Computer Forensics Based On What I Have Read: Definition of Computer Forensics

Computer Forensics
Based on what I have read:
Definition of Computer Forensics:
Computer forensics is the discipline that combines elements of law and computer science to collect and
analyze data from computer systems, networks, wireless communications, and storage devices in a way
that is admissible as evidence in a court of law.
Stages of Forensic investigation in tracking a cybercrime:
1- Computer crime is suspected.

2- Collect preliminary evidence
3- Obtain court warrant for seizure
4- Perform first responder procedures
5- Seize evidence at the crime scene
6- Transport them to Forensics lab
7- Create 2 bit stream copies of the evidence
8- Generate MD5 checksum on the images
9- Prepare chain of custody
10- Storage of original evidence in a secure location
11- Analyze the image copy for evidence
12- Prepare a forensic report
13- Submit the report to the client
14- If required, attend the court and testify as expert witness
We can classify the incident (violation of computer/ network security) as:

- Low level
- Mid level
- High Level
Low level: they must be handled within one working day.

These are identified through:
- Loss of personal password
- Suspected sharing of organization’s account
- Unsuccessful scans and probes
- Presence of computer virus or worm
Mid Level: they must be handled the same day the event occurs.
These are identified through:
- Violation of special access to a computer or computing facility.
- Unfriendly employee termination
- Unauthorized storing and processing of data
- Destruction of property related to a computer incident(less than 100000$)
- Personal theft of data related to computer incident
- Computer virus or worm of comparatively larger intensity
- Illegal access to buildings
High level: must be handled immediately
They include:
- Denial of service attacks
- Suspected computer break in
- Computer virus or worms of highest intensity like: Trojan back door
- Destruction of property exceeding 100000$
- Personal theft exceeding 100000$ and illegal fund transfer or download/sale
After collecting the evidence:
Analysis of the evidence:

This step is composed of 3 tasks. The preparation, processing and interpretation of the
data preserved. During the preparation task the examiner make a copy of the master copy. The
master copy is a copy of the original data, which is authenticated (for example verified against
the original with a hash algorithm like MD5 or SHA1). The examiner makes a copy of
the master copy so that it is possible to start over without access to the original if changes
to the data have to be made during the examination .
During the processing task the goal is to find the relevant data and to extract it so that it
can be presented as evidence. To do this the examiner recovers deleted data and searches
for encrypted files, they also use pattern-matching techniques to search to find data
corresponding to events. In this step a large variety of software is commonly used.
These tools are:
Tools
There already exists a solid base of software for conducting computer forensic
investigations. Following is a brief description of the most common tools.
1- EnCase, made by Guidance Software is considered to be the largest digital
investigation software on the market. It is written for Windows but can access a
variety of file systems from a large amount of operating systems.
2- Forensic Toolkit (FTK), made by AccessData is another forensic tool for Windows
systems. FTK is also able to access different file systems but its strength lies in it’s
ability to search. It uses a sorted index to speed up searches and it contains
numerous internal viewers for different file types.
3- ILook Investigator, developed by IRS Criminal Investigation Division Electronic
Crimes Program, is a tool running on Windows. ILook handles raw disk images as
well as some widely used commercial formats. It enables the examiner to browse
files in various categories. Encrypted files, deleted files, password protected files
and files with invalid signature compared to its extension, just to name a few. It has
the advantage of enabling the image creation of complicated systems such as
servers with advanced RAID configurations etc. Unfortunately ILook is only
licensed to law enforcement agencies, which make it impossible to get for
companies making internal investigations etc.
4- ProDiscover, made by Pathways, is also a tool for windows. ProDiscover is also
able to analyze a number of file systems. The license also contains the source code,
so that investigators can identify exactly what the software is doing.
5- SMART, a Linux based alternative. Developed by the same person who originally
wrote EnCase (EnCase was called “Expert Witness” at the time). SMART makes
use of the wide support for file systems on Linux and have advanced features like
recovering deleted files, keyword search, and listing of image files.
6- Sleuth kit/Autopsy is a collection of UNIX tools and commands and a graphical
front end for these. Sleuth kid is also able to analyze numerous file systems and
recover deleted files. It also has a feature where file accesses can listed chronologically
During the interpretation task the actual human work begins. Here the examiner has to
lay the puzzle, connecting pieces together and find out their meaning. Things like the
reliability of the data and which people that can be connected to the data have to be
considered .
Note :Even though the analysis part is divided into different tasks it seem reasonable that
much of the analyze work is done iteratively as each task can give input to another.
Presentation of the results

The final step is to present the result of the examination, maybe in front of a jury or
judge but it can also be to a board of a company, for example in a company-internal
investigation. In this step an especially important skill the examiner need to possess is the
ability to explain the technical aspects of the investigation in a way that it is easy to
understand for people who does not know anything about the technology. It is also very
important that all steps done to extract and find the evidence have been carefully documented so
the procedures can be explained and reproduces if required.
New Research topics:
1- ERM : Electonic E-record management

This research aims at finding new algorithms for searching email archives. In other words, emails
are kept as evidences in any business to refer to in case of a crime. However, large companies
exchange hundreds of emails daily. To make their life easier, we would like to find new
algorithms to discard some of the email records because cybercrimes are time sensitive.
2- Thesis: He concentrated on timestamps which exist at least one in most computer files and
objects. He thinks that if he can combine evidences that are coherent in time, the investigator
might find evidence that happened at the same time much easier and even find evidence that
would otherwise not be found at all. He planned to create a prototype software tool that can
scan a hard drive image for timestamps and list them on a graphical timeline where the
examiner should be able to see what evidence of different times occur at the same time. He also
evaluated this tool against a modern computer forensics tool to see if it has any advantages
compared to it. He did this by performing a user test where test subjects will try to solve a fictive
case with each tool. It appeared that the prototype tool performed much better than any other
tools.

Computer Forensics Based On What I Have Read: Definition of Computer Forensics

Uploaded by

Copyright:

Available Formats

Computer Forensics Based On What I Have Read: Definition of Computer Forensics

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Computer Forensics Based On What I Have Read: Definition of Computer Forensics

Uploaded by

Copyright:

Available Formats

Computer Forensics

Based on what I have read:

Definition of Computer Forensics:

Stages of Forensic investigation in tracking a cybercrime:

1- Computer crime is suspected.

We can classify the incident (violation of computer/ network security) as:

Low level: they must be handled within one working day.

High level: must be handled immediately

Analysis of the evidence:

These tools are:

Presentation of the results

New Research topics:

1- ERM : Electonic E-record management

You might also like