1.
Study of Computer Forensics and different tools used for forensic investigation
▪ Collecting
▪ Preserving
▪ Analysing
▪ Presenting digital evidence
▪ All legally
Type of Forensics
▪ Disk Forensics : Examines hard drives and storage media.
▪ Network Forensics : Monitors and analyses network traffic.
▪ Email Forensics : Investigates email headers, senders, and attachments.
▪ Mobile Forensics : Extracts data from smartphones and tablets.
▪ Cloud Forensics : Deals with cloud-based storage and virtual environments.
Tools
▪ EnCase – Used to analysing files, recovering deleted files, and generating report
▪ FTK (Forensic Toolkit) – Performs hashing, decryption, indexing, and quick searches
▪ Autopsy/Sleuth Kit – Used to analysing hard drive and smartphones.
2. Recovering Deleted Files with the help of Forensics Tools using Foremost or freeRecover or
any other open source tools
Steps to recover data
▪ Foremost install : apt install foremost
▪ Options help : foremost -h
▪ Connect USB Drive and then delete all files.
▪ Find the path of our disk : fdisk -l
▪ Copy the path and then : foremost -t jpg,pdf,mp4 -v -q -I /dev/sdb2 -o /root/Desk
▪ You can use -v for see list of files
▪ -q for quick scanning
▪ -i input device which device to recover
▪ -o output path where to recover
3. Implement the steps for hiding and extract any text file behind an image file/ Audio file using
Command Prompt
▪ Take a image then create a text file and write it
▪ Write click on text file then click on 7-Zip => add to [Link]
▪ Now we have [Link] file
▪ Open cmd and go to that folder directory
▪ Write : copy /b [Link]+[Link] [Link]
▪ Then we have the another image
▪ Then we open it with the 7-zip then we see that text doc inside
4. Using Autopsy tool live forensics case investigation : Recovering Deleted Files in a Data Breach
1. Autopsy Install karo – Apne system pe Autopsy forensic tool install karo (official website se).
2. New Case Create karo – Autopsy open karke “Create New Case” pe click karo aur case name &
investigator details bhar do.
3. Data Source Add karo – “Add Data Source” pe click karke disk image (.E01, .DD) ya live drive
select karo jahan se data breach hua tha.
4. Ingest Modules Enable karo – Keyword Search, File Analysis, Deleted Files Recovery jaise
modules enable karo.
5. Analysis Start karo – Autopsy data scan karega aur sab files, artifacts, browser history, aur
deleted data extract karega.
6. Deleted Files Locate karo – “Deleted Files” section me jao → yahan sab recoverable deleted
files dikhenge.
7. Recover Files – Required deleted files select karke “Extract File(s)” pe click karo aur safe
location pe save karo.
8. Keyword Search use karo – Sensitive keywords (passwords, data breach terms, email IDs)
search karke related files find karo.
9. Timeline Analysis karo – “Timeline” view me jaake pata lagao kab files delete hui aur breach
timing kya thi.
10. Generate Report – “Generate Report” option se HTML ya PDF report banao jisme recovered
files, timestamps, aur evidence summary ho.
5. Conduct Employee Misconduct Investigation using autopsy tool
Case: Employee Misconduct Investigation using Autopsy Tool
1. Autopsy Open karo – Autopsy forensic tool launch karo.
2. New Case Create karo – “Create New Case” select karke case name likho jaise
EmployeeMisconduct_Case1.
3. Investigator Details Add karo – Investigator ka naam aur organization details fill karo.
4. Data Source Add karo – Suspect employee ka hard disk image, USB drive, ya system folder add
karo.
5. Ingest Modules Enable karo – File Type Identification, Keyword Search, Web History Analysis,
aur Email Parser modules enable karo.
6. Analysis Start karo – Autopsy system ka detailed scan karega aur saari files analyze karega.
7. Keyword Search karo – Keywords jaise “confidential”, “leak”, “password”, “salary data” use
karke suspicious files dhoondo.
8. Web History Check karo – Browser artifacts section me jaake visited websites aur downloads
verify karo.
9. Email Analysis karo – Outlook / Thunderbird mail data analyze karke unauthorized
communication check karo.
10. USB Connection Logs Dekho – “Recent Activity” module me external USB devices ke records
check karo (data theft ke liye).
11. Deleted Files Recover karo – Deleted Documents ya confidential files restore karke verify karo
ki kya kuch delete kiya gaya tha.
12. Timeline View use karo – Events timeline dekh kar pata lagao kis date/time pe suspicious
activity hui.
13. Generate Report – “Generate Report” option me HTML/PDF format me final report banao
with all evidence, keywords, timestamps, aur findings.
6. Conduct Ransomware Attack Investigation using autopsy tool
Case: Ransomware Attack Investigation using Autopsy Tool
1. Autopsy Open karo – Apne system me Autopsy forensic tool launch karo.
2. New Case Create karo – “Create New Case” pe click karke case name likho jaise
Ransomware_Case1.
3. Investigator Details Add karo – Investigator ka naam aur organization information fill karo.
4. Data Source Add karo – Affected system ka disk image (.E01, .DD) ya drive add karo.
5. Ingest Modules Enable karo – File Analysis, Hash Lookup, Keyword Search, Recent Activity, aur
Malware Detection modules enable karo.
6. Scan Start karo – Autopsy system ke saare files aur folders analyze karega for suspicious
encryption patterns.
7. Identify Encrypted Files – “File Types” section me jaake unusual extensions (.locked, .enc, .cry)
identify karo.
8. Check Ransom Note – Desktop ya Documents folder me ransom note files ([Link],
[Link], etc.) search karo.
9. Keyword Search – Keywords jaise “bitcoin”, “decrypt”, “ransom” search karke related
evidence collect karo.
10. Timeline Analysis – “Timeline View” me jaake dekhna kis date/time pe ransomware ne files
encrypt ki.
11. Registry & Log Analysis – “Recent Activity” me startup entries aur suspicious processes check
karo.
12. Email or Network Traces – Email artifacts aur browser history me suspicious download links ya
attachments find karo.
13. Recover Deleted Files – “Deleted Files” section me jaake ransomware ke pehle ke deleted files
recover karo.
14. Hash Lookup – Malware ke hash ko compare karo known ransomware databases ke saath.
15. Generate Report – Final report banao (HTML/PDF) jisme encrypted files, ransom notes,
timestamps, aur recovery evidence sab include ho.