Cyber Security Chapter 4

I am going to send you 4th chapter of cyber sequrity .you have to explain me each and
everyting in details for my semster notes but make it simple to understand.

Sure Soumalya!
Send me Chapter 4 of Cyber Security, and I’ll explain everything in clean, simple, semester-friendly
notes—with proper headings, bullet points, and easy examples.

I’m ready when you are.

1. Cyber Forensics

Introduction to cyber forensics

Computer equipment and associated storage media

Here you go Soumalya — Chapter 4: Cyber Forensics, explained in simple, exam-friendly language
with clean notes.

1. Cyber Forensics

Introduction to Cyber Forensics

What is Cyber Forensics?

Cyber forensics (also called Computer Forensics) is the process of collecting, analyzing, and
preserving digital evidence from computers or electronic devices.

The goal is to find facts and evidence related to cybercrimes like hacking, data theft, fraud,
harassment, etc.
It helps law enforcement agencies investigate digital crimes following proper legal procedures.

Why Cyber Forensics is Needed?

1. Cybercrimes are increasing

Crimes like online fraud, identity theft, and hacking happen every day.

2. Digital evidence is fragile

It can be deleted or modified easily, so proper forensic methods are needed.

Printed using ChatGPT to PDF, powered by PDFCrowd HTML to PDF API. 1/22
 3. Helps in legal proceedings
Properly collected evidence can be presented in court.
4. Helps organizations track security issues
Companies use forensics to find how an attack happened.

Main Objectives of Cyber Forensics

Identify: find what happened.

Preserve: ensure the evidence is not changed.

Analyze: examine the data to extract useful information.
Present: prepare reports for courts or officials.

Examples of digital evidence

Emails
Chat logs

Images/videos

Browser history

Deleted files
Hard disk data

Mobile phone records

Computer Equipment and Associated Storage Media

Cyber forensics involves analyzing different types of devices and storage media where digital evidence
may exist.

A) Computer Equipment

These are the hardware items usually examined:

1. Desktop Computers

Contains hard drives, RAM, processor, etc.

Forensic experts check:

Installed software

User accounts

Logs
Email data

2. Laptops

Portable, often used for cybercrimes.

Printed using ChatGPT to PDF, powered by PDFCrowd HTML to PDF API. 2/22
 Includes storage, wifi data, browsing history, etc.

3. Servers

Stores large amount of data for organizations.

Important for detecting:

Database attacks

Unauthorized access

Network breaches

4. Mobile Devices (Smartphones, Tablets)

Very common source of evidence.

Stores:

Messages, WhatsApp chats

Location data

Photos, call logs

App data

5. Networking Devices

Routers, switches, firewalls.

Helps trace:

IP addresses

Traffic logs
Attack patterns

B) Associated Storage Media

These are devices where data is stored and can be used as evidence.

1. Hard Disk Drives (HDD)

Main storage in computers.

Stores OS, files, logs, deleted files (recoverable).

2. Solid State Drives (SSD)

Faster storage used in laptops.

Contains user data, system logs.

3. USB Flash Drives / Pen Drives

Printed using ChatGPT to PDF, powered by PDFCrowd HTML to PDF API. 3/22
 Portable and easy to hide.

Often used for data theft or transferring illegal data.

4. Memory Cards (SD, microSD)

Used in phones and cameras.

Contains images, videos, app data.

5. Optical Media

CD, DVD
May contain movies, software, copied data.

6. Cloud Storage

Google Drive, Dropbox, iCloud.

Stores:
Documents

Backups
Chat history

Synced photos

7. External Hard Drives

Used for storing backups or large files.

Often used to hide sensitive data.

Simple Summary
Cyber forensics deals with finding digital evidence from devices like computers, mobiles, or storage
media.
It helps solve cybercrimes by collecting, preserving, analyzing, and presenting evidence properly.

If you want, I can continue with the next topics of Chapter 4.

Role of the forensics investigator

Forensics investigation process

Here you go Soumalya — simple, clear, exam-friendly notes for the next two topics.

Role of the Forensics Investigator

Printed using ChatGPT to PDF, powered by PDFCrowd HTML to PDF API. 4/22
A forensics investigator is the person responsible for finding, collecting, preserving, and analyzing
digital evidence during a cybercrime investigation.

Main Roles & Responsibilities

1. Evidence Collection

Identify all possible sources of digital evidence

(computers, phones, servers, USB drives, emails, logs, etc.)

Collect data without altering or damaging it.

2. Evidence Preservation

Ensure that evidence remains unchanged.

Use write blockers, secure storage, and hashing techniques.

Maintain chain of custody (record of who handled evidence).

3. Evidence Analysis

Examine the data using forensic tools.

Recover deleted files, analyze logs, extract hidden data.

Identify how the attack happened and who did it.

4. Reporting

Write a clear, detailed forensic report.

Include findings, screenshots, steps taken, timeline of events.

5. Presenting Evidence in Court

Act as an expert witness.

Explain technical evidence in simple language to judges/lawyers.

6. Following Legal and Ethical Guidelines

Must follow laws regarding:

Data privacy
Search warrants

Evidence handling
Must ensure investigations are ethical and unbiased.

7. Use of Forensic Tools

Tools like EnCase, Autopsy, FTK, Cellebrite.

Perform imaging, recovery, and analysis.

Printed using ChatGPT to PDF, powered by PDFCrowd HTML to PDF API. 5/22
8. Ensuring No Data Tampering

Investigator must ensure they do not:

Modify timestamps
Alter files

Introduce new data

9. Coordination with Other Teams

Work with:

Police
Lawyers
IT teams

Incident response teams

Forensics Investigation Process

The forensic investigation process is a step-by-step procedure to ensure evidence is collected and
handled properly.

1. Identification
First step is to identify:

What happened?

What devices or systems were affected?

What data may contain evidence?

Example: Detecting a hacked computer or stolen company data.

2. Preservation
Protect and preserve evidence from damage or modification.
Steps include:

Disconnecting system from network

Creating bit-by-bit forensic image

Using write blockers

Documenting chain of custody

3. Collection

Printed using ChatGPT to PDF, powered by PDFCrowd HTML to PDF API. 6/22
 Collecting actual data/evidence from:

Hard disks
RAM

Email servers

Mobile devices
Logs

USB drives

Must follow legal procedures.

4. Examination
Apply forensic techniques/tools to examine evidence.

Works on both visible and hidden data.

Tasks:

Recover deleted files

Check logs
Find malware

Analyze browser history

5. Analysis
Detailed investigation to answer:
Who committed the crime?

What exactly happened?

How did the attacker enter?

What data was stolen or modified?

Build a timeline of events.

6. Documentation
Every step must be recorded:

Date & time

Tools used
Actions taken

Evidence location

Helps maintain transparency.

Printed using ChatGPT to PDF, powered by PDFCrowd HTML to PDF API. 7/22
7. Reporting
Prepare the final forensic report.

Should include:
Summary of findings

Method of investigation

Evidence screenshots
Timeline of attack

Investigator’s conclusion

8. Presentation
Present the report in court.
Must explain technical details in a simple way.

Act as an expert witness if required.

Simple Diagram (Text Form)

nginx

Identification → Preservation → Collection → Examination → Analysis → Documentation → Reporting

→ Presentation

If you want, I can continue with the next topic of Chapter 4.

Collecting network-based evidence

Writing computer forensics reports

Here you go Soumalya — clear, simple, exam-ready notes for the next two topics.

Collecting Network-Based Evidence

Network-based evidence means any data that is generated, transmitted, or stored on computer
networks.
It helps investigators understand how an attack happened, which IP was used, and what data was
accessed.

1. What is Network-Based Evidence?

Printed using ChatGPT to PDF, powered by PDFCrowd HTML to PDF API. 8/22
It includes evidence from:

Routers

Firewalls
Switches

Network traffic logs

Server logs
IDS/IPS (Intrusion Detection/Prevention Systems)

Wi-Fi access point logs

This evidence helps track:

Attack source (IP address)

Time of attack

Type of attack (DDoS, port scan, malware, etc.)

Communication between attacker and victim

2. Types of Network-Based Evidence

a) Logs

Firewall logs
Record allowed/blocked traffic.
Router logs
Track IP addresses and packet flow.
Server logs
Login attempts, file access, errors.

Web server logs

URLs accessed, user agents.

b) Packet Captures

Captured using tools like Wireshark.

Shows:
Source & destination IP

Protocol used

Contents of packets
Helps detect malware communication or data exfiltration.

c) IDS/IPS Alerts

Intrusion Detection Systems trigger alerts when suspicious activity is detected.

Printed using ChatGPT to PDF, powered by PDFCrowd HTML to PDF API. 9/22
 Example: SQL injection, brute force attack.

d) Network Metadata

Connection timestamps

MAC addresses
Session duration

Bandwidth usage

3. Steps to Collect Network Evidence

1. Identify the Sources

Find all devices that store network logs:

Routers, switches, firewalls, proxies, servers.

2. Ensure Evidence Preservation

Use read-only mode wherever possible.

Export logs without modifying timestamps.

Maintain chain of custody.

3. Capture Live Traffic (If Needed)

Tools: Wireshark, tcpdump.

Capture must be done carefully because:

Data moves fast

It may contain sensitive information

4. Retrieve Stored Logs

Export logs from:

Firewall
Web server

Authentication servers

VPN logs

5. Normalize and Analyze

Combine logs from different sources into a timeline.

Look for:

Repeated failed login attempts

Printed using ChatGPT to PDF, powered by PDFCrowd HTML to PDF API. 10/22
 Unusual IPs

Large outgoing data

Connections at odd times

6. Document Everything

Save log files securely.

Note the date, time, tool used, and device name.

4. Tools for Network Forensics

Wireshark

tcpdump

Snort / Suricata (IDS)

Splunk (log analysis)

Nagios / SolarWinds

Writing Computer Forensics Reports

A forensic report is the final output of the investigation.
It must be clear, factual, and understandable for people who are not technical (like lawyers, judges, or
managers).

1. Purpose of a Forensic Report

Summarize findings from the investigation
Present evidence in a simple, logical way

Help legal authorities understand what happened

Provide proof of cybercrimes

2. Characteristics of a Good Forensic Report

Clear and simple language
Objective (no personal opinions)

Accurate and complete

Well-structured
Legally valid

Supported by screenshots and logs

Printed using ChatGPT to PDF, powered by PDFCrowd HTML to PDF API. 11/22
3. Structure of a Computer Forensics Report
1. Title Page

Case name
Investigator’s name
Date of report

2. Executive Summary

Short overview of:

What happened
What was found
Final conclusion

Written in very simple language.

3. Scope of Investigation

What devices were examined

What was the purpose of investigation

4. Evidence Collected

List of all evidence:

Hard disks
Pen drives

Logs
Packet captures

Mobile data
Mention how evidence was preserved.

5. Tools and Techniques Used

Examples:

Autopsy

EnCase
FTK
Wireshark

Hashing tools

6. Detailed Investigation Findings

Printed using ChatGPT to PDF, powered by PDFCrowd HTML to PDF API. 12/22
 Step-by-step explanation of what was found:
Deleted files recovered
Login attempts

Malware detected
Network logs
Timeline of events

Include screenshots, tables, and charts.

7. Conclusion

Final summary of:

Cause of the incident
Who was responsible

How the attack happened

8. Recommendations

How to prevent similar incidents in future:

Strong passwords
Firewalls

Updates
Monitoring

9. Appendices

Screenshots
Log extracts

Hash values
Technical details

4. Tips for Writing a Good Forensic Report

Keep the language simple (avoid jargon).
Always write facts, not assumptions.

Maintain a proper timeline.

Add hash values to prove evidence was not changed.
Keep formatting clean and professional.

If you want Soumalya, I can continue with the next topics of Chapter 4 as well.

Printed using ChatGPT to PDF, powered by PDFCrowd HTML to PDF API. 13/22
 2. Auditing

Planning an audit against a set of audit criteria

Information Security Management System (ISMS) management

Here you go Soumalya — simple, detailed, exam-ready notes for the next topics.

2. Auditing
Auditing in cyber security means examining systems, processes, and policies to ensure they follow
security standards and do not contain weaknesses.

What is Auditing?
Auditing is the systematic evaluation of an organization’s information systems.

It checks:
Are security controls working properly?
Are policies being followed?

Are there any risks or vulnerabilities?

Auditing helps maintain a secure, compliant, and well-managed IT environment.

Planning an Audit Against a Set of Audit Criteria

Audit criteria means rules, standards, or benchmarks that the auditor uses to judge the system.

Examples of audit criteria:

ISO 27001 standard

Company security policies

Legal regulations (IT Act, GDPR)

Network security guidelines

Steps in Planning an Audit

1. Define Audit Objectives

What do we want to check?

Data privacy?
Network security?

Printed using ChatGPT to PDF, powered by PDFCrowd HTML to PDF API. 14/22
 Access control?
Policy compliance?

2. Identify Audit Scope

Which departments?
Which systems?

Which time period?

Example: Only audit the “User access management” for last 12 months.

3. Select Audit Criteria

Criteria can be:

International standards (ISO 27001, NIST)

Company policies
Legal requirements

4. Determine Required Resources

Audit team members

Time required

Tools (scanners, log analyzers, checklists)

5. Collect Background Information

System architecture

Network diagrams
Security policies

Previous audit reports

6. Prepare Audit Plan

The audit plan includes:

What will be audited

Who will audit

When auditing will occur

Method of auditing (interviews, tests, log analysis)

7. Communicate with Stakeholders

Inform the IT team, management, and users.

Schedule meetings and access permissions.

Printed using ChatGPT to PDF, powered by PDFCrowd HTML to PDF API. 15/22
8. Create Audit Checklists

Example checklist:

Are passwords strong?

Are logs maintained?
Are firewalls configured properly?

9. Risk Assessment

Identify high-risk areas to focus on:

Financial data
Network entry points
External-facing servers

10. Final Approval

Management approves the audit plan before execution.

Information Security Management System (ISMS) Management

What is ISMS?
ISMS stands for Information Security Management System.
It is a framework of policies, procedures, and controls that an organization uses to:

Protect information
Manage risks

Ensure confidentiality, integrity, and availability (CIA Triad)

The most common standard for ISMS is ISO/IEC 27001.

Main Components of ISMS

1. Information Security Policies

Guidelines for handling and protecting data.

2. Risk Assessment & Treatment

Identify risks
Analyze impact
Decide how to reduce/avoid them

Printed using ChatGPT to PDF, powered by PDFCrowd HTML to PDF API. 16/22
3. Security Controls

Controls include:

Access control
Cryptography
Physical security

Network security
Incident handling
Backup and recovery

4. Asset Management

List all assets (computers, servers, databases) and assign ownership.

5. Access Control

Ensure only authorized people can access systems.

6. Incident Management

Process for handling:

Breaches
Malware attacks
Insider threats

7. Business Continuity & Disaster Recovery

Plans to keep business running during emergencies.

8. Compliance Management

Follow:

Legal laws
Standards (ISO 27001)
Organizational policies

ISMS Management Process (Using PDCA Cycle)

ISMS follows the PDCA (Plan–Do–Check–Act) model.

1. PLAN

Define security policies

Printed using ChatGPT to PDF, powered by PDFCrowd HTML to PDF API. 17/22
 Identify risks
Choose controls

Set security objectives

2. DO

Implement controls

Provide training
Deploy security technologies

3. CHECK

Monitor systems
Conduct internal audits

Review incidents
Evaluate compliance

4. ACT

Fix weaknesses
Improve controls

Update policies

This cycle continues continuously to improve security.

Benefits of ISMS
Protects data from threats

Reduces risk of cyber attacks

Increases customer trust
Ensures legal and regulatory compliance

Helps in systematic management of security

If you want Soumalya, I can continue with the next topics from Chapter 4.

Introduction to ISO 27001:2013

Here you go Soumalya — simple, clear, exam-ready notes on ISO 27001:2013.

Printed using ChatGPT to PDF, powered by PDFCrowd HTML to PDF API. 18/22
Introduction to ISO 27001:2013
ISO 27001:2013 is an international standard for Information Security Management Systems (ISMS).
It provides a systematic approach for managing sensitive information so that it remains:

Confidential (only authorized people can access it)

Accurate/Integrity (information is not altered)

Available (accessible when needed)

It is published by the International Organization for Standardization (ISO) and the International
Electrotechnical Commission (IEC).

What is the Purpose of ISO 27001?

The purpose is to help organizations:

Identify security risks

Implement proper controls

Protect information assets

Reduce chances of cyber attacks
Maintain legal and regulatory compliance

In simple terms:
👉 ISO 27001 tells companies how to keep their data safe.

Key Features of ISO 27001:2013

1. Risk-Based Approach

Organizations must identify threats.

Assess risks and apply controls to minimize them.

2. Information Security Management System (ISMS)

ISO 27001 provides a complete ISMS framework.

It defines how to manage, monitor, review, and improve security.

3. PDCA Model (Plan–Do–Check–Act)

ISO 27001 follows the continuous improvement cycle:

Plan: Identify risks & set objectives

Do: Implement controls

Check: Review performance

Printed using ChatGPT to PDF, powered by PDFCrowd HTML to PDF API. 19/22
 Act: Improve the system

4. 114 Security Controls

These are listed in Annex A of the standard.

They cover:

Access control
Cryptography
Physical security

Network security
Incident management
Business continuity

5. Documentation Requirements

Organizations must maintain:

Policies
Procedures
Risk assessment reports

Incident logs
Audit findings
Compliance records

Structure of ISO 27001:2013

The standard contains 10 main clauses:

Clauses 0–3: Introduction and Basics

Scope

Normative references
Terms and definitions

Clause 4: Context of the Organization

Understand business environment and stakeholders.

Clause 5: Leadership

Top management commitment to ISMS.

Clause 6: Planning

Printed using ChatGPT to PDF, powered by PDFCrowd HTML to PDF API. 20/22
Risk assessment and risk treatment plans.

Clause 7: Support

Resources, training, documentation.

Clause 8: Operation

Implementing security controls.

Clause 9: Performance Evaluation

Internal audits and monitoring.

Clause 10: Improvement

Corrective actions, improving ISMS continuously.

Annex A Controls
Annex A contains 114 controls grouped into 14 categories, such as:

Information security policies

Human resource security

Cryptography
Physical security

Communications security
Supplier relationships
Incident management

Business continuity

These controls help organizations design strong security.

Benefits of ISO 27001:2013

1. Protects Sensitive Data

Ensures all critical information is secure.

2. Reduces Cybersecurity Risks

Identifies vulnerabilities and fixes them.

3. Builds Customer Trust

Clients prefer companies that follow ISO standards.

Printed using ChatGPT to PDF, powered by PDFCrowd HTML to PDF API. 21/22
4. Legal Compliance

Helps organizations comply with:

IT Act
GDPR

Other regulations

5. Improves Business Continuity

Prepares the company for disasters and cyber attacks.

6. Continuous Improvement

Regular audits and reviews keep the system effective.

Simple Explanation (One Line)

👉 ISO 27001:2013 is a global standard that teaches organizations how to protect their
information through a strong ISMS and risk-based security controls.

If you want, I can explain the clauses of ISO 27001, Annex A controls, or the differences between ISO
27001 and ISO 27002.

Printed using ChatGPT to PDF, powered by PDFCrowd HTML to PDF API. 22/22