Hard Questions DF

1. Define Network Forensics. Explain its scope and importance.

Definition:

Network Forensics ek aisa branch hai Digital Forensics ka jisme network traffic ko
capture, record aur analyze kiya jata hai — jaise ki packets, logs, connections, IP addresses
— taaki cyber attacks, unauthorized access, data breach ya kisi bhi suspicious activity ka
pata lagaya ja sake.

Simple words mein:

Network Forensics = Network data ka investigation + Evidence collect karna for
cybercrimes.

Scope of Network Forensics (Kya-kya cover hota hai?)

1. Packet Capture & Analysis
– Live network packets ko capture karke unka deep analysis.
– Tools: Wireshark, TCPDump, Ettercap.
2. Intrusion Detection & Investigation
– Network attacks jaise DoS, malware communication, port scanning detect karna.
3. Network Log Analysis
– Routers, firewalls, servers ke logs ko analyze karke suspicious activities track karna.
4. Tracing Attackers
– Attacker ka source, path, ya IP tracing.
5. Data Breach Investigation
– Kaunsa data leak हुआ, kaise हुआ aur kis device ke through evaluate karna.
6. Compliance & Policy Enforcement
– Organizations mein network security policies follow ho rahi hai ya nahi check
karna.
7. Incident Response Support
– Attack hone ke baad forensic evidence provide karna for recovery & legal cases.

Importance of Network Forensics (Kyu zaroori hai?)

1. Cyber Attacks Detect and Prevent
– Network traffic dekhkar real-time threats identify hote hain.
2. Evidence Collection for Legal Cases
– Court-acceptable digital evidence provide karta hai.
3. Identify Root Cause of Attacks
– Attack ka kaise, kab aur kahan se hua — iska pata milta hai.
 4. Monitor Insider Threats
– Employees ke malicious activities detect hoti hain.
5. Improves Network Security
– Vulnerabilities identify karke system ko secure banaya jata hai.
6. Supports Incident Response Team
– Attack ke baad quick recovery aur mitigation ke liye जरूरी information deta hai.

2. Discuss the forensic importance of network components and OSI layers.

1. Forensic Importance of Network Components

Network components jaise routers, switches, firewalls, servers forensic investigation mein
bahut important hote hain because ye network activity ke logs store karte hain. Inka use
karke investigator attack ka source, path, aur behavior identify kar sakta hai.

(a) Router

• Routing tables, NAT logs, IP logs store karta hai.

• Attack kis IP se aaya, packets kaise forward hue — pata lagta hai.
• Useful in tracing attackers.

(b) Switch

• MAC address tables maintain karta hai.

• Kis port se kaunsa device connected tha, identify kiya ja sakta hai.
• Helps in insider threat investigation.

(c) Firewall

• Allowed/blocked traffic ke logs keep karta hai.

• Suspicious ports, denied attempts, malware traffic detect hota hai.
• Very useful for intrusion detection.

(d) IDS / IPS (Intrusion Detection/Prevention Systems)

• Attack signatures detect karta hai.

• Alerts generate karta hai — forensic evidence ban jata hai.
• Helps in real-time attack analysis.

(e) Servers (Web, Mail, DNS)

• Web server logs se pata lagta hai attacker ne kya pages access kiye.
• Mail server logs phishing investigation mein kaam aate hain.
• DNS logs se malicious domain resolution track hota hai.
(f) Access Points / Wireless Devices

• Connected devices ke MAC logs store karte hain.

• Wi-Fi attacks jaise spoofing, unauthorized device detection ke liye important.

2. Forensic Importance of OSI Layers

OSI model ke har layer ka forensic role hota hai kyunki cyber attacks har layer ko target karte
hain. Layer-wise forensic analysis se attack ka exact level samajh aata hai.

(a) Layer 1 – Physical Layer

• Cable tampering, signal jamming detect karne mein helpful.

• Physical access ka forensic evidence (e.g., unplugged devices).

(b) Layer 2 – Data Link Layer

• MAC address spoofing detect karna.

• ARP spoofing/poisoning attacks trace karna.

(c) Layer 3 – Network Layer

• IP addresses, routing information forensic evidence provide karta hai.

• DDoS, IP spoofing, unauthorized access investigation.

(d) Layer 4 – Transport Layer

• TCP/UDP port analysis se malicious connections ka pata lagta hai.

• SYN flood, port scanning jaise attacks investigate hote hain.

(e) Layer 5 – Session Layer

• Active sessions, login times, session hijacking trace karna.

• Helps in tracking unauthorized user sessions.

(f) Layer 6 – Presentation Layer

• Encryption/encoding related evidence.

• Malware payloads kis format mein transmitted hue, identify karna.

(g) Layer 7 – Application Layer

• HTTP, DNS, FTP logs forensic ke liye most important.

• SQL injection, XSS, phishing, malware communication detect karna.
3. Write short notes on: (a) Wireshark (b) TCPDump in Network Forensics

(a) Wireshark – Short Note

Wireshark ek powerful GUI-based network protocol analyzer hai jo live network traffic
ko capture, filter, decode, aur analyze karta hai.

Key Points (Forensic Use):

• Real-time packet capture with detailed information (IP, ports, protocols).

• 2000+ protocols ko decode kar sakta hai.
• Suspicious traffic jaise malware communication, port scans, DNS anomalies detect
karta hai.
• Filters (display/capture) se specific evidence easily mil jata hai.
• Attack timeline, source IP, destination, payload content analyze karne mein helpful.
• Reports export karne ki facility forensic documentation ke liye useful.

In short:
Wireshark helps investigators visualize and analyze network packets to identify cyber
attacks, intrusions, and data breaches.

(b) TCPDump – Short Note

TCPDump ek command-line packet capture tool hai jo network interface se passing
packets ko capture aur log karta hai.

Key Points (Forensic Use):

• Lightweight, fast, and ideal for live/remote server forensics.

• BPF (Berkeley Packet Filter) use karta hai for precise packet capturing.
• Captured packets ko .pcap file mein store kar sakte hain forensic analysis ke liye.
• Simple commands se IP tracing, port monitoring, suspicious traffic identify kiya ja
sakta hai.
• Wireshark ke saath use hota hai:
– TCPDump se capture → Wireshark me visualize & analyze.

In short:
TCPDump helps forensic investigators quickly capture raw packet data from
servers/networks for later deep analysis.

4. Explain packet sniffing and analysis using Ettercap and Wireshark

Packet Sniffing ka matlab hota hai network me travel hote packets ko capture, monitor
aur analyze karna.
Ye cyber attacks, data breaches aur suspicious traffic identify karne ke liye Network
Forensics ka important part hai.
1. Wireshark (Packet Analysis)
Wireshark ek GUI-based packet analyzer hai jo live network traffic ko capture karta hai aur
uski deep inspection deta hai.

Forensic Points:

1. Live Packet Capture:

– Real-time IP, MAC, Ports, Protocols, Payload sab capture karta hai.
2. Filtering:
– http, [Link], [Link] jaise filters se suspicious packets instantly mil jaate hain.
3. Deep Analysis:
– Investigator source-destination IP, TCP handshake, DNS queries, malware traffic
check karta hai.
4. Protocol Decode:
– 2000+ protocols decode karta hai, useful for web attacks, data breach analysis.
5. Export Evidence:
– Packets .pcap me save karke legal evidence create kiya ja sakta hai.

Conclusion:
Wireshark forensic examiners ko complete packet-level visibility deta hai.

2. Ettercap (Packet Sniffing through MITM)

Ettercap ek Man-in-the-Middle + packet sniffing tool hai, specially LAN attacks
investigate karne ke liye.

Forensic Points:

1. ARP Spoofing Detection:

– Ettercap se ARP poisoning aur spoofing attacks identify kiye ja sakte hain.
2. MITM Traffic Capture:
– Attacker-victim ke beech me exchange hota raw unencrypted traffic capture hota hai.
3. Session Information:
– Credentials, cookies, malicious redirects detect karne me helpful.
4. Host Scanning:
– Network me connected devices detect karta hai (attacker identification me help).
5. Export for Further Analysis:
– Captured traffic ko Wireshark me detailed analysis ke liye export kiya ja sakta hai.

Conclusion:
Ettercap LAN-level attacks jaise MITM, spoofing aur unauthorized interception ko trace
karne ke liye best hai.
6. Describe the process of packet capture using TCPDump with an example.

TCPDump ek powerful command-line packet capture tool hai jo network interface se

passing real-time packets ko capture karke .pcap file me store karta hai.
Yeh lightweight, fast aur forensic investigation me commonly use hota hai.

1. Selecting the Network Interface

Packet capture shuru karne ke liye pehle network interface choose karna padta hai, jaise:

tcpdump -D

Is command se system ke saare available interfaces list ho jaate hain.

For example: eth0, wlan0 etc.

2. Starting Packet Capture

Capture start karne ke liye basic command:

tcpdump -i eth0

• -i eth0 → eth0 interface par live packets capture honge.

• Tool source IP, destination IP, ports, protocol sab real-time me show karta hai.

3. Applying Filters (Forensics ke liye useful)

Investigators specific packets capture karna chahte hain, toh filter use karte hain.

Example: Sirf TCP port 80 (HTTP) traffic capture karna:

tcpdump -i eth0 tcp port 80

Isse unwanted traffic remove ho jata hai aur suspicious activity jaldi milti hai.

4. Saving Captured Packets to a File

Captured packets ko .pcap file me store karne ke liye:

tcpdump -i eth0 -w [Link]

 • -w → write to file
Is file ko baad me Wireshark me open karke deep analysis kiya ja sakta hai.

5. Stopping Capture
Capture ko stop karne ke liye simply Ctrl + C press kiya jata hai.
TCPDump summary de deta hai:

• total packets captured

• dropped packets
• analyzed packets

Example (Full Command)

Suppose investigator ko ek suspicious web attack investigate karna hai, toh vo command use
karega:

tcpdump -i eth0 tcp port 80 -w attack_capture.pcap

Meaning:

• eth0 par HTTP traffic capture karo

• saara data attack_capture.pcap me save karo
• baad me Wireshark me kholkar payload, attacker IP, and request patterns analyze karo

7. Explain WHOIS and nslookup useful in Website Penetration Testing?

Website Penetration Testing me information gathering (reconnaissance) sabse pehla aur

important step hota hai.
Is stage me attacker ya security tester website ke domain, server, owner, DNS records ke
baare me details collect karta hai.
Iske liye WHOIS aur nslookup do most commonly used tools hain.

1. WHOIS – (Domain Information Lookup Tool)

WHOIS ek public database lookup tool hai jisse kisi bhi domain ke baare me ownership aur
registration details milti hain.

WHOIS se kya information milti hai?

• Domain owner ka name/company

 • Email ID & contact details
• Registrar (GoDaddy, Namecheap, etc.)
• Domain registration & expiry date
• Name servers (NS records)
• Hosting details

Penetration Testing me WHY useful?

1. Domain Ownership Verification

– Kaun website own karta hai? Company details mil jati hain.
2. Technical Contacts
– Admin ya technical support ke email milte hain (Social engineering risk check).
3. Registrar & Nameserver Info
– Attack surface identify hota hai.
4. Track Domain History
– Kisne kab register kiya, expired toh nahi? Phishing sites detect hoti hain.

Short line:
WHOIS → Domain owner & registration details for reconnaissance.

2. nslookup – (DNS Information Lookup Tool)

nslookup command-line tool hai jo domain ke DNS records fetch karta hai.
Isse pata chalta hai domain internet par kaise resolve ho raha hai.

nslookup se kya information milti hai?

• Domain ka IP Address
• Server ka A record, MX record (mail server), TXT record
• Reverse lookup (IP → Domain)
• Authoritative name servers

Penetration Testing me WHY useful?

1. Server IP Identify Karna

– Website ka real server IP milta hai (useful for port scanning, footprinting).
2. Subdomain Discovery
– Mail server, web server, API endpoints detect ho sakte hain.
3. DNS Misconfigurations Detect Karna
– Weak DNS records = easy attack surface.
4. Load Balancers/Redirection Trace
– Multiple IPs hone par architecture samajh me aata hai.

Short line:
nslookup → DNS records, server IP, and domain infrastructure ka information deta
hai.
8. Illustrate forensic analysis of Linux and Windows systems using Autopsy.

Autopsy ek GUI-based digital forensics tool hai jo investigators ko Linux aur Windows
systems se deleted files, logs, user activity, artifacts, aur system evidence recover aur
analyze karne me help karta hai.

Autopsy hard drives, partitions, images (E01, DD, RAW) ko scan karke detailed forensic
report generate karta hai.

🔹 1. Forensic Analysis of Windows Systems using Autopsy

Windows OS me Autopsy specially user activity aur file system artifacts analyze karne ke
kaam aata hai.

Key Forensic Artifacts in Windows:

1. NTFS File System Analysis

o Deleted files recovery
o MFT (Master File Table) se file timestamps, creation, modification details
2. Registry Analysis
o Installed software
o USB device history
o User login details
o Recent document lists
3. Browser History Analysis
o Chrome/Edge/Firefox ke browsing history, downloads, cookies
o Phishing or suspicious website visits detect karna
4. Event Logs
o Security logs → login attempts
o System logs → crashes, errors
o Attack timeline create karne me helpful
5. Email & Chat Artifacts
o Email archives, attachments
o Messaging apps ka data

Conclusion (Windows):
Autopsy Windows ke deleted files, registry entries, browser history, aur system logs recover
karke attacker ke actions ka complete timeline banata hai.

🔹 2. Forensic Analysis of Linux Systems using Autopsy

Linux systems me Autopsy mainly ext file systems (ext2, ext3, ext4) analyze karta hai.
Key Forensic Artifacts in Linux:

1. EXT File System Analysis

o Deleted files recovery
o Inode information (file metadata)
o Hidden files trace karna
2. Log File Analysis (/var/log/)
o Auth logs → successful/failed logins
o Syslog → background processes, services
o Cron logs → scheduled tasks (malware persistence check)
3. User Activity Analysis
o Bash history (commands executed)
o SSH logins
o Installed packages
4. Configuration Files (/etc/)
o passwd & shadow files (user accounts)
o Network configuration
o Startup scripts where attackers hide malware
5. Mounted Drives & Permissions
o Unauthorized mount points
o Suspicious permission changes

Conclusion (Linux):
Autopsy Linux me logs, bash history, user accounts, aur deleted data analyze karke security
breaches trace karta hai.

9. Describe Hashdeep and illustrate how it is used for auditing and comparing evidence

Hashdeep ek command-line file integrity verification tool hai jo files ke liye multiple hash
values (MD5, SHA1, SHA256) generate karke unhe audit aur compare karne ke kaam aata
hai.
Digital Forensics me iska use evidence ki integrity check, verification, aur tampering
detection ke liye hota hai.

🔹 1. What is Hashdeep?
Hashdeep:

• Multi-hash tool (MD5, SHA-1, SHA-256, Tiger, Whirlpool)

• Recursively directories scan karta hai
• Known-good hash sets create kar sakta hai
• Evidence ko verify karne ke liye “audit mode” provide karta hai
• Hash values compare karke data tampered hai ya unchanged — pata lagata hai

Short line:
Hashdeep = Hash generation + Evidence auditing + Integrity verification.
🔹 2. How Hashdeep Helps in Digital Forensics?
1. Integrity Verification
– Original evidence ka hash create karke ensure karte hain ki data change nahi hua.
2. Chain of Custody Protection
– Court me proof ki file ko kisi ne modify nahi kiya.
3. Audit Mode
– Large file sets compare karne ke liye extremely useful.
4. Detecting Modifications
– Deleted, added, or modified files identify ho jaate hain.

🔹 3. Using Hashdeep for Auditing & Comparing Evidence

(A) Step 1: Create Baseline Hashes (Original Evidence)

For example, investigator drive image ka hash create karta hai:

hashdeep -r /evidence/source > [Link]

• -r → recursive mode
• [Link] me saare files ke hash values store ho jayenge
• Isko “known-good” reference bola jata hai

(B) Step 2: Audit Evidence Later

Same location ya backup copy inspect karne ke liye audit mode use hota hai:

hashdeep -a -k [Link] /evidence/current

• -a → audit mode
• -k [Link] → compare with original hash list

Hashdeep automatically report karta hai:

• Matched files
• Modified files
• Missing files
• New/extra files
(C) Step 3: Interpretation of Results

Hashdeep report 3 cheeze clear batata hai:

1. UNMATCHED – File modify/change ho gayi

2. MISSING – Evidence ka original file absent
3. MATCHED – File 100% unchanged (integrity verified)

Isse pata lagta hai ki evidence original condition me hai ya alter hua hai.

10. Explain Data Carving using Bulk Extractor with its forensic applications.

Data Carving forensic technique hai jisme investigator damaged, deleted ya partial storage
media se specific types of data recover karta hai—file system ki help ke bina.
Iska matlab agar partition corrupt ho, file table delete ho ya disk formatted ho, tab bhi data
carve kiya ja sakta hai.

Bulk Extractor ek advanced data carving tool hai jo raw disk ya image ko scan karke useful
forensic artifacts extract karta hai.

🔹 1. What is Bulk Extractor?

Bulk Extractor:

• Open-source forensic tool

• File system ko ignore karke raw bytes scan karta hai
• Important artifacts extract karta hai like:
o Email addresses
o Credit card numbers
o URLs
o Phone numbers
o Passwords
o EXIF metadata
o Network packets
• Fast, efficient, aur parallel processing support karta hai.

Short Line:
Bulk Extractor = Fast Data Carving Tool for finding digital artifacts without using file
system.
🔹 2. How Data Carving Works in Bulk Extractor
Bulk Extractor pattern matching, regular expressions aur scanners use karke drive ke raw
data me se artifacts extract karta hai.

Process (Simple Steps):

Step 1 — Provide Input Image

Investigator disk image deta hai:

bulk_extractor -o output_folder [Link]

Step 2 — Bulk Extractor Scanning

Tool poori drive scan karta hai:

• No need for partition table

• No need for file system
• Direct raw sector-by-sector analysis

Step 3 — Artifact Extraction

Bulk Extractor automatically extract karta hai:

• Emails → [Link]
• URLs → [Link]
• Credit card numbers → [Link]
• Phone Numbers → [Link]
• EXIF info → [Link]
• Network packets → [Link]

Step 4 — Output Report Generation

Saara extracted data separate files me save hota hai.

Investigator directly patterns dekh sakta hai and evidence analyze kar sakta hai.

🔹 3. Forensic Applications of Data Carving using Bulk Extractor

1. Recovery of Deleted Data

Formatted or deleted partitions se emails, URLs, passwords recover ho jate hain.

2. Cybercrime Investigation

• Suspect ke system se email addresses extract

• Browsing history, URL patterns recover
• Hidden communication track karna
3. Financial Fraud Cases

Credit card numbers, bank-related strings automatically carve ho jate hain.

4. Child Exploitation & Image Metadata Cases

EXIF metadata carve karke:

• GPS coordinates
• Camera information
• Timestamps
detect kiye ja sakte hain.

5. Malware & Intrusion Analysis

Network packet fragments carve hokar malware communication pattern reveal karte hain.

6. Large Dataset Processing

Bulk Extractor huge drives (1 TB+) quickly scan kar sakta hai—manual search se bohot fast.

11. Explain different password cracking techniques with suitable tools.

Password cracking ka main purpose lost passwords recover karna, authentication bypass
detect karna, ya forensic investigation ke during evidence extract karna hota hai. Different
techniques aur tools use hote hain depending on password strength aur hashing method.

1. Brute Force Attack

• Isme attacker sabhi possible character combinations try karta hai jab tak correct
password na mile.
• Slow but guaranteed results.
• Weak passwords easily break ho jate hain.

Tools:

• John the Ripper

• Hydra
• Hashcat

2. Dictionary Attack
• Predefined wordlist (dictionary) use hota hai jisme common passwords stored hote
hain.
• Fast, but only effective if password dictionary-based ho.

Tools:
 • John the Ripper
• Hydra
• Cain & Abel
• Wordlists: [Link], SecLists

3. Hybrid Attack
• Dictionary + Brute Force ka mix.
Example:
Password = Hello123
Tool dictionary word “Hello” leke uske aage numbers brute force se try karega.

Tools:

• Hashcat
• John the Ripper

4. Rainbow Table Attack

• Precomputed hash tables use karta hai.
• Fast lookup-based password cracking.
• Sirf un hashes ke liye kaam karta hai jinke rainbow tables pehle se available ho.

Tools:

• RainbowCrack
• Ophcrack

5. Credential Stuffing
• Ek site ka leaked username–password dusri site me try karna (reused passwords ke
liye).
• Forensics me breach source identify karne me helpful.

Tools:

• Hydra, Burp Suite Intruder

6. Social Engineering / Phishing

 • Human manipulation se passwords collect kiye jate hain.
• Digital forensics me compromise ka root cause identify hota hai.

Tools:

• SET (Social Engineering Toolkit)

• Evilginx

7. Offline Hash Cracking

• System se hash extract karke offline crack kiya jata hai.
• OS-level forensics me important.

Hash Extraction Tools:

• Mimikatz (Windows)
• Pwdump
• SAMInside

Cracking Tools:

• Hashcat
• John the Ripper

12. Demonstrate how John the Ripper is used for password cracking, with an example.

John the Ripper (JtR) ek powerful open-source password-cracking tool hai jo dictionary
attack, brute-force attack aur hybrid attack support karta hai. Forensic investigation me ye
password hash recover karne ke liye widely use hota hai.

1. Step 1: Install John the Ripper

Linux par JtR install karne ka simple command:

sudo apt install john

2. Step 2: Extract Password Hashes

Windows ke liye hashes usually SAM aur SYSTEM files se milte hain.
Linux me /etc/shadow file se milte hain.

Example: Linux shadow file se hash extract:

sudo unshadow /etc/passwd /etc/shadow > [Link]

Is file me username + hashed password dono aa jate hain.

3. Step 3: Run John to Crack the Password

John ko directly hash file dena hota hai.

Dictionary Attack Example

john --wordlist=/usr/share/wordlists/[Link] [Link]

Brute Force Attack Example

john --incremental [Link]

JtR hashes analyze karke matching password try karta rahega.

4. Step 4: Check Cracked Passwords

Cracked passwords dekhne ke liye:

john --show [Link]

Output example:

user1:password123
user2:qwerty

Practical Example (Easy to Write in Exam)

Suppose [Link] file me following hash hai:

student:$6$abc123$uHhks8WcK...

Command chalaya:

john --wordlist=[Link] [Link]

After some time John prints:

student:welcome123

This means password "welcome123" successfully cracked.

13. Examine Rainbow Tables and their significance in password recovery.

Rainbow Tables pre-computed large databases hote hain jisme plaintext passwords aur
unke corresponding hash values stored hote hain. Forensic investigators in tables ka use
karke hashed passwords ko quickly recover kar sakte hain without performing expensive
brute-force calculations.

1. What Are Rainbow Tables?

• A lookup table that contains password → hash mappings.
• Instead of cracking the hash by trying all combinations, investigator simply searches
the hash inside the rainbow table.
• Time–memory trade-off method use karta hai:
o Less time required (fast cracking)
o More storage required (large table files)

2. How Rainbow Tables Work?

1. Passwords generate kiye jaate hain (example: common words, patterns).
2. Har password ka hash compute hota hai (MD5, SHA1, NTLM etc.).
3. Phir reduction functions use karke chain form ki jati hai, jisse storage kam lagta hai.
4. Cracking ke time investigator target hash ko chain me match karta hai.
5. Agar match mil jaata hai toh corresponding plaintext password recover ho jaata hai.

3. Significance in Password Recovery

(a) Very Fast Password Cracking

• Real-time brute force ki jagah direct lookup hota hai.

Example: NTLM hash crack seconds me ho jata hai.

(b) Useful for Weak & Common Passwords

• Standard password patterns, dictionary-based passwords rainbow tables me mostly

cover hote hain.

(c) Helpful in Digital Forensics

• Investigators compromised systems ke hash files (SAM, shadow) lete hain aur
rainbow table se password identify karte hain.
• Incident response me breach ka impact samajhne me help.

(d) Effective for Offline Cracking

 • Since attacker/investigator ke paas hash hai, wo network access ke bina/password
lock ke bina crack kar sakta hai.

(e) Demonstrates Need for Salting

• Rainbow tables ke existence se hi security experts salted hashing ka use recommend

karte hain.
• Salt hash-algorithm ko unpredictable banata hai, jisse rainbow tables useless ho jate
hain.

4. Common Rainbow Table Tools

• RainbowCrack
• Ophcrack (Windows NTLM passwords)
• Free rainbow tables: MD5, SHA1, LM/NTLM

14. Discuss WiFi packet capture and password cracking using Aircrack-ng.

Aircrack-ng ek powerful WiFi security auditing suite hai jo wireless traffic ko capture karke
WEP/WPA/WPA2 passwords crack karne ke liye use hota hai. Forensic investigators ise
unauthorized access, WiFi misuse, aur network breach analysis ke liye use karte hain.

1. Step 1: Put Wireless Adapter in Monitor Mode

Monitor mode WiFi card ko raw wireless packets capture karne deta hai.

Command:

airmon-ng start wlan0

This creates:
wlan0mon = monitoring interface

2. Step 2: Scan Available WiFi Networks

Nearby WiFi networks scan karne ke liye:

airodump-ng wlan0mon

This displays:

• BSSID (AP MAC)

 • Channel
• Encryption type (WEP/WPA)
• Connected clients
• Signal strength

Investigator target network choose karta hai.

3. Step 3: Capture Packets from Target Network

Target WiFi aur channel lock karke capture start:

airodump-ng -c <channel> --bssid <AP_MAC> -w capture wlan0mon

This collects handshakes and data packets.

WPA/WPA2 crack karne ke liye 4-way handshake required hota hai.

4. Step 4: Force Handshake (Optional Deauthentication Attack)

Handshake jaldi capture karne ke liye connected device ko temporarily disconnect kiya jata
hai:

aireplay-ng --deauth 10 -a <AP_MAC> <client_MAC>

Jab client reconnect hota hai → handshake capture ho jata hai.

5. Step 5: Crack WiFi Password Using Aircrack-ng

Handshake file crack karne ka command:

aircrack-ng [Link] -w [Link]

Aircrack-ng dictionary attack perform karta hai:

• Handshake ke hash ko dictionary ke passwords se compare karta hai

• Match milte hi password reveal ho jata hai

Example output:

KEY FOUND! [ mywifi@123 ]

15. Explain SQL Injection attack. How can forensic investigators detect and analyze it?

1. What is SQL Injection?

SQL Injection (SQLi) ek attack technique hai jisme attacker malicious SQL queries web
application ke input fields me insert karta hai, taaki backend database ka control mil sake.

Key Idea:

• Attacker input box (login form, search bar, URL parameter) me SQL code daalta hai.
• Application input ko verify nahi karti → SQL command directly database me execute
ho jata hai.

Common Example:

Login form me attacker enter kare:

' OR '1'='1

Query ban jati hai:

SELECT * FROM users WHERE username='' OR '1'='1' AND password='';

This returns all users, allowing attacker to bypass login.

2. Impact of SQL Injection

• Authentication bypass
• Database dump (tables, emails, passwords)
• Data modification or deletion
• Remote command execution (severe cases)
• Website takeover

3. How Forensic Investigators Detect SQL Injection?

(a) Web Server Log Analysis

Investigator server logs me suspicious patterns detect karta hai:

• ' OR 1=1 --
• UNION SELECT
• ' OR 'a'='a'
• DROP TABLE
• /[Link]?id=1 UNION SELECT username,password FROM users

Logs jisme unusual characters (', ", --, %27) mile → SQLi indicator.

(b) Database Logs Evaluation

Database logs me:
 • Sudden large SELECT queries
• Table structure changes
• Unauthorized user creation
• Huge data export operations
Ye sab SQL Injection ke artifacts hote hain.

(c) Application Logs & Error Logs

Error messages jaise:

• SQL syntax error near “UNION”

• Invalid query format
• Database exception

Ye confirm karte hain ki attacker SQL commands inject kar raha tha.

(d) Network Packet Capture

Wireshark/IDS tools me:

• HTTP requests me suspicious payloads

• Encoded SQL keywords (%27, %20UNION)
Detect ho jate hain.

(e) File Integrity Analysis

Attack ke baad attacker web server par backdoor files upload kar sakta hai:

• [Link]
• Adminer scripts
• Modified PHP files

Hash comparison se changes detect kiye ja sakte hain.

4. How Forensic Investigators Analyze SQL Injection?

• Attack timeline reconstruct karna using logs.
• Which user accounts accessed illegally.
• Kaunse tables dump hue (users, payments, emails).
• Attack vector identify karna (URL, form, API).
• Server compromise level determine karna (database only or full system).
• Evidence preservation (logs, DB dump, packet captures).

16. Write short notes on any two tools: HTTrack, Nikto, Netcraft.
1. HTTrack – Short Note
HTTrack ek website copier / offline browser tool hai jo poori website ko download karke
local system par offline view karne deta hai.

Uses in Forensics / Security:

• Suspect websites ka offline mirror create karne ke liye.

• Evidence preservation: agar website delete ho jaye tab bhi copy safe rahti hai.
• Malicious website ka static analysis without going online.
• Phishing site structure, code, and assets examine karne me helpful.

In short:
HTTrack forensic investigators ko websites ka exact offline clone banane deta hai for safe
analysis.

2. Nikto – Short Note

Nikto ek Open-source web server vulnerability scanner hai jo 6000+ known
vulnerabilities detect karta hai.

Key Features:

• Outdated server versions detect karta hai.

• Dangerous files, default scripts, misconfigurations scan karta hai.
• SSL, HTTP methods, and web technologies ko check karta hai.

Forensic Importance:

• Attack vector identify karne me madad (kaun si weakness exploit hui).

• Breached server ki security assessment ke liye.
• Web shells ya malicious scripts detect karne me useful.

In short:
Nikto helps investigators scan web servers for vulnerabilities and misconfigurations.

3. Netcraft – Short Note

Netcraft ek online reconnaissance and threat intelligence service hai.

What It Provides:

• Hosting information, DNS details

• Technologies used by website (OS, server stack)
• Website age, IP history, SSL certificate data
• Phishing detection and cybersecurity alerts

Forensic Usage:
 • Attack source tracing
• Suspicious domains ki background details collect karna
• Website cloning, hosting change history analyze karna

In short:
Netcraft is used for deep website profiling and investigation of malicious or suspicious
domains.

17. Describe how Dmitry and the Wayback Machine help in collecting historical and
passive intelligence on a target.

Digital forensics and penetration testing me passive intelligence gathering ka matlab hai
target ke baare me information collect karna without directly interacting with or attacking
the target.
Dmitry and the Wayback Machine isi purpose ke powerful tools hain.

1. Dmitry (Deepmagic Information Gathering Tool)

Dmitry ek command-line OSINT (Open Source Intelligence) tool hai jo freely available
public information extract karta hai.
Yeh passive reconnaissance ke liye bahut use hota hai.

Information Collected by Dmitry:

• Domain WHOIS information

• IP address lookup
• Netcraft reports
• Subdomains discovery
• Email addresses found on the website
• Port scanning (optional)

How Dmitry Helps in Historical/Passive Intelligence

• Investigator bina target ko alert kiye domain history, owner details, DNS records,
email leaks, aur subdomain structure gather kar sakta hai.
• Yeh initial profiling me assist karta hai:
o Website kaun host karta hai
o Domain kab create hua tha
o Kis location se operate hota hai
o Koi suspicious subdomains exist karte hain kya

Forensic Use:

• Attack source tracing

• Website compromise ke pehle/baad me information comparison
• Blacklisted/malicious emails identify karna
In short:
Dmitry investigator ko comprehensive passive domain intel deta hai without interacting
with the server.

2. Wayback Machine ([Link])

Wayback Machine ek online web archive hai jo websites ke purane snapshots store karta
hai.
Investigators isse kisi website ka historical record, changes, aur deleted content dekh paate
hain.

What Investigators Can See:

• Website ka old layout, pages, and code

• Deleted pages, removed malware, or suspicious content
• Past meta-data, scripts, contact details
• Change history (before and after a breach)

How Wayback Machine Helps

• Agar attacker ne website deface ki thi → old version se compare kar sakte hain.
• Deleted evidence (e.g., malicious download links) retrieve kiye ja sakte hain.
• Website ke evolution se pata chal sakta hai ki kab se vulnerabilities exist thi.
• Phishing investigations me cloned pages identify hoti hain.

Forensic Use:

• Timeline building (kab kya changes hue)

• Deleted webpages as digital evidence
• Domain reputation analysis
• Old exposed directories/files detect karna

In short:
Wayback Machine investigators ko historical website snapshots provide karta hai, jo
deleted content aur past vulnerabilities identify karne me helpful hain.

18. Explain PDF File Analysis techniques in digital forensics.

PDF (Portable Document Format) files often contain hidden data, metadata, scripts,
embedded objects, and modification history, which can be crucial evidence in cybercrime,
fraud, forgery, and malware investigations. Digital forensics me PDF analysis ke liye
multiple techniques use ki jati hain.

1. Metadata Analysis
PDF metadata me file ke baare me background information hoti hai, jise forensic
investigators extract karte hain:

Metadata includes:

• Author name
• Creation & modification time
• Software used to create/edit
• Document version
• Keywords, titles, producer info

Tools:

• pdfinfo
• ExifTool
• PDFid

Use: Document ka timeline, authenticity, aur alterations check karne me helpful.

2. Embedded Object & Content Analysis

PDF me images, videos, JavaScript, forms, and hidden files embed ho sakte hain.

Investigators:

• Malicious scripts locate karte hain

• Hidden attachments extract karte hain
• Malware payload detect karte hain (PDF-based exploits)

Tools:

• pdf-parser
• peepdf
• PDF Examiner
3. JavaScript & Action Script Examination
Many malicious PDFs JavaScript use karte hain system exploit karne ke liye.

Investigation includes:

• Suspicious JavaScript code identify karna

• Auto-run functions (OpenAction) inspect karna
• Obfuscated code de-analyze karna

Common Indicators:

• Shellcode
• Exploit-triggering scripts
• Redirecting URLs

4. Structure & Object Tree Analysis

PDF ka internal structure (Catalog → Pages → Objects) analyze kiya jata hai.

Investigators check:

• Suspicious objects
• Unexpected streams
• Rebuilt or modified xref tables
• Corrupted / intentionally malformed objects
• Hidden or duplicate objects used for evasion

Tools:

• pdf-parser
• PDFtk
• Didier Stevens tools

5. Hashing & Integrity Verification

PDF file ke MD5/SHA256 hash generate karke investigators check karte hain:

• File tampered hai ya original

• Chain-of-custody maintain karna
• Comparison with known malicious files

Tools: sha256sum, Hashdeep

6. Text Extraction & Keyword Search
Investigators PDF ke readable content ko analyze karte hain:

• Fraud keywords
• Threatening language
• Financial or contract manipulation
• Hidden text layers (OCR required)

Tools:

• strings
• PDFMiner
• OCR tools (Tesseract)

7. PDF Malware Detection

Malicious PDFs often exploit vulnerabilities like:

• CVE-2010-0188, CVE-2008-2992 (Adobe Reader exploits)

Forensic checks:

• Suspicious embedded files (.exe, .dll)

• Shellcode inside streams
• Suspicious encoding or compression

Tools:

• VirusTotal
• Cuckoo Sandbox
• PDFid

19. Explain the role and process of image metadata extraction (using Imago) in a forensic
investigation.

Image files (JPEG, PNG, TIFF, RAW formats) contain metadata, known as EXIF
(Exchangeable Image File Format), which stores hidden information about the image
creation process.
Imago Forensics is a powerful open-source tool that helps investigators automatically
extract, analyze, and organize image metadata for digital forensic cases.
1. Role of Image Metadata in Forensics
Image metadata helps investigators understand:

(a) Device Information

• Camera model
• Serial number
• Lens type
• Firmware version

(b) Time & Location

• Date/time of image creation

• Last modification time
• GPS coordinates (if available) → latitude, longitude

(c) Technical Details

• Resolution
• File size
• Compression
• Color model

(d) Case Evidence

• Prove where & when a photo was taken

• Link a set of images to same device/person
• Detect tampering
• Track criminal movement using GPS data

2. What Is Imago?
Imago is a Python-based digital forensic toolkit used to:

• Extract EXIF metadata

• Detect GPS information
• Analyze image fingerprints
• Generate CSV/JSON reports
• Classify images for investigation

It is specifically designed for bulk image forensics.

3. Process of Metadata Extraction Using Imago

Step 1: Install Imago

pip install imago-forensics

Step 2: Run Imago on a Folder Containing Images

Command:

[Link] -i /path/to/images -o [Link]

What Imago Does Automatically:

• Scans all images

• Extracts EXIF data
• Finds GPS coordinates
• Identifies camera information
• Records timestamps
• Saves everything to a report file

Example Output (Simplified)

File Name Date Taken GPS Camera Model

[Link] 2024-04-22 11:33 19.997N, 73.789E Nikon D3500

4. How Investigators Use Imago Output

(a) Timeline Reconstruction

Check when photos were taken → reconstruct crime sequence.

(b) Geolocation Tracking

GPS metadata → shows location where image was captured.

(c) Device Linking

Same camera serial number → same suspect device.

(d) Tampering Detection

Mismatch between:

• Metadata timestamp vs file system timestamp

• Edited using Photoshop/Apps → “Software” field reveals manipulation.
(e) Bulk Image Processing

Imago’s batch mode helps investigators analyze thousands of images quickly.

20. Discuss common types of email attacks and how investigators analyze them.

Email attacks are widely used for fraud, malware delivery, and social engineering. The most
common types are:

1. Phishing

Fake emails designed to steal passwords, OTPs, bank details.

• Investigation:
o Check email headers (Return-Path, Received lines) to identify spoofed
addresses.
o Analyze links using sandbox or URL scanners.
o Verify sender domain via SPF, DKIM, DMARC.

2. Spear Phishing

Highly targeted phishing sent to a specific person (CEO, employee).

• Investigation:
o Compare writing style (stylometry).
o Match sender details with known contacts.
o Track IP and geolocation from headers.

3. Malware Attachments

Emails containing malicious PDFs, EXEs, DOC macros, ZIP files.

• Investigation:
o Extract and scan attachments with AV engines or sandbox.
o Look for macro code, embedded scripts, exploit payloads.
o Examine network behavior after execution.

4. Business Email Compromise (BEC)

Attacker impersonates CFO/CEO requesting fund transfer.

• Investigation:
o Check login logs for suspicious login (foreign IPs).
o Inspect mail forwarding rules (attackers auto-forward mails).
o Analyze mailbox activity timeline.
5. Spoofing

Email appears from a legitimate address but actually sent through another server.

• Investigation:
o Compare From: vs Return-Path
o Check if domain fails SPF, DKIM, DMARC validation.
o Trace sending IP in email header.

How Investigators Analyze Email Attacks (General Steps)

1. Email Header Analysis – Identify sender’s mail server, IP address, authentication
status.
2. Body & URL Analysis – Extract URLs, check for obfuscation or redirection.
3. Attachment Analysis – Static + dynamic analysis for malware.
4. Log Analysis – Check server logs, login times, IPs, and access history.
5. Evidence Preservation – Export email as .eml / .msg, maintain chain of custody.

21. Illustrate the process of recovering deleted emails using forensic tools.

Recovering deleted emails is a crucial part of email forensics. Deleted emails often remain on
the server or in system storage until overwritten. Forensic tools help extract, reconstruct, and
analyze them.

1. Acquire and Preserve Email Evidence

• Create a forensic image of the system or mail server (PST/OST/MBOX files).
• Use tools like FTK Imager, Magnet Axiom to maintain chain of custody.

2. Scan for Deleted or Hidden Email Artifacts

• Forensic tools search through:
o Unallocated space
o Deleted items folders
o Email cache files (OST, MBOX, EDB)
• Tools: Autopsy, MailXaminer, Forensic Email Collector.

3. Reconstruct Email Databases

• Tools rebuild corrupted or partially deleted mail files.
• Example: Recover deleted emails from Outlook OST/PST using
Kernel OST Recover or Magnet Axiom’s Email Parser.
4. Keyword and Metadata Search
• Investigators search recovered mail using:
o Sender/Receiver
o Subject
o Date & time
o Email content keywords
• Metadata like Message-ID, timestamps, and header paths help verify authenticity.

5. Recover Emails from Server Logs & Backups

• Many mail servers (Gmail, Exchange) keep:
o Message logs
o SMTP transaction logs
o Periodic backups
• Tools like EnCase and X-Ways help extract logs and reconstruct deleted messages.

6. Export & Document Evidence

• Export recovered emails in EML, MSG, or PDF formats.
• Document findings, timestamps, and tool output for legal use.

Summary (easy to remember):

Acquire → Scan → Rebuild → Search → Recover from logs → Export

22. Explain how data is extracted and analyzed from Android and iOS devices.

Mobile forensics focuses on recovering data from Android and iOS devices in a safe, forensic
manner. The process includes acquisition, extraction, and analysis using specialized tools.

1. Identification & Preservation

• Device placed in airplane mode to avoid remote wipe.
• Use Faraday bags to block network signals.
• Document device: IMEI, model, OS version, lock status.
2. Types of Data Extraction

(a) Logical Extraction

• Extracts data through standard OS APIs (contacts, SMS, call logs).
• Used when device is locked or encrypted.
• Tools: Cellebrite UFED, MSAB XRY.

(b) File System Extraction

• Full file system including app data, databases, logs.
• Provides deeper access to WhatsApp, Instagram, browser history, SQLite
databases.

(c) Physical Extraction

• Bit-by-bit copy of entire memory (internal storage + deleted data).
• Allows recovery of deleted photos, messages, artifacts.
• Often used on Android; limited on iOS due to strong encryption.

(d) Chip-off / JTAG Extraction (advanced)

• Used when device is damaged or locked.
• Memory chip removed or accessed at hardware level.

3. Android Device Forensics

• Android uses open file system, making extraction flexible.
• Tools can access:
o /data/data app folders
o WhatsApp/Telegram databases
o GPS data, screenshots, browser history
• Deleted files recovered from unallocated space.

Tools: Cellebrite UFED, Oxygen Forensics, Autopsy (via Android image).

4. iOS Device Forensics

• iOS has strong encryption + secure enclave, making physical extraction harder.
• Common method: Logical and File system extraction using trusted pairing records.
• Tools extract:
o iMessage, FaceTime logs
 o Photos, notes, app data
o Keychain (sometimes)
• Full physical extraction only possible in some versions with jailbreak exploits.

Tools: GreyKey, Cellebrite, Elcomsoft.

5. Analysis of Extracted Data

• Investigators analyze:
o Chat messages (WhatsApp, SMS)
o Call logs
o App data (SQLite databases)
o Geolocation (GPS, WiFi, cell-tower)
o Browser history
o Deleted files and artifacts
• Tools provide timelines, linking user actions to evidence.

Tools: Cellebrite Physical Analyzer, Axiom, Oxygen Detective.

Summary (easy to remember)

Preserve → Choose Extraction Type → Extract (logical/file/physical) → Analyze chats,
logs, GPS → Report

23. Explain the concept of Mobile Forensics and its challenges.

1. Meaning of Mobile Forensics

Mobile Forensics is the scientific process of recovering, extracting, analyzing, and
preserving digital evidence from mobile devices like Android phones, iPhones, tablets,
SIM cards, and memory cards.
Its goal is to find data such as calls, SMS, WhatsApp chats, photos, GPS location, browser
history, app logs, and even deleted data for legal investigations.

2. Key Steps in Mobile Forensics

1. Seizure & Preservation – Device kept in airplane mode / Faraday bag.
2. Acquisition – Logical, file-system, or physical extraction.
3. Analysis – Chats, location, deleted data, app artifacts.
4. Reporting – Document evidence for courts.
3. Challenges in Mobile Forensics

(a) Device Locking & Encryption

• PIN, pattern, biometric locks.
• iOS Secure Enclave and Android full-disk encryption make extraction difficult.

(b) Rapid OS & App Updates

• Android/iOS versions frequently change, breaking forensic tool compatibility.
• Apps like WhatsApp, Signal, Telegram use end-to-end encryption.

(c) Variety of Devices & File Systems

• Thousands of Android models, custom ROMs, chipsets.
• Multiple file systems: YAFFS2, EXT4, APFS (iOS).

(d) Cloud Storage & Syncing

• Data stored remotely (Google Drive, iCloud, WhatsApp Cloud Backups).
• Requires separate legal process to obtain.

(e) Anti-Forensic Techniques

• Secure wipe apps
• Hidden vault apps
• Encrypted containers
• Self-destructing messages (Signal, Telegram)

(f) Physical Damage & Root/Jailbreak Issues

• Water-damaged or broken devices are difficult to extract.
• Rooted/jailbroken devices may have altered evidence integrity.

4. Summary (Easy to Remember)

Mobile Forensics = Extraction + Analysis of mobile data
Challenges = Encryption, Updates, Device Variety, Cloud, Anti-Forensics, Damage
24. Discuss the importance of Expert Witness and Report Writing in Digital Forensic investigations.

Digital forensics findings are only useful if they can be explained clearly in court. That is
why expert witnesses and professional report writing are essential components of any
investigation.

1. Expert Witness – Importance

An Expert Witness is a trained forensic specialist who presents technical evidence in a
simple, legally acceptable manner.

Role & Importance:

(a) Interpretation of Technical Evidence

• Courts and lawyers may not understand digital evidence.

• Expert witness explains how evidence was collected, analyzed, and preserved.

(b) Ensures Credibility and Reliability

• Presents findings without bias.

• Strengthens the validity of the investigation through professional expertise.

(c) Helps in Cross-Examination

• Answers defense questions confidently.

• Justifies tools used, methods followed, and reliability of results.

(d) Maintains Chain of Custody

• Confirms that evidence was preserved without tampering.

• Demonstrates forensic soundness of procedures.

(e) Assists in Legal Decision Making

• Their explanations often influence the court’s verdict.

• Converts complex technical data into meaningful legal proof.

2. Report Writing – Importance

A forensic report is a formal document that presents all findings in a structured,
professional, and legally accepted format.

(a) Comprehensive Documentation

• Contains details of acquisition, tools used, timestamps, logs, analysis, screenshots.

• Serves as a permanent record of the investigation.
(b) Legal Admissibility

• Courts rely heavily on a clear, unbiased, factual report for judgment.

• A poorly written report can weaken the case.

(c) Supports Expert Testimony

• Expert witness refers to the report during testimony.

• Ensures consistency and accuracy.

(d) Ensures Repeatability

• Another expert should be able to repeat the same process using the report.
• Adds transparency and scientific validity.

(e) Helps Understand Evidence Flow

• Step-by-step documentation shows:

o How data was collected
o How it was analyzed
o How conclusions were reached

Summary (Easy to Remember)

Expert Witness = Explains, Justifies, Defends evidence
Report Writing = Documents, Supports, Proves evidence

Together, they ensure digital evidence is clear, credible, admissible, and legally strong.

25. Illustrate the difference between a technical report and a legal report.

Digital forensic investigations generate two types of documentation: Technical Reports and
Legal Reports, each serving a different purpose.

1. Purpose

Technical Report

• Prepared for technical experts or investigators.

• Shows detailed steps, tools, logs, commands, file structures, etc.

Legal Report

• Prepared for court, judges, lawyers, and law enforcement.

• Contains concise, non-technical explanations focusing on conclusions.
2. Level of Detail

Technical Report

• Very detailed, includes:

o Hash values
o Tool output
o Screenshots
o Command-line logs
o File paths and timestamps

Legal Report

• Summary-level detail.
• Avoids jargon and focuses on findings and interpretations, not raw data.

3. Language Used

Technical Report

• Written in technical, forensic terminology.

• Uses precise terms like “MD5 hash,” “image acquisition,” “registry artifact,” etc.

Legal Report

• Written in simple, plain language understandable by non-technical people (judges,

lawyers).

4. Audience

Technical Report

• Digital forensic experts

• Investigators
• Technical analysts

Legal Report

• Court
• Prosecution/Defense
• Jury
• Law enforcement officials
5. Objective

Technical Report

• To document the investigation completely.

• Ensure the procedure is repeatable and verifiable by other experts.

Legal Report

• To present evidence in a legally admissible and clear form.

• Support testimony of the expert witness.

6. Format & Structure

Technical Report

• Structured like a lab report:

o Acquisition details
o Tools used
o Analysis steps
o Raw findings

Legal Report

• Follows legal standards:

o Executive summary
o Evidence description
o Key findings
o Conclusion

Summary (Easy to Remember)

Technical Report = Detailed, Technical, For Experts
Legal Report = Simplified, Clear, For Court

26. Illustrate common tools used in mobile forensics with examples.

Mobile forensics uses specialized tools to extract, analyze, and recover data from Android,
iOS, SIM, and memory cards. Below are the most commonly used tools with examples.
1. Cellebrite UFED
• Most widely used mobile forensic tool.
• Supports logical, file-system, and physical extraction.
• Recovers WhatsApp chats, call logs, SMS, photos, GPS, browser data, and deleted
files.
• Example: Extracting deleted WhatsApp messages from an Android phone.

2. MSAB XRY
• Powerful tool for safe extraction from thousands of devices.
• Supports:
o SIM extraction
o App data recovery
o Chronological timeline creation
• Example: Recovering GPS movement history from an iPhone.

3. Oxygen Forensics Suite (Oxygen Detective)

• Advanced analysis tool for:
o Social media apps (Instagram, Telegram, Facebook)
o Cloud extraction
o Wi-Fi connections
o Device artifacts
• Example: Analyzing Telegram chats, including deleted messages.

4. Magnet Axiom Mobile

• Focuses on deep analysis of extracted data.
• Builds timelines, reconstructs events, analyzes cloud backups.
• Example: Recovering browser history and media files from Android/iOS backups.

5. Autopsy (for Android images)

• Open-source forensic suite.
• Used to analyze Android phone images:
o Photos
o WhatsApp databases
o App artifacts
• Example: Analyzing a .dd image from a rooted Android device.
6. Andriller
• Android-specific toolkit.
• Performs:
o Password/pattern/PIN cracking
o Parsing WhatsApp and Viber databases
• Example: Extracting Android lockscreen pattern from [Link] file.

7. Elcomsoft Mobile Forensic Toolkit

• Specialized iPhone/iCloud forensics.
• Extracts:
o iCloud backups
o Keychain data
o Deleted messages
• Example: Downloading and analyzing an iCloud backup for evidence.

Summary (Easy to Remember):

UFED → Extraction
XRY → Safe Acquisition
Oxygen → App & Cloud Artifacts
Axiom → Deep Analysis
Autopsy → Open-source analysis
Andriller → Android passwords
Elcomsoft → iPhone/iCloud data

27. Demonstrate the use of Volatility for memory analysis.

Volatility is an open-source memory forensics framework used to analyze RAM dumps and
extract evidence such as running processes, network connections, malware, registry data, and
user activities.

Below is the step-by-step demonstration.

1. Acquire the Memory Image

• First, investigator captures RAM using tools like:
FTK Imager, Belkasoft RAM Capturer, DumpIt.
• The output is usually a .raw, .dd, or .mem file.
• This file becomes the input for Volatility.
2. Identify the Memory Profile
Volatility needs OS profile (e.g., Win10x64, Win7SP1x64).

Command:

volatility -f [Link] imageinfo

Outputs: suggested profiles, system time, and OS version.

3. List Running Processes

This identifies active and hidden processes (useful for detecting malware).

volatility -f [Link] --profile=Win7SP1x64 pslist

Findings: PID, process names, parent-child relations.

To detect hidden processes:

volatility -f [Link] --profile=Win7SP1x64 psscan

4. Analyze Network Connections

Shows live network activity captured from RAM.

volatility -f [Link] --profile=Win7SP1x64 netscan

Outputs:

• Open ports
• Remote IPs
• Malware C2 connections (if any)

5. Extract Browser History / Commands

To view command prompt history:

volatility -f [Link] --profile=Win7SP1x64 cmdscan

To view clipboard data:

volatility -f [Link] --profile=Win7SP1x64 clipboard

To extract web history (depending on browser):

volatility iehistory

6. Dump Suspicious Process Memory

Useful for malware analysis:

volatility -f [Link] --profile=Win7SP1x64 memdump -p 1234 -D output/

This dumps the memory of process PID 1234.

7. Extract Files or Registry Hives

Registry extraction:

volatility hivelist
volatility printkey -K "Software\Microsoft\Windows\CurrentVersion\Run"

This reveals startup programs (common malware persistence location).

8. Reporting
The investigator documents:

• Commands used
• Indicators of compromise (IOCs)
• Suspicious processes
• Network connections
• Extracted artifacts

✅ Summary (Easy to Remember for Exams)

Imageinfo → Profile → PSList → NetScan → CMD/History → MemDump → Registry
→ Report
28. Explain Email Forensics and outline the steps involved in investigating email crimes.

1. Meaning of Email Forensics

Email Forensics is the process of identifying, collecting, analyzing, and presenting email-
related evidence in digital investigations.
It helps investigators trace fraud, phishing, harassment, spoofing, malware distribution,
impersonation, and corporate data leakage carried out via emails.

Email forensics focuses on:

• Email headers
• Message body
• Attachments
• Server logs
• Routing paths
• Metadata
• Deleted or hidden emails

2. Steps Involved in Investigating Email Crimes

Step 1: Evidence Collection & Preservation

• Acquire emails from:
o User mailboxes (PST/OST/MBOX)
o Email servers
o Cloud accounts (Gmail, Outlook)
• Preserve data using forensic imaging and maintain chain of custody.
• Prevent alteration or deletion.

Step 2: Email Header Analysis

• Header reveals:
o Sender’s IP address
o Mail server hops
o SPF/DKIM authentication
o Time stamps (Received lines)
• Helps trace the true origin of spoofed or forged emails.
Step 3: Body & Attachment Analysis
• Check for:
o Phishing links
o Malware attachments
o Embedded scripts
o Social engineering indicators
• Tools used: MailXaminer, FTK, Axiom.

Step 4: Server Log and Metadata Analysis

• Email servers keep logs of:
o Sent / received messages
o Login activity
o IP addresses
o Failed login attempts
• Helps identify unauthorized access or compromised accounts.

Step 5: Recovery of Deleted Emails

• Use tools to recover:
o Deleted PST/OST items
o Unallocated memory mail fragments
o Cached emails
• Tools: Autopsy, Kernel PST, Magnet Axiom.

Step 6: Link and Timeline Analysis

• Investigators correlate:
o Sender → Recipient
o Time of sending
o Device used
o Network details
• Helps build a narrative of the crime.

Step 7: Reporting & Presentation

• Prepare a legally admissible report including:
o Header findings
o IP tracing
o Malware results
o Recovery logs
• Expert witness explains email evidence in court.

Summary (Easy to Remember)

Collect → Header → Body/Attachments → Server Logs → Recover Deleted →
Correlate → Report