23-04-2011, 12:29 PM
[attachment=12697]
CHAPTER-1
INTRODUCTION
1.1 COMPUTER FORENSICS
“Forensic computing is the process of identifying, preserving, analyzing and presenting digital evidence in a manner that is legally acceptable.”(Rodney Mckemmish 1999).
From the above definition we can clearly identify four components:-
IDENTIFYING
This is the process of identifying things such as what evidence is present, where and how it is stored, and which operating system is being used. From this information the investigator can identify the appropriate recovery methodologies, and the tools to be used.
PRESERVING
This is the process of preserving the integrity of digital evidence, ensuring the chain of custody is not broken. The data needs to preserved (copied) on stable media such as CD-ROM, using reproducible methodologies. All steps taken to capture the data must be documented. Any changes to the evidence should be documented, including what the change was and the reason for the change. You may need to prove the integrity of the data in the court of law.
ANALYSING
This is the process of reviewing and examining the data. The advantage of copying this data onto CD-ROMs is the fact it can be viewed without the risk of accidental changes, therefore maintaining the integrity whilst examining the changes
PRESENTING
This is the process of presenting the evidence in a legally acceptable and understandable manner. If the matter is presented in court the jury who may have little or no computer experience, must all be able to understand what is presented and how it relates to the original, otherwise all efforts could be futile.
Far more information is retained on the computer than most people realize. Its also more difficult to completely remove information than is generally thought. For these reasons (and many more), computer forensics can often find evidence or even completely recover, lost or deleted information, even if the information was intentionally deleted.
The goal of computer forensics is to retrieve the data and interpret as much information about it as possible as compared to data recovery where the goal is to retrieve the lost data.
1.2 WHAT IS COMPUTER FORENSICS?
Computer forensics is simply the application of disciplined investigative techniques in the automated environment and the search, discovery, and analysis of potential evidence. It is the method used to investigate and analyze data maintained on or retrieved from electronic data storage media for the purposes of presentation in a court of law, civil or administrative proceeding. Evidence may be sought in a wide range of computer crime or misuse cases. Computer forensics is rapidly becoming a science recognized on a par with other forensic sciences by the legal and law enforcement communities. As this trend continues, it will become even more important to handle and examine computer evidence properly. Not every department or organization has the resources to have trained computer forensic specialists on staff.
1.3 History of Computer Forensics
Michael Anderson
“Father of computer forensics”
special agent with IRS
Meeting in 1988 (Portland, Oregon)
creation of IACIS, the International Association of Computer Investigative Specialists
the first Seized Computer Evidence Recovery Specialists (SCERS) classes held
CHAPTER-2
NEED FOR COMPUTER FORENSICS
2.1 Purpose
The purpose of computer forensics is mainly due to the wide variety of computer crimes that take place. In the present technological advancements it is common for every organization to employ the services of the computer forensics experts. There are various computer crimes that occur on small scale as well as large scale. The loss caused is dependent upon the sensitivity of the computer data or the information for which the crime has been committed.
The computer forensics has become vital in the corporate world. There can be theft of the data from an organization in which case the organization may sustain heavy losses. For this purpose computer forensics are used as they help in tracking the criminal.
The need in the present age can be considered as much severe due to the internet advancements and the dependency on the internet. The people that gain access to the computer systems with out proper authorization should be dealt in. The network security is an important issue related to the computer world. The computer forensics is a threat against the wrong doers and the people with the negative mindsets.
The computer forensics is also efficient where in the data is stored in a single system for the backup. The data theft and the intentional damage of the data in a single system can also be minimized with the computer forensics. There are hardware and software that employ the security measures in order to track the changes and the updating of the data or the information. The user information is provided in the log files that can be effectively used to produce the evidence in case of any crime a legal manner.
The main purpose of the computer forensics is to produce evidence in the court that can lead to the punishment of the actual. The forensic science is actually the process of utilizing the scientific knowledge for the purpose of collection, analysis, and most importantly the presentation of the evidence in the court of law. The word forensic itself means to bring to the court.
The need or the importance of the computer forensics is to ensure the integrity of the computer system. The system with some small measures can avoid the cost of operating and maintaining the security. The subject provides in depth knowledge for the understanding of the legal as well as the technical aspects of computer crime. It is very much useful from a technical stand point, view.
The importance of computer forensics is evident in tracking the cases of the child pornography and email spamming. The computer forensics has been efficiently used to track down the terrorists from the various parts of the world. The terrorists using the internet as the medium of communication can be tracked down and their plans can be known.
There are many tools that can be used in combination with the computer forensics to find out the geographical information and the hide outs of the criminals. The IP address plays an important role to find out the geographical position of the terrorists. The security personnel deploy the effective measures using the computer forensics. The Intrusion Detecting Systems are used for that purpose.
2.2 Why is Computer Forensics Important?
Adding the ability to practice sound computer forensics will help you ensure the overall integrity and survivability of your network infrastructure. You can help your organization if you consider computer forensics as a new basic element in what is known as a “defense-in-depth”1 approach to network and computer security. For instance, understanding the legal and technical aspects of computer forensics will help you capture vital information if your network is compromised and will help you prosecute the case if the intruder is caught.
Two basic types of data are collected in computer forensics.
(a) Persistent data
(b) Volatile data.
2.3 Computer forensics helps the organization in the following way:-
RECOVER DATA THAT YOU THOUGHT WAS LOST FOREVER:-
Computers systems may crash, files may be accidentally deleted, disks may accidentally be reformatted, viruses may corrupt files, file may be accidentally overwritten, disgruntled employees may try to destroy your files. All of this can lead to loss of your critical data, but computer forensic experts should be able to employ the latest tools and techniques to recover your data.
ADVICE YOU ON HOW TO KEEP YOUR DATA AND INFORMATION SAFE FROM THEFT OR ACCIDENTAL LOSS:-
Business today relies on computers. Your sensitive records and trade secrets are vulnerable to intentional attacks from, for e.g. hackers, disgruntled employees, viruses, etc. also unintentional loss of data due to accidental deletion, h/w or s/w crashes are equally threatening. Computer forensic experts can advice you on how to safeguard your data by methods such as encryption and back-up.
EXAMINE A COMPUTER TO FIND OUT WHAT ITS USER HAS BEEN DOING:-
Whether you’re looking for evidence in a criminal prosecution, looking for evidence in a civil suit, or determining exactly what an employee has been up to. Your computer forensics expert should be equipped to find and interpret the clues left behind.
SWEEP YOUR OFFICE FOR LISTNENING DEVICES:-
There are various micro-miniature recording and transmitting devices available in todays hi-tech world. The computer forensic expert should be equipped to conduct thorough electronic countermeasure (ECM) sweeps of your premises.
HI-TECH INVESTIGATION:-
The forensic expert should have the knowledge and the experience to conduct hi-tech investigations involving cellular cloning, cellular subscription fraud, s/w piracy, data or information theft, trade secrets, computer crimes, misuse of computers by employees, or any other technology issue.
CHAPTER-1
INTRODUCTION
1.1 COMPUTER FORENSICS
“Forensic computing is the process of identifying, preserving, analyzing and presenting digital evidence in a manner that is legally acceptable.”(Rodney Mckemmish 1999).
From the above definition we can clearly identify four components:-
IDENTIFYING
This is the process of identifying things such as what evidence is present, where and how it is stored, and which operating system is being used. From this information the investigator can identify the appropriate recovery methodologies, and the tools to be used.
PRESERVING
This is the process of preserving the integrity of digital evidence, ensuring the chain of custody is not broken. The data needs to preserved (copied) on stable media such as CD-ROM, using reproducible methodologies. All steps taken to capture the data must be documented. Any changes to the evidence should be documented, including what the change was and the reason for the change. You may need to prove the integrity of the data in the court of law.
ANALYSING
This is the process of reviewing and examining the data. The advantage of copying this data onto CD-ROMs is the fact it can be viewed without the risk of accidental changes, therefore maintaining the integrity whilst examining the changes
PRESENTING
This is the process of presenting the evidence in a legally acceptable and understandable manner. If the matter is presented in court the jury who may have little or no computer experience, must all be able to understand what is presented and how it relates to the original, otherwise all efforts could be futile.
Far more information is retained on the computer than most people realize. Its also more difficult to completely remove information than is generally thought. For these reasons (and many more), computer forensics can often find evidence or even completely recover, lost or deleted information, even if the information was intentionally deleted.
The goal of computer forensics is to retrieve the data and interpret as much information about it as possible as compared to data recovery where the goal is to retrieve the lost data.
1.2 WHAT IS COMPUTER FORENSICS?
Computer forensics is simply the application of disciplined investigative techniques in the automated environment and the search, discovery, and analysis of potential evidence. It is the method used to investigate and analyze data maintained on or retrieved from electronic data storage media for the purposes of presentation in a court of law, civil or administrative proceeding. Evidence may be sought in a wide range of computer crime or misuse cases. Computer forensics is rapidly becoming a science recognized on a par with other forensic sciences by the legal and law enforcement communities. As this trend continues, it will become even more important to handle and examine computer evidence properly. Not every department or organization has the resources to have trained computer forensic specialists on staff.
1.3 History of Computer Forensics
Michael Anderson
“Father of computer forensics”
special agent with IRS
Meeting in 1988 (Portland, Oregon)
creation of IACIS, the International Association of Computer Investigative Specialists
the first Seized Computer Evidence Recovery Specialists (SCERS) classes held
CHAPTER-2
NEED FOR COMPUTER FORENSICS
2.1 Purpose
The purpose of computer forensics is mainly due to the wide variety of computer crimes that take place. In the present technological advancements it is common for every organization to employ the services of the computer forensics experts. There are various computer crimes that occur on small scale as well as large scale. The loss caused is dependent upon the sensitivity of the computer data or the information for which the crime has been committed.
The computer forensics has become vital in the corporate world. There can be theft of the data from an organization in which case the organization may sustain heavy losses. For this purpose computer forensics are used as they help in tracking the criminal.
The need in the present age can be considered as much severe due to the internet advancements and the dependency on the internet. The people that gain access to the computer systems with out proper authorization should be dealt in. The network security is an important issue related to the computer world. The computer forensics is a threat against the wrong doers and the people with the negative mindsets.
The computer forensics is also efficient where in the data is stored in a single system for the backup. The data theft and the intentional damage of the data in a single system can also be minimized with the computer forensics. There are hardware and software that employ the security measures in order to track the changes and the updating of the data or the information. The user information is provided in the log files that can be effectively used to produce the evidence in case of any crime a legal manner.
The main purpose of the computer forensics is to produce evidence in the court that can lead to the punishment of the actual. The forensic science is actually the process of utilizing the scientific knowledge for the purpose of collection, analysis, and most importantly the presentation of the evidence in the court of law. The word forensic itself means to bring to the court.
The need or the importance of the computer forensics is to ensure the integrity of the computer system. The system with some small measures can avoid the cost of operating and maintaining the security. The subject provides in depth knowledge for the understanding of the legal as well as the technical aspects of computer crime. It is very much useful from a technical stand point, view.
The importance of computer forensics is evident in tracking the cases of the child pornography and email spamming. The computer forensics has been efficiently used to track down the terrorists from the various parts of the world. The terrorists using the internet as the medium of communication can be tracked down and their plans can be known.
There are many tools that can be used in combination with the computer forensics to find out the geographical information and the hide outs of the criminals. The IP address plays an important role to find out the geographical position of the terrorists. The security personnel deploy the effective measures using the computer forensics. The Intrusion Detecting Systems are used for that purpose.
2.2 Why is Computer Forensics Important?
Adding the ability to practice sound computer forensics will help you ensure the overall integrity and survivability of your network infrastructure. You can help your organization if you consider computer forensics as a new basic element in what is known as a “defense-in-depth”1 approach to network and computer security. For instance, understanding the legal and technical aspects of computer forensics will help you capture vital information if your network is compromised and will help you prosecute the case if the intruder is caught.
Two basic types of data are collected in computer forensics.
(a) Persistent data
(b) Volatile data.
2.3 Computer forensics helps the organization in the following way:-
RECOVER DATA THAT YOU THOUGHT WAS LOST FOREVER:-
Computers systems may crash, files may be accidentally deleted, disks may accidentally be reformatted, viruses may corrupt files, file may be accidentally overwritten, disgruntled employees may try to destroy your files. All of this can lead to loss of your critical data, but computer forensic experts should be able to employ the latest tools and techniques to recover your data.
ADVICE YOU ON HOW TO KEEP YOUR DATA AND INFORMATION SAFE FROM THEFT OR ACCIDENTAL LOSS:-
Business today relies on computers. Your sensitive records and trade secrets are vulnerable to intentional attacks from, for e.g. hackers, disgruntled employees, viruses, etc. also unintentional loss of data due to accidental deletion, h/w or s/w crashes are equally threatening. Computer forensic experts can advice you on how to safeguard your data by methods such as encryption and back-up.
EXAMINE A COMPUTER TO FIND OUT WHAT ITS USER HAS BEEN DOING:-
Whether you’re looking for evidence in a criminal prosecution, looking for evidence in a civil suit, or determining exactly what an employee has been up to. Your computer forensics expert should be equipped to find and interpret the clues left behind.
SWEEP YOUR OFFICE FOR LISTNENING DEVICES:-
There are various micro-miniature recording and transmitting devices available in todays hi-tech world. The computer forensic expert should be equipped to conduct thorough electronic countermeasure (ECM) sweeps of your premises.
HI-TECH INVESTIGATION:-
The forensic expert should have the knowledge and the experience to conduct hi-tech investigations involving cellular cloning, cellular subscription fraud, s/w piracy, data or information theft, trade secrets, computer crimes, misuse of computers by employees, or any other technology issue.
