Introduction to Computer Forensics: Concepts,

Importance, Categories, and Methodology

Learning Outcomes

After this session, students will be able to:

1.​ Explain what computer forensics is and its role in cybersecurity.​

2.​ Identify the importance of computer forensics in legal, corporate, and

investigative contexts.​

3.​ Categorize different types of computer forensics and their respective

applications.​

4.​ Apply a methodical forensic investigation process in theory and practice.​

5.​ Understand challenges and best practices for collecting and preserving
digital evidence.​

1 Introduction to Computer Forensics

🔹 Definition
Computer Forensics is the scientific and methodical practice of identifying,
collecting, preserving, analyzing, and presenting digital evidence from computers,
storage media, and digital devices to uncover facts about cyber incidents and
criminal activity.

Key Point: The evidence collected must be forensically sound — admissible in a

court of law.
🔹 Characteristics of Computer Forensics:
●​ Scientific: Follows repeatable methods and analysis procedures.​
 ●​ Systematic: Evidence collection and analysis follow defined processes.​

●​ Legally Compliant: Maintains chain of custody and admissibility standards.​

●​ Investigative: Helps determine the “who, what, when, where, and how” of an
incident.​

🔹 Example Scenarios:
●​ Investigating data breaches in a corporate network.​

●​ Tracing cyber attacks from IP logs.​

●​ Recovering deleted emails or financial records.​

●​ Analyzing employee misconduct or insider threats.​

2️ Importance of Computer Forensics

Digital crimes are increasingly common; thus, computer forensics is critical for
both investigation and prevention.
🔹 Key Areas of Importance:
Area Significance

Legal Proceedings Ensures collected digital evidence is admissible in

court.

Cybercrime Helps identify attackers, methods, and impacted

Investigation systems.
 Data Recovery Enables retrieval of deleted, hidden, or corrupted files.

Corporate Security Investigates insider threats, policy violations, and fraud.

Incident Response Enhances understanding of attacks to improve security

protocols.

🔹 Illustrative Example:
An employee exfiltrates sensitive company data.

●​ Computer forensics identifies files copied, USB usage, and timestamps.​

●​ Network forensics may reveal data upload activity.​

●​ Evidence supports legal action against the employee.​

3️ Categories of Computer Forensics

Computer forensics can be divided into specialized categories, depending on the

source and nature of evidence.

🔹 1. Disk / File System Forensics

●​ Examines hard drives, SSDs, USB drives, CDs, and other storage media.​

●​ Focuses on recovering deleted files, analyzing file metadata, hidden files,

and partitions.​

●​ Tools: FTK Imager, Autopsy, EnCase​

Example: Recovering deleted project files to investigate IP theft.

🔹 2. Network Forensics
●​ Captures and analyzes network traffic, logs, and communications.​

●​ Detects intrusions, malware spread, and unauthorized data transfer.​

●​ Tools: Wireshark, tcpdump, Zeek, Snort​

Example: Identifying a malicious outbound connection transferring sensitive data.

🔹 3. Memory (RAM) Forensics

●​ Focuses on volatile data in system memory.​

●​ Reveals running processes, open network connections, encryption keys, and

passwords.​

●​ Tools: Volatility, Rekall​

Example: Extracting an encryption key from a live RAM dump.

🔹 4. Email Forensics
●​ Analyzes email messages and headers.​

●​ Detects phishing, fraud, spoofing, and unauthorized communication.​

●​ Tools: MailXaminer, Forensic Toolkit​

Example: Tracing an email to identify a spam or phishing source.

🔹 5. Mobile Device Forensics
●​ Investigates smartphones, tablets, and IoT devices.​

●​ Includes SMS, call logs, app data, GPS, deleted messages, and social media.​

●​ Tools: Cellebrite, MOBILedit, Oxygen Forensics​

Example: Recovering deleted messages that reveal insider collusion.

🔹 6. Cloud Forensics
●​ Deals with data stored on cloud platforms like AWS, Google Drive, or
Dropbox.​

●​ Challenges: Multi-tenancy, distributed architecture, and jurisdictional issues.​

●​ Tools: Magnet AXIOM, EnCase Cloud​

Example: Investigating a leaked confidential document from a cloud account.

🔹 7. Malware Forensics
●​ Focuses on analyzing malicious software.​

●​ Techniques: Reverse engineering, behavioral analysis, and sandbox

execution.​

●​ Tools: IDA Pro, Ghidra, Cuckoo Sandbox​

Example: Understanding a ransomware’s encryption mechanism to mitigate
attacks.

🔹 Summary Table: Forensics Categories

Category Evidence Source Purpose Example Tool

Disk Hard drives, USBs Recover deleted or hidden files FTK Imager, Autopsy

Network Network traffic Detect intrusions Wireshark, Zeek

Memory RAM Capture volatile data Volatility, Rekall

Email Emails Investigate spoofing MailXaminer

Mobile Smartphones Recover calls/SMS Cellebrite

Cloud Cloud storage Access distributed data Magnet AXIOM

Malware Executables Reverse engineer malware IDA Pro, Ghidra

4️ Methodology of Computer Forensics

A structured methodology ensures investigations are systematic, repeatable, and

legally defensible.
🔹 Step 1: Identification
●​ Determine devices, files, or network sources that may hold evidence.​

●​ Identify live systems vs. offline systems.​

Example: Identifying the target PC and email accounts in a fraud investigation.

🔹 Step 2: Preservation
●​ Protect evidence integrity.​

●​ Use write-blockers, encryption, and hash verification (MD5/SHA256).​

●​ Maintain chain of custody logs.​

Example: Creating a bit-by-bit forensic image of a hard drive.

🔹 Step 3: Collection / Acquisition

●​ Acquire data using verified tools.​

●​ Avoid modifying original evidence.​

●​ Verify integrity via hash comparison.​

Commands / Tools:

# Create forensic disk image using dd (Linux)

dd if=/dev/sda of=/mnt/forensics/[Link] bs=4M

md5sum /mnt/forensics/[Link]

🔹 Step 4: Examination & Analysis

●​ Analyze collected evidence to extract relevant data.​

●​ Examine logs, files, emails, metadata, and network captures.​

●​ Apply specialized forensic tools per evidence type.​

Example: Using Autopsy to view deleted files and file metadata.

🔹 Step 5: Documentation
●​ Maintain detailed notes of every step.​

●​ Record:​

○​ Who collected evidence​

○​ Time and date​

○​ Tools and versions used​

○​ Analysis steps and results​

🔹 Step 6: Reporting & Presentation
●​ Prepare clear and concise forensic report.​

●​ Include:​

○​ Investigation scope and methods​

○​ Timeline of events​

○​ Findings and conclusions​

●​ Must be legally defensible for court proceedings.​

🔹 Forensic Investigation Flow (Visual Representation)

Incident → Identification → Preservation → Collection → Analysis →
Documentation → Reporting

5️⃣ Challenges in Computer Forensics

1.​ Encrypted or password-protected data.​

2.​ Cloud and distributed environments.​

3.​ Volatile data (RAM, live network sessions).​

4.​ Anti-forensic techniques (data wiping, steganography).​

5.​ Maintaining the legal chain of custody.​

6.​ Large data volumes requiring efficient processing.​

6️⃣ Recommended Tools

Tool Function

FTK Imager Disk imaging and acquisition

Autopsy / Sleuth File system and metadata analysis

Kit

Volatility / Rekall Memory forensics

Wireshark / Network packet analysis

tcpdump

EnCase Professional forensic suite

Cellebrite Mobile forensics

Magnet AXIOM Cloud and disk forensic analysis

7️⃣ Practical Examples / Case Studies

1.​ Recover deleted financial records from a hard drive.​

2.​ Investigate a suspicious login using Linux /var/log/[Link].​

3.​ Analyze captured network traffic to detect data exfiltration.​

 4.​ Examine mobile devices for deleted messages in an insider fraud case.​

5.​ Reverse-engineer a malware sample to understand its behavior.​

8️⃣ Summary

●​ Computer Forensics is critical for cybercrime investigation, legal support,

and corporate security.​

●​ Categories include disk, network, memory, email, mobile, cloud, and

malware forensics.​

●​ Methodology ensures evidence integrity, admissibility, and thorough

analysis.​

●​ Challenges include encryption, anti-forensics, cloud data, and large volumes.​

9️⃣ Suggested Readings

1.​ Nelson, Phillips & Steuart — Guide to Computer Forensics and

Investigations​

2.​ Maras, Marie-Helen — Computer Forensics: Cybercriminals, Laws, and

Evidence​

3.​ Carrier, Brian — File System Forensic Analysis​

4.​ NIST SP 800-86 — Guide to Integrating Forensic Techniques into Incident

Response
 System Forensics
🧱 1. Introduction to Digital Forensics
🔹 Definition:
Digital Forensics is the process of identifying, preserving, analyzing, and
presenting digital evidence that can be used in a court of law.

🔹 Objectives:
●​ Recover, analyze, and preserve computer data.​

●​ Identify who, what, when, where, and how an incident occurred.​

●​ Maintain integrity and chain of custody.​

🔹 Phases of Forensic Investigation:

Phase Description
Identification Recognize and locate potential sources of
evidence.
Preservation Secure and isolate data to prevent alteration.
Collection Acquire a forensic copy using imaging
tools.
Analysis Examine data for relevant evidence.
Documentation & Present findings clearly and accurately.
Reporting
🪟 2. Windows Forensics
🔹 Key Evidence Sources:
1.​ Registry Hives:​

○​ [Link], SAM, SYSTEM, SOFTWARE, SECURITY​

○​ Contain user activity, system configuration, connected USB devices,

etc.​

2.​ Event Logs (.evtx):​

○​ Stored in C:\Windows\System32\winevt\Logs​

○​ Categories: Security, System, Application​

○​ Crucial for login attempts, service starts, and system changes.​

3.​ Prefetch Files:​

○​ Located in C:\Windows\Prefetch​

○​ Reveal application execution history.​

4.​ Browser Artifacts:​

○​ Cache, cookies, history, and downloads for evidence of online activity.​

5.​ Memory (RAM) Dumps:​

○​ Captures volatile data: open network connections, running processes,

passwords in memory.​
🔹 Common Tools and Uses:
Tool Purpose
FTK Imager Create forensic image without altering
source data.
Autopsy / Sleuth Kit Analyze disk images and recover deleted
files.
RegRipper Extract information from Windows
Registry hives.
Volatility / Rekall Perform memory forensics.
Event Viewer / Log Analyze system and security logs.
Parser

🔹 Example Practical Activity:

Objective: Identify last USB device connected.​
Procedure:

1.​ Extract SYSTEM and SOFTWARE registry hives.​

Run RegRipper plugin:​

​
[Link] -r SYSTEM -p usbdevices

2. Interpret output showing device name, serial number, and timestamp.​

Learning Outcome: Students learn to trace hardware evidence via registry

artifacts.
​

EXTENDED NOTES:

Windows Forensics

1. Overview
Computer forensics is the discipline of identifying, preserving, analyzing, and
presenting digital evidence in a manner that is legally acceptable. Windows
forensics focuses on artifacts, logs, file systems, and system behaviors found on
Microsoft Windows operating systems. These notes summarize objectives, tools,
exercises, procedures, artifacts, and best practices for a hands-on Windows forensic
lab.

2. Objective
The lab's main objective is to practice locating and extracting forensic evidence
from a Windows system. Specific learning goals include:

●​ Performing network enumeration and understanding active connections.​

●​ Viewing system information and running processes (including memory

artifacts).​

●​ Reading and interpreting Windows event logs.​

●​ Examining raw disk sectors and filesystem structures.​

●​ Creating forensic disk images and verifying integrity via hashes.​

●​ Recovering deleted files and analyzing browser cookies and history.​

 ●​ Searching for and extracting picture/video artifacts (including scanning for
hidden or renamed files).​

3. Scenario (Summary)
Steve, a computer forensics examiner, is called to investigate a laptop belonging to
a 26-year-old suspect. He conducts systematic analysis of Windows registries,
event logs, processes, and file systems using forensic tools. During the
investigation, Steve locates images and videos that constitute criminal evidence
and confirms the laptop's primary user through corroborating artifacts.

4. Forensic Methodology (High-level Process)

1.​ Identification — Recognize potential sources of evidence (drives, memory,
network logs).​

2.​ Preservation — Isolate and preserve original evidence (write blockers, disk
images).​

3.​ Collection — Acquire data (forensic imaging, memory dumps, log exports).​

4.​ Examination — Use tools to inspect images, logs, and artifacts (carve files,
parse registries).​

5.​ Analysis — Correlate artifacts to reconstruct events and user activity.​

6.​ Reporting — Produce a clear, reproducible report with timelines, hashes,

and supporting artifacts.​

Chain of custody must be maintained and documented for every evidence item.

5. Lab Setup & Environment

 ●​ Virtual Private Cloud (VPC): Preconfigured images (e.g., Windows Server
2008 or provided VM snapshots).​

●​ Tools available on network share: OSForensics, Process Explorer, Event

Log Explorer, Helix, FTK Imager, EnCase, image carving tools, password
crackers, steganography tools.​

●​ Data provided: Hard disk clones, investigation files, victim machine images
and vulnerable websites (for training).​

6. Key Tools & Purpose

●​ OSForensics — Search, index, carve files, locate hidden forensic material,
timeline creation.​

●​ Process Explorer (Sysinternals) — Inspect loaded processes, DLLs,

handles, and process relationships.​

●​ Event Log Explorer — Read, filter, and analyze Windows Event Logs in a
forensic-friendly interface.​

●​ Helix — Live response toolkit (acquire memory, network info) and bootable
incident response environment.​

●​ FTK / EnCase — Full-featured forensic suites for imaging, indexing, deep

analysis, and report generation.​

●​ FTK Imager — Forensic imaging and basic file carving; create E01/RAW
images and calculate hashes.​

●​ Other utilities — netstat, tasklist, regedit/registry parsers, MFT

viewers, thumbcache viewers.​
7. Exercises (Step-by-step Tasks — condensed)
Exercise A — Discover & Extract Hidden Material (OSForensics)

1.​ Mount or open target disk image (read-only).​

2.​ Run index/search for file names, extensions, and content strings.​

3.​ Use file carving to recover deleted or fragmented files.​

4.​ Search for hidden slack space data or alternate data streams (ADS).​

5.​ Export findings and preserve hashes.​

Exercise B — Extract Info on Loaded Processes (Process Explorer)

1.​ Run on a forensic duplicate or live response image.​

2.​ List running processes; inspect parent/child relationships.​

3.​ Examine open handles, network connections, and loaded modules (DLLs).​

4.​ Save process and module lists for evidence.​

Exercise C — Event Log Viewing & Analysis (Event Log Explorer)

1.​ Load Security, System, Application, and Application and Services logs.​

2.​ Filter by time window, Event IDs, or specific users.​

3.​ Identify suspicious events (logins, privilege escalations, system errors,

installation events).​

4.​ Correlate event timestamps with file timestamps and network activity.​

Exercise D — Forensic Investigation (Helix)

 1.​ Use Helix for live acquisition (memory dump, running processes, network
stats).​

2.​ Acquire volatile data carefully (note that acquisition changes system state —
document thoroughly).​

3.​ Create forensic images of physical disks and verify via hashing.​

8. Windows Artifacts to Check (Common Locations)

●​ Registry hives: [Link], SOFTWARE, SYSTEM, SAM, SECURITY —
user activity, installed software, autostart entries.​

●​ Event logs: Windows Event Log files (*.evtx) in

C:\Windows\System32\winevt\Logs.​

●​ User profiles: C:\Users\<username>\ — Documents, Desktop,

Downloads, AppData (Local, Roaming).​

●​ Prefetch: C:\Windows\Prefetch — program execution history (useful

for timeline).​

●​ $MFT (NTFS Master File Table) — file metadata and deleted file records.​

●​ Recycle Bin: C:\$[Link]\ — recover deleted user files and

metadata.​

●​ Thumbcache — cached thumbnails of images.​

●​ Browser artifacts: History, Cookies, Cache (Edge, Chrome, Firefox paths

under AppData).​

●​ Shellbags — evidence of folders and folder access.​

●​ LNK files — shortcut files that reveal execution paths and timestamps.​
9. Imaging & Integrity
●​ Always work on copies (forensic images), never on original media.​

●​ Use write-blockers for physical drives when possible.​

●​ Create bit-for-bit images (E01 or RAW) using FTK Imager, dd, or EnCase.​

●​ Compute and record hashes (MD5, SHA1, and/or SHA256) for originals and
images; verify after transfer.​

10. Recovering Deleted Files & File Carving

●​ Use carving tools and OSForensics to search for file headers/footers.​

●​ Check slack space and unallocated clusters for remnants.​

●​ Recover images/videos; verify file signatures and metadata.​

11. Timeline Correlation & Analysis

●​ Build a timeline combining: file system timestamps (Created, Modified,
Accessed), event logs, browser history, and process execution times.​

●​ Correlate user logins, downloaded files, and application executions to

establish sequence of events.​

12. Reporting & Deliverables

 ●​ Forensic image(s) with hash values.​

●​ List of artifacts recovered (file paths, hashes, brief descriptions).​

●​ Timeline of relevant events with supporting evidence references.​

●​ Investigator notes: tools used, commands, acquisition sequence,

chain-of-custody log.​

●​ Formal investigation report suitable for legal proceedings.​

13. Legal, Ethical & Privacy Considerations

●​ Obtain proper legal authority (warrants, consent) before imaging or
searching devices.​

●​ Minimize exposure of unrelated personal data; document scope.​

●​ Preserve chain of custody and document every action taken on evidence.​

14. Best Practices & Examiner Checklist

●​ Use a standardized checklist for acquisition and analysis.​

●​ Photograph device and environment before powering on (if physical

seizure).​

●​ Use write-blocker and create verified images.​

●​ Log every tool, version, and command used.​

●​ Maintain a clear, reproducible workflow and store artifacts securely.​

15. Common Pitfalls
●​ Working on original media without imaging.​

●​ Failing to document volatile data before shutdown.​

●​ Not recording hashes or breaking chain of custody.​

●​ Overlooking registry/user artifacts and browser data.​

16. Further Exercises & Extensions

●​ Correlate network traffic captures with host artifacts.​

●​ Use MFT analysis to recover previously deleted filename history.​

●​ Examine steganography and image metadata (EXIF) for hidden data.​

●​ Practice report writing and court testimony simulations.​

Linux Forensics
🔹 Important File Locations:
Evidence Location Description
Type
System Logs /var/log/syslog, /var/log/[Link] User logins, authentication
attempts
Command ~/.bash_history Record of executed shell
History commands
User Accounts /etc/passwd, /etc/shadow System users and encrypted
passwords
Mounted /etc/mtab, /proc/mounts Connected drives and
Devices partitions
Network /var/log/secure, SSH logins, failed access
Activity /var/log/messages

🔹 Linux Forensic Commands:

Command Function
last Lists last logged-in users
who Shows current logged-in
users
ps aux Lists active processes
lsof Displays open files by
process
grep, awk, Filter and search through log
find data

🔹 Tools for Analysis:

Tool Function
Autopsy Disk image analysis
The Sleuth Kit Command-line forensic
(TSK) toolkit
log2timeline / Build timeline of system
Plaso events
Foremost / Scalpel File carving and recovery
Chkrootkit / Detect rootkits or hidden
rkhunter processes

🔹 Example Practical Activity:

Objective: Investigate suspicious login activity.​
Procedure:

grep "Failed password" /var/log/[Link]

last -a | head

Learning Outcome: Students learn to identify failed logins and suspicious access
patterns.

Network Forensics
Network Forensics Overview

🔹 Definition:
Network forensics is the capture, recording, and analysis of network traffic to
uncover security incidents, policy violations, or data leaks.

🔹 Goals:
●​ Detect malicious activity (malware, intrusion, DDoS, data exfiltration).​

●​ Identify source and target of attacks.​

●​ Preserve traffic evidence for legal use.​

Network Forensic Investigation Strategies

🔹 Investigation Workflow:
1.​ Incident Identification: Determine abnormal or unauthorized network
activity.​

2.​ Data Capture: Use tools like tcpdump, Wireshark, or Snort for packet
capture.​

3.​ Preservation: Save .pcap files in a write-protected manner.​

4.​ Analysis: Filter and inspect relevant packets.​

5.​ Correlation: Match traffic patterns with host system evidence.​

6.​ Reporting: Summarize attack pattern, source, and mitigation.

Let’s understand about “PCAP files”

A pcap (packet capture) file is a binary file format that stores captured network
traffic, including packet headers and payload data, and is used by network analysis
tools like Wireshark and tcpdump for troubleshooting, security analysis, and
network forensics. These files contain information such as source and destination
IP addresses, protocols, packet length, and the actual data transmitted over a
network.

What a pcap file contains:

Capture Header: Contains information about the capture process, like the
timestamp and the network interface used.

Packet Headers: Information about each network packet, such as source and
destination IP addresses, protocol type (e.g., TCP, UDP), and packet length.

Packet Payload: The actual data payload of the network packet.

Why pcap files are important:

Network Troubleshooting: They help diagnose and resolve network problems.

Security Analysis: Used to monitor network activity, detect threats, and investigate
security incidents.

Network Forensics: Provide valuable evidence for reconstructing network events,

especially in cases like data breaches or intrusions.

How to work with pcap files:

Capture: Use tools like Wireshark or tcpdump to capture live network traffic and
create the pcap file.

Analyze: Open the pcap file with network analysis software (like Wireshark) to
examine the captured packets.

Interpret: The software will display a structured view of the data, allowing you to
understand network communication and identify issues.

🔹 Common Tools:
Tool Function
Wireshark / TShark Deep packet analysis
NetworkMiner Passive packet analysis and session
reconstruction
Snort / Zeek (Bro) Intrusion detection and logging
tcpdump Command-line packet capture
NetWitness / Security Full-scale network forensic suites
Onion

🔹 Example Case Study:

A system shows unusual outbound connections every 5 minutes.

●​ Task: Capture packets using tcpdump and analyze in Wireshark.​

●​ Objective: Identify malicious beaconing or data exfiltration.​

📈 6. Statistical Flow Analysis (25 min)

🔹 Concept:
Instead of analyzing every packet, flow analysis examines aggregated metadata
(source/destination IP, port, protocol, byte count).

Sources:

●​ NetFlow, sFlow, IPFIX, or router flow exports.

🔹 Uses:
●​ Detect anomalies (spikes in traffic).​

●​ Identify top talkers or unusual ports.​

 ●​ Recognize DDoS or data leakage events.​

🔹 Tools:
Tool Function
ntopng Real-time network traffic
analysis
SiLK (CERT NetSA) Flow data collection and
querying
ELK Stack (ElasticSearch, Logstash, Flow visualization and
Kibana) dashboarding

🔹 Example Practical:
Objective: Identify abnormal traffic flows using SiLK.

rwfilter --sport=22 --protocol=6 --pass=ssh_traffic.rw

rwstats --fields=dip --top --count=5 ssh_traffic.rw

Outcome: Detects top 5 IPs targeted over SSH, potentially indicating brute-force
attempts.

📡 7. Packet Analysis
🔹 Concept:
Packet analysis involves inspecting captured traffic at the frame and protocol
level to reconstruct sessions or detect payload-based attacks.
🔹 Analysis Steps:
1.​ Capture traffic (using tcpdump -i eth0 -w [Link])​

2.​ Open .pcap in Wireshark.​

3.​ Apply filters (e.g., http, [Link]==443, [Link]==[Link]).​

4.​ Inspect packet headers (Ethernet, IP, TCP/UDP, Application Layer).​

5.​ Reassemble streams to observe content (HTTP requests, file transfers).​

🔹 Example Practical:
Task: Analyze HTTP traffic for potential data theft.

●​ Filter: [Link] == "POST"​

●​ Identify: Suspicious data upload or credential transmission.​

Tools Used:​
Wireshark, TShark, Xplico.

🧾 8. Summary & Takeaways

Aspect Windows Forensics Linux Forensics Network Forensics
Evidence Registry, Event Logs, Log files, Bash Packet Captures, Flow
Sources Prefetch History Logs
Tools RegRipper, Volatility TSK, Autopsy, Wireshark, SiLK,
log2timeline Zeek
Focus User/System Process & Login Traffic Pattern
Artifacts Traces Analysis
Challenges Encryption, Volume Hidden Processes Encrypted Traffic,
Volume
Skills Gained System Analysis Command-line Log Network Attack
Analysis Reconstruction

📘 References:
1.​ Nelson, Phillips & Steuart — Guide to Computer Forensics and
Investigations​

2.​ Davidoff, Sherri — Network Forensics: Tracking Hackers through

Cyberspace​

3.​ SANS Digital Forensics Course Notes​

4.​ Wireshark Documentation ([Link]

5.​ CERT NetSA SiLK Analysis Suite

Advanced Network, Mobile Forensics, and

Case Studies
 1. Forensics of Wireless Networks
Wireless network forensics focuses on monitoring, capturing, and analyzing
wireless communication data to identify unauthorized access, intrusions, or misuse
of network resources.

1.1 Importance

●​ Detects unauthorized access points (rogue APs).​

●​ Tracks malicious activities like spoofing and sniffing.​

●​ Provides digital evidence for legal investigation.​

●​ Helps strengthen wireless network security policies.​

1.2 Wireless Network Evidence Sources

Source Description

Access Point Logs Contains connection attempts, timestamps, and

MAC addresses.

DHCP Logs Records IP-MAC mapping details.

RADIUS Useful for verifying user login attempts.

Authentication Logs

Packet Captures Raw wireless data packets for detailed traffic

(PCAP) analysis.
SSID & Encryption Helps identify weak security configurations.
Information

1.3 Wireless Forensics Tools

Tool Function

Wireshark / Packet capture and protocol analysis.

Tshark

Kismet Network detection, sniffing, and

intrusion detection.

Aircrack-ng Wireless key cracking and traffic

Suite monitoring.

NetStumbler / Identifies available networks and signal

InSSIDer strength.

CommView for Packet analysis for WLAN security

Wi-Fi audits.

1.4 Common Wireless Attacks

●​ Rogue Access Point Attack – Unauthorized AP mimics a legitimate one.​

●​ Deauthentication Attack – Forces disconnection from AP to capture

reauthentication.​

●​ Man-in-the-Middle (MITM) – Intercepts traffic between users and servers.​

 ●​ MAC Spoofing – Falsifies a legitimate device’s MAC address.​

●​ Evil Twin Attack – Clone of a legitimate AP for phishing and data theft.​

1.5 Investigation Steps

1.​ Capture: Use sniffers to collect wireless packets.​

2.​ Preserve: Secure captured data in evidence media.​

3.​ Analyze: Examine MAC, SSID, encryption, and anomalies.​

4.​ Correlate: Match logs from AP, DHCP, and RADIUS servers.​

5.​ Report: Summarize findings with timestamped evidence.​

2. Network Intrusion Detection Analysis

Network intrusion detection forensics involves monitoring network traffic for
suspicious activity, and collecting data to identify security breaches.

2.1 Purpose

●​ To detect and prevent unauthorized access.​

●​ To monitor malicious network behavior.​

●​ To analyze and reconstruct network-based attacks.​

2.2 Intrusion Detection Techniques

Type Description
Signature-base Matches traffic against known attack
d IDS patterns.

Anomaly-base Detects deviation from normal

d IDS baseline behavior.

Hybrid IDS Combines signature and anomaly

detection.

2.3 Indicators of Intrusion

●​ Excessive port scans.​

●​ Abnormal outbound connections.​

●​ Multiple failed login attempts.​

●​ Unusual data exfiltration patterns.​

●​ Unknown processes generating network traffic.​

2.4 Common IDS/IPS Tools

Tool Function

Snort / Open-source intrusion detection/prevention

Suricata systems.

Zeek (Bro) Deep inspection and behavioral network

analysis.
 Security Complete IDS/NSM platform for forensic
Onion analysis.

Splunk / ELK Log analysis and visualization for event

Stack correlation.

Wireshark Captures and decodes network packets for

investigation.

2.5 Network Forensic Data Sources

●​ Firewall Logs – Track incoming/outgoing packets.​

●​ Router Logs – Contain routing and session data.​

●​ NetFlow/sFlow Data – Summarizes traffic patterns.​

●​ DNS & Proxy Logs – Detects malicious domain communication.​

●​ Endpoint Security Logs – Correlates local device activity.​

3. Event Log Aggregation and Correlation Analysis

Event log forensics aims to aggregate logs from multiple sources and correlate
them to identify the timeline and cause of security incidents.

3.1 Importance

●​ Builds a chronological attack timeline.​

●​ Detects coordinated multi-stage attacks.​

●​ Reduces false positives through cross-verification.​

●​ Provides a unified incident response perspective.​

3.2 Log Sources

Type Example

System Logs Windows Event Viewer, Syslog

in Linux.

Application Web servers, databases, custom

Logs apps.

Security Logs Firewalls, IDS/IPS, antivirus.

Network Switches, routers, access points.

Device Logs

3.3 Log Aggregation Tools

●​ SIEM Platforms: Splunk, IBM QRadar, ArcSight, ELK Stack.​

●​ Syslog Servers: Graylog, Kiwi Syslog Server.​

●​ Centralized Storage: Ensures synchronization using NTP.​

3.4 Correlation Techniques

 Technique Description

Temporal Matches events by time sequence.

Correlation

Causal Identifies cause–effect relationship between

Correlation events.

Pattern Detects similar behaviors or attack signatures.

Matching

Statistical Uses frequency or probability analysis to

Correlation identify anomalies.

3.5 Benefits

●​ Enhanced situational awareness.​

●​ Rapid threat detection and mitigation.​

●​ Improved forensic readiness.​

●​ Efficient incident response and compliance reporting.​

4. Mobile Forensics – Overview

Mobile forensics focuses on recovering digital evidence from mobile devices
such as smartphones, tablets, and smartwatches.

4.1 Key Objectives

 ●​ Extract and analyze mobile data without altering evidence.​

●​ Recover deleted data, logs, and communication history.​

●​ Identify user behavior and location information.​

●​ Maintain forensic soundness and chain of custody.​

4.2 Stages of Mobile Forensics

Stage Description

[Link] Secure and isolate the device to prevent

remote wiping.

2. Acquisition Extract data using logical, physical, or

chip-off methods.

3. Examination Analyze extracted files, databases, and app

data.

4. Analysis Identify relevant evidence like messages,

GPS, images.

5. Reporting Document findings with timelines and

metadata.

4.3 Mobile Evidence Types

 ●​ Call logs, contacts, and messages (SMS/MMS).​

●​ Instant messaging apps (WhatsApp, Telegram, Signal).​

●​ Browser history and cached files.​

●​ Photos, videos, and multimedia.​

●​ GPS and geolocation data.​

●​ Cloud sync and backup files.​

4.4 Mobile Forensics Tools

Tool Function

Cellebrite UFED Data extraction and decoding from all

device types.

Magnet AXIOM Comprehensive analysis of mobile and

cloud data.

Oxygen Forensics Suite Advanced app data and timeline

visualization.

Autopsy (with mobile Open-source investigation platform.

plugins)

XRY (Micro Forensic-grade mobile acquisition tool.

Systemation)
 4.5 Challenges in Mobile Forensics

●​ Device encryption and secure boot mechanisms.​

●​ Continuous OS updates and hardware variations.​

●​ Cloud synchronization complicating local evidence retrieval.​

●​ Privacy and legal issues (GDPR, consent, warrants).​

5. Case Studies

1. Mobile Forensics in Voyeurism Case – Ahmedabad (2025)

Incident:​
A 27-year-old man, Ravi Prajapati, was arrested for allegedly filming a
14-year-old girl while she was changing clothes inside a trial room at a mall in
Ahmedabad. The girl's mother discovered the phone under the partition and handed
it over to her. The device contained four incriminating video clips. Prajapati
initially claimed his phone had accidentally fallen, but forensic analysis revealed
otherwise. The phone was sent for forensic analysis to check for similar videos or
past activity. The Times of India

Forensic Techniques Used:

●​ Mobile Data Extraction: Recovered video files and metadata.​

●​ Timeline Analysis: Established the sequence of events leading to the

incident.​

●​ Device Profiling: Identified previous activities and potential repeat offenses.​

2. ₹100 Crore Cyber Fraud Racket – Moradabad (2025)
Incident:​
A major cyber fraud racket involving over ₹100 crore was uncovered by police in
Moradabad, with five individuals arrested, including a Nigerian national. The scam
involved creating fake profiles on matrimonial and social media platforms,
impersonating foreign doctors and customs officers to dupe victims under the guise
of marriage proposals and gift deliveries from abroad. A complaint by a teacher
who lost ₹94 lakh led to the investigation. The gang used over 100 bank accounts
to launder money, with 37 complaints recorded across 18 Indian states. The Times
of India

Forensic Techniques Used:

●​ Digital Footprint Analysis: Tracked IP addresses and online activities.​

●​ Financial Transaction Monitoring: Analyzed bank records and digital

payment trails.​

●​ Social Media Profiling: Investigated fake profiles and communication

patterns.​

3. Espionage Investigation – YouTuber Jyoti Malhotra (2025)

Incident:​
In an espionage investigation involving YouTuber Jyoti Malhotra, Hisar police
seized five electronic devices, including mobile phones and a laptop, from
Malhotra and Harkirat Singh, IT in-charge of the Haryana Sikh Gurdwara
Management Committee. The devices were sent for cyber forensic analysis.
Authorities revealed Malhotra was in regular contact with a Pakistani official and
had multiple bank accounts with numerous financial transactions, complicating the
investigation. A leaked conversation indicated potential espionage activities during
her visit to the Attari border. The Times of India

Forensic Techniques Used:

●​ Communication Analysis: Examined call logs, messages, and contacts.​

 ●​ Financial Transaction Scrutiny: Investigated bank account activities and
fund transfers.​

●​ Cross-Border Data Correlation: Linked activities to international contacts

and locations.​

6. Learning Outcomes
By the end of this module, students should be able to:

1.​ Apply forensic methods to investigate wireless and wired network incidents.​

2.​ Analyze intrusion patterns using IDS and SIEM tools.​

3.​ Aggregate and correlate event logs for comprehensive analysis.​

4.​ Perform mobile device forensics maintaining evidence integrity.​

5.​ Evaluate real-world forensic cases to understand investigation workflow.​

7. References
●​ Eoghan Casey, Digital Evidence and Computer Crime (Academic Press).​

●​ NIST SP 800-101 Rev. 1 – Guidelines on Mobile Device Forensics.​

●​ Brian Carrier, File System Forensic Analysis.​

●​ Nelson, Phillips & Steuart, Guide to Computer Forensics and Investigations.​

●​ SANS Institute Forensic Resources and Whitepapers.