Forensics 1

Computer
Forensics
Computer in crimes
Target Tool
Excise evasion
 Raid on residence of plastic company owner
 Seized amount - Two crores
 12 Computers confiscated
Excise Evasion (Contd.)
 Forensic examination of computer systems
revealed
– Excise evasion of more than 26 crores
– Detailed kickbacks to excise officials

Parliament Attack Case
 Seized laptop contained incriminating
material.
 Forensic analysis revealed

– Role of LET
– Pakistan IPs
– Telephone numbers
– Coded messages
Computer Forensics
 Establishes the link between crime and the
criminal
 Different from traditional branches of

forensic science
 Deals with collection, examination and

analysis of digital evidence
Components Of
Computer Forensics
Disk forensics
Network forensics
Software forensics
Disk Forensics
 Recovering deleted information
 Recreating time critical events

Digital Evidence
 Evidence stored or transmitted in binary form
 Includes evidence from

– computer
– digital audio
– digital video
– cell phones
Precautions in handling
digital evidence
 The U.S. doorframe case
 Evidence is not compromised due to incorrect

procedures
 A continuing chain of custody is established and

maintained
 Procedures and findings are documented.

Electronic Evidence
Precautions
 Static Electricity
 Magnetic Fields
 Shock
 Moisture
New Technology
Computer Forensics
Practices
 Analysis of bit-stream copies
 Use of proper software utilities
 Proper documentation
 Not trusting the suspect computer

Computer Forensics
Practices (Contd..)
 Avoiding booting from the suspect machine
– Modification of system files to delete information
 Avoiding use of the suspect OS
– Modification of routine OS commands for

destruction of information
Duties of a forensic expert
 Protect suspect system during examination
 Recover all files
 Access the contents of protected or encrypted files
 Analyze relevant data
 Provide testimony in court of law

The computer forensics
process
• acquire
• authenticate
• analyze
• document
Imaging
 Attaching suspect storage media to

forensic workstation
 Imaging storage media by attaching a

hard drive to the suspect computer
Make suspect drive read
only
Prevent accidental
writes to the suspect
hard drive using a
write blocker
Imaging Tools
 Winhex
 Norton Ghost 2000
 Byte back (tech assist.
Inc)
 Encase (guidance
software)
Authenticate
 Using hash functions to ensure authenticity
of image
 If acquisition hash equals verification hash,

image is authentic
Document
 A forensic examination report

must
– List softwares used &

their versions
– be in simple language
– list the hash results
– list all storage media
numbers, model, make
– be supported by
photographs
Document
Chain-of-custody log
– ACL of people having access to collected evidence

– Tracks evidence from source to courtroom
– Unbroken chain-of-custody authenticates electronic
evidence
Document
The five “Ws” of chain-of-custody log
– Who – took possession of the evidence
– What – description of evidence
– Where – did they take it to
– When – time and date
– Why – purpose for taking evidence
Work Station- Portable
Data Retrieval
 Active space
 Slack space
 Unallocated space
 Swap files
Data Storage
 The sector is the smallest
unit of storage device
 A "regular" disk sector is

512 bytes, a CD-ROM
sector is 2048 bytes.
How data is stored?
 Data is stored in clusters in MS
operating systems
 Clusters are groups of sectors
 A cluster can range from 1-128

sectors
 Cluster size depends on the size

of storage media and the
operating system
Slack Space (File Slack)
 File sizes rarely match the size of one or multiple
clusters perfectly.
 “File slack” is storage space existing from the end

of file to the end of the last cluster assigned to
the file.
 Contains random data from any part of the storage

media
Slack Space (RAM slack)
 If the last sector in a file has storage space it is
padded with random data from the memory
buffers of the operating system.
 This random data is called RAM Slack as it comes

from the RAM of the computer.
Importance of Slack Space
 Identifying network logon names, passwords and

other sensitive information
 Legacy data in file slack can be analyzed to

identify prior uses of the suspect computer
 Fragments of prior e-mail messages and word

processing documents can be found in file slack.
Unallocated Space
 Deletion of a file by the computer user releases

clusters allocated to the file
 The data associated with the 'deleted' file remains

behind.
 This data storage area is referred to as

unallocated storage space
Data Hiding
 Renaming file files
 Changing file extensions
 Turning on hidden attribute
 Encryption & Steganography

Forensics 1

Uploaded by

Copyright:

Available Formats

Forensics 1

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Forensics 1

Uploaded by

Copyright:

Available Formats

Computer

 Raid on residence of plastic company owner

 Seized amount - Two crores

– Excise evasion of more than 26 crores

– Detailed kickbacks to excise officials

 Forensic analysis revealed

 Different from traditional branches of

 Deals with collection, examination and

 Recovering deleted information

 Recreating time critical events

 Includes evidence from

 Evidence is not compromised due to incorrect

 A continuing chain of custody is established and

 Procedures and findings are documented.

 Use of proper software utilities

 Not trusting the suspect computer

– Modification of system files to delete information

 Avoiding use of the suspect OS

– Modification of routine OS commands for

 Recover all files

 Access the contents of protected or encrypted files

 Analyze relevant data

 Provide testimony in court of law

 Attaching suspect storage media to

 Imaging storage media by attaching a

 If acquisition hash equals verification hash,

 A forensic examination report

– List softwares used &

– ACL of people having access to collected evidence

 A "regular" disk sector is

 Clusters are groups of sectors

 A cluster can range from 1-128

 Cluster size depends on the size

 “File slack” is storage space existing from the end

 Contains random data from any part of the storage

 This random data is called RAM Slack as it comes

 Identifying network logon names, passwords and

 Legacy data in file slack can be analyzed to

 Fragments of prior e-mail messages and word

 Deletion of a file by the computer user releases

 The data associated with the 'deleted' file remains

 This data storage area is referred to as

 Changing file extensions

 Turning on hidden attribute

 Encryption & Steganography

You might also like