CYBER FORENSICS

COMPUTER TECHNOLOGY

Babasaheb Gawde Institute of Technology[BGIT], Mumbai Central

Abstract:-Given the increasing opportunities for computer-

based crime, a number of related emerging issues need
serious consideration by law enforcement.Forensic
computing, however, is still a relatively young branch of IT
and has so far been mainly concerned with the retrieval and
analysis of data stored on computers used in the commission
of crimes.

Introduction

More and more, information technology is becoming the

instrument of criminal activity. Criminal exploitation of
digital technologies has necessitated a new type of criminal
investigation - Computer Forensics. Computer forensics is
simply the application of computer investigation and
analysis techniques in the interests of determining potential
legal evidee.

NEED FOR FORENSIC COMPUTING

Thanks to computer technology, hours of research in the

library has transitioned into just a few minutes of research

1
 CYBER FORENSICS

COMPUTER TECHNOLOGY

Babasaheb Gawde Institute of Technology[BGIT], Mumbai Central

browsing the Internet. We truly live in the information age. 3. When it is necessary for a person to access
Unfortunately, so do criminals! Personal computers have original digital evidence, that person should
become an inexpensive and yet powerful tool that can be be trained for that purpose.
used in the furtherance of almost any criminal activity. 4. All activity relating to the seizure, access,
Criminal acts can easily be coordinated worldwide using the storage or transfer of digital evidence must be
Internet and criminal communications can be encrypted. fully documented, preserved and available
for review.
WHAT IS FORENSICS?
5. An individual is responsible for all actions
The term “Forensics” means the gathering of evidence for taken with respect to digital evidence while
presentation to the public or court. Computer based crime the digital evidence is in their possession.
has given rise to new field of specialization— forensic 6. Any agency, which is responsible for seizing,
computing— which is the process of identifying, preserving, accessing, storing or transferring digital
analyzing and presenting digital evidence in a manner that is evidence is responsible for compliance with
legally acceptable. these principles.

WHAT IS COMPUTER FORENSICS? CYBER FORENSICS ACTIVITIES

Computer forensics is simply the application of computer  Cyber forensic activities commonly includes:
investigation and analysis techniques in the interests of 1. The secure collection of computer data.
determining potential legal evidence. 2. The identification of suspect data.
3. The examination of suspect data to
CYBER FORENSICS PRINCIPLES
determine details such as origin and content.
 The 6 Principles are: 4. The presentation of computer – based
1. When dealing with digital evidence, all of the information to courts of law.
general forensic and procedural principles 5. The application of a country’s laws to
must be applied. computer practice.
2. Upon seizing digital evidence, actions taken
DURING CORE ELEMENTS INVESTIGATION
should not change that evidence.
Forensic Computing encompasses four key elements:

2
 CYBER FORENSICS

COMPUTER TECHNOLOGY

Babasaheb Gawde Institute of Technology[BGIT], Mumbai Central

 THE IDENTIFICATION AND EXTRACTION OF The basic methodology consists of the 3 as:
DIGITAL EVIDENCE :It is the first step in the
 Acquire the evidence without altering or damaging
forensic process. For a given subject system -
the original.
knowing what evidence is present, where it is stored
 Authenticate the image.
and how it is stored is vital to determining which
 Analyze the data without modifying it.
processes are to be employed to facilitate its
recovery. CURRENT AND FUTURE ISSUES
 THE PRESERVATION OF DIGITAL EVIDENCE :
 LAW AND TECHNOLOGY: THE BALANCE:-
It is a critical element in the forensic process.
Advances in technology present the forensic
 THE ANALYSIS OF DIGITAL EVIDENCE: It is
computer specialist with new problems. Advances in
the process of extraction, processing and
technology can also lead to more advanced solutions.
interpretation of digital data.
 DATA VOLUME: -Probably the greatest single
 THE PRESENTATION OF DIGITAL EVIDENCE:
challenge facing forensic computing today is the
It involves the actual presentation in a court of law.
rapid increase in the capacity of today’s storage
This includes the manner of presentation, the
media. Being able to copy, store and process large
expertise and qualifications of the presenter and the
volumes of data in a timely and accurate manner
credibility of the processes employed to produce the
presents a unique challenge to forensic
evidence being tendered.
computing.Currently, tape backup and CD-ROMs
provide the most popular solution, but both have
their shortcomings, size and handling with CD-
PRIMARY ACTIVITIES OF FORENSIC COMPUTING
ROMs, and reliability with tapes. One emerging
Forensic computing is not a single activity, but consist of solution is the Digital Versatile Disk (DVD), but at
two primary activities listed below: present its acceptance within forensic computing is
very limited. The use of binary imaging, combined
 MEDIA AND ELECTRONIC DEVICE
with a need to extract specific items of information,
ANALYSIS.
means that specialized tools are needed and there are
 DATA COMMUNICATION ANALYSIS.
extra steps within the examination process.
THE 3 As

3
 CYBER FORENSICS

COMPUTER TECHNOLOGY

Babasaheb Gawde Institute of Technology[BGIT], Mumbai Central

 ENCRYPTION :- Regardless of the encryption

process used, if the user is required to open cipher
text by way of a password or key , the encryption
process can almost always be attacked by using brute
force techniques, which is sometimes impractical
due to the tremendous time complexity involved.

CONCLUSION

Given the increasing opportunities for computer-based

crime, a number of related emerging issues need serious
consideration by law enforcement.Forensic computing,
however, is still a relatively young branch of IT and has so
far been mainly concerned with the retrieval and analysis of
data stored on computers used in the commission of crimes.

REFERENCE: www.thestudymaterial.com

www.google.com