Computer Forensics
Computer Forensics is the branch of digital investigation that deals with finding, collecting,
analyzing, and presenting digital evidence from computers and electronic devices.
Objectives:
● To detect cybercrime
● To collect digital proof
● To support legal cases
● To identify criminals
● To protect systems
Uses:
1. Cybercrime Investigation
Computer forensics helps in detecting and solving crimes like hacking, online fraud,
identity theft, and cyber attacks by analyzing digital evidence.
2. Corporate Fraud Cases
It is used in companies to find employee misconduct, financial fraud, data manipulation,
and misuse of company systems.
3. Data Theft Cases
Computer forensics helps to trace how confidential data was stolen, copied, or transferred
and identifies the person responsible.
4. Legal Disputes
Digital evidence such as emails, messages, and system logs is used in court cases, divorce
cases, and business disputes to support legal decisions.
Evidence Collection
Evidence collection is the process of gathering digital data safely from devices without
changing it.
Sources of Evidence:
● Hard disk
● Pen drive
● Mobile phone
● Emails
● Network logs
● System files
Rules:
● Do not modify data
● Maintain chain of custody
● Use proper tools
● Document every step
Disk and Memory Forensics
Disk and Memory Forensics are used to collect and analyze data from storage devices and main
memory to find digital evidence.
A) Disk Forensics
Disk forensics deals with data stored on permanent storage devices such as hard disks, SSDs,
pen drives, and memory cards.
It includes:
● 📁 Files and Folders – Checking stored documents, images, videos, etc.
● Deleted Data – Recovering files removed by the user.
● Hidden Files – Finding files that are hidden intentionally.
● 💽 File Systems – Studying how data is organized on the disk.
Purpose:
● To recover lost data
● To find user activities
● To collect permanent evidence
B) Memory (RAM) Forensics
Memory forensics deals with data stored in main memory (RAM) while the system is running.
It includes:
● Running Processes – Programs currently in use
● 🔑 Passwords – Temporary stored credentials
● Network Connections – Active internet sessions
● Malware Data – Information about viruses or spyware
Purpose:
● To analyze live systems
● To detect hidden malware
● To find active attacks
Evidence Collection in Disk and Memory
In computer forensics, evidence collection means gathering digital data from storage devices
(disk) and main memory (RAM) in a safe and legal way without changing the original data
Proper evidence collection is very important so that the data can be used in court.
A) Evidence Collection in Disk Forensics
Disk evidence collection deals with data stored on hard disks, SSDs, pen drives, memory
cards, etc.
Steps in Disk Evidence Collection
1. Identify the Device
Find all storage devices related to the case.
2. Isolate the Device
Disconnect from the network to avoid data changes.
3. Create Disk Image (Copy)
Make an exact copy of the disk using forensic tools (bit-by-bit copy).
4. Use Write Blocker
Prevents any change to the original disk.
5. Verify Data (Hash Value)
Generate hash values (MD5/SHA) to prove data integrity.
6. Store Safely
Keep the original device in sealed and secure storage.
Data Collected from Disk
● Files and folders
● Deleted files
● Hidden data
● Recycle Bin
● System files
● Application data
Importance of Disk Evidence Collection
● ✔ Preserves original data
● ✔ Allows recovery of deleted files
● ✔ Provides permanent evidence
● ✔ Supports legal cases
B) Evidence Collection in Memory (RAM) Forensics
Memory evidence collection deals with data stored in RAM while the system is running
This data is temporary and is lost when the system is shut down.
Steps in Memory Evidence Collection
1. Keep System Running
Do not shut down the computer immediately.
2. Capture Memory Dump
Use forensic tools to copy RAM data.
3. Collect Live Data
Gather information about:
o Running processes
o Network connections
o Open files
o Logged-in users
4. Save Evidence Securely
Store memory data on external devices.
5. Verify with Hash Values
Ensure memory data is not altered.
Data Collected from Memory
● Active programs
● Passwords in RAM
● Encryption keys
● Malware in action
● Network sessions
Importance of Memory Evidence Collection
Helps in live investigation
Finds temporary data
Detects running malware
Reveals active attacks
Precautions During Evidence Collection
● Do not modify original data
● Follow proper procedures
● Maintain chain of custody
● Document every step
● Use certified forensic tools
Registry and Log Files
In computer forensics, Registry and Log Files are important sources of digital evidence. They
store information about system activity, user behavior, and software usage.
A) Registry (Windows Registry)
The Windows Registry is a special database in the Windows operating system that stores
system settings, hardware information, software details, and user preferences
It helps the operating system and applications work properly.
What Does the Registry Contain?
1. Installed Software (Explained in Detail)
The registry keeps records of all programs installed on the computer.
It stores information such as:
o Software name and version
o Installation date
o Installation location (path)
o Publisher name
o License information (sometimes)
Forensic Use:
Investigators use this data to:
o Find which software was installed
o Check for illegal or pirated software
o Detect hacking tools or spyware
o Know when a program was installed or removed
This helps in understanding what tools were used on the system
2. User Accounts
The registry stores details of all users on the computer, such as:
o Usernames
o Login history
o User profiles
o Last login time
Forensic Use:
Helps identify who used the system and when.
3. System Configuration
This includes system settings like:
o Hardware information
o Display settings
o Network settings
o Security policies
Forensic Use:
Helps understand how the system was configured during an incident.
4. Startup Programs
The registry stores programs that start automatically when Windows boots.
It includes:
o Antivirus software
o System tools
o Malicious programs (if present)
Forensic Use:
Helps detect malware that runs automatically
Use of Windows Registry
Tracks user activities
Finds installed and deleted programs
Identifies suspicious software
Supports criminal investigation
B) Log Files
Log files are files that record events and activities happening in the computer system.
They act like a diary of system operations
Types of Log Files
1. Login Logs
These record:
o Login and logout times
o Successful and failed attempts
o Usernames
Use:
Helps find unauthorized access
2. Error Logs
These record:
o System crashes
o Hardware failures
o Software problems
Use:
Helps analyze system failures
3. Network Logs
These record:
o Internet usage
o IP addresses
o Data transfers
o Connection times
Use:
Helps trace online activities and attacks
4. Application Logs
These record:
o Software usage
o Program errors
o User actions inside applications
Use:
Helps track software-related activities
Use of Log Files
Shows who did what and when
Helps reconstruct events
Detects security breaches
Provides proof in court
Evidence Collection Windows Registry and Log files
The Windows Registry gives detailed information about system settings and user behavior,
while log files provide a time-based record of system events. Both are essential for effective
computer forensic investigations.
Evidence collection from Windows Registry and log files involves acquiring volatile and
non-volatile data to reconstruct user activity, system configuration, and attacker actions.
Key artifacts include [Link] (user activity), system hives (SYSTEM, SOFTWARE), and
Event Logs, typically extracted using tools like RegEdit, FTK Imager, or PowerShell
commands to identify executed programs, mounted devices, and network connections.
Windows Registry Evidence Collection
The registry serves as a database of configuration, user, and hardware information.
● Location of Hives: System hives are in C:\Windows\system32\config, and user hives
([Link], [Link]) are in C:\Users\<user>\.
● Key Evidence Locations:
o Execution Evidence: RunMRU (commands), UserAssist, and ShimCache.
o Folder Access: Shellbags in [Link] track folder navigation.
o USB/Device History: Mounted devices are found
in HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR.
o Network Activity: Wireless networks are located in SOFTWARE\Microsoft\Windows
NT\CurrentVersion\NetworkList\Profiles.
● Collection Methods: Using {Link: [Link] [Link]
registry-analysis-techniques} to export hives, PowerShell (Get-Item), or forensic
tools like {Link: EnCase
[Link] or {Link:
Registry Explorer [Link]
Log File Evidence Collection
Windows Event Logs are critical for analyzing malicious attacks or unauthorized
behavior.
● Types of Logs: System, Application, and Security logs (EVTX format) located
in C:\Windows\System32\winevt\Logs\.
● Key Event IDs:
o 4624/4625: Successful/failed logins.
o 4688: Process creation (if enabled).
o 4697/7045: Service installation (common for persistence).
● Collection Tools: Event Viewer, PowerShell (Get-WinEvent), or forensic tools
like Cyber Triage, Ftk Imager.
Key Considerations
● Volatile Data: Registry data can be lost on reboot; live acquisition is crucial.
● Alternative Sources: System Restore points provide historical snapshots of the
registry.
● Analysis: Tools like ShellBags Explorer and AmcacheParser are used to interpret raw
data.
Evidence Acquisition.
Evidence Acquisition. The collection of digital evidence from a source (e.g., device, network) in
a manner that ensures its admissibility and integrity, is a foundational step in forensic
investigations.
Evidence acquisition in digital forensics is the critical first phase of capturing, preserving, and duplicating
data from devices or networks to ensure its integrity and admissibility in legal proceedings. It involves
creating a bit-by-bit, forensic image of storage media using specialized tools (e.g., FTK Imager,
EnCase) and verifying the copy using hashing algorithms like SHA1 to prove no alteration
occurred.
Purpose of Evidence Acquisition
To preserve original data
To prevent data loss
To maintain data integrity
To ensure legal validity
To support investigation
Methods of Evidence Acquisition
Disk Imaging
● Creates an exact copy of the hard disk
● Also called bit-by-bit copy
● Most common method
Memory Dump
● Copies data from RAM
● Used in live investigation
Logical Acquisition
● Copies selected files and folders
● Faster but not complete
Physical Acquisition
● Copies the entire device
● Includes deleted and hidden data
Steps in Evidence Acquisition
1. Identify Evidence Source
Find computer, mobile, storage device, etc.
2. Secure the Device
Disconnect from internet and power (if needed).
3. Use Write Blocker
Prevents modification of original data.
4. Create Forensic Copy
Make exact image of disk or memory.
5. Generate Hash Value
Verify data integrity (MD5/SHA).
6. Document Process
Record date, time, tools used, and person.
7. Store Safely
Keep original evidence in secure place.
Precautions During Acquisition
● Do not work on original data
● Always use forensic tools
● Maintain proper documentation
● Avoid unauthorized access
● Follow legal procedures
Types of Evidence Acquisition
Static (Dead) Acquisition
● Done when the system is switched off
● Hard disk is removed and copied
● Safer method
● No change in data
Used for: Disk analysis
Live Acquisition
● Done when the system is running
● Used to collect RAM and live data
● Includes running processes and network connections
Used for: Memory forensics
Difference Between Live and Dead Acquisition
Comparison: Live vs Dead Acquisition
Live
Charact
Acquisi Dead Acquisition
eristic
tion
System Power
Powered off
state ed on
Volatil
e
Type of (RAM,
data process Persistent (disk, files, logs)
collected es,
connec
tions)
High
(requir
Risk of
es
alteratio Low (with proper tools)
active
n
interve
ntion)
Admiss
ible if
Legal
well More robust for legal proceedings
value
docum
ented
Required
expertis High Medium
e
Active
inciden
ts,
Typical
malwar Post-mortem analysis, seized evidence
use
e in
memor
y
Challenges in Computer forensics
Computer forensics faces significant challenges due to the exponential growth of data,
widespread encryption, and, complex cloud/IoT environments. Key hurdles include
maintaining data integrity, overcoming anti-forensic techniques, navigating complex
international jurisdictions, and keeping pace with rapidly evolving technology.
Key Challenges in Computer Forensics:
● Massive Data Volume ("Big Data"): The sheer amount of data to analyze makes
it difficult to find relevant evidence quickly, requiring advanced, time-consuming
analysis techniques.
● Encryption and Security: Widespread, sophisticated encryption locks
investigators out of devices and files, demanding specialized tools for access.
● Cloud and IoT Complexity: Data is scattered across multiple, often virtual,
locations and jurisdictions, making, acquisition, and legal access complex.
● Anti-Forensics Techniques: Deliberate attempts to hide, delete, or scramble data
(e.g., wiping, steganography) complicate recovery.
● Jurisdictional Issues: Digital crimes often span international borders, creating
legal hurdles regarding which laws apply and how to legally acquire data.
● Data Volatility: The short lifespan of data in RAM and live systems means
evidence can be lost if not captured immediately.
● Skill Shortage and Training: The need for constant, up-to-date training to combat
new technologies and AI-driven threats exceeds the number of qualified analysts.
● Admissibility in Court: Ensuring evidence meets strict legal standards for
authenticity, maintaining a, chain of custody, is crucial to avoid dismissal.
● Limited Standardization: A lack of universally accepted, standardized, methods
can result in legal challenges regarding the reliability of forensic techniques.
Technological Impact:
The rapid evolution of devices, apps, and operating systems often makes forensic tools
obsolete, forcing analysts to rely on, manual, or experimental, techniques,
Key used in Computer Forensics
Computer forensics relies on a variety of specialized tools to collect, analyze, and preserve
digital evidence from devices like computers, smartphones, and networks.
Key Tools in Computer Forensics
1
Magnet AXIOM: A comprehensive digital forensics solution that excels in collecting an
d analyzing evidence from computers, smartphones, and cloud services. It features power
ful filtering capabilities and is regularly updated to remain compatible with the latest devi
ces and applications.
2
EnCase: Known as a gold standard in digital forensics, EnCase is widely used for eviden
ce acquisition, analysis, and reporting. It supports disk imaging and file recovery, ensurin
g that evidence integrity is maintained throughout investigations.
3 Autopsy: An open-
source digital forensics platform that provides a graphical interface for investigators. It offers
extensive analysis capabilities, including file filtering, timeline analysis, and recovery of
deleted files. Autopsy is popular in educational settings due to its zero price tag.
4
FTK Imager: This tool is used to create forensic images of hard drives and other storage
devices. It preserves evidence in its original condition and allows investigators to view fil
es and folders before imaging.
5
COFEE: A tool designed to gather digital evidence from a suspect's computer by generat
ing a forensic image. It allows investigators to access files and emails without modifying
the original system.
6
DFF (Digital Forensics Framework): This tool allows users to connect to devices and u
tilize various plugins to collect and analyze digital evidence from file systems and networ
k sources.
DumpZilla: A tool that extracts data from web browsers, retrieving browsing history, co
okies, and passwords, which can be crucial in investigations.
MAGNET RAM Capture: This tool captures live memory data from a computer, allowi
ng investigators to analyze running processes and recover data not stored on the hard driv
e.