Download - Computer forensics
Computer
Forensics
LALIT GARG 3610109
CSE-2NDYEAR
IndexWhat is Computer ForensicsObjective of Computer ForensicsWhy Computer ForensicsHistory of Computer ForensicsHow it approachesSteps of InvestigationWhat not to do during InvestigationComputer Forensics Techniques
IndexAnti-ForensicsComputer Forensics ToolsAdvantages of Computer ForensicsDisadvantages of Computer ForensicsConclusions
What is Computer Forensics
Computer forensics is considered to be the use of analytical and investigative techniques to identify, collect, examine and preserve evidence/information which is magnetically stored or encoded
Objective of Computer Forensics
Usually to provide digital evidence of aspecific or general activity
Why Computer Forensics?
- Employee internet abuse- Unauthorized disclosure of corporate information and data - Industrial espionage - Damage assessment - Criminal fraud and deception cases - More general criminal cases- and countless others!
History of Computer Forensics Bankruptcy in Enron in December 2001 Hundreds of employees were left jobless while some
executives seemed to benefit from the company's collapse.
The United States Congress decided to investigate and A specialized detective force began to search through hundreds of Enron employee computers using computer forensics.
How it approaches?
-Secure the subject system (from tampering during the operation)-Take a copy of hard drive (if applicable)-Identify and recovery all files (including those deleted)- Access/copy hidden, protected and temporary files-Study 'special' areas on the drive (eg: residue from previously deleted files)- Investigate data/settings from installed applications/programs
How it approaches….cont
-Assess the system as a whole, including its structure- Consider general factors relating to the users activity- Create detailed report. Throughout the investigation, it is important to stress that a full audit log of your activities should be maintained.
Steps of Investigation
Secure the computer system to ensure that the equipment and data are safe
Find every file on the computer system Recover as much deleted information as possible using
applications Reveal the contents of all hidden files with programs
designed to detect the presence of hidden data Decrypt and access protected files
Cont…
Analyze special areas of the computer's disks Document every step of the procedure Be prepared to testify in court as an expert
witness in computer forensics
What should not be done during investigation?
-Avoid changing date/time stamps (of files for example) or changing data itself-Overwriting of unallocated space (which can happen on re-boot for example). 'Study don't change' is a useful catch-phrase.
Computer Forensics Technique Cross-Drive Analysis(CDA)
Live Analysis
Deleted File Analysis
Anti-Forensics : The Nightmare Programmers design anti-forensic tools to make it hard
or impossible to retrieve information during an investigation
Dozens of ways people can hide information
Anti-Forensics…..contd. Some programs can fool computers by changing the
information in files' headers Programs can divide files up into small sections and
hide each section at the end of other files Programs called packers can insert executable files into
other kinds of files Encryption is another way to hide data Changing the metadata attached to files Some computer applications will erase data if an
unauthorized user tries to access the system
Computer Forensics Tools
Disk imaging software Software or hardware write tools Hashing tools File recovery programs Programs to preserve information in RAM Encryption decoding software Password cracking software
Advantages of Computer Forensics
Ability to search through a massive amount of data
Quickly Thoroughly In any language
Disadvantages of Computer Forensics
Digital evidence accepted into court must prove that there is no
tampering all evidence must be fully
accounted for computer forensic specialists
must have complete knowledge of legal requirements, evidence handling and storage and
documentation procedures
Disadvantages of Computer Forensics
Costsproducing electronic records & preserving them is
extremely costly
Presents the potential for exposing privileged documents
Legal practitioners must have extensive computer knowledge
Conclusion
With computers becoming more and more involved in our everyday lives, both professionally and socially, there is a need for computer forensics. This field will enable crucial electronic evidence to be found, whether it was lost, deleted, damaged, or hidden, and used to prosecute individuals that believe they have successfully beaten the system.
Thank You
It’s nice to be important but it is more important to be nice
Any Query???