Scribd Logo
Upload

Welcome to Scribd!

  • 178 views

    Computer Forensics Final

    Uploaded by

    Prathima Prahalad
    The document provides an overview of computer forensics tools EnCase and Forensic Toolkit (FTK). It describes their main features, such as EnCase allowing recovery of deleted folders and files in their original form, and FTK's four phases of acquiring, preserving, analyzing and presenting evidence. The document also gives screenshots of both tools' interfaces and compares their capabilities, such as EnCase supporting more file systems but FTK having more image format support and the ability to perform SHA-1 hashing. It concludes that both tools are essential for thorough forensic investigations.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PPT, PDF, TXT or read online from Scribd

    Computer Forensics Final

    Uploaded by

    Prathima Prahalad
    178 views34 pages
    The document provides an overview of computer forensics tools EnCase and Forensic Toolkit (FTK). It describes their main features, such as EnCase allowing recovery of deleted folders and files in their original form, and FTK's four phases of acquiring, preserving, analyzing and presenting evidence. The document also gives screenshots of both tools' interfaces and compares their capabilities, such as EnCase supporting more file systems but FTK having more image format support and the ability to perform SHA-1 hashing. It concludes that both tools are essential for thorough forensic investigations.

    Copyright

    © Attribution Non-Commercial (BY-NC)

    Available Formats

    PPT, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    The document provides an overview of computer forensics tools EnCase and Forensic Toolkit (FTK). It describes their main features, such as EnCase allowing recovery of deleted folders and files in their original form, and FTK's four phases of acquiring, preserving, analyzing and presenting evidence. The document also gives screenshots of both tools' interfaces and compares their capabilities, such as EnCase supporting more file systems but FTK having more image format support and the ability to perform SHA-1 hashing. It concludes that both tools are essential for thorough forensic investigations.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PPT, PDF, TXT or read online from Scribd
    Download as ppt, pdf, or txt
    178 views34 pages

    Computer Forensics Final

    Uploaded by

    Prathima Prahalad
    The document provides an overview of computer forensics tools EnCase and Forensic Toolkit (FTK). It describes their main features, such as EnCase allowing recovery of deleted folders and files in their original form, and FTK's four phases of acquiring, preserving, analyzing and presenting evidence. The document also gives screenshots of both tools' interfaces and compares their capabilities, such as EnCase supporting more file systems but FTK having more image format support and the ability to perform SHA-1 hashing. It concludes that both tools are essential for thorough forensic investigations.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PPT, PDF, TXT or read online from Scribd
    Download as ppt, pdf, or txt
    of 34

    COMPUTER FORENSICS

    Prathima Prahlad

    Presentation Outline
    Preview Computer Forensics Encase Forensic tool kit Encase Features and screenshots Forensic Tool kit Features and screenshots Case Study Conclusion References

    Computer forensics
    To gather data from evidence recovered at crime scenes. Evidence usually is in digital format and more often than not is sparse. The aim to recover the sparse evidence, link and understand the information. There are tools that are used to understand, decode and help solve crimes using the information.

    EnCase
    EnCase is a standard, commercially available software program that is specifically designed as a tool for computer forensic investigations. Developed by guidance software. It is used by many law enforcement agencies, which help in solving crimes.

    Features EnCase
    Supports file types like FAT,NTFS. Security features include protecting files using passwords, encryption. Can combine files to create a common case. Has graphical allocation map showing the disk cluster by cluster.

    EnCase Case Creation

    EnCase - Options

    EnCase Choose Devices

    EnCase Choose drive

    EnCase Recovering folders

    EnCase

    EnCase Recovery status

    EnCase

    EnCase not just locates the deleted folders, but also gets back the content. You could read the file back in its original form Encase lets you to copy the folder to any destination.

    Forensic Toolkit
    Developed by AccessData It is one of the most advanced tools in computer forensics Helps in recovery and management of data There are 4 phases Acquiring, Preserving, Analyzing and Presenting.

    Acquiring and Preserving


    The computer evidence can be preserved in two ways: by creating an image of the suspect drive using hardware devices or using software applications. FTK Imager is a software acquisition tool. To prevent against accidental or intentional manipulation of evidence, FTK Imager makes a bit-by-bit duplicate image of the media. The forensic image is identical in every way to the original, including file slack and unallocated space or free space.

    Analyzing
    To analyze the evidence, FTK uses a variety of tools, including hashing, the Known File FilterTM (KFFTM) database, and searching. Message Digest 5 (MD5) and Secure Hash Algorithm (SHA-1) are the two hash functions available in FTK. Individual files are hashed to compare the results with a known database of hashes, such as KFF. KFF is an FTK utility that compares file hashes against a database of hashes from known files. The purpose of KFF is to eliminate ignorable files or to alert you to known illicit or dangerous files. It also checks for duplicate files. FTK uses dtSearch as its index search engine. dtSearch, one of the leading search tools available, can quickly search gigabytes of text.

    Analyzing.
    Message Digest 5 (MD5) A 128-bit digital fingerprint based on a file's content that was designed by Ron Rivest of RSA. It takes as input an arbitrarylength file and outputs a fixed-length number referred to as a hash or digest. The number is derived from the input in such a way that it is computationally infeasible to derive any information about the input from the hash. MD5 hashes are used by the KFF to identify known file. Secure Hash Algorithm (SHA-1) A 160-bit digital fingerprint based on a files content that was designed by the National Institute of Standards and Technology (NIST). It takes as input an arbitrary-length file and outputs a fixed-length number referred to as a hash or digest. It is also computationally infeasible to find another file that will produce the same output.

    Presenting
    FTK presents computer evidence by creating a case report and case log to document the evidence and investigation results. Uses the Report Wizard to create and modify reports. The case log assists in documenting and logging activities during the investigation and analysis of a case. Bookmarks customize graphics references, select file listings, and include supplementary files and the case log can be added in the report.

    FTK Case Creation

    FTK- User Information

    FTK- Logging Options

    FTK- Process types

    FTK- Refining

    FTK- Refining Index

    FTK- Adding evidence

    FTK- Status

    FTK- Processing

    FTK- Image verification

    FTK- Index Search

    Comparison of EnCase and FTK


    IMAGING OF DEVICES - FTK supports more image formats than encase. But, EnCase has its own image format while FTK does not have its own image format. FILE SYSTEMS SUPPORTED EnCase supports more file systems than FTK. SEARCHING - FTK search takes longer, has good features as Live and Indexed Search. EnCase uses its own search engine. HASHING - FTK supports SHA-1 hashing which is not supported by EnCase. If budget is a concern, Forensic toolkit is economically sound as compared to EnCase which is almost double the price of FTK. FTK provides almost all the features that facilitate in the smooth running and completion of a forensic investigation. If only one tool is to be chosen, EnCase leads FTK due to its advanced features which give EnCase competitive advantage over FTK or any other forensic tool in the market.

    Case Study-BTK Killer


    Investigators used encase to track the BTK killer in 2005 The BTK (bind, torture, kill) killer killed 10 people from 1974 to 1991 The killer (Dennis Rader) sent letters to the investigating authorities from 2004 In 2005 the killer sent a floppy disk to a broadcast channel. Using encase, police found a deleted Microsoft word document. The document on recovery showed, that it was modified by "Dennis" and a name of the church was written in the document. Further Investigation led to the discovery that the killer was a president at the church and thus the authorities nabbed the killer.

    Conclusion
    Many researchers believe that computer forensics may play a part in every case that has to be solved. Taking into account the features provided by the two tools, both the tools are essential for a thorough and complete forensic investigation. Research in computer forensics is being done. Government agencies are investing heavily in forensics, to help in solve crime. Many new tools are being developed, to help solve crime.

    References
    Zhang Yan; Lin Ying; Research on the key technology of secure forensics, 2010 Third international symposium on Intelligent information technology and security informatics. April 2010. Page(s): 649 - 652 Dixon, P.D; An overview of computer forensics, IEEE potentials, Dec 2005. Page(s) 7-10 Liu Zhijun; Wang Ning; Developing a computer forensics program in police higher education, 4th international conference on Computer science and education, 2009. Page(s): 1431 - 1436 Website: accessdata.com Website: mediarecovery.pl

    Thank you

    You might also like