4361601

DIGITAL FORENSIC
U-5

Nandu Fatak
[Link].
“I’ve seen things you people wouldn’t believe. Files
deleted and wiped coming back to life. I watched
hard drive heads… glitter in the dark of cleanrooms.
All those … data will never be lost … in time, we can
get it all back.”

(Blade Runnerish).
• Introduction to DF
• Locard’s Principal of exchange in digital forensics
• Branches of Digital Forensics
• Phases of investigation
• Methods to preserve Digital Evidence
• Evidence role of devices as forensics in
investigation
Digital
Forensic
It is branch of forensic science, it combines law and
Information technology together to examine digital
devices forensically.
 LOCARD’s Principal

Locard's Principal
"It is impossible for a criminal to act, especially considering
the intensity of a crime, without leaving traces of this
presence."
In other words, Locard's believed that no matter where a
criminal goes or what a criminal does, he will leave
something at the scene of the crime. At the same time, he
will also take something back with him. A criminal can
leave all sorts of evidence, including fingerprints,
footprints, hair, skin, blood, bodily fluids, pieces of clothing
and more. By coming into contact with things at a crime
scene, a criminal also takes part of that scene with him,
whether it's dirt, hair or any other type of trace evidence. Examples:
Cyber Bullying,
“Any action of an individual, and Financial Fraud,
obviously, the violent action constituting
any cyber crime
the crime, cannot occur without leaving
a trace” is an example
Branches of

Digital Forensic
Memory Forensic
 Memory Evidences

• Hard Disk
• Pen drive
• CD/DVD/Blu-Ray
• Mouse
• Keyboard
• Wi-Fi Router
• Firewall
• NIC
• BIOS
• Memory Card and many more
Memory forensics is forensic analysis of a computing device' memory dump.

Its primary application is investigation of advanced computer attacks which are

stealthy enough to avoid leaving data on the computing device's memory.

All types of memory must be analysed for forensic information.

Memory forensics can provide unique insights into runtime system activity, including open network
connections and recently executed commands or processes.

In many cases, critical data pertaining to attacks or threats will exist solely in system memory. –
examples include network connections, account credentials, chat messages, encryption keys, running
processes, injected code fragments, and internet history which is non-cacheable.

Any program – malicious or otherwise – must be loaded in memory in order to execute, making memory
forensics critical for identifying otherwise obfuscated attacks. As attack methods become increasingly
sophisticated, memory forensics tools and skills are in high demand for security professionals today.

Many network-based security solutions like firewalls and antivirus tools are unable to detect malware
written directly into a computer’s physical memory or RAM.
Network Forensic
Network forensics is related to the monitoring and analysis of computer network traffic for the
purposes of information gathering, legal evidence, or intrusion detection. Unlike other areas of
digital forensics, network investigations deal with volatile and dynamic information. Network
traffic is transmitted and then lost, so network forensics is often a pro-active investigation.

Network forensics generally has two uses. The first, relating to security, involves monitoring a
network for anomalous traffic and identifying intrusions. An attacker might be able to erase all
log files on a compromised host; network-based evidence might therefore be the only evidence
available for forensic analysis. The second form relates to law enforcement. In this case analysis
of captured network traffic can include tasks such as reassembling transferred files, searching
for keywords and parsing human communication such as emails or chat sessions.
Data Base Forensic
Database forensics is digital forensic science relating to the forensic study of databases
and their related metadata.

It applies normal forensic process and applying investigative techniques to database

contents and metadata. Cached information may also exist in a servers RAM requiring live
analysis techniques.

A forensic examination of a database may relate to the timestamps that apply to the
update time of a row in a relational table being inspected and tested for validity in order
to verify the actions of a database user. Alternatively, a forensic examination may focus
on identifying transactions within a database system or application that indicate evidence
of wrongdoing, such as fraud.

Software tools can be used to manipulate and analyse data. These tools also provide
audit logging capabilities which provide documented proof of what tasks or analysis a
forensic examiner performed on the database.
Software Forensic
 Software forensics is the science of analysing software source code or binary code to
determine whether intellectual property infringement or theft occurred.
Software forensics tools can compare code to determine correlation, a measure that can
be used to guide a software forensics expert.

Past methods of code comparison included hashing, statistical analysis, text matching,
and tokenization. These methods compared software code and produced a single
measure indicating whether copying had occurred.
However, these measures were not accurate enough to be admissible in court because
the results were not accurate, the algorithms could be easily fooled by simple substitutions
in the code, and the methods did not take into account the fact that code could be similar
for reasons other than copying.
Copy right infringement and Trade secret protection and infringement, patent infringement
falls in this category.
 Window Forensic

• Registry Artifacts
• Window event logs
• Desktop
• Windows Recycle Bin Artifacts
• App Data Artifacts
• Hidden File Artifacts
• Sticky notes
• [Link]
 Registry Artifacts

HKEY_USERS HKEYCURRENT_USER HKEYCLASSES_ROOT HKEYCURRENT_CONFIG HKEYLOCAL_MACHINE

Configuration
Hardware profile
All loaded user Currently logged Configuration information of
profiles. of system at
user profile information hardware and
startup
software settings.
 Evidence Path

• Wireless evidence in registry

HKEY_LOCAL_MACHINE\SOFTWARE\MICROSFOT\WINDOWS\CURRENTVERSION\NETWORKLIST\PROFILES

• Recent docs key

HKEY_LOCAL_MACHINE\SOFTWARE\MICROSFOT\WINDOWS\CURRENTVERSION\EXPLORER\RECENTDOCS

• Typed URL keys

• HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TYPED_URLS

• Startup location in registry

• HKEY_LOCAL_MACHINE\SOFTWARE\MICROSFOT\WINDOWS\CURRENTVERSION\RUN
 Information found in Registry

• Users and time ,last used the system.

• Most recently used software.
• Any device mounted.
• Whenever system connected to wireless
access point.
• What and which files are accessed.
• List of any searches done
Email Forensic
 Email forensics is the analysis of the content
source of the email message, by identifying the
sender and the receiver, the date and time of
the email, and analysing all the activities
involved.
Malware Forensic
Malware analysis is the study of the unique features, objectives, sources,
and potential effects of harmful software and code, such as spyware,
viruses, malvertising, and ransomware.

It analyses malware code to understand how it varies from other kinds.

Analysis may fetch amount of damage an intrusion caused, Identify who

installed malware and by which channel/port.
Determine the attack's level of sophistication, Pinpoint the exact
vulnerability the malware exploited to access your system.
Static Malware Analysis: Static malware analysis looks for files that may harm system
without actively running the malware code, making it a safe tool for exposing malicious
libraries or packaged files. Static malware analysis can uncover clues regarding the nature
of the malware, such as filenames, hashes, IP addresses, domains, and file header data.
The malware can be observed using a variety of tools, such as network analysers.

Dynamic Malware Analysis: Dynamic malware analysis uses a sandbox, which is a secure,
isolated, virtual environment where you can run suspected dangerous code. Security
professionals can closely monitor the malware in the sandbox without worrying about
infecting the rest of the system or network, allowing them to gather more information about
the malware.

Hybrid Malware Analysis: Hybrid malware analysis combines both static and dynamic
techniques. For example, if malicious code makes changes to a computer’s memory,
dynamic analysis can detect that activity. Then, static analysis can determine exactly what
changes were made.
 Stages of Malware Analysis

Static Properties Analysis: Static properties refer to strings of code embedded inside the
malware file, hashes, header details, and metadata. Static properties analysis provides a quick
and easy way to gather helpful information about malware because the malware does not have to
be executed.

Interactive Behaviour Analysis: Interactive behaviour analysis involves a security analyst

interacting with malware running in a lab, making observations regarding its behaviour. In this
way, we have better understanding of how malware uses different elements of a computer
system, such as its memory.

Fully Automated Analysis: Fully automated analysis scans suspected malware files using
automated tools, focusing on what the malware can do once inside your system. After the
analysis, a report is generated the potential damage.

Manual Code Reversing: Manual code reversing breaks down the code used to build the malware
to learn how it works and what it is capable of doing. This is a time-consuming process that
requires significant skill. However, when used correctly, manual code reversing can reveal
valuable information about the malware.
Mobile Forensic
 Mobile forensics is the process of recovering digital evidence from mobile devices using
accepted methods
.
Unlike traditional digital forensics processes, mobile forensics solely focuses on retrieving
information from mobile devices such as smartphones, androids, and tablets.

Mobile devices contain an abundance of information from text messages and web search history
to location data, so they can be extremely useful for an investigation by law enforcement.
 Example:
Forensic investigators must track activities across multiple devices to get the full
picture of events. For example, a hacker may have used a vulnerable device to gain
access to the network and spread it across other, more sensitive devices.
Investigators must know how all these devices work and interconnect to be able to
accurately assess the course of events.

Importance

Mobile devices carry a significant amount of information that can be necessary to

understand the full picture and scope of a digital attack, which makes mobile
forensics extremely important. In 2021, there were 15 billion operating mobile
devices worldwide. That’s nearly two per person. The amount of data stored across
these devices is astounding. One significant difference between mobile and
traditional computer forensics is that systems are no longer isolated and absolute.
Commonly used devices like phones, cars, cameras, doorbells, and even
refrigerators are interconnected and can operate under one network.
PHASES OF DIGITAL FORESNIC
 Investigating Cybercrime

Identification Collection Preservation Analysis Documentation Presentation

 Collection

Prepare Conduct Collect Transport

 Collection

Prepare Conduct Collect Transport

Plan Crime Scene Secure Collect

investigation Package
Premise Evidence

Identify Label
Prepare Document Transport
Evidence Evidence

Conduct
Photograph
Prepare Equipment Short
Evidence
Interview

Discuss
Strategy
Expert
 Planning Cyber Crime Investigation

• Purpose of Raid
• Related Acts
• Numbers of Suspect
• Strategy of Crime Scene Investigation
• Evidence transportation to Lab
 Prepare Document

• Case Diary
• Seizure Form
• Chain of custody form
 Prepare Equipment

• Camera for videography and

photography
• Evidence Labels and Markers
• Anti-static bag and bubble rapper
• Forensic imaging tool
• Blank storage device
 Secure Premise

• Identify head and worker

• Check premise and identify available
digital devices
• Move people away from power source
and digital devices
 Identify Evidence

• External Storage Media

• Network Devices
• Network Administrator
 Analysis

• Extraction and Reconstruction of data

evidence.
• Usually conducted at FSL
• It is done in controlled environment.
 Collect Evidence

• Collect ,Label and Photograph Evidence

• Computer, mobile ,laptop and server each has
separate produce for collection.
• Unique label and tagging
• Photographs of labels,devices,tagging,serial
no.,manufacturer etc.
 Log Analysis

System logs
• Log analysis is the process of reviewing, • System activity logs
interpreting and understand computer- • Endpoint logs, Application logs
generated records. • Authentication logs, Physical security logs
• Logs are generated by a range of Networking Logs
programmable technologies, including • Email logs, Firewall logs,VPN logs,Netflow
logs
networking devices, operating systems,
Technical Logs
applications, and more. • HTTP proxy logs,DNS, DHCP and FTP logs
• A log consists of a series of messages in • Appflow logs, Web and SQL server logs
time-sequence that describe activities going Cyber Security Monitoring Logs
on within a system. • Malware protection software logs
• Log analysis is the delicate art of reviewing • Network intrusion detection system logs
• Network intrusion prevention system logs
and interpreting these messages to gain
• Data loss protection logs
insight into the inner workings of the system
Standard Operating Procedure for Social Media
Standard Operating Procedure for CCTV
Standard Operating Procedure for Mobile /Tablet
 Presentation

• Case identifier number

• Case investigator and submitter.
• Date of receipt and date of report.
• Descriptive list of items submitted.
• Identify signature of examiner.
• Recovering erased file.
• Results/conclusion
 Methods to Preserve a Digital
Evidence
Five Rules: Admissible, Authentic, Complete, Reliable, Believable.
The five steps recommended(as per FBI) for collecting and preserving
evidence are:
(1) obtaining it legally
(2) describing the evidence in detailed notes
(3) identifying it accurately and positively
(4) packaging it properly for identification, storage, or shipment to the
laboratory
(5) establishing and maintaining the chain of custody.
 Drive Imaging
Before initiating the process of digital evidence analysis, officers or investigators
should image it first. It means to create a bit-for-bit duplicate of an evidence file.
In this way, the original digital evidence file can be retained.

Do not perform analysis on the original evidence file (perform any such analysis
on its duplicate file). Make sure to limit every action performed on the original
digital evidence file, otherwise, the court will not accept it for legal proceedings.
 Chain of custody

In the judiciary, it is essential to prove the integrity of evidence. It should be

appropriately handled by maintaining audit logs detailing.

Therefore, protecting digital evidence is a great challenge.

Chain of Custody helps in proving the authenticity of evidence as it provides

a complete record of who accessed the file, at what time, and the sequence
of activities performed on the evidence by any authenticated user.
 Hash Value
• Digital Forensic tools often calculates hash value of
digital evidence.
• MD5 and SHA is used.
• It calculates any alteration or modification of data.
 Hash Value
• The purpose of a hash value is to verify the authenticity and integrity of the image as
an exact duplicate of the original media. Hash values are critical, especially when
admitting evidence into court, because altering even the smallest bit of data will
generate a completely new hash value.
• The most obvious solution is to encrypt all sensitive data. At the most basic level, this
means password-protecting any data storage. However, passwords can be guessed
or cracked by brute-force algorithms. Safer still is to use an encryption key reserved
for authorized personnel.

• Use 128-bit hash value MD5 functions. This form of encryption breaks data up into
chunks of 512-bit blocks, which can’t be read without the appropriate decryption key.

• In essence, everything. Hard drives, external drives including USB sticks, backup
drives and cloud storage, the department should consider all the different places their
data may be held, and make sure that each one is encrypted.
Evidence role of devices as in Digital
Forensics Investigation
 CCTV
CCTV forensics is the analysis of video footage captured on a specific CCTV system. This is achieved using
specialist software and forensic methodology to ensure the admissibility of the digital evidence.

Whether there are single or multiple cameras attached to the system, digital forensic experts can capture all
relevant footage within a specified timeframe. CCTV analysis can help confirm the identification of individuals,
vehicles, and the time of day, or for evidencing a timeline of events.

The analysis will culminate in a presentation alongside an expert report and statement ready for use in court.
All specific information relating to the investigation is identified, coinciding with times and dates from the CCTV
systems.

The acquired digital evidence can assist both prosecution and defence in establishing a case’s accurate
timeline of events.
• CCTV image enhancement to improve the quality of footage.

• Event analysis using tracking markers to evidence the movement of an individual across a
timeline of events.

• Video authenticity to identify whether CCTV footage has been manipulated or tampered with.
• Digital retrieval and restoration of damaged, overwritten or deleted digital video evidence.

• Facial mapping analysis to measure and map unique features to identify an individual.
 Vehicle

In recent years, Smart Cars have become the trend.

It uses computers, modern sensing, information fusion, communication, artificial intelligence and automatic
control technologies.

The various safety devices and entertainment devices installed in the car are becoming more and more
abundant. It can be said that a large amount of data on the car can be used as the object of digital vehicle
forensics.

Common Car Data Forensics objects include:

• Car speed information

• Accelerator/brake status
• Location change information
• Collision information
• Communication information
• Entertainment information
 Computing Devices

Cybersecurity and computer forensics are two distinct fields in I.T.

Cybersecurity focuses on protecting computing systems and networks from

unauthorized access, theft, and damage.

Computing device’ involves investigating and analysing digital evidence to uncover

the causality of a cyber attack or other computer-related offense.

This includes collecting and maintaining data, analysing it to identify the origin of the
attack, and presenting results in court cases and other litigation.

While both fields are essential for protecting computer systems and data, they have
different goals and require distinct skill sets.
Role of computing devices are huge as Computer forensics is a broad field
that encompasses various types of investigations.

The most common types of use is in Email forensics, Malware forensics,

Memory forensics, Mobile Phone forensics, Database forensics, Disk
forensics everything falls under computing devices as evidence category.
 Head of Information Technology
Government Polytechnic for Girls, Ahmedabad