RMIT Classification: Trusted
Computer and Internet
Forensics. COSC307 9|COSC3080
Dr Jonathan Crellin
© 2017 Pearson Education, Ltd., All rights reserved. CRICOS provider number: 00122A | RTO Code: 3046
1
RMIT Classification: Trusted
About me…
Dr Jonathan Mark Crellin
Senior Lecturer, School of Science Engineering and Technology.
Former Program Manager for MSc Digital Forensic in the University of
Portsmouth UK, with students from many police and military/counter
terrorism units around the world. Worked closely with the Hampshire
Police High Tech Crime unit (UK) and have been an invited guest at a
number of High Tech Crime units, including the HM Customs and
Excise lab, the largest in UK.
3
RMIT Classification: Trusted
Topics to be discussed
• Understanding Computer & Internet Forensics
• The need for Computer & Internet Forensics
• Basic concepts
• Digital Forensics Artifacts
• Course Overview
4
RMIT Classification: Trusted
Forensic Science
• Forensics is the application of science to investigate crimes
and establish facts.
• A forensic scientist is responsible for the important task of
establishing facts related to questions such as:
• what has happened,
• how did it happen,
• who has been involved,
• when did it occur?
• A forensic scientist may have to give evidence in a criminal or
civil court case, to enable a jury or judge (depending on
jurisdiction) to make decisions of guilt or innocence.
5
RMIT Classification: Trusted
Scenario
• The law enforcement agents arrive at
a crime scene that includes digital
devices and media
• Laptops and Computers
• Phones and Smartphones
• Tablets
• USB, CD, DVD, External Hard
Drive, memory cards etc etc
• Cameras, drones, and IoT devices Source: https://
[Link]/articles/types-of-devices-examined-
and other devices. in- digital-forensics-investigations/
• An Investigator collects evidences
from digital devices and media
(physical and internet)
6
RMIT Classification: Trusted
Computer and Internet Forensics
• Computer Forensics
• With the use and spread of digital systems, such as computers and smartphones,
a new branch of forensics was born to investigate computer related crimes
• Later evolved into Digital Forensics (DF) that involves cyber attacks on
personal computing devices, servers, or computer networks.
• Digital Forensics is the application of computer science to:
• Investigate digital evidence of a crime for a legal purpose
• Gather facts about an attacker’s behavior and identify the attacker
• Assessing the level of damage due to the attack
Forensics is the application of science to investigate crimes and
establish facts.
7
RMIT Classification: Trusted
Some examples…
• Investigation of conspiracy to murder and rape a television
presenter
• Involves sceizure of computers and mobile devices used
• Physical evidence, restraints, gags, drugs and weapons
• Chat log data collecte with police officers in the US
• Investigation of a child pornography and abuse ring
• Involved seizure of computers and chat logs, video, digital and analog
• Chat log data collecte with police officers in AUS
• Operation Firewall
• Uncovering digital transactions (over $4m)
• Identifying members of ‘shadowcrew’ leading to 28 convictions
88
RMIT Classification: Trusted
The knock…
99
RMIT Classification: Trusted
The need for Digital Forensics
• Finding evidence of attacker activity in the network or a
computer system and sifting false alarms from actual incidents.
• Robustly removing the attacker, so their foothold from the
network no longer remains.
• Identifying the extent and timeframe of a breach. This helps in
communicating with relevant stakeholders.
• Finding the loopholes that led to the breach. What needs to
be changed to avoid the breach in the future?
• Understanding attacker behavior to pre-emptively block
further intrusion attempts by the attacker.
• Sharing information about the attacker with the community.
10
RMIT Classification: Trusted
Basic Concepts of Digital Forensics
• Artifacts
• Evidence Preservation
• Chain of custody
• Order of volatility
• Timeline creation
11
RMIT Classification: Trusted
Artifacts
• Artifacts are pieces of evidence that point to an activity performed on a
system.
• When performing DF, artifacts are collected to support a hypothesis
or claim about attacker activity.
• Example:
■ If we are to claim that the attacker used Windows registry keys to
maintain persistence on a server, we can use the said registry key to
support our claim.
■ In this case, the mentioned registry key will be considered an artifact.
■ Artifact collection is, therefore, an essential part of the DFIR process.
■ Artifacts can be collected from the Endpoint or Server's file system,
memory, or network activity.
12
RMIT Classification: Trusted
Evidence Preservation
• When performing DF, we must maintain the integrity of the
evidence we are collecting.
• Any forensic analysis could contaminate the evidence.
• This applies to ALL evidence, DNA, Fingerprints, Footprints, CCTV,
Digital artefacts on a computer or mobile device, IoT device (e.g.
drones, cameras etc.), digital storage devices. An investigator must
act to preserve ALL forms of evidence…
• The evidence is first collected and write-protected and for mobile
internet aware devices this includes network isolation.
• A bit copy (sometimes known as a hash dump) of the write-protected
evidence is used for analysis.
13
RMIT Classification: Trusted
Chain of custody
•Another critical aspect of maintaining the physical integrity of evidence
• Ensures that the collected evidence is kept in secure custody.
• A Chain of Custody is maintained for all evidence items, usually via the use
of forensic bags, and retention of evidence in a secure evidence store after it
arrives in the Police Station.
• Any person not related to the investigation must not handle the evidence, or it
will contaminate the chain of custody of the evidence.
• A contaminated chain of custody raises questions about the integrity of the
data and weakens the case being built by adding unknown variables that can't
be solved.
• If the evidence analyst is not an expert of handling hard drive correctly, traces
in it can be contaminated.
ACPO Good Practice Guide for Digital Evidence (2012) Association of
Chief Police Officers, UK
14
RMIT Classification: Trusted
Police Procedures for Digital Evidence
• In the eLibrary of this course shell I’ve provided links to the UK,
US NIJ, and Australian/New Zealand procedure documents for
dealing with digital evidence.
• Its worthwhile have a quick read of them, perhaps the UK one is
the most straight forward and I’ve used it in teaching for many
years.
• It describes the process for seizure, but predates the add on of
collecting volatile data (such as RAM). I notice that TAILS, the live
USB version of TOR was deliberately design by the US Navy to
prevent volatile data collection
15
15
RMIT Classification: Trusted
Evidence Bags…
Evidence with Chain of Custody form
Evidence bags cannot be opened without that being
evident, once sealed.
Authority: This is the LEGAL POWER under which the
evidence was seized. Police Officers cannot enter a
property or take away anything they fancy UNLESS they
have ground to consider it evidence of a crime…
A forensic examiner commits an offence if they
examine a piece of ‘evidence’ that was not legally seized
Each case is usually assigned a CASE NUMBER (eg
151), and each piece of evidence is assigned an
evidence number (eg 1)…
Each time the bag is opened, who opened it, date and
time, is recorded.
16
16
RMIT Classification: Trusted
Order of volatility
Digital evidence is often volatile, i.e., it can be lost forever if not captured in time.
• Some sources are more volatile as compared to others.
• It is vital to understand the order of volatility of the different evidence sources to capture
and preserve accordingly.
•Example:
• Computer system's memory (RAM) keeps data only as long as it remains powered on
(actually there is a slight exception to that).
• Data in a RAM will be lost when the computer is shut down.
• A hard drive or SSD is persistent storage and maintains the data even if power is lost.
• But SSDs can modify data simply by being powered up. A hard drive is less volatile than
RAM and SSDs, and does not change unless it receives commands from the device its
attached to (hence use of Write Blockers)
• We need to preserve the RAM before powering down the computer and preserving the SSD
or hard drive
17
RMIT Classification: Trusted
Timeline Creation
• In order to understand and present evidence of a crime, we need to
understand the sequence in which actions took place
• A timeline of events needs to be created for efficient and accurate
analysis.
• This timeline of events puts all the activities in chronological order.
• Timeline creation:
• helps collate information from various sources to create a story of how
things happened.
• It helps identify which suspects may have been involved in the offence
being investigated.
• Timelines are themselves digital data, and can also be unreliable,
especially on removable storage devices.
18
RMIT Classification: Trusted
Timeline Creation - Example
19
RMIT Classification: Trusted
Key Tasks Involves in Digital Forensics - 1
• Computer Systems Forensics
• Hard Drives: Analysis of files, operating systems, and hidden partitions.
• Logs and System Files: Examination of system logs, event logs, and
application logs.
• File Systems:
• Deleted Files: Recovery and analysis of deleted files and fragments.
• File Metadata: Examination of file properties and timestamps.
• Network Forensics:
• Traffic Analysis: Monitoring and analyzing network traffic to identify suspicious
activities.
• Logs and Sessions: Review of firewall logs, router logs, and VPN sessions.
• Malware: Examination of systems affected by viruses, trojans, and
other malware to understand its function and impact. (NB: Beware of the
Trojan Defense!)
20
RMIT Classification: Trusted
Key Tasks Involves in Digital Forensics - 2
• Digital Storage:
• External Drives: Analysis of USB drives, SD cards, and other external storage
media.
• Cloud Storage: Investigation of data stored on cloud services.
• Mobile Devices:
• Call Logs and Messages: Retrieval of call history, text messages, and
multimedia messages, especially social media.
• Apps and Data: Examination of installed applications and user data
(especially location data, photographs and media recordings, thumbs nail
images of deleted images
• Internet Activity:
• Browsing History: Analysis of web browser histories and cache.
• Email Forensics: Examination of email headers, content, and attachments.
21
RMIT Classification: Trusted
Document Metadata Analysis
File being analyzed
File was created by MS Word
Application Date Created
Tool being used
22
RMIT Classification: Trusted
Image Metadata Analysis
Image File being
analyzed
Tool being used
Device Info
23
RMIT Classification: Trusted
Simple Practical Examples of Digital Forensics
In the practical we will go through a simple scenario and examination
of a digital storage device. This illustrates:
1) Preservation of evidence (latex gloves!)
2) Chain of custody (Forensic bag chain of custody)
3) Use of Forensic Imager (requires a Windows PC, not a lab PC)
4) Using an Disk Image
5) Examination of files undeleted and deleted
6) Identification of connections with a suspect
7) Possible lines of inquiry
8) Possible lines of defense for a defending advocate and strategies
that can be used to counter them.
24
RMIT Classification: Trusted
Learning Strategy for the students
The learning activities included in this course are:
• Lectures (online) (lecture notes + lectures + recording): explain
key concepts.
• Workshop: analyse the subject matters with demonstrations and
examples.
• Assignments: an integrated understanding of the subject matters
comprising of theory and practice.
• Private study: analyse course material, help students to learn
cyber security issues and mitigation strategies.
26
RMIT Classification: Trusted
Assessments
27
RMIT Classification: Trusted
Help and Support, Communication
• CANVAS Discussion Boards
• Please post your queries in the
relevant thread
• Consultation with Teaching team
• I will set up a bookable system
through CANVAS calendar
• Emails
• Please include the COURSE CODE,
and CAMPUS in the subject!!!
28
RMIT Classification: Trusted
End of Lecture 1
29