Upload
san-geetha-b-c
View
125
Download
2
Tags:
Embed Size (px)
Citation preview
Computer Forensics
Index
1. Introduction 4
2. History of Computer Forensics 5-6
3. What is Computer Forensics 7-8
4. Goal of Computer Forensics 8
5. Digital Evidence 9-10
6. Advantages & Disadvantages of Computer Forensics 11
7. Applications of Computer Forensics 12
8. Conclusion 13
9. References 14
Figures Index:
Fig 1: Federal bureau of investigation logo 5
Fig 2: DNA Evidence 9
Fig 3: Crime Evidence 10
Fig 4: Equipments used for Digital evidence 10
Introduction
Computer forensics (sometimes known as computer forensic science) is a branch of digital
forensic science pertaining to legal evidence found in computers and digital storage media. It is
a Scientific process of preserving, identifying, extracting, documenting, and interpreting data on
computer. Although it is most often associated with the investigation of a wide variety of
computer crime, computer forensics may also be used in civil proceedings. The discipline
involves similar techniques and principles to data recovery, but with additional guidelines and
practices designed to create a legal audit trail. Evidence from computer forensics investigations
is usually subjected to the same guidelines and practices of other digital evidence. It has been
used in a number of high profile cases and is becoming widely accepted as reliable within US
and European court systems.
Forensics deals primarily with the recovery and analysis of the latent evidence.Latent evidence
can take many forms,from fingerprints left on a window to DNA evidence recovered from blood
stains to the files on a hard drive.It is the discipline that combines elements of law and computer
science to collect and analyze data from computer systems,networks,wireless communications,
and storage devices in a way that is admissible as evidence in a court of law.
It is the science was created to address the specific and articulated needs of law enforcement to
make the most of this new form of electronic evidence .With the average storage capacity in a
personally owned microcomputer approaching 30 gigabytes.
Computer Forensics has become a vital role in providing evidence in cases such as computer
misuse and attacks against computer systems as well as more traditional crimes such as
murder, money laundering,drugs,abuse and fraud.
History of Computer Forensics
The field of computer forensics began in the 1980s, shortly after personal computers became a
viable option for consumers. In 1984, an FBI program was created. Known for a time as the
Magnetic Media Program, it is now known as the Computer Analysis and Response Team
(CART). Shortly thereafter, the man who is credited with being "the father of computer
forensics" began work in this field. His name was Michael Anderson, and he was a special
agent with the criminal investigation division of the IRS. Anderson worked for the government in
this capacity until the mid 1990s, after which he founded New Technologies, Inc., a leading
computer forensics firm.
A meeting held in 1988 in Oregon led to the formation of the IACIS (International Association of
Computer Investigative Specialists). Shortly after that, the first classes were held to train
SCERS (Seized Computer Evidence Recovery Specialists).
Computer Forensic Timeline
1970s-First crimes cases involving computers, mainly financial fraud
1980’s -Financial investigators and courts realize that in some cases all the records and
evidences were only on computers.
1984-FBI Magnetic Media Program created. Later it become Computer Analysis and Response
Team (CART)
FBI(FEDERAL BUREAU INVESTIGATION) LOGO
1987 Acces Data – Cyber Forensic Company formed
1988-Creation of IACIS, the International Association of Computer Investigative Specialists First
Seized Computer Evidence Recovery Specialists (SCERS) classes held.
1993- First International Conference on Computer Evidence held
1995- International Organization on Computer Evidence (IOCE) formed
1997-The G8 countries in Moscow declared that “Law enforcement personnel must be trained
and equipped to address high-tech crimes”.
1998-In March G8 appointed IICE to create international principles, guidelines and procedures
relating to digital evidence
1998- INTERPOL Forensic Science Symposium
1999-FBI CART case load exceeds 2000 cases, examining 17 terabytes of data
2000-First FBI Regional Computer Forensic Laboratory established
2003-FBI CART case load exceeds 6500 cases, examining 782 terabytes of data
What is Computer Forensics
Computer forensics, also called cyberforensics, is the application of computer investigation and
analysis techniques to gather evidence suitable for presentation in a court of law. The goal of
computer forensics is to perform a structured investigation while maintaining a documented
chain of evidence to find out exactly what happened on a computer and who was responsible
for it.
Forensic investigators typically follow a standard set of procedures: After physically isolating the
computer in question to make sure it cannot be accidentally contaminated, investigators make a
digital copy of the hard drive. Once the original hard drive has been copied, it is locked in a safe
or other secure storage facility to maintain its pristine condition. All investigation is done on the
digital copy.Investigators use a variety of techniques and proprietary forensic applications to
examine the hard drive copy, searching hidden folders and unallocated disk space for copies of
deleted, encrypted, or damaged files. Any evidence found on the digital copy is carefully
documented in a "finding report" and verified with the original in preparation for legal
proceedings that involve discovery, depositions, or actual litigation.
Computer forensics has become its own area of scientific expertise, with accompanying
coursework and certification.
In the field of computer forensics, crucial data can be gathered from dozens of sources. These
sources may include computer messaging, e-mails, the Internet, tapes, CDs, disks, or printouts
made by a specific computer. The proper collection and analysis of computer evidence through
accepted computer forensic protocols is a critical component to any internal investigation or
audit. Evidence can be sought in a wide range of computer incidents, including but not limited
to:
Theft of Company Secrets (client, customer or employee lists)
Employee Sabotage or Terrorism
Credit Card Fraud
Financial Crimes
Embezzlement (money or information)
Economic Crimes
Harassment (sexual)
Child Pornography
Major Crimes
Identity Theft (short or long-term plans)
Simply stated, computer forensics can be used to investigate any crime or incident directly or
indirectly related to a computer.
Goal of Computer Forensics
Evidence Collection: Evidence refers to anything that can be collected from the system under
investigation by a computer forensics expert. Prior to performing any kind of analysis of sources
of digital evidence, it is necessary to uncover all hidden or deleted data. ERM can help with the
collection and preservation of evidence while at the same time avoiding unwanted data loss. A
“chain of custody” ensures that the integrity of the evidence is not compromised. The
methodology that our computer forensic experts use ensures that it is not possible to overwrite
the evidence collected.
Analysis: This is the phase where the real investigation takes place. The data identified and
collected previously will be scrutinized utilizing specialized computer forensic tools and
techniques. The focus will be on the creation of a timeline that pieces together the sequence of
events and also on the study of internal attributes and format of data in order to gather any kind
of information that will help in the investigation. The analysis phase is complex and time
consuming but forms the most crucial phase of any investigation.
Reporting: Upon completion of the Analysis phase, all findings will be documented and reported
in a format that can be understood by all. In most cases, since members of the management will
be the recipients of the report, a clear and simple description of the incident, its consequences
and recommendations will be provided.
Digital Evidence
Digital evidence or electronic evidence is any probative information stored or transmitted in
digital form that a party to a court case may use at trial.[1] Before accepting digital evidence a
court will determine if the evidence is relevant, whether it is authentic, if it is hearsay and
whether a copy is acceptable or the original is required.
The use of digital evidence has increased in the past few decades as courts have allowed the
use of e-mails, digital photographs, ATM transaction logs, word processing documents, instant
message histories, files saved from accounting programs, spreadsheets, internet browser
histories, databases, the contents of computer memory, computer backups, computer printouts,
Global Positioning System tracks, logs from a hotel’s electronic door locks, and digital video or
audio files.Many courts in the United States have applied the Federal Rules of Evidence to
digital evidence in a similar way to traditional documents, although some have noted
important[according to whom?] differences. For example, that digital evidence tends to be more
voluminous, more difficult to destroy, easily modified, easily duplicated, potentially more
expressive, and more readily available. As such, some courts have sometimes treated digital
evidence differently for purposes of authentication, hearsay, the best evidence rule, and
privilege. In December 2006, strict new rules were enacted within the Federal Rules of Civil
Procedure requiring the preservation and disclosure of electronically stored evidence. Digital
evidence is often attacked for its authenticity due to the ease with which it can be modified,
although courts are beginning to reject this argument without proof of tampering.
CATEGORIES OF EVIDENCE:
Fig2: DNA Evidence
Fig 3: Crime Evidence
EQUIPMENTS USED FOR DIGITAL EVIDENCE:
Advantages and Disadvantages of Computer Forensics
Advantages:
Ability to search through a massive amount of data
Quickly
Thoroughly
In any language
Disadvantages:
must prove that there is no tampering
all evidence must be fully accounted for
computer forensic specialists must have complete knowledge of legal requirements, evidence handling and storage and documentation procedures
Applications of Computer Forensics
Criminal
Computer forensics is popularly used in criminal cases. Computer forensics analysis may provide evidence that a crime has been committed, whether that crime involved computers directly or not. Evidence may be in the form of a document, an email, an instant message, a chat room or a photograph. This is seen frequently in narcotics cases, stalking, sexual harassment, sexual exploitation, extortion, kidnapping and even murder cases.
Domestic
Computer forensics also frequently plays a role in domestic cases and is generally centered on proof of infidelity. Examples include recovered emails, chat room transcripts, instant messaging and photographs.
Security
The Center for Computer Forensics reports that 92 percent of all business documents and records are stored digitally and that although hackers are commonly seen as a threat to security, in reality greater risks are found within a company. Examples include theft of intellectual property (such as customer lists, new designs, company financials or trade secrets) and embezzlement. The fact is that if a person is alone with a computer for less than five minutes, it is enough time to copy a hard drive on a removable storage device.
Marketing
Computer forensics is also used in marketing. Examples of this can be seen on Amazon.com when recommendations are provided, or "Just for you" from the iTunes Store. When a person visits a website, a memory of that website is placed in the computer's memory. Each site has different meta-tags embedded in it; meta-tags are one or two word descriptions of the site content. The advertisements that person experiences are tailored to the meta-tags of the sites visited, similar to a target demographic.
Conclusion
Hence, by this technology of computer forensics, crime cases can be solved very easily within a very short time span and the accused is easily caught by the sure shot evidences. The reasons behind the crime scene can be easily determined and solved in various situations and scenarios.
In law, if information is not admitted into evidence, then, for legal purposes, it does not exist. Testimony by both the forensic specialist who developed the evidence and someone who can explain it’s significance to the case is often required. Only then does the information become evidence. It should be clear from the above that technical skills and legal expertise must be combined in order to discover, develop and utilize digital evidence. The process used must conform to both the law and science. Failure in either arena, renders the product legally worthless
The preceding has been based on the use of computer forensics to exploit stored digital information. Certainly, this need will grow dramatically in the future, as more and more of society's information are stored electronically. However, a potentially even larger use may be to document activities and processes that take place electronically. In other words, to examine data that is not only at rest, but also that which is in motion. And while the law will slowly evolve and accept more and more technical issues, computer forensic specialists will continue the process of education for all parties in the legal process.
References
Matt Bishop, Introduction to Computer Security, Addison-Wesley, 2005.
Richard Bejtlich, The Tao of Network Security Monitoring, Addison-Wesley, 2005.
N. Brownlee and E. Guttman, , “RFC 2350 - Expectations for Computer Security Incident Response,” http://www.faqs.org/rfcs/rfc2350.html, 1998.
Mariusz Burdach, “Forensic Analysis of a Live Linux System, Part One,” http://www.securityfocus.com/infocus/1769, March 2004.
Mariusz Burdach, “Forensic Analysis of a Live Linux System, Part Two,” http://www.securityfocus.com/infocus/1773, April 2004.