔治·华盛顿大学毕业证如何办理
 
Udemy_2024_Global_Learning_Skills_Trends_Report (1).pdf
Udemy_2024_Global_Learning_Skills_Trends_Report (1).pdfUdemy_2024_Global_Learning_Skills_Trends_Report (1).pdf
Udemy_2024_Global_Learning_Skills_Trends_Report (1).pdf
 
The Building Blocks of QuestDB, a Time Series Database
The Building Blocks of QuestDB, a Time Series DatabaseThe Building Blocks of QuestDB, a Time Series Database
The Building Blocks of QuestDB, a Time Series Database
 
一比一原版(爱大毕业证书)爱丁堡大学毕业证如何办理
一比一原版(爱大毕业证书)爱丁堡大学毕业证如何办理一比一原版(爱大毕业证书)爱丁堡大学毕业证如何办理
一比一原版(爱大毕业证书)爱丁堡大学毕业证如何办理
 
一比一原版(Harvard毕业证书)哈佛大学毕业证如何办理
一比一原版(Harvard毕业证书)哈佛大学毕业证如何办理一比一原版(Harvard毕业证书)哈佛大学毕业证如何办理
一比一原版(Harvard毕业证书)哈佛大学毕业证如何办理
 
ViewShift: Hassle-free Dynamic Policy Enforcement for Every Data Lake
ViewShift: Hassle-free Dynamic Policy Enforcement for Every Data LakeViewShift: Hassle-free Dynamic Policy Enforcement for Every Data Lake
ViewShift: Hassle-free Dynamic Policy Enforcement for Every Data Lake
 
Global Situational Awareness of A.I. and where its headed
Global Situational Awareness of A.I. and where its headedGlobal Situational Awareness of A.I. and where its headed
Global Situational Awareness of A.I. and where its headed
 
一比一原版(UO毕业证)渥太华大学毕业证如何办理
一比一原版(UO毕业证)渥太华大学毕业证如何办理一比一原版(UO毕业证)渥太华大学毕业证如何办理
一比一原版(UO毕业证)渥太华大学毕业证如何办理
 
一比一原版(Chester毕业证书)切斯特大学毕业证如何办理
一比一原版(Chester毕业证书)切斯特大学毕业证如何办理一比一原版(Chester毕业证书)切斯特大学毕业证如何办理
一比一原版(Chester毕业证书)切斯特大学毕业证如何办理
 
一比一原版(Coventry毕业证书)考文垂大学毕业证如何办理
一比一原版(Coventry毕业证书)考文垂大学毕业证如何办理一比一原版(Coventry毕业证书)考文垂大学毕业证如何办理
一比一原版(Coventry毕业证书)考文垂大学毕业证如何办理
 
End-to-end pipeline agility - Berlin Buzzwords 2024
End-to-end pipeline agility - Berlin Buzzwords 2024End-to-end pipeline agility - Berlin Buzzwords 2024
End-to-end pipeline agility - Berlin Buzzwords 2024
 
Predictably Improve Your B2B Tech Company's Performance by Leveraging Data
Predictably Improve Your B2B Tech Company's Performance by Leveraging DataPredictably Improve Your B2B Tech Company's Performance by Leveraging Data
Predictably Improve Your B2B Tech Company's Performance by Leveraging Data
 
一比一原版(UCSF文凭证书)旧金山分校毕业证如何办理
一比一原版(UCSF文凭证书)旧金山分校毕业证如何办理一比一原版(UCSF文凭证书)旧金山分校毕业证如何办理
一比一原版(UCSF文凭证书)旧金山分校毕业证如何办理
 
Learn SQL from basic queries to Advance queries
Learn SQL from basic queries to Advance queriesLearn SQL from basic queries to Advance queries
Learn SQL from basic queries to Advance queries
 
一比一原版(牛布毕业证书)牛津布鲁克斯大学毕业证如何办理
一比一原版(牛布毕业证书)牛津布鲁克斯大学毕业证如何办理一比一原版(牛布毕业证书)牛津布鲁克斯大学毕业证如何办理
一比一原版(牛布毕业证书)牛津布鲁克斯大学毕业证如何办理
 
一比一原版(UMN文凭证书)明尼苏达大学毕业证如何办理
一比一原版(UMN文凭证书)明尼苏达大学毕业证如何办理一比一原版(UMN文凭证书)明尼苏达大学毕业证如何办理
一比一原版(UMN文凭证书)明尼苏达大学毕业证如何办理
 
DSSML24_tspann_CodelessGenerativeAIPipelines
DSSML24_tspann_CodelessGenerativeAIPipelinesDSSML24_tspann_CodelessGenerativeAIPipelines
DSSML24_tspann_CodelessGenerativeAIPipelines
 

Lect 4 computer forensics

  • 1. Intro to Computer Forensics Mr. Islahuddin Jalal MS (Cyber Security) – UKM Malaysia Research Title – 3C-CSIRT Model for Afghanistan BAKHTAR UNIVERSITY ‫باخترپوهنتون‬ ‫د‬
  • 2. Outline • CF Investigation Process • Secure the Evidence • Acquire and Analyze the Data • Assess Evidence and Case • Prepare the Final Report • Testify in the court as an Expert witness • Computer Forensics Service Providers
  • 3. Secure the Evidence • Secure the evidence without damaging the evidence’s integrity • Place the evidence in a secured site by not allowing any intruders to access it • Maintain the chain of custody to properly track the evidence • Identify digital and non digital artifacts to separate the evidence according to their behavior • Maintain a log book at the entrance of the lab to log in the timings and name of the person visited • Place an intrusion alarm system in the entrance of the forensic lab • Contact law enforcement agencies to know how to preserve the evidence
  • 4. Chain of custody • Chain of custody is a legal document that demonstrates the progression of evidence as it travels from original evidence location to the forensic laboratory
  • 6. Note……………. • Original Evidence should not be used for analysis
  • 9. Recovery……… if Necessary • Tools of Recovery • Recover my files • Digital Rescue premium • EASEUS data recovery wizard • PC inspector file Recovery • Advanced Disk Recovery • Total Recall
  • 10. Analyze the Data • Thoroughly analyze the acquired data to draw conclusions related to the case • Data analysis techniques depend on the scope of the case or client’s requirements • Analysis of the file’s content, date and time of file creation and modification, users associated with file creation access and file modification, and physical storage location of the file • Identify and categorize data in order of relevance
  • 11. Tools for Analysis • Forensic tools help in sorting and analysis of a large volume of data to draw meaningful conclusions. • Tools • AccessData’s FTK • Guidance Software’s Encase Forensics • Brain Carrier’s the Sleuth Kit
  • 12. Evidence Assessment • Conduct a complete assessment by reviewing the • Search warrant • Legal authorization • Case detail • Nature of the hardware and software • Potential evidence • Circumstances surrounding the acquisition of the evidence to be examined
  • 14. Prepare the final Report • Report Writing is a crucial stage in the outcome of the investigation • The report should be clear, concise and written for the appropriate audience
  • 17. Expert Witness • An expert witness is a person who has a thorough knowledge of a subject and whose credentials can convince others to believe his or her opinions on that subject in a court of law
  • 18. Testifying in the court • Presenting digital evidence in the court requires knowledge of new, specialized, evolving and sometimes complex technology
  • 19. Computer forensics Service Providers • www.compforensics.com • www.forensic.com • www.burgessforensics.com • Global digital forensics • etc
  • 20.
  • 21. Thank You For Your Patience