DIGITAL NOTES

ON
DIGITAL FORENSICS
UNIT -1 & 2
B. TECH IV YEAR - II SEM(2024-25)

DEPARTMENT OF CSE (AIML)

GEETHANJALI COLLEGE OF ENGINEERING & TECHNOLOGY

(Autonomous Institution – UGC, Govt. of India)
(Affiliated to JNTUH, Hyderabad, Approved by AICTE - Accredited by NBA & NAAC – ‘A’ Grade)
Cheeryala(V) Keesara(M) Medchal(Dist)Telangana -501301, INDIA.
 Syllabus
UNIT - I

Digital Forensics Fundamentals: Digital Forensics definition, Use of Digital Forensics in

Law Enforcement, Digital Forensics Assistance to Human Resources/Employment
Proceedings, Digital Forensics Services, Benefits of Professional Forensics Methodology,
Steps taken by Digital Forensics Specialists Types of Digital Forensics Technology: Types of
Military Digital Forensic Technology, Types of Law Enforcement, Digital Forensic
Technology, Types of Business Digital Forensic Technology Digital Forensics Evidence and
Capture: Data Recovery Defined, Data Back-up and Recovery, The Role of Back-up in Data
Recovery, The Data Recovery Solution.

UNIT – II

Evidence Collection and Data Seizure

Reasons to collect Evidence. Collection Options, Obstacles, Types of Evidence, The Rules of
Evidence, Volatile Evidence, General Procedure, Collection and Archiving, Methods of
Collection, Artifacts, Collection Steps, Controlling Contamination

The Chain of Custody Duplication and Preservation of Digital Evidence

Preserving the Digital Crime Scene, Computer Evidence Processing Steps, Legal Aspects of
Collecting and Preserving Digital Forensic Evidence Computer Image Verification and
Authentication, Special Needs of Evidential Authentication, Practical Consideration, Practical
Implementation.

TEXT BOOKS:

1. Computer Forensics, Computer Crime Investigation by John R,Vacca, Firewall Media,

New Delhi.
 REFERENCE BOOKS:

1. Real Digital Forensics by Keith j.Jones, Richard Bejitlich,Curtis W.Rose ,Addison-

Wesley Pearson Education

2. Forensic Compiling,A Tractitioneris Guide by Tony Sammes and Brain

Jenkinson,Springer International edition.

3. Computer Evidence Collection &Presentation by Chrostopher L.T. Brown,Firewall

Media.

4. Homeland Security ,Techniques& Technologies by Jesus Mena,Firewall Media.

5. Software Forensics Collecting Evidence from the Scene of a Digital Crime by Robert
M.Slade ,TMH 2005

6. Windows Forensics by chad Steel,Wiley India Edition.

GCET DEPARTMENT OF CSE-EA

UNIT-1
INTRODUCTION
1.1 WHAT IS DIGITAL FORENSICS?

 Digital forensics is the process of methodically examining computer media (hard disks,
diskettes, tapes, etc.) for evidence. In other words, computer forensics is the collection,
preservation, analysis, and presentation of computer-related evidence.
 Digital forensics also referred to as computer forensic analysis, electronic discovery,
electronic evidence discovery, digital discovery, data recovery, data discovery, computer
analysis, and computer examination.
 Computer evidence can be useful in criminal cases, civil disputes, and human
resources/ employment proceedings.

1.2 USE OF DIGITAL FORENSICS IN LAW ENFORCEMENT

Computer forensics assists in Law Enforcement. This can include:

 Recovering deleted files such as documents, graphics, and photos.

 Searching unallocated space on the hard drive, places where an abundance of data
often resides.

 Tracing artifacts, those tidbits of data left behind by the operating system. Our
experts know how to find these artifacts and, more importantly, they know how to
evaluate thevalue of the information they find.
 Processing hidden files — files that are not visible or accessible to the user — that
contain past usage information. Often, this process requires reconstructing and analyzing
the date codes for each file and determining when each file was created, last modified, last
accessed and when deleted.
 Running a string-search for e-mail, when no e-mail client is obvious.

DIGITAL FORENSICS Page 1

GCET DEPARTMENT OF CSE-EA

1.3 DIGITAL FORENSICS ASSISTANCE TO HUMAN RESOURCES /

EMPLOYMENT PROCEEDINGS
Computers can contain evidence in many types of human resources proceedings, including
sexual harassment suits, allegations of discrimination, and wrongful termination claims.
Evidence can be found in electronic mail systems, on network servers, and on individual
employee’s computers.
EMPLOYER SAFEGUARD PROGRAM

Employers must safeguard critical business information. An unfortunate concern today is the
possibility that data could be damaged, destroyed, or misappropriated by a discontented
individual. Before an individual is informed of their termination, a computer forensic specialist
should come on-site and create an exact duplicate of the data on the individual’s computer. In
this way, should the employee choose to do anything to that data before leaving, the employer
is protected. Damaged or deleted data can be re-placed, and evidence can be recovered to show
what occurred. This method can also be used to bolster an employer’s case by showing the
removal of proprietary information or to protect the employer from false charges made by the
employee. You should be equipped to find and interpret the clues that have been left behind.
This includes situations where files have been deleted, disks have been reformatted, or other
steps have been taken to conceal or destroy the evidence. For example, did you know?

 What Web sites have been visited?

 What files have been downloaded?

 When files were last accessed?

 Of attempts to conceal or destroy evidence?

 Of attempts to fabricate evidence?

 That the electronic copy of a document can contain text that was removed from the final
printed version?
 That some fax machines can contain exact duplicates of the last several hundred pages
received?

DIGITAL FORENSICS Page 2

GCET DEPARTMENT OF CSE-EA

 That faxes sent or received via computer may remain on the computer indefinitely?

 That email is rapidly becoming the communications medium of choice for businesses?

 That people tend to write things in email that they would never consider writing in a
memorandum or letter?
 That email has been used successfully in criminal cases as well as in civil litigation?

 That email is often backed up on tapes that are generally kept for months or years?

 That many people keep their financial records, including investments, on computers?

1.4 DIGITAL FORENSICS SERVICES

Computer forensics professionals should be able to successfully perform complex evidence
recovery procedures with the skill and expertise that lends credibility to your case.

For example, they should be able to perform the following services:

1. DATA SEIZURE

 Following federal guidelines, computer forensics experts should act as the

representative, using their knowledge of data storage technologies to track down
evidence.
 The experts should also be able to assist officials during the equipment seizure process.

2. DATA DUPLICATION/PRESERVATION

 When one party must seize data from another, two concerns must be addressed:
 the data must not be altered in any way
 the seizure must not put an undue burden on the responding party
 The computer forensics experts should acknowledge both of these concerns by making
an exact duplicate of the needed data.
 When experts works on the duplicate data, the integrity of the original is maintained.

3. DATA RECOVERY

 Using proprietary tools, your computer forensics experts should be able to safely recover

DIGITAL FORENSICS Page 3

GCET DEPARTMENT OF CSE-EA

and analyze otherwise inaccessible evidence.

 The ability to recover lost evidence is made possible by the expert’s advanced
understanding of storage technologies.

4. DOCUMENT SEARCHES

 Computer forensics experts should also be able to search over 200,000 electronic
documents in seconds rather than hours.
 The speed and efficiency of these searches make the discovery process less complicated
and less intrusive to all parties involved.

5. MEDIA CONVERSION

 Computer forensics experts should extract the relevant data from old and un-readable
devices, convert it into readable formats, and place it onto new storage media for
analysis.

6. EXPERT WITNESS SERVICES

 Computer forensics experts should be able to explain complex technical processes in an

easy-to- understand fashion.
 This should help judges and juries comprehend how computer evidence is found, what it
consists of, and how it is relevant to a specific situation.

7. COMPUTER EVIDENCE SERVICE OPTIONS

Computer forensics experts should offer various levels of service, each designed to suit your
individual investigative needs. For example, they should be able to offer the following
services:
 Standard service: Computer forensics experts should be able to work on your case
during nor-mal business hours until your critical electronic evidence is found.
 On-site service: Computer forensics experts should be able to travel to your location to

DIGITAL FORENSICS Page 4

GCET DEPARTMENT OF CSE-EA

per-form complete computer evidence services. While on-site, the experts should
quickly be able to produce exact duplicates of the data storage media in question.
 Emergency service: Your computer forensics experts should be able to give your case
the highest priority in their laboratories. They should be able to work on it without
interruption until your evidence objectives are met.
 Priority service: Dedicated computer forensics experts should be able to work on your
case during normal business hours (8:00 A.M. to 5:00 P.M., Monday through Friday)
until the evidence is found. Priority service typically cuts your turnaround time in half.
 Weekend service: Computer forensics experts should be able to work from 8:00 A.M.
to 5:00 P.M., Saturday and Sunday, to locate the needed electronic evidence and will
continue 14 Computer Forensics, Second Edition working on your case until your
evidence objectives are met.

8. OTHER MISCELLANEOUS SERVICES

Digital forensics experts should also be able to provide extended services. These services
include:

 Analysis of computers and data in criminal investigations

 On-site seizure of computer data in criminal investigations

 Analysis of computers and data in civil litigation.

 On-site seizure of computer data in civil litigation

 Analysis of company computers to determine employee activity

 Assistance in preparing electronic discovery requests

 Reporting in a comprehensive and readily understandable manner

 Court-recognized computer expert witness testimony

 Computer forensics on both PC and Mac platforms

 Fast turnaround time.

DIGITAL FORENSICS Page 5

GCET DEPARTMENT OF CSE-EA

1.5 BENEFITS OF PROFESSIONAL FORENSIC METHODOLOGY

A knowledgeable computer forensics professional should ensure that a subject computer

system is carefully handled to ensure that:

1. No possible evidence is damaged, destroyed, or otherwise compromised by the

procedures used to investigate the computer.
2. No possible computer virus is introduced to a subject computer during the analysis process.

3. Extracted and possibly relevant evidence is properly handled and protected from later
mechanical or electromagnetic damage.
4. A continuing chain of custody is established and maintained.

5. Business operations are affected for a limited amount of time, if at all.

6. Any client-attorney information that is inadvertently acquired during a forensic

exploration is ethically and legally respected and not divulged.

1.6 STEPS TAKEN BY DIGITAL FORENSICS SPECIALISTS

The computer forensics specialist should take several careful steps to identify and attempt to
retrieve possible evidence that may exist on a subject’s computer system. For example, the
following steps should be taken:

1. Protect the subject computer system during the forensic examination from any possible
alteration, damage, data corruption, or virus introduction.
2. Discover all files on the subject system. This includes existing normal files, deleted yet
remaining files, hidden files, password-protected files, and encrypted files.
3. Recover all of discovered deleted files.

4. Reveal the contents of hidden files as well as temporary or swap files used by both the
application programs and the operating system.
5. Access the contents of protected or encrypted files.

6. Analyze all possibly relevant data found in special areas of a disk. This includes but is
not limited to what is called unallocated space on a disk, as well as slack space in a file

DIGITAL FORENSICS Page 6

GCET DEPARTMENT OF CSE-EA

(the remnant area at the end of a file in the last assigned disk cluster, that is unused by
current file data, but once again, may be a possible site for previously created and
relevant evidence).
7. Print out an overall analysis of the subject computer system, as well as a listing of all
possibly relevant files and discovered file data.
8. Provide an opinion of the system layout; the file structures discovered; any discovered
data and authorship information; any attempts to hide, delete, protect, and encrypt
information; and anything else that has been discovered and appears to be relevant to the
overall computer system examination.
9. Provide expert consultation and/or testimony, as required.

TYPES OF DIGITAL FORENSIC TECHNOLOGY

1.7 TYPES OF MILITARY DIGITAL FORENSIC TECHNOLOGY

 Key objectives of cyber forensics include rapid discovery of evidence, estimation of

potential impact of the malicious activity on the victim, and assessment of the intent and
identity of the perpetrator.
 Real-time tracking of potentially malicious activity is especially difficult when the
pertinent information has been intentionally hidden, destroyed, or modified in order to
elude discovery.
 National Law Enforcement and Corrections Technology Center (NLECTC) works with
criminal justice professionals to identify urgent and emerging technology needs.
 NLECTC centers demonstrate new technologies, test commercially available
technologies and publish results — linking research and practice.
 National Institute of Justice (NIJ) sponsors research and development or identifies best
practices to address those needs.
 The information directorate entered into a partnership with the NIJ via the auspices of
the NLECTC, to test the new ideas and prototype tools. The Computer Forensics
Experiment 2000 (CFX-2000) resulted from this partnership.

DIGITAL FORENSICS Page 7

GCET DEPARTMENT OF CSE-EA

DIGITAL FORENSIC EXPERIMENT-2000 (CFX-2000)

 CFX-2000 is an integrated forensic analysis framework.

 The central hypothesis of CFX-2000 is that it is possible to accurately determine the

motives, intent, targets, sophistication, identity, and location of cyber criminals and
cyber terrorists by deploying an integrated forensic analysis framework.
 The cyber forensic tools involved in CFX-2000 consisted of commercial off-the-shelf
software and directorate-sponsored R&D prototypes. CFX includes SI-FI integration
environment.
 The Synthesizing Information from Forensic Investigations (SI-FI) integration
environment supports the collection, examination, and analysis processes employed
during a cyber-forensic investigation.
 The SI-FI prototype uses digital evidence bags (DEBs), which are secure and
tamperproof containers used to store digital evidence.
 Investigators can seal evidence in the DEBs and use the SI-FI implementation to
collaborate on complex investigations.

 Authorized users can securely reopen the DEBs for examination, while automatic audit
of all actions ensures the continued integrity of their contents.
 The teams used other forensic tools and prototypes to collect and analyze specific
features of the digital evidence, perform case management and time lining of digital
events, automate event link analysis, and perform steganography detection.
 The results of CFX-2000 verified that the hypothesis was largely correct and that it is
possible to ascertain the intent and identity of cyber criminals.
 As electronic technology continues its explosive growth, researchers need to continue
vigorous R&D of cyber forensic technology in preparation for the onslaught of cyber
reconnaissance probes and attacks.

DIGITAL FORENSICS Page 8

GCET DEPARTMENT OF CSE-EA

1.8 TYPES OF LAW ENFORCEMENT : DIGITAL FORENSIC

TECHNOLOGY

Digital forensics tools and techniques have become important resources for use in internal
investigations, civil lawsuits, and computer security risk management. Law enforcement
and military agencies have been involved in processing computer evidence for years.

Computer Evidence Processing Procedures

Processing procedures and methodologies should conform to federal computer evidence

processing standards.

1. Preservation of Evidence
 Computer evidence is fragile and susceptible to alteration or erasure by any number of
occurrences.

 Computer evidence can be useful in criminal cases, civil disputes, and human resources/

DIGITAL FORENSICS Page 9

GCET DEPARTMENT OF CSE-EA

employment proceedings.
 Black box computer forensics software tools are good for some basic investigation
tasks, but they do not offer a full computer forensics solution.
 SafeBack software overcomes some of the evidence weaknesses inherent in black box
computer forensics approaches.
 SafeBack technology has become a worldwide standard in making mirror image backups
since 1990.
TROJAN HORSE PROGRAMS

 The computer forensic expert should be able to demonstrate his or her ability to avoid
destructive programs and traps that can be planted by computer users bent on
destroying data and evidence.
 Such programs can also be used to covertly capture sensitive information, passwords,
and network logons.

DIGITAL FORENSICS DOCUMENTATION

 Without proper documentation, it is difficult to present findings.

 If the security or audit findings become the object of a lawsuit or a criminal

investigation, then documentation becomes even more important.
FILE SLACK
 Slack space in a file is the remnant area at the end of a file in the last assigned disk
cluster, that is unused by current file data, but once again, may be a possible site for
previously created and relevant evidence.
 Techniques and automated tools that are used by the experts to capture and evaluate file
slack.

DATA-HIDING TECHNIQUES
 Trade secret information and other sensitive data can easily be secreted using any
number of techniques. It is possible to hide diskettes within diskettes and to hide entire
computer hard disk drive partitions. Computer forensic experts should understand such
issues and tools that help in the identification of such anomalies.

DIGITAL FORENSICS Page 10

GCET DEPARTMENT OF CSE-EA

E-C OMMERCE INVESTIGATIONS

 Net Threat Analyzer can be used to identify past Internet browsing and email activity
done through specific computers. The software analyzes a computer’s disk drives and
other storage areas that are generally unknown to or beyond the reach of most general
computer users. Net Threat Analyzer avail-able free of charge to computer crime
specialists, school officials, and police.
DUAL-PURPOSE PROGRAMS
 Programs can be designed to perform multiple processes and tasks at the same time.
Computer forensics experts must have hands-on experience with these programs.

TEXT SEARCH TECHNIQUES

 Tools that can be used to find targeted strings of text in files, file slack, unallocated file
space, and Windows swap files.
FUZZY LOGIC TOOLS USED TO IDENTIFY UNKNOWN TEXT

 Computer evidence searches require that the computer specialist know what is being
searched for. Many times not all is known about what may be stored on a given
computer system.
 In such cases, fuzzy logic tools can provide valuable leads as to how the subject computer
was used.

2. Disk Structure
 Computer forensic experts must understand how computer hard disks and floppy
diskettes are structured and how computer evidence can reside at various levels within
the structure of the disk.
 They should also demonstrate their knowledge of how to modify the structure and hide
data in obscure places on floppy diskettes and hard disk drives.

3. Data Encryption
 Computer forensic experts should become familiar with the use of software to crack
security associated with the different file structures.

DIGITAL FORENSICS Page 11

GCET DEPARTMENT OF CSE-EA

4. Matching a Diskette to a Computer

 Specialized techniques and tools that make it possible to conclusively tie a diskette to a
computer that was used to create or edit files stored on it. Computer forensic experts
should become familiar how to use special software tools to complete this process.
5. Data Compression
 Computer forensic experts should become familiar with how compression works and
how compression programs can be used to hide and disguise sensitive data and also
learn how password- protected compressed files can be broken.
6. Erased Files
 Computer forensic experts should become familiar with how previously erased files can
be recovered by using DOS programs and by manually using data-recovery technique &
familiar with cluster chaining.
7. Internet Abuse Identification and Detection
 Computer forensic experts should become familiar with how to use specialized software
to identify how a targeted computer has been used on the Internet.
 This process will focus on computer forensics issues tied to data that the computer user
probably doesn’t realize exists (file slack, unallocated file space, and Windows swap
files).
8. The Boot Process and Memory Resident Programs
 Computer forensic experts should become familiar with how the operating system can
be modified to change data and destroy data at the whim of the person who configured
the system.
 Such a technique could be used to covertly capture keyboard activity from corporate
executives, for example. For this reason, it is important that the experts understand
these potential risks and how to identify them.

1.9 TYPES OF BUSINESS DIGITAL FORENSIC TECHNOLOGY

The following are different types of business computer forensics technology:-

DIGITAL FORENSICS Page 12

GCET DEPARTMENT OF CSE-EA

REMOTE MONITORING OF TARGET COMPUTERS

 Data Interception by Remote Transmission (DIRT) is a powerful remote control

monitoring tool that allows stealth monitoring of all activity on one or more target
computers simultaneously from a remote command center.
 No physical access is necessary. Application also allows agents to remotely seize and
secure digital evidence prior to physically entering suspect premises.
CREATING TRACKABLE ELECTRONIC DOCUMENTS

 Binary Audit Identification Transfer (BAIT) is a powerful intrusion detection tool that
allows users to create trackable electronic documents.
 BAIT identifies (including their location) unauthorized intruders who access, download,
and view these tagged documents.
 BAIT also allows security personnel to trace the chain of custody and chain of
command of all who possess the stolen electronic documents.

THEFT RECOVERY SOFTWARE FOR LAPTOPS AND PCS

 What it really costs to replace a stolen computer:

 The price of the replacement hardware & software.

 The cost of recreating data, lost production time or instruction time, reporting
and investigating the theft, filing police reports and insurance claims, increased
insurance, processing and ordering replacements, cutting a check, and the like.
 The loss of customer goodwill.

 If a thief is ever caught, the cost of time involved in prosecution.

 PC PHONEHOME

 PC PhoneHome is a software application that will track and locate a lost or stolen
PC or laptop any-where in the world. It is easy to install. It is also completely
transparent to the user.

DIGITAL FORENSICS Page 13

GCET DEPARTMENT OF CSE-EA

 If your PC PhoneHome-protected computer is lost or stolen, all you need to do is

make a report to the local police and call CD’s 24-hour command center. CD’s
recovery specialists will assist local law enforcement in the recovery of your
property.

FORENSIC SERVICES AVAILABLE

Services include but are not limited to:

 Lost password and file recovery

 Location and retrieval of deleted and hidden files

 File and email decryption

 Email supervision and authentication

 Threatening email traced to source

 Identification of Internet activity

 Computer usage policy and supervision

 Remote PC and network monitoring

 Tracking and location of stolen electronic files

 Honeypot sting operations

 Location and identity of unauthorized software users

 Theft recovery software for laptops and PCs

 Investigative and security software creation

 Protection from hackers and viruses.

DIGITAL FORENSICS Page 14

GCET DEPARTMENT OF CSE-EA

DIGITAL FORENSIC EVIDENCE and CAPTURE

1.10 Data Recovery Defined

 Data recovery is the process in which highly trained engineers

evaluate and extract data from damaged media and return it in an intact format.

 Many people, even computer experts, fail to recognize data recovery

as an option during a data crisis. But it is possible to retrieve files that have
been deleted and passwords that have been forgotten or to recover entire hard
drives that have been physically damaged.

1.11 Data Back-up and Recovery

Back-up Obstacles

 Back-up Window: The back-up window is the period of time when

back-ups can be run. The back-up window is generally timed to occur during
nonproduction periods when network bandwidth and CPU utilization are low.

 Network bandwidth: If a network cannot handle the impact of

transporting hundreds of gigabytes of data over a short period of time, the
organization’s centralized backup strategy is not viable.

 System throughput: Three I/O bottlenecks are commonly found in

traditional backup schemes. These are

1. The ability of the system being backed up to push data to the backup
server

2. The ability of the backup server to accept data from multiple systems
simultaneously

3. The available throughput of the tape device(s) onto which the data is
moved

DIGITAL FORENSICS Page 15

GCET DEPARTMENT OF CSE-EA

 Lack-of Resources: Many companies fail to make appropriate

investments in data protection until it is too late.

1.12 The Role of Back-up in Data Recovery

There are many factors that affect back-up. For example:

 Storage costs are decreasing: The cost per megabyte of primary

(online) storage has fallen dramatically over the past several years and
continues to do so as disk drive technologies advance.

 Systems have to be on-line continuously: Because systems must be

continuously online, the dilemma becomes that you can no longer take files
offline long enough to perform backup.

 The role of Back-up has changed: The role of backup now includes
the responsibility for recovering user errors and ensuring that good data has
been saved and can quickly be restored.

CONVENTIONAL TAPE BACK-UP IN TODAY’S MARKET

 A typical tape management system consists of a dedicated workstation

with the front-end interfaced to the network and the back-end controlling a
repository of tape devices. The media server runs tape management software.
It can administer backup devices throughout an enterprise and can run
continuous parallel backups and restores.

 An alternative to tape backup is to physically replicate or mirror all

data and keep two copies online at all times. The advantage is that the data
does not have to be restored, so there are no issues with immediate data
availability.
ISSUES WITH TODAY’S BACK-UP

 NETWORK BACKUP creates network performance problems.

Using the production network to carry backup data, as well as for normal user

DIGITAL FORENSICS Page 16

GCET DEPARTMENT OF CSE-EA

data access, can severely overburden today’s busy network resources.

 OFFLINE BACKUP affects data accessibility. The time that the host
is offline for data backup must be minimized. This requires extremely high-
speed, continuous parallel backup of the raw image of the data.
 LIVE BACKUPS allow data access during the backup process but
affect performance. The downside to the live backup is that it puts a
tremendous burden on the host.
 MIRRORING doesn’t protect against user error and replication of
bad data. Fully replicated online data sounds great, albeit at twice the cost per
megabyte of a single copy of online data.

NEW ARCHITECTURES AND TECHNIQUES ARE REQUIRED

 Backup at extremely high speed is required. Recovery must be

available at file level. The time that systems off-line for back-up must be
eliminated.
 Remote hot recovery sites are needed for immediate resumption of
data access. Backup of critical data is still required to ensure against data
errors and user errors.
 To achieve effective backup and recovery, the decoupling of data from its storage
space is needed.

 It is necessary to develop techniques to journal modified pages, so that

journaling can be invoked within the primary storage device, without host
intervention.
 Part of the primary storage area must be set aside for data to be backed
up. This area must be as large as the largest backup block. We should have fast
nonrandom restoration of critical data.

1.13 The Data Recovery Solution

SHRINKING EXPERTISE, GROWING COMPLEXITY

a. The complex systems that have evolved over the past 30 years must be

DIGITAL FORENSICS Page 17

GCET DEPARTMENT OF CSE-EA

monitored, managed, controlled, and optimized. But most of the bright

young graduates this term haven’t had much exposure to mainframe
concepts.

b. Backups often take place while an application is running. Application

changes take place on the fly. If an outage occurs, the company stands
to lose tens of thousands of dollars an hour.
FAILURES:
Disk storage is more reliable than ever, but hardware failures are still possible. A simple
mistake can be made by an application programmer, system programmer, or operations person.
Logic errors in programs or application of the wrong update at the wrong time can result in a
system crash or, worse. Disasters do really occurs! Floods, tornadoes, earthquakes, tsunamis,
and even terrorism can do strike. We must be ready.

BUDGETS AND DOWNTIME

We have fewer resources (people, processing power, time, and money) to do more work than
ever before, and we must keep your expenses under control. Systems must remain available to
make money and serve customers. Downtime is much too expensive to be tolerated.

RECOVERY: THINK BEFORE YOU BACK-UP

One of the most critical data-management tasks involves recovering data in the event of a
problem. You must evaluate your preparations, make sure that all resources are available in
usable condition, automate processes as much as possible, and make sure you have the right
kind of resources.

Evaluate your preparation

If all of the resources (image copies, change accumulations, and logs) are available at recovery
time, these preparations certainly allow for a standard recovery. Finding out at recovery time
that some critical resource is missing can be disastrous!
Don’t let your resources fall through the cracks
Identifying different types of conditions is critical to ensuring a successful recovery. Checking
your assets to make sure they’re ready should be part of your plan.

DIGITAL FORENSICS Page 18

 GCET DEPARTMENT OF CSE-EA

Automated Recovery

With proper planning and automation, recovery is made possible, reliance on specific
personnel is reduced, and the human-error factor is nearly eliminated.

Data integrity and your business relay on building recovery job control language (JCL). In the
event of a disaster, the Information Management System (IMS) recovery control (RECON) data
sets must be modified in preparation for the recovery.

Cleaning your RECON data sets can take hours if done manually, and it’s an error-prone process.

Make Recoveries Efficient

Multithreading tasks shorten the recovery process. Recovering multiple databases with one
pass through your log data certainly will save time. Taking image copies, rebuilding indexes,
and validating pointers concurrently with the recovery process further reduce downtime.

Take Back-ups

The first step to a successful recovery is the backup of your data. Your goal in backing up data
is to do so quickly, efficiently, and usually with minimal impact to your customers. You might
need only very brief out-ages to take instant copies of your data, or you might have intelligent
storage devices that allow you to take a snapshot of your data. Both methods call for tools to
assist in the management of resources.

BACK-UP AND RECOVERY SOLUTION

BMC software has developed a model called the Back-up and Recovery Solution (BRS) for the
Information Management System (IMS) product.

Image Copy

BRS contains an Image Copy component to help manage your image copy process.
BRS can take batch, on-line (fuzzy), or incremental image copies; Snapshot copies; or
Instant Snapshot copies.

DIGITAL FORENSICS Page 19

GCET DEPARTMENT OF CSE-EA

The Image Copy component of BRS offers a variety of powerful features: dynamic allocation of
all input and output data sets, stacking of output data sets, high performance access methods
(faster I/O), copying by volume, compression of output image copies, and database group
processing--- all while interfacing with DBRC and processing asynchronously.

Change Accumulation

The BRS Change Accumulation component takes advantage of multiple engines, large virtual
storage resources, and high-speed channels and controllers that are available in many
environments.

Use of multiple tack control block (TCB) structures enables overlapping of as much processing
as possible, reducing both elapsed and CPU time.

Recovery

 The BRS Recovery component, which functionally replaces the IMS Database
Recovery utility for null- function (DL/I) databases and data-entry databases (DEDBs),
allow recovery of multiple databases with one pass of the log and change accumulation
data sets while dynamically allocating all data sets required for recovery.

 BRS recovers multiple databases to any point in time. BRS can determine the best
choice for a Point-in- Time (PIT) recovery. Full DBRS support includes:

RECOVERY MANAGER

 Recovery Manager component lets you automate and synchronize recoveries

across applications and databases by creating meaningful groups of related databases and
creating optimized JCL to perform the recovery of these groups.
 Recovery Manager component provides a positive response for the IMS
commands that are used to deallocate and start your databases.
 Recovery Manager component fully automates the process of cleaning the
RECON data sets for restart following a disaster recovery.
 Recovery Manager component also allows you to test your recovery strategy and

DIGITAL FORENSICS Page 20

GCET DEPARTMENT OF CSE-EA

notifies you when media errors have jeopardized your recovery resources.
POINTER CHECKING

BRS offers the capability to verify the validity of database pointers through the Concurrent
Pointer Checking function for both full-function databases and Fast Path data-entry databases
(DEDBs).

INDEX REBUILD

If indexes are ever damaged or lost, the Index Rebuild function of BRS allows you rebuild them
rather than recover them.

RECOVERY ADVISOR

The Recovery Advisor component of BRS allows you to monitor the frequency of your image
copies and change accumulations.

It helps you to determine whether all your databases are being backed-up. By using any
number of back-up and recovery tools available, you can better manage your world and be
ready to recover!

DIGITAL FORENSICS Page 21

GCET DEPARTMENT OF CSE-EA

Unit-II
EVIDENCE COLLECTION AND DATA SEZIURE
2.1 Why Collect Evidence?

The simple reasons for collecting evidence are:

 Future Prevention: Without knowing what happened, you have no hope of ever being
able to stop someone else from doing it again.

 Responsibility: The attacker is responsible for the damage done, and the only way to
bring him to justice is with adequate evidence to prove his actions. The victim has a
responsibility to the community. Information gathered after a compromise can be
examined and used by others to prevent further attacks.

2.2 Collection Options

Once a compromise has been detected, you have two options:

 Pull the system off the network and begin collecting evidence: In this case you may
find that you have insufficient evidence or, worse, that the attacker left a dead man
switch that destroys any evidence once the system detects that its offline.

 Leave it online and attempt to monitor the intruder: you may accidentally alert the
intruder while monitoring and cause him to wipe his tracks any way necessary,
destroying evidence as he goes.

2.3 Obstacles

 Computer transactions are fast, they can be conducted from anywhere, can be encrypted
or anonymous, and have no intrinsic identifying features such as handwriting and
signatures to identify those responsible.

DIGITAL FORENSICS Page 22

GCET DEPARTMENT OF CSE-EA

 Any paper trail of computer records they may leave can be easily modified or destroyed,
or may be only temporary.

 Auditing programs may automatically destroy the records left when computer
transactions are finished with them.

 Investigating electronic crimes will always be difficult because of the ease of altering the
data and the fact that transactions may be done anonymously.

 The best we can do is to follow the rules of evidence collection and be as assiduous as
possible.

2.4 Types of Evidence

 Real Evidence: Real evidence is any evidence that speaks for itself without relying
on anything else. In electronic terms, this can be a log produced by an audit function—
provided that the log can be shown to be free from contamination.

 Testimonial Evidence: Testimonial evidence is any evidence supplied by a witness.

As long as the witness can be considered reliable, testimonial evidence can be almost as
powerful as real evidence.

 Hearsay: Hearsay is any evidence presented by a person who was not a direct
witness. Hearsay is generally inadmissible in court and should be avoided.

2.5 The Rules of Evidence

1. Admissible: Admissible is the most basic rule. The evidence must be able to be used in
court.

2. Authentic: You must be able to show that the evidence relates to the incident in a relevant
way.

DIGITAL FORENSICS Page 23

GCET DEPARTMENT OF CSE-EA

3. Complete: It’s not enough to collect evidence that just shows one perspective of the
incident.

4. Reliable: Your evidence collection and analysis procedures must not cast doubt on the
evidence’s authenticity and veracity.

5. Believable: The evidence you present should be clearly understandable and believable to a
jury.

Using the preceding five rules, we can derive some basic do’s and don’ts:

 Minimize handling and corruption of original data: Once you’ve created a master
copy of the original data, don’t touch it or the original. Any changes made to the
originals will affect the outcomes of any analysis later done to copies.
 Account for any changes and keep detailed logs of your actions: Sometimes evidence
alteration is unavoidable. In these cases, it is absolutely essential that the nature, extent,
and reasons for the changes be documented.
 Comply with the five rules of evidence: Following these rules is essential to
guaranteeing successful evidence collection.
 Do not exceed your knowledge: If you ever find yourself ―out of your depth,‖ either go
and learn more before continuing (if time is available) or find someone who knows the
territory.
 Follow your local security policy: If you fail to comply with your company’s security
policy, you may find yourself with some difficulties.
 Capture as accurate an image of the system as possible: Capturing an accurate image
of the system is related to minimizing the handling or corruption of original data.
 Be prepared to testify: If you’re not willing to testify to the evidence you have collected,
you might as well stop before you start. No one is going to believe you if they can’t
replicate your actions and reach the same results.
 Work fast: The faster you work, the less likely the data is going to change. Volatile
evidence may vanish entirely if you don’t collect it in time. If multiple systems are

DIGITAL FORENSICS Page 24

GCET DEPARTMENT OF CSE-EA

involved, work parallel.

 Proceed from volatile to persistent evidence: Always try to collect the most volatile
evidence first.
 Don’t shutdown before collecting evidence: You should never, ever shutdown a
system before you collect the evidence. Not only do you lose any volatile evidence, but
also the attacker may have trojaned the startup and shutdown scripts, plug-and-play
devices may alter the system configuration, and temporary file systems may be wiped
out.
 Don’t run any programs on the affected system: The attacker may have left trojaned
programs and libraries on the system; you may inadvertently trigger something that
could change or destroy the evidence you’re looking for.

2.6 Volatile Evidence

Always try to collect the most volatile evidence first. An example an order of volatility
would be:

1. Registers and cache

2. Routing tables
3. Arp cache
4. Process table
5. Kernel statistics and modules
6. Main memory
7. Temporary file systems
8. Secondary memory
9. Router configuration
10. Network topology

2.7 General Procedure

 Identification of Evidence: You must be able to distinguish between evidence and junk
data

DIGITAL FORENSICS Page 25

GCET DEPARTMENT OF CSE-EA

 Preservation of Evidence: The evidence you find must be preserved as close as

possible to its original state.
 Analysis of Evidence: Analysis requires in-depth knowledge of what you are looking
for and how to get it.
 Presentation of Evidence: The manner of presentation is important, and it must be
understandable by a layman to be effective.

2.8 Collection and Archiving

Once we’ve developed a plan of attack and identified the evidence that needs to be
collected.

Logs and Logging: You should run some kind of system logging function. It is
important to keep these logs secure and to back them up periodically. Messages and
logs from programs can be used to show what damage an attacker did.

Monitoring: By monitoring we can gather statistics, watch out for irregular, and trace
where an attacker is coming from and what he is doing. Unusual activity or the sudden
appearance of unknown users should be considered definite cause for closer inspection.
You should display a disclaimer stating what monitoring is done when users log on.

2.9 Methods of Collection

There are two basic forms of collection: freezing the scene and honeypotting.

Freezing the Scene

 It involves taking a snapshot of the system in its compromised state. You should then
start to collect whatever data is important onto removable nonvolatile media in a
standard format.

 All data collected should have a cryptographic message digest created, and those
digests should be compared to the originals for verification.

DIGITAL FORENSICS Page 26

GCET DEPARTMENT OF CSE-EA

Honeypotting

 It is the process of creating a replica system and luring the attacker into it for further
monitoring.
 The placement of misleading information and the attacker’s response to it is a good
method for determining the attacker’s motives.

2.10 Artifacts

 There is almost always something left behind by the attacker be it code fragments,
trojaned programs, running processes, or sniffer log files. These are known as artifacts.

 Never attempt to analyze an artifact on the compromised system.

 Artifacts are capable of anything, and we want to make sure their effects are controlled.

2.11 Collection Steps

1. Find the Evidence: Use a checklist. Not only does it help you to collect evidence, but it
also can be used to double-check that everything you are looking for is there.

2. Find the Relevant Data: Once you’ve found the evidence, you must figure out
what part of it is relevant to the case.

3. Create an Order of Volatility: The order of volatility for your system is a good
guide and ensures that you minimize loss of uncorrupted evidence.

4. Remove external avenues of change: It is essential that you avoid alterations to the
original data.

5. Collect the Evidence: Collect the evidence using the appropriate tools for the job.

6. Document everything: Collection procedures may be questioned later, so it is

important that you document everything you do. Timestamps, digital signatures, and
signed statements are all important.

DIGITAL FORENSICS Page 27

GCET DEPARTMENT OF CSE-EA

2.12 Controlling Contamination: The Chain of Custody

Once the data has been collected, it must be protected from contamination. Originals
should never be used in forensic examination; verified duplicates should be used.

A good way of ensuring that data remains uncorrupted is to keep a chain of custody. This
is a detailed list of what was done with the original copies once they were collected.

Analysis

 Once the data has been successfully collected, it must be analyzed to extract the
evidence you wish to present and to rebuild what actually happened.

Time

 To reconstruct the events that led to your system being corrupted, you must be
able to create a timeline.
 Never, ever change the clock on an affected system.

Forensic Analysis of Back-ups

 When we analyze back-ups, it is best to have a dedicated host for the job. We need a
dedicated host which is secure, clean and isolated from any network for analyzing back-
ups.

 Document everything you do. Ensure that what you do is repeatable and capable of
always giving the same results.

Reconstructing the Attack

After collecting the data, we can attempt to reconstruct the chain of events leading to and
following the attacker’s break-in. We must correlate all the evidence we have gathered.
Include all of the evidence we’ve found when reconstructing the attack---no matter how
small it is.

DIGITAL FORENSICS Page 28

GCET DEPARTMENT OF CSE-EA

Searching and Seizing

There is no one methodology for performing a computer forensic investigation and analysis.

There are too many variables for to be just one way. Some of the typical variable that comes
to the mind includes operating systems; software applications; cryptographic algorithms and
applications; and hardware platforms. But moving beyond these obvious variables spring
other equally challenging variables: law, international boundaries, publicity, and
methodology.

There are a few widely accepted guidelines for computer forensic analysis:

 A computer forensic examiner is impartial. Our job is to analyze the media and report
our findings with no presumption of guilt or innocence.
 The media used in computer forensic examinations must be sterilized before each use.

 A true image (bit stream) of the original media must be made and used for the analysis.

 The integrity of the original media must be maintained throughout the entire investigation.

Before the Investigation

 For the sake of first argument, you must have skilled technicians in-house and a top notch
lab
the right equipment, the right computer forensic tools, and so on.

 District attorneys may require more documentation on the chain of evidence handling.

 When you have a case arise, you know what is required and can work the case from the
inception in support of these requirements.
Methodology Development

 Define your methodology, and working according to this methodology.

 Here methodology defines a method, a set of rules: guidelines that are employed by a
discipline.

DIGITAL FORENSICS Page 29

 GCET DEPARTMENT OF CSE-EA

Document Everything

The chain of evidence is so important in computer forensic investigations. If resources

allow, have two computer forensic personnel assigned to each case every step of the way.
Important in the documentation are the times that dates steps were taken; the names of those
involved; and under whose authority were the steps taken?

Evidence Search and Seizure

Prior to search and seizure, you already have the proper documents filled as well as permission
from the authority to search and seize the suspect’s machine.

Step 1: Preparation

You should check all media that is to be used in the examination process. Document the
wiping and scanning process. Check to make sure that all computer forensic tools are
licensed for use and all lab equipment is in working order.

Step 2: Snapshot

We should photograph the scene, whether it is a room in a home or in a business. You

should also note the scene. Take advantage of your investigative skills here. Note pictures,
personal items, and the like. Photograph the actual Evidence. For example, the evidence is a
PC in a home office. Take a photograph of the monitor. Remove the case cover carefully
and photograph the internals.

Step 3: Transport

If you have the legal authority to transport the evidence to your lab, you should pack the
evidence securely. Photograph/videotape and document the handling of evidence leaving the
scene to the transport vehicle and from transport vehicle to the lab examination facility.

Step 4: Examination

You should prepare the acquired evidence for examination in your lab. There are many

DIGITAL FORENSICS Page 30

GCET DEPARTMENT OF CSE-EA

options to on what tool to use image the drive. You could use EnCase, the Unix command
DD, ByetBack, or also SafeBack. It is wise to have a variety of tools in your lab. Each of
these tools has its respective strengths. The important note to remember here is: Turn off
virus-scanning software. We must record the time and date of the COMS. Do not boot the
suspect machine.

When making the image, make sure that the tool you use does not access the file system of
the target evidence media. After making the image, seal the original media in an
electrostatic-safe container, catalog it, and initial the container. Finally, the examination of
the acquired image begins.

DUPLICATION AND PRESERVATION OF DIGITAL EVIDENCE

2.13 Preserving the Digital Crime Scene

 After securing the computer, we should make a complete bit stream backup of all
computer data before it is reviewed or processed.

 Bit stream backups are much more thorough than standard backups.

 They involve copying of every bit of data on a storage device, and it is recommended
that two such copies be made of the original when hard disk drives are involved.

 Any processing should be performed on one of the backup copies.

 IMDUMP was the first software for taking bit stream back-ups developed by Michael
White.

SafeBack

 SafeBack has become a law enforcement standard and is used by numerous government
intelligence agencies, military agencies, and law enforcement agencies worldwide.

 SafeBack program copies and preserves all data contained on the hard disk.

 Even it goes so far as to circumvent attempts made to hide data in bad clusters and even
sectors with invalid CRCs.

DIGITAL FORENSICS Page 31

GCET DEPARTMENT OF CSE-EA

SnapBack

 Another bit steam back-up program, called SnapBack, is also available and is used by
some law enforcement agencies primarily because of its ease of use.

 Its prices several hundreds of dollars higher than SafeBack.

 It has error-checking built into every phase of the evidence back-up and restoration
process.
 The hard disk drive should be imaged using specialized bit stream back-up software.

 The floppy diskettes can be imaged using the standard DOS DISKCOPY program.

 When DOS DISKCOPY is used, it is recommended that the MS DOS Version 6.22 be
used and (data verification) switch should be invoked from the command line.

 Know and practice using all of your forensic software tools before you use them in the
processing of computer evidence.

 We may only get one chance to do it right.

2.14 Computer Evidence Processing Steps

There really are no strict rules that must be followed regarding the processing of computer
evidence.
The following are general computer evidence processing steps:

1. Shut down the computer.

Depending on the computer operating system, this usually involves pulling the plug or
shutting down a network computer using relevant commands required by the network
involved. Generally, time is of the essence, and the computer system should be shut down as
quickly as possible.

2. Document the hardware configuration of the system.

Be-fore dismantling the computer, it is important that pictures are taken of the computer

DIGITAL FORENSICS Page 32

GCET DEPARTMENT OF CSE-EA

from all angles to document the system hardware components and how they are connected.
Labeling each wire is also important, so that it can easily be reconnected when the system
configuration is restored to its original condition at a secure location.

3. Transport the computer system to a secure location.

A seized computer left unattended can easily be compromised. Don’t leave the computer
unattended unless it is locked up in a secure location.

4. Make bit stream backups of hard disks and floppy disks.

All evidence processing should be done on a restored copy of the bit stream backup rather
than on the original computer. Bit stream backups are much like an insurance policy and are
essential for any serious computer evidence processing.

5. Mathematically authenticate data on all storage devices.

You want to be able to prove that you did not alter any of the evidence after the computer
came into your possession. Since 1989, law enforcement and military agencies have used a
32- bit mathematical process to do the authentication process.

6. Document the system date and time.

If the system clock is one hour slow because of daylight-savings time, then file timestamps
will also reflect the wrong time. To adjust for these inaccuracies, documenting the system
date and time settings at the time the computer is taken into evidence is essential.

7. Make a list of key search words.

it is all but impossible for a computer specialist to manually view and evaluate every file on
a computer hard disk drive. Gathering information from individuals familiar with the case to
help com-pile a list of relevant keywords is important. Such keywords can be used in the
search of all computer hard disk drives and floppy diskettes using automated soft-ware.

8. Evaluate the Windows swap file.

The Windows swap file is a potentially valuable source of evidence and leads. When the

DIGITAL FORENSICS Page 33

GCET DEPARTMENT OF CSE-EA

computer is turned off, the swap file is erased. But the content of the swap file can easily be
captured and evaluated.

9. Evaluate file slack.

It is a source of significant security leakage and consists of raw memory dumps that occur
during the work session as files are closed. File slack should be evaluated for relevant
keywords to supplement the keywords identified in the previous steps. File slack is typically
a good source of Internet leads. Tests suggest that file slack provides approximately 80 times
more Internet leads than the Windows swap file.

10. Evaluate unallocated space (erased files).

Unallocated space should be evaluated for relevant keywords to supplement the keywords
identified in the previous steps.

11. Search files, file slack, and unallocated space for keywords.

The list of relevant keywords identified in the previous steps should be used to search all
relevant computer hard disk drives and floppy diskettes. It is important to review the output
of the text search utility and equally important to document relevant findings.

12. Document file names, dates, and times.

From an evidence standpoint, file names, creation dates, and last modified dates and times
can be relevant. The output should be in the form of a word-processing-compatible file that
can be used to help document computer evidence issues tied to specific files.

13. Identify file, program, and storage anomalies.

Encrypted, compressed, and graphic files store data in binary format. As a result, text data
stored in these file formats cannot be identified by a text search program. Manual evaluation
of these files is required. Depending on the type of file involved, the contents should be
viewed and evaluated for its potential as evidence.

DIGITAL FORENSICS Page 34

GCET DEPARTMENT OF CSE-EA

14. Evaluate program functionality.

Depending on the application software involved, running programs to learn their purpose
may be necessary. When destructive processes that are tied to relevant evidence are
discovered, this can be used to prove willfulness.

15. Document your findings.

It is important to document your findings as is-sues are identified and as evidence is found.
Documenting all of the software used in your forensic evaluation of the evidence, including
the version numbers of the programs used, is also important. Be sure you are legally
licensed to USE the forensic software. Screen prints of the operating software also help
document the version of the software and how it was used to find or process the evidence.

16. Retain copies of software used.

As part of your documentation process, it is recommended that a copy of the software used
be included with the output of the forensic tool involved. Duplication of results can be
difficult or impossible to achieve if the soft-ware has been upgraded and the original version
used was not retained.

2.15 Legal Aspects of Collecting and Preserving Computer

Forensic Evidence

Definition

 A chain of custody is a roadmap that shows how evidence was collected, analyzed, and
preserved in order to be presented as evidence in court.

 Preserving a chain of custody for electronic evidence requires proving that:

 No information has been added or changed.

 A complete copy was made.

 A reliable copying process was used.

 All media was secured.

DIGITAL FORENSICS Page 35

GCET DEPARTMENT OF CSE-EA

Legal Requirements

 When evidence is collected, certain legal requirements must be met. These legal
requirements are vast, complex, and vary from country to country.

 CERT Advisory CA-1992-19 suggests the following text be tailored to a corporation’s

specific needs under the guidance of legal counsel:

 This system is for the use of authorized users only. Individuals using
this computer system without authority, or in excess of their authority,
are subject to having all of their activities on this system monitored and
recorded by system personnel.

 In the course of monitoring individuals improperly using this system, or

in the course of system maintenance, the activities of authorized users
may also be monitored.

 Anyone using this system expressly consents to such monitoring and is

advised that if such monitoring reveals possible evidence of criminal
activity, system personnel may provide the evidence of such monitoring
to law enforcement officials.

 The legality of workplace monitoring depends primarily on whether employment

policies exist that authorize monitoring and whether that policy has been clearly
communicated to employees.

 To prove that the policy has been communicated, employees should sign a statement
indicating that they have read, understood, and agreed to comply with corporate
policy and consent to sys-tem monitoring.

Evidence Collection Procedure

When the time arrives to begin collecting evidence, the first rule that must be followed is

DIGITAL FORENSICS Page 36

GCET DEPARTMENT OF CSE-EA

Do not rush.

 The investigation team will need a copy of their incident-handling procedure, an

evidence collection notebook, and evidence identification tags.

 They may also need to bring tools to produce reliable copies of electronic evidence,
including media to use in the copying process.

 In some cases, legal counsel will want photographs of the system prior to search and
seizure. Then include a Polaroid camera in the list of tools.

The Incident Coordinator

Policy and procedure should indicate who is to act as incident coordinator.

The Incident coordinator

 will contact the other members of the response team as outlined in the Incident
Response Policy, when an incident is reported.

 will be responsible for ensuring that every detail of the incident-handling procedure
is followed, upon arrival at the incident site.

 will assign team members the various tasks outlined in the incident-handling procedure.

 serve as the liaison to the legal team, law enforcement officials, management, and
public relations personnel.

Ultimate responsibility for ensuring that evidence is properly collected and preserved, and
that the chain of custody is properly maintained, belongs to the incident coordinator.

The Evidence Notebook

 One team member will be assigned the task of maintaining the evidence note-book.
 This person will record the who, what, where, when, and how of the investigation
process. At a minimum, items to be recorded in the notebook include the following task.
a) Who initially reported the suspected incident along with time, date, and circumstances
surrounding the suspected incident?
DIGITAL FORENSICS Page 37
GCET DEPARTMENT OF CSE-EA

b) Details of the initial assessment leading to the formal investigation.

c) Names of all persons conducting the investigation.

d) The case number of the incident.

e) Reasons for the investigation.

f) A list of all computer systems included in the investigation, along with complete system
specifications. Also include identification tag numbers assigned to the systems or
individual parts of the system.

g) Network diagrams.

h) Applications running on the computer systems previously listed.

i) A copy of the policy or policies that relate to accessing and using the systems previously
listed.

j) A list of administrators responsible for the routine maintenance of the system.

k) A detailed list of steps used in collecting and analyzing evidence. Specifically, this list
needs to identify the date and time each task was performed, a description of the task,
who performed the task, where the task was performed, and the results of the analysis.

l) An access control list of who had access to the collected evidence at what date and time.

 A separate notebook should be used for each investigation. It should be bound in such a
way that it is obvious if a page or pages have been removed.

 This notebook is a crucial element in maintaining chain of custody. Therefore, it must be

as detailed as possible to assist in maintaining this chain.

Evidence Collection
 Another team member (or members) will be assigned the task of evidence collection.

 To avoid confusion, the number of people assigned this task should be kept to a minimum.

 This member (or members) should also be highly proficient with copying and analysis

DIGITAL FORENSICS Page 38

GCET DEPARTMENT OF CSE-EA

tools.

 This person will tag all evidence and work with the person responsible for the evidence
notebook to ensure that this information is properly recorded.

 Next, the person will also be responsible for making a reliable copy of all data to be used
as evidence.

 The data will include complete copies of drives on compromised or suspect systems, as
well as all relevant log files.
 This can be done on-site or the entire system can be moved to a forensics lab, as needs
dictate.

 A binary copy of the data is the proper way to preserve evidence.

 A reliable copy process has three critical characteristics.

 The process must meet industry standards for quality and reliability.

 The copies must be capable of independent verification.

 The copies must be tamperproof.

 Once all evidence is collected and logged, it can be securely transported to the forensics
lab.

 A detailed description of how data was transported and who was responsible for the
transport, along with date, time, and route, should be included in the log.

Storage and Analysis of Data

 The lab must provide some form of access control; a log should be kept detailing
entrance and exit times of all individuals.

 It is important that evidence never be left in an unsecured area.

 If a defense lawyer can show that unauthorized persons had access to the evidence, it
could easily be declared inadmissible.

DIGITAL FORENSICS Page 39

GCET DEPARTMENT OF CSE-EA

 As analysis of evidence is performed, investigators must log the details of their actions
in the evidence notebook. The following should be included at a minimum:

 The date and time of analysis

 Tools used in performing the analysis

 Detailed methodology of the analysis

 Results of the analysis.

 Finally, once all evidence has been analyzed and all results have been recorded in the
evidence notebook, a copy of the notebook should be made and given to the legal team.

 If the legal team finds that sufficient evidence exists to take legal action, it will be
important to maintain the chain of custody until the evidence is handed over to the
proper legal authorities.

 Legal officials should provide a receipt detailing all of the items received for entry into
evidence.

COMPUTER IMAGE VERIFICATION AND AUTHENTICATION

2.16 Special Needs of Evidential Authentication

 During an investigation, it is decided that evidence may reside on a computer system.

 It may be possible to seize or impound the computer system, but this risks violating the
basic principle of innocent until proven guilty, by depriving an innocent party of the
use of his or her system.

 It should be perfectly possible to copy all the information from the computer system in
a manner that leaves the original system untouched and yet makes all contents
available for forensic analysis.

 The courts may rightly insist that the copied evidence is protected from either
accidental or deliberate modification and that the investigating authority should prove
that this has been done. Thus, it is not the content that needs protection, but its

DIGITAL FORENSICS Page 40

GCET DEPARTMENT OF CSE-EA

integrity.

 This protection takes two forms:

 A secure method of determining that the data has not been altered by even a
single bit since the copy was taken.

 A secure method of determining that the copy is genuinely the one taken at the
time and on the computer in question.

 These elements are collectively referred as the Digital Image Verification and
Authentication Protocol.

DIGITAL IDS AND AUTHENTICATION TECHNOLOGY

 Without an assurance of the software’s integrity, and without knowing who published
the software, it’s difficult for customers to know how much to trust software.

 It’s difficult to make the choice of downloading the software from the Internet.

 For example (when using Microsoft Authenticode coupled with Digital IDs™ from
VeriSign®), through the use of digital signatures, software developers are able to
include information about themselves and their code with their programs.

 When customers download software signed with Authenticode and verified by

VeriSign, they should be assured of content source, indicating that the software really
comes from the publisher who signed it, and content integrity, indicating that the
software has not been altered or corrupted since it was signed.

Authenticode
 Microsoft Authenticode allows developers to include information about themselves and
their code with their programs through the use of digital signatures.

 Through Authenticode, the user is informed:

1. Of the true identity of the publisher

2. Of a place to find out more about the control

DIGITAL FORENSICS Page 41

GCET DEPARTMENT OF CSE-EA

3. The authenticity of the preceding information

 Users can choose to trust all subsequent downloads of software from the same
publisher and all software published by commercial publishers that has been verified
by VeriSign.

Public Key Cryptography

 In public key cryptographic systems, every entity has two complementary keys (a public
key and private key) that function only when they are held together.

 Public keys are widely distributed to users, whereas private keys are kept safe and only
used by their owner.

 Any code digitally signed with the publisher’s private key can only be successfully
verified using the complementary public key.

 Code that successfully verified using the publisher’s public key, could only have been
digitally signed using the publisher’s private key, and has not been tampered with.

Certificate Authorities
 Certification Authorities such as VeriSign are organizations that issue digital certificates
to applicants whose identity they are willing to vouch for. Each certificate is linked to
the certificate of the CA that signed it.

 VeriSign has the following responsibilities:

1. Publishing the criteria for granting, revoking, and managing certificates

2. Granting certificates to applications who meet the published criteria

3. Managing certificates

4. Storing VeriSign’s root keys in an exceptionally secure manner

5. Verifying evidence submitted by applicants

6. Providing tools for enrollment

DIGITAL FORENSICS Page 42

GCET DEPARTMENT OF CSE-EA

7. Accepting the liability associated with these responsibilities

8. Time-stamping digital signatures.

Digital ID
 A Digital ID/Certificate is a form of electronic credentials for the Internet.

 A Digital ID is issued by a trusted third party to establish the identity of the ID holder.

 The third party who issues certificates is known as a Certificate Authority (CA).

 Digital ID technology is based on the theory of public key cryptography.

 The purpose of a Digital ID is to reliably link a public/private key pair with its owner.

 When a CA such as VeriSign issues a Digital IDs, it verifies that the owner is not
claiming a false identity.

 When a CA issues you a digital certificate, it puts its name behind the statement that you
are the rightful owner of your public/private key pair.

How Authenticode works with VeriSign Digital IDs?

Authenticode: VeriSign Digital ID process

1. Publisher obtains a Software Developer Digital ID from VeriSign

2. Publisher creates code

3. Using the SIGNCODE.EXE utility, the publisher

 Creates a hash of the code, using an algorithm such as MD5 or SHA

DIGITAL FORENSICS Page 43

GCET DEPARTMENT OF CSE-EA

 Encrypts the has using his/her private key

 Creates a package containing the code, the encrypted hash, and the publisher’s
certificate
4. The end user encounters the package

5. The end user’s browser examines the publisher’s Digital ID. Using the VeriSign root
Public Key, which is already embedded in Authenticode enabled applications, the end
user browser verifies the authenticity of Software Developer Digital ID (which is itself
signed by the VeriSign root Private Key)

6. Using the publisher’s public key contained within the publisher’s Digital ID, the end
user browser decrypts the signed hash.

7. The end browser runs the code through the same hashing algorithm as the publisher,
creating a new hash.

8. The end user browser compares the two hashes. If they are identical, the browser
messages that the content has been verified by VeriSign, and the end user has the
confidence that the code was signed by the publisher identified in the Digital ID, and the
code hasn’t been altered since it was signed.

Time Stamping: Because key pairs are based on mathematical relationships that can
theoretically be ―cracked‖ with a great deal of time and effort, it is a well-established
security principle that digital certificates should expire.

2.17 Practical Consideration

 It is useful to present some fundamental requirements of a forensic data collection
system before considering how these can be securely protected.

 Other forensic experts may argue against some or all of them:

a. Forensic data collection should be complete and non-software specific, thus

avoiding software traps and hidden partitioning.

b. In operation, it should be as quick and as simple as possible to avoid error or delay.

DIGITAL FORENSICS Page 44

GCET DEPARTMENT OF CSE-EA

c. It should be possible for anyone to use a forensic data collection system with the
minimum amount of training.

d. Necessary costs and resources should be kept to a minimum.

 To meet the conditions specified in items 2, 3, and 4, the digital integrity verification and
authentication protocol must be tailored to suit.

 Only investigators issued with a valid digital signature would be able to complete copies.

2.18 Practical Implementation

 A minimum amount of reliance is placed on the technical ability of the
operator/investigator.

 It must be understood that during the copying process, procedures are implemented to
trap and handle hardware errors, mapping exceptions where necessary.

 It must also be understood that procedures are implemented to verify that information is
copied correctly.

 This information is stored on each cartridge within a copy series.

 Also stored on each cartridge is a reference area containing copy-specific

information such as CPU type and speed, hardware equipment indicators, copying drive
serial number, cartridge sequence number, exhibit details and reference comments,
operator name together with a unique password, and the real date and time as entered by
the operator.

 The cartridge is divided into blocks of an arbitrary chosen size. Blocks may contain
reference, ROM, CMOS, or disk data depending on their location on the cartridge. Each
cartridge contains the information copied from the suspect drive on a sector by sector
basis.

Safe Boxes and the Vault

 As each block is copied and verified, a hash value is generated such that a single bit
change anywhere within the block would produce a different hash. The result is stored in
the relevant safe box and copying to the next block.

DIGITAL FORENSICS Page 45

GCET DEPARTMENT OF CSE-EA

 Once all the blocks relevant to a particular cartridge have been copied and treated in this
way, the whole group of safe boxes, collectively referred to as the vault, are treated as an
individual block and a vault hash value is generated and stored in the final safe box. The
vault is then copied to another area of the cartridge and this second copy is encrypted.

 The vault hash value for each cartridge is stored in a separate area in memory and the
operator is prompted to insert a new cartridge until the copy is completed. The final
cartridge will contain similar information to the others in the series and in addition will
have the accumulated vault hash values from all other cartridges in the series.

 Once the final cartridge has been copied, the operator is prompted to insert a
preformatted floppy disk into the drive used to start the DIBS process. All of the
accumulated vault hash values are then written to a floppy disk together with the
reference details of the whole copy procedure. At least two identical floppy disks are
created in this manner.

 The floppy disks are then sealed in numbered, tamperproof bags and both numbers are
written on both envelops. The computer owner is given his or her chosen floppy and the
other is placed in secure storage.

Security Considerations
 Computer forensics investigators are constantly discovering new vulnerabilities in old
image verification and authentication products.

 As a result CIOs (Chief information Officers) are devoting more money and time to
image verification and authentication security.

 Staff-members are the ones who make sure viruses don’t come in and holes aren’t
created in the firewall.

 They have to understand that most business is built on trust, and their role in maintaining
trust is crucial.

 It’s difficult, perhaps impossible, to measure the return on investment in security.

DIGITAL FORENSICS Page 46

GCET DEPARTMENT OF CSE-EA

 You have to protect your data. It only takes one time ---one hacker getting in and
hacking all your financial data.

 It would be irresponsible on CIO’s part not have the toughest image verification and
authentication security possible.

DIGITAL FORENSICS Page 47