Unit IV

4.1 Introduction to Computer Forensics

Scope of Computer Forensics

• Criminal investigations involving computers
• Civil litigation and dispute resolution
• Corporate investigations (fraud, policy violations)
• Incident response and breach analysis
• Intelligence and national security operations

Objectives of Computer Forensics

1. Identify: Locate and identify digital evidence
2. Preserve: Protect evidence from alteration or destruction
3. Extract: Retrieve relevant data from storage media
4. Analyze: Examine evidence to determine significance
5. Document: Create comprehensive records of findings
6. Present: Provide testimony and reports for legal proceedings

Principles of Computer Forensics

4.2 Digital Forensics Science

Branches of Digital Forensics

Forensic Tools Categories

• Acquisition Tools: Create forensic images of storage media
• Analysis Tools: Examine and analyze digital evidence
• Documentation Tools: Record findings and generate reports
• Password Recovery Tools: Access encrypted or protected data
• File Carving Tools: Recover deleted or fragmented files

Scientific Method in Digital Forensics

1. Observation: Initial assessment of the situation
2. Hypothesis: Formulating theories about what occurred
3. Testing: Examining evidence to test hypotheses
4. Analysis: Interpreting test results
5. Conclusion: Drawing conclusions based on evidence
6. Reporting: Documenting and presenting findings

4.3 The Need for Computer Forensics

Reasons for Computer Forensics

1. Legal Requirements

• Prosecuting computer-related crimes
• Supporting civil litigation
• Regulatory compliance investigations
• Intellectual property disputes

2. Organizational Needs

• Internal investigations of employee misconduct
• Incident response and breach analysis
• Policy violation investigations
• Due diligence in mergers and acquisitions

3. Data Recovery

• Recovering accidentally deleted files
• Retrieving data from damaged storage media
• Reconstructing events from system artifacts

Importance in Modern Context

4.4 Cyber Forensics and Digital Evidence

Types of Digital Evidence

Characteristics of Digital Evidence

• Fragility: Easily altered, damaged, or destroyed
• Invisibility: Not apparent without proper tools
• Volume: Large quantities requiring systematic analysis
• Mobility: Can be easily copied and transmitted
• Time Sensitivity: May be volatile or have limited retention

Sources of Digital Evidence

• Computer hard drives and solid-state drives
• Mobile devices and tablets
• Removable storage media
• Network devices and logs
• Cloud storage and services
• Email servers and archives
• Social media platforms
• IoT devices

Admissibility Requirements

1. Authenticity: Evidence must be genuine and unaltered
2. Integrity: Evidence must be complete and uncorrupted
3. Reliability: Methods used must be reliable and accepted
4. Relevance: Evidence must relate to the case
5. Completeness: Evidence should provide full context

4.5 Forensics Analysis of E-Mail

Email as Evidence

Email is a significant source of digital evidence in investigations involving fraud, harassment, intellectual property theft, and other crimes. Email forensics involves examining email headers, content, and metadata to establish facts.

Components of Email for Analysis

Email Header Analysis

Email headers contain valuable information for investigations:

• Received: Shows the path email took through mail servers
• From: Sender's email address (can be spoofed)
• To: Recipient's email address
• Date: When the email was sent
• Message-ID: Unique identifier for the message
• X-Originating-IP: IP address of sender (if available)

Email Forensic Process

1. Identification: Locate relevant email evidence
2. Preservation: Create forensic copies of email data
3. Extraction: Retrieve emails from servers, clients, or archives
4. Analysis: Examine headers, content, and metadata
5. Validation: Verify authenticity and trace origin
6. Reporting: Document findings

Challenges in Email Forensics

• Email header spoofing
• Encrypted communications
• Multiple email storage locations
• Email deletion and overwriting
• Cross-jurisdictional issues

4.6 Digital Forensics Life Cycle

Phases of Digital Forensics

1. Identification

• Recognize and determine the nature of the incident
• Identify potential sources of evidence
• Prioritize evidence collection based on volatility
• Document the scene and initial observations

2. Preservation

• Secure the crime scene and evidence
• Prevent unauthorized access or modification
• Document chain of custody
• Create forensic images of storage media
• Verify integrity using hash values

3. Collection

• Gather evidence following proper procedures
• Collect volatile data first (RAM, network connections)
• Create bit-for-bit copies of storage media
• Document all collection activities

4. Examination

• Process collected data using forensic tools
• Extract relevant information
• Recover deleted files and hidden data
• Decrypt encrypted content when possible

5. Analysis

• Interpret extracted data
• Correlate evidence from multiple sources
• Construct timeline of events
• Draw conclusions based on evidence

6. Presentation

• Prepare comprehensive reports
• Present findings in understandable manner
• Provide expert testimony when required
• Maintain objectivity and accuracy

Order of Volatility

Evidence should be collected in order of volatility (most volatile first):

1. CPU registers and cache
2. RAM (Random Access Memory)
3. Network connections and routing tables
4. Running processes
5. Hard disk and storage media
6. Remote logging and monitoring data
7. Physical configuration and network topology
8. Archival media (backups, tapes)

4.7 Chain of Custody Concept

Purpose of Chain of Custody

• Prove evidence has not been tampered with
• Establish accountability for evidence handling
• Ensure admissibility in legal proceedings
• Document who handled evidence and when
• Record all actions taken with evidence

Elements of Chain of Custody Documentation

Best Practices

1. Minimize the number of people handling evidence
2. Use tamper-evident packaging
3. Label all evidence clearly and uniquely
4. Obtain signatures for all transfers
5. Store evidence in secure, access-controlled locations
6. Calculate and verify hash values at each transfer
7. Photograph evidence before and after handling

Breaking Chain of Custody

Chain of custody can be broken by:

• Gaps in documentation
• Missing signatures
• Improper storage conditions
• Unauthorized access
• Hash value changes indicating alteration

4.8 Network Forensics

Network Forensics Approaches

Data Sources for Network Forensics

• Full Packet Capture: Complete network traffic recording
• Flow Data: NetFlow, IPFIX records of connections
• Firewall Logs: Allowed and blocked traffic records
• IDS/IPS Alerts: Security event notifications
• DNS Logs: Domain name resolution records
• DHCP Logs: IP address assignment records
• Proxy Logs: Web traffic records
• Authentication Logs: Login attempts and results

Network Forensics Process

1. Preparation: Deploy capture and logging infrastructure
2. Detection: Identify anomalous network activity
3. Capture: Record relevant network traffic
4. Analysis: Examine captured data for evidence
5. Correlation: Link network events with other evidence
6. Reporting: Document findings and conclusions

Challenges in Network Forensics

• High volume of network traffic
• Encrypted traffic obscuring content
• Storage requirements for full packet capture
• Real-time analysis demands
• Distributed nature of network attacks
• IP address spoofing and anonymization

4.9 Approaching a Computer Forensics Investigation

Initial Response Steps

1. Secure the Scene

• Restrict access to the investigation area
• Document the initial state (photographs, notes)
• Identify all devices and potential evidence
• Record the condition of systems (powered on/off)

2. Assess the Situation

• Determine the nature and scope of the incident
• Identify the type of investigation required
• Evaluate legal and regulatory requirements
• Establish preliminary timeline

3. Plan the Investigation

• Define investigation objectives and scope
• Identify required resources and tools
• Assign roles and responsibilities
• Establish communication protocols

Evidence Collection Procedures

For Powered-On Systems:

1. Capture volatile data (RAM, network connections)
2. Document running processes and open files
3. Record logged-in users and network configurations
4. Perform orderly shutdown if appropriate
5. Create forensic image of storage media

For Powered-Off Systems:

1. Do not power on the system
2. Remove storage media carefully
3. Use write blockers when connecting media
4. Create forensic image of storage media
5. Verify image integrity with hash values

Investigation Workflow

4.10 Forensics and Social Networking Sites

Social Media as Evidence Source

Social networking sites contain vast amounts of potentially relevant evidence including communications, relationships, locations, and activities.

Types of Evidence from Social Media

Security and Privacy Threats

• Identity Theft: Personal information used for fraud
• Social Engineering: Information used to manipulate victims
• Stalking: Location and activity tracking
• Reputation Damage: Misuse of shared content
• Data Mining: Aggregation of personal information

Forensic Challenges

• Data stored on remote servers
• Privacy settings limiting access
• Platform cooperation requirements
• Content deletion by users
• Cross-jurisdictional legal issues
• Volume and variety of data

Collection Methods

• Legal requests to platforms (subpoenas, warrants)
• User account data exports
• Public content preservation
• Third-party archiving services
• Local device examination

4.11 Challenges in Computer Forensics

Technical Challenges

Legal and Procedural Challenges

• Jurisdiction: Crimes spanning multiple legal jurisdictions
• Privacy Laws: Restrictions on evidence collection
• Admissibility Standards: Varying requirements across jurisdictions
• Chain of Custody: Maintaining evidence integrity
• Expert Testimony: Explaining technical findings to non-experts

Anti-Forensics Techniques

• Data Destruction: Secure deletion and wiping
• Data Hiding: Steganography, encrypted containers
• Trail Obfuscation: Log manipulation, timestamp alteration
• Artifact Elimination: Removing traces of activity
• Attack Against Tools: Exploiting forensic tool vulnerabilities

Emerging Challenges

• Internet of Things (IoT) devices
• Cryptocurrency and blockchain
• Artificial intelligence and automation
• 5G and advanced networking
• Quantum computing implications

4.12 Forensic Image

Forensic Image vs. Regular Backup

Common Forensic Image Formats

Forensic Imaging Process

1. Document Original Media: Record serial numbers, model, capacity, physical condition
2. Connect Write Blocker: Use hardware or software write blocker to prevent modification
3. Generate Source Hash: Calculate MD5/SHA-256 of original before imaging
4. Create Forensic Image: Use forensic imaging tool to create bit-by-bit copy
5. Verify Image: Hash the image and compare to source hash (must match exactly)
6. Document Chain of Custody: Record who handled evidence and when
7. Store Securely: Preserve original and work only with forensic image copies

4.13 Live Forensics vs. Dead Forensics

Live Forensics (Live Analysis)

Dead Forensics (Post-Mortem Analysis)

When to Use Each Approach

4.14 Evidence Acquisition Methods

Types of Acquisition

Write Blockers

Purpose of Write Blockers:

• Prevents accidental modification of evidence during imaging
• Maintains forensic integrity of original media
• Required for evidence admissibility in court
• Documents that evidence was not altered after seizure

Acquisition Tools

• FTK Imager: Free tool for creating forensic images; supports E01, DD formats
• dd (Unix/Linux): Command-line tool for raw imaging
• Guymager: Open-source Linux imaging tool with GUI
• EnCase Imager: Enterprise imaging solution
• Volatility: Memory acquisition and analysis
• Magnet RAM Capture: Live memory capture

4.15 Forensic Tools and Techniques

Comprehensive Forensic Suites

Specialized Forensic Tools

Memory Forensics

• Volatility: Open-source memory analysis framework; extracts processes, network connections, registry data from RAM dumps
• Rekall: Memory forensics framework with advanced analysis capabilities
• Magnet RAM Capture: Captures volatile memory from Windows systems

Mobile Forensics

• Cellebrite UFED: Industry-leading mobile extraction tool; supports thousands of devices
• Oxygen Forensic: Mobile device forensics and cloud data extraction
• AXIOM: Magnet Forensics' comprehensive digital investigation platform

Network Forensics

• Wireshark: Packet capture and protocol analysis
• NetworkMiner: Network forensic analyzer with file extraction
• Zeek (Bro): Network security monitor and traffic analyzer

Key Forensic Techniques

File Carving

4.16 Incident Response

Incident Response Phases (NIST Framework)

Relationship Between Incident Response and Forensics

• Evidence Collection: Forensics is critical during containment to preserve evidence
• Root Cause Analysis: Forensics determines how the incident occurred
• Attribution: Forensic analysis may identify attackers
• Lessons Learned: Forensic findings inform security improvements
• Legal Action: Forensic evidence supports prosecution or civil action

Incident Response Team (IRT) Roles

• Incident Handler/Lead: Coordinates response activities
• Forensic Analyst: Collects and analyzes evidence
• Malware Analyst: Analyzes malicious code
• Network Administrator: Implements network containment
• System Administrator: Manages affected systems
• Legal/Compliance: Handles regulatory and legal aspects
• Communications: Manages internal and external communication

4.17 Forensic Report Writing

Structure of a Forensic Report

Report Writing Best Practices

• Be Objective: Present facts without bias or assumptions
• Avoid Jargon: Use plain language; define technical terms
• Support Claims: Every finding must reference supporting evidence
• Be Precise: Use exact dates, times, file names, and hash values
• Visual Aids: Include timelines, diagrams, and screenshots where helpful
• Assume Court Presentation: Write as if the report will be challenged in court
• Peer Review: Have another examiner review before submission