COMPUTER FORENSICS STUDY - 17 SOURCES: FORENSICCONTROL.COM
WHEN AND HOW IS COMPUTER FORENSICS USED?
There are a few areas of crime or dispute where computer forensics cannot be applied. Law enforcement agencies were among the earlisst and beaviest users of computer forensics - as a result they've often been at the forefront of developments of this field.A forensic computer exam can reveal more than expected.So a computer forensic examination might reveal when a document first appeared on a computer, when it was last edited, when it was last saved or printed and which user carried out these actions. - Intellectual property theft
- Employment disputes
- Invoice fraud, often enabled by phising emails
- Forgeries
- Inappropriate email and internet use in the workplace
- Regulatory compliance
LIVE ACQUISTION: GETTING DATA FROM A POWERED COMPUTER
Traditionally, examiners copy data from a device which is turned off. They use a write-blocker to make an exact bit for bit copy of the original storage medium, and create an acquistion hash of the original medium. Then they work from this copy, leaving the original obiously unchanged.By running such application (and attaching a device such as USB drive to the suspect's computer) the examiner makes changes and/or additions to the computer which were not present before. But if the examiner records these actions, can show why they were necessary, and explain their consequences to a court of law, the evidence produced is usually still admissible.THE STAGES OF COMPUTER FORENSICS EXAMINATION
1. READINESS
For the forensic examiner, readiness includes appropriate training, testing and verification of their own software and equipment. They need to be familiar with legislation, know how to deal with unexpected issues (such as what to do if child abuse images arre found during a fraud engagement) and ensure their data acquistion computer and associated items are suitable for the task.
2. EVALUATION
Commercial organizations also need to consider health and safety issues, conflict of interest issues and possible risks- financial and to their reputtation - when they accept a particular project.
3. COLLECTION
The examiner would also hold interviews or meetings with personnel who might have inforamtion relevant to the examination - such as the computer's end users, the manager and the person responsible for the computer services, i.e. an IT administrator.
The collection stage can also involve the labelling and bagging of items from the site which may be used in the investigation - these are sealed in numbered tamper-evident bags. The material then needs to be securely and safely transported to the examiner's office or laboratory.
4. ANALYSIS
During analysis the examiner usually feeds back to their line manager or client. These exchanges may result in the analysis taking a different path or narrowing to specific areas. Forensic analysts must be acccurate, thorough, impartial, recorded, repeatable and completed within the available timescales and allocated resources.
There are multiple tools available for computer forensic analysis. The examiner should use any tool they feel comfortable with, as long as they can justify their choice. A computer forensic tool must do what it's meant to do, so examiners need to regularly test and calibrate their tools before carrying out any analysis.
Examiners can also use 'dual-tool verification' to confirm the integrity of their results during analysis. For example, if the examiner finds artfact X at location Y usng tool A, they should be able to replicate these results with tool B.
5. PRESENTATION
The report must be written with the end reader in mind. Often that the reader will be non-technical, so appropriate terminology should be used .The examiner may need to participate in meetings or conference calls to discuss and elaborate on their report.
6. REVIEW
The review of an examination can be simple, quick and begin during any of the above stages. It could incldue a basic analysis of what went wrong and what went well, along with feedback from the person/company who requested the investigation. Any lessons learnt from this stage should be applied to future examinations and feed into the Readiness stage.
WHAT ISSUES COMPUTER FORENSICS EXAMINERS FACE?
Computer forensics examiners come up against three main categories of fproblem: technical, legal and administrative. ENCRYPTION:
Encrypted data can be impossible to view without the correct key or password. If the key is not avaiable or the owner won't reveal it, it may be stored:
- Elsewhere on the computer;
- On another computer which the suspect can access;
- On the computer's volatile memory (RAM). This is usually lost on computer shut-down.
When encryption may be present the examiner may need to consider using "live acquisition" techniques outlined above.
INCREASING STORAGE SPACE:
Storage media hold ever-greater amounts of data, so the examiner's analysis computers need sufficient processing power and available storage capacity to search and analyze large amounts of data efficiently.
NEW TECHNOLOGIES:
Computing is a continually evolving field, with new hardware, software and OS emerging constantly. No single computer forensic examiner can be an expert on all areas, though they are often expected to analyze something they haven't encountered before.
This means they need to be prepared and able to test and experiment with the behaviour of new technologies. At this point, networking and sharing knowledge with other computer forensic examiners comes in useful, because someone else may already have come across the same issue.
ANTI-FORENSICS
Anti-forensics is the practice of attempting to thwart computer forensic analysis - through encryption, over-writing to make it unrecoverable, modifying files' metadata and file obfuscation (diguising files). As with encryption, the evidence that such methods have been used may be stored elsewhere on the computer or on another computer which the suspect can access.
In our experience, it's very rare to see anti-forensic tools used correctly and frequently enough to totally obscure their presence or the presence of the evidence they were used to hide.
LEGAL ISSUES
Data often isn't stored on a person computer but on remote computers which they are renting storage space on, otherwise known as the 'cloud'. This data may be in a different country, meaning access it could involve different legislation. And if access is possible, it may be complicated and expensive.
LEGAL ARGUMENTS:
Legal issues can confuse or distract from a computer examiner's findings. One example of this is the "Trojan Defence". A trojan is a piece of computer code disguised as something benign but which has a hidden and malicious purpose. Trojans have many uses, including key-logging, up/downloading files and installing viruses. A lawyer may be able to argue that actions on a computer were not carried out by a user, but instead automated by a Trojan without the user's knowledge. This kind of Trojan Defence has been sucessfully used even when no trace of a Trojan or other malicious code was found on the suspect's computer.
In such casesm a competent opposing lawyer supplied with evidence from a competent computer forensic analyst should be able to dismiss the argument. A good examiner will have identified and addressed possible arguments from the 'opposition' during the analysis and writing stages of their report.
ADMINISTRATIVE ISSUES
These are all kinds of standards and guidelines in computer forensics, few of which are universally accepted. The reasons for this include:
- Standard-setting bodeis can be tied to particular legislation
- Standards are aimed either at law enforcement or commercial forensics but not both
- The authors of such standards are not accepted by their peers
- High joining fees for professional bodeis can put practitioners of
FIT TO PRACTICE:
Many jurisdictions have no qualifying body to check the competence and integrity of computer forensics professionals. This means anyone can present themselves as a computer forensic expert, which in turn can lead to poor quality examinations and negative view of the profession as a whole.
COMPUTER FORENSIC TERMS
ACQUISITION HASH:
BIT COPY:
DENIAL OF SERVICE ATTACK:
HACKING:
KEY-LOGGING:
METADATA:
PHISING:
RAM:
WRITE-BLOCKER: