Computer Forensics in todays world

Question 1

What is Computer Forensics?

Answer 1

A set of methodological procedures and techniques that help identify, gather, preserve, extract, interpret, document, and present evidence from computers in a way that is legally admissible.

Question 2

Objectives of Computer Forensics include:

Answer 2

1. Identify, gather, and preserve the evidence of a cybercrime
2. Track and prosecute the perpetrators in a court of law
3. Interpret, document and present the evidence to be admissible during prosecution
4. Estimate the potential impact of a malicious activity on the victim and assess the intent of the perpetrator
5. Find vulnerabilities and security loopholes that help attackers
6. Understand the techniques and methods used by attackers to avert prosecution, and overcome them
7. Recover deleted files, hidden files, and temporary data that could be used as evidence
8. Perform incident response to prevent further loss of intellectual property, finances and reputation during an attack

Question 3

What is Cyber Crime?

Answer 3

is defined as any illegal act involving a computing device, network, its systems, or its applications. There are Internal & External attacks.

Question 4

Civil

Answer 4

brought for violation of contracts and lawsuits where a guilty outcome generally results in monetary damages to the plaintiff

Question 5

Criminal

Answer 5

brought by law enforcement agencies in response to a suspected violation of law where a guilty outcome may result in monetary damages, imprisonment, or both

Question 6

Administrative

Answer 6

non-criminal in nature and are related to misconduct or activities of an employee

Question 7

Rules of Forensics Investigation

Answer 7

1. Limited access to and examination of the original evidence
2. Record all changes made to any evidence files
3. Create an evidence chain of custody document for tracking ALL access to evidence
4. Set standards for investigating all evidence and follow/comply with them
5. Hire professionals for analysis of evidence if special skill sets are required
6. Evidence should be strictly related to the incident
7. The evidence should comply with all jurisdiction standards
8. Document the procedures applied to all evidence
9. Securely store all evidence
10. Use recognized and appropriate tools for analysis

Question 8

Cyber Crime Investigation Methodology/Steps:

Answer 8

1. Identify the computer crime
2. Collect preliminary evidence
3. Obtain court warrant for discovery/seizure of evidence (if required)
4. Perform first responder procedures
5. Seize evidence at the crime scene
6. Transport evidence to the lab
7. Create two bit stream copies of the evidence
8. Generate MD5 checksum of the images
9. Maintain chain of custody
10. Store original evidence in secure location
11. Analyze the image copy for evidence
12. Prepare a forensic report
13. Submit report to client
14. Testify in court as an expert witness (if required)

Question 9

Corporate Investigations / Enterprise Theory of Investigation (ETI)

Answer 9

A methodology for investigating criminal activity. It adopts a holistic approach toward any criminal activity as a criminal operation rather than as a single criminal act.

Question 10

Locard’s Exchange Principle

Answer 10

anyone or anything, entering a crime scene takes something of the scene with them, and leaves something of themselves behind when they leave.