251100690018
Forensic Tool Application in Cybercrime Investigation
Objective:
Analyse how digital forensic tools and methodologies are applied during a
cybercrime investigation.
Task:
You are provided with the following scenario:
A company suspects that an employee has exfiltrated confidential data using a
USB drive before resigning. The system is now powered off and handed over
for investigation.
Questions:
1. Investigation Approach
Describe the step-by-step forensic methodology you would follow (from
evidence acquisition to reporting).
Steps:
1. Identification & Preparation
Identify the system and USB device involved
Obtain authorization for investigation
Secure the system and ensure it remains powered off
Prepare and validate forensic tools (write blocker, imaging tools)
Maintain chain of custody documentation from the start
2. Acquire the data
Create a disk image using tools like FTK Imager
Ensure bit-by-bit copy (no modification)
In this process we will build computer investigation toolkit
Before investigation, the organization must prepare a forensic
toolkit we need to check Laptop with forensic software,
Updated OS, Write blockers, Backup devices, basic networking
devices, network cables.
Then collect the data where data can be collected Locally and
Over Network
Data Collection process are Process Documentation, Choose
investigation method, Identify data sources, capture volatile
data first, create bitwise copy and verify data.
There is two types of investigation to collect the data: Offline
investigation and Online investigation.
And Store and Archive
3. Analysis of the data
Examine logs, registry, USB traces
Recover deleted or hidden files
In this process we can analyse network data
In network analysis we can examine network service logs,
examine firewall, proxy and ID’s logs, Check packet sniffer
logs.
Then analyse host data
In host analysis we need to identify what to search, examine OS
data, Check running process.
And analyse storage media
Investigators must identify relevant files where, perform offline
analysis, check for encryption, uncompressing compressed files,
create directory structure diagram, study file metadata, use file
viewers, after analysis investigators must be careful before
making conclusions.
4. Reporting
Document findings clearly
Maintain chain of custody
Gather and organize information
Write the report
Investigators must must collect notes from assess phase, acquire
phase, analyse phase.
Report will contain Purpose of the report, Author Details,
Incident summary, Evidence section, Details section,
Conclusion, Supporting Documents.
2. Tool Selection and Justification
Identify at least three forensic tools (e.g., disk analysis, memory
analysis, USB artefact analysis).
Explain why each tool is appropriate.
Specify what type of evidence each tool helps uncover.
1. FTK Imager
Purpose: Disk Imaging
Step-by-Step Explanation:
Connect the suspect system’s storage device using a write
blocker
Open FTK Imager and select “Create Disk Image”
Choose the source (physical drive or USB)
Select image type (RAW / E01 format)
Start imaging to create a bit-by-bit copy of the disk
Generate hash values (MD5/SHA) to verify integrity
Why it is used:
Ensures the original evidence is not modified
Creates an exact forensic copy for analysis
Evidence obtained:
Deleted files
File system structure
USB-related traces
Disk imaging preserves original evidence integrity
2. Autopsy
Purpose: Disk Analysis
Step-by-Step Explanation:
Load the disk image into Autopsy
Autopsy automatically scans and indexes files
View file system, user folders, and hidden files
Use timeline feature to track user activity
Recover deleted files and analyse metadata
Why it is used:
Provides an easy graphical interface
Helps quickly analyse large amounts of data
Evidence obtained:
File access history
Deleted/recovered files
User activity timeline
3. Volatility
Purpose: Memory Analysis
Step-by-Step Explanation:
Acquire memory dump from system (if available)
Load memory image into Volatility
Run commands like pslist, netscan, etc.
Analyse running processes and network connections
Detect hidden or malicious processes
Why it is used:
Extracts volatile data not stored on disk
Helps detect suspicious activity
Evidence obtained:
Running programs
Hidden processes
Network connections
4. USBDeview / Registry Tools
Purpose: USB Artefact Analysis
Step-by-Step Explanation:
Open USBDeview or registry viewer tool
Check registry paths related to USB devices
Identify connected USB devices
Analyse timestamps (first/last connected time)
Correlate with file access activity
Why it is used:
Tracks history of USB devices used
Helps prove data exfiltration
Evidence obtained:
Device name and serial number
Connection timestamps
Usage history
Windows stores USB activity in registry artefacts
3. Artefact Analysis
List and explain at least four system artefacts you would examine to
prove USB data exfiltration.
In digital forensics, artefacts are system-generated data that record user
activities and device usage. These help prove whether a USB device was
used for data exfiltration
1. Windows Registry
Explanation:
The Windows Registry is a database that stores system and user
activity information
It records details of all USB devices connected to the system
What to check:
USB device serial number, vendor ID, product ID
First time and last time the device was connected
Importance:
Helps identify which USB device was used
Provides strong evidence linking device to system
2. SetupAPI Logs
Explanation:
These logs record installation and connection of hardware devices,
including USB drives
Stored in system log files (e.g., [Link])
What to check:
Date and time of USB connection
Device installation details
Importance:
Confirms when the USB device was connected
Helps build a timeline of events
3. Recent Files / LNK Files
Explanation:
Windows creates shortcut (.lnk) files when a file is opened
These shortcuts store information about file location and access
time
What to check:
Files accessed from USB drive
File paths and timestamps
Importance:
Shows which files were opened or copied from USB
Direct evidence of data access/exfiltration
4. Event Logs
Explanation:
Windows Event Logs record system activities and device events
Includes logs related to USB insertion/removal
What to check:
USB connection/disconnection events
User login/logout activity
Importance:
Helps correlate user activity with USB usage
Provides timeline-based evidence
4. Evidence Integrity
Explain how you will ensure evidential integrity during acquisition and
analysis.
Evidence integrity means ensuring that digital evidence is not altered,
damaged, or tampered during investigation so that it is admissible in
court.
1. Use Write Blocker
Explanation:
A write blocker is a hardware/software tool that provides read-only
access to storage devices
It prevents any accidental or intentional modification of data
Why important:
Ensures the original evidence remains unchanged
Maintains forensic soundness
Write blockers prevent any write operations to the disk
2. Disk Imaging
Explanation:
Disk imaging is the process of creating a bit-by-bit copy of the
original storage device
The copy includes all data, including deleted and hidden files
Why important:
Investigation is performed on the copied image, not the original
Protects original evidence from damage
Disk imaging preserves exact data structure
3. Hash Values (MD5 / SHA)
Explanation:
Hashing generates a unique digital fingerprint of data
Common algorithms: MD5, SHA-1, SHA-256
Why important:
Hash of original and copied data must match
Confirms that no changes occurred during acquisition or analysis
4. Chain of Custody
Explanation:
A documented record of who collected, handled, and analyzed the
evidence
Includes date, time, and actions performed
Why important:
Ensures accountability and transparency
Required for evidence to be legally admissible