Digital forensics
- 1. DIGITAL FORENSICS WITH TOOLS PRESENTED BY :- VISHNU.V MASTER OF COMPUTER APPLICATION DEPARTMENT OF COMPUTER APPLICATION 1
- 2. TYPES OF CRIMES TRADITIONAL CRIMES Traditional crimes are crimes which are done in earlier days without the help of electronics or digital components. Example : robbery , pick pocket ,kidnapping, Blackmail, theft etc…. DIGITAL CRIMES Digital crimes are crimes which are done through digital world with the help of Digital gadgets or devices. Example : Hacking , dos attack ,malware, online financial theft etc….. ** NOW A DAYS MOST OF OUR DATA ARE IN THE FORM OF DIGITAL EVIDENCE ** 2
- 3. INTRODUCTION FORENSICS Forensic science is the application of science to criminal and civil laws, mainly on the criminal side during criminal investigation, as governed by the legal standards of admissible evidence and criminal procedure . DIGITAL FORENSICS Digital Forensics is the use of scientifically derived and proven methods toward the preservation, collection, validation, identification, analysis, interpretation, documentation, and presentation of digital evidence derived from digital devices. 3
- 4. GRAPHICAL REPRESENTION OF CYBER CRIMES 4
- 5. MOST COMMON TYPES OF CYBER ATTACKS 5
- 6. HISTORY OF COMPUTER FORENSICS • Michael Anderson • “Father of computer forensics” • special agent with IRS ( law enforcement agency) • Meeting in 1988 (Portland, Oregon) • creation of IACIS, the International Association of Computer Investigative Specialists • • The first Seized Computer Evidence Recovery Specialists (SCERS) classes held. 6
- 7. WORKING PROCESS : METHOD OF HIDING DATA Hard Drive/File System manipulation : • Slack Space • Partition waste space • Hidden drive Space • Bad sectors • Extra Tracks • Change file names and extensions 7
- 8. BRANCHES OF DIGITAL FORENSICS The technical aspect of an investigation is divided into several sub-branches, relating to the type of digital devices involved: • Computer forensics • Firewall Forensics • Database Forensics • Network forensics • Forensic data analysis • Mobile device forensics. The typical forensic process encompasses the seizure, forensic imaging and analysis of digital media and the production of a report into collected evidence. 8
- 9. TYPES OF DIGITAL FORENSICS Digital forensics are classified into two : LIVE DATA FORENSICS Live data forensics is only focused on computer systems that are powered on. The main purpose is to acquire volatile data that would otherwise get lost if the computer system is turned off or would be overwritten if the computer system will stay turned on for a longer period. Then go for the traditional forensics. TRADITIONAL DATA FORENSICS Live data forensics is only focused on computer systems that are powered off. But in case of mobile phone if it is on keep it on, if it is off keep it off. If mobile phone is on change to flight mode because of hash value will change continuously. Then crimes cant be proved. 9
- 10. STEPS IN DIGITAL FORENSICS 10
- 11. IDENTIFICATION Identification is the most difficult step in digital forensics. 11
- 12. CENTRAL FORENSIC SCIENCE LABORATORY IN INDIA The Central Forensic Science Laboratory (CFSL) is a wing of the Indian Ministry of Home Affairs, which fulfills the forensic requirements in the country. It houses the only DNA repository in South and Southeast Asia. CFSL Hyderabad is a center of excellence in chemical sciences CFSL Kolkata (the oldest laboratory in India) in biological sciences CFSL Chandigarh in physical sciences. CFSL New Delhi comes under the Central Bureau of Investigation, Delhi 12
- 14. KERALA CYBER FORENSICS LABS The Kerala State Forensic Science laboratory was established in 1961 at the Medical College Building, Thiruvananthapuram Dr. Thangavelu, the then Principal of Medical College, Thiruvananthapuram was the first Honorary Director of the laboratory. At present, the laboratory consists of Headquarters lab situated in Police Head Quarters, Thiruvananthapuram and two fully functional Regional Forensic Science Labs at Thrissur and Kannur. There are Nineteen District Mobile Forensic Labs(DMFL) in all Police Districts. One new Regional FSL at Kochi has been sanctioned and is about to start its functioning. The Headquarters lab at Thiruvananthapuram consists of eleven divisions such as Physics, Ballistics, Biology, Serology, DNA, Documents, Documents- Civil, Cyber, Chemistry, Explosives and Polygraph divisions. RFSLs have four major divisions such as Physics, Chemistry, Biology and Documents. 14
- 15. EXAMPLES OF DIGITAL EVIDENCE • e-mails • digital photographs, • ATM transaction logs • Finger prints • word processing documents • Instant message histories • files saved from accounting program • spreadsheets • internet browser histories • Databases • The contents of computer memory • computer backups • computer printouts • Global Positioning System tracks, • logs from a hotel’s electronic door locks • digital video or audio files Types of Digital Evidence 15
- 16. STEPS FOR EVIDENCE PRESENTATION • Format &Authenticity • Hard Copy / Soft Copy • Software used versions • CV of the expert qualifications • Hash results • All storage media details • Report should be in simple terms • Supported by photographs 16
- 17. RULES OF EVIDENCE • Admissible - Conform to legal rules in court. • Authentic - Possible to prove the evidence genuine. • Complete - Should reflect all aspects of the incident or crime. • Reliable - Clarity about how the evidence was collected and handled. • Believable - Must be readily believable and understandable by the court 17
- 18. HASHING • Hashing is a mathematical model for authenticating any digital data. • It uses a set of computations to generate a unique code for the input data. • Any minute change in the input data will change the resultant hash value . • .There are standard algorithms like MD5, SHA1 and SHA2 used for this. • Hashing can be done using hardware solutions or software solutions. ** software hashes are not valuable at the court ** 18
- 19. DEVICES USED IN DIGITAL FORENSICS WRITE BLOCKER Write blockers are devices that allow acquisition of information on a drive without creating the possibility of accidentally damaging the drive contents. They do this by allowing read commands to pass but by blocking write commands. RAID - RAPID ACTION IMAGING DEVICE RAID or Master Device is a complete set Of tools within a box which can carry out by investigation officers in scene of crime. Write Blocker 19
- 20. DIGITAL FORENSICS SOFTWARE TOOLS Some of the most common digital forensics software tools ; • Disk Forensics tool :- Cyber Check 6.0 - Forensic Data Recovery & Analysis tool • Live Forensics Tool :- Win-LiFT 3.0 – Windows Live Forensics Tool • Network Forensics Tools:- Net Force Suite 3.0 - A comprehensive collection of Network Forensics tools • Device Forensics Tools :- Mobile Check 3.1 - Cell phone Forensics tool Third party Foreign Tools : • FTK • EnCase • Magnet Axiom • Autopsy – Open Source • Cellebrite • Oxygen • XRY 20
- 21. ADVANTAGES OF DIGITAL FORENSICS • The most important advantage, however, is that it is able to search through a large and massive amount of data. • it has the ability to do this very quickly. • Digital forensics can be used in corporate fraud, breach of contract and asset recovery, theft, and intellectual property disputes. • IT can search in the hard drives in different languages, and this is beneficial since cyber crimes have the ability to cross borders on the internet. • The many valuable data that has been lost and deleted can be achieved sufficiently . • It can then become substantial evidence in court. 21
- 22. CHALLENGES FACED BY DIGITAL FORENSICS • The increase of PC’s and internet access has made the exchange of information quick and inexpensive. • Easy availability of Hacking Tools. • Lack of physical evidence makes crimes harder to prosecute. • The large amount of storage space available to suspects . • The rapid technological changes requires constant upgrade or changes to solutions . 22
- 23. IT ACT IN INDIA Section65-Tampering with computer source document section 66-Hacking with computer system section 66-Receiving stolen computer or communication device section 66C-Using password of another person section 66D-Cheating using computer resource section 66E-Publishing private images of others section 66F-Acts of cyber terrorism section 67-Publishing information which is obscene in electronic form. section 67A-Publishing images containing sexual acts section 67B-Publishing child porn or predating children online section 67C-Failure to maintain records section 68-Failure/refusal to comply with orders section 70-Securing access or attempting to secure access to a protected system section 71-Misrepresentation 23
- 24. FEATURE SCOPE • There is an increasing wide array of tools used to preserve and analyze digital evidence. • The single approach to utilize single evidence such as hard drives will change as there is increasing size of hundreds of Gigabytes and Terabytes to be used. • Huge targets will require more sophisticated analysis techniques and equipment. • There will also be better collaborative functions to allow forensics investigators to perform investigations a lot more efficiently that they do presently. 24
- 25. SUGGESTIONS TO KEEP YOU SAFE Update your system software's on continues intervals Update all your applications Don’t try to install unknown applications Don’t even open your unknown links which received by means of social media or by mail or sms . Don’t share your OTP or any keys with any one. 25
- 26. TOOLS DEMONSTRATION WITH WINDOWS 10. • HASHING • BROWSE ANALYSIS 26
- 27. KERALA POLICE CYBERDOME Headed with :- MANOJ ABRAHAM IPS Address :- Cyber dome, Thejaswini Annexe Building, Techno park Campus, Thiruvananthapuram, Kerala -695581. Website :- www.cyberdome.kerala.gov.in E-mail :- [email protected] Facebook page :- https://www.facebook.com/KeralaPoliceCyberdome 27
- 28. CONCLUSION • Digital forensics is important for solving crimes with digital devices against digital devices against people where evidence may reside in a device • Several sound tools and techniques exist to search and analyze digital data. • Regardless of existing tools, evolving digital age and development of technology requires heavier research in digital forensics. 28
- 30. END OF THE PRESENTATION THANK YOU ITS YOUR TIME 30