analysis of digital evidence
Post on 08-Apr-2017
115 Views
Preview:
TRANSCRIPT
RAKESH KUMAR MISHRA15MSFS035M.Sc.(FORENSIC SCIENCE)2ND SEMESTER
ANALYSIS OF DIGITAL EVIDENCE
Content.. DIGITAL
EVIDENCE PLACE WHERE DIGITAL EVIDENCE FOUND WHY INVESTIGATE..?? CARDINAL RULES OF COMPUTER
FORENSIC BAISC CONCEPT OF ANALYSIS OF DIGITAL EVIDENCE.. DIGITAL EVIDENCE ANALYSIS
METHEDOLOGY.. OFFENCE & PUNISHMENT UNDER THE INFORMATION ACT ,2000
DIGITAL EVIDENCE Digital evidence is information stored or transmitted in
binary form that may be relied on, in court. Digital evidence includes information on computers, audio
files, video recordings, and digital images. Digital evidence is information and data of value to an
investigation that is stored on, received, or transmitted by an electronic device.
This evidence is acquired when data or electronic devices are seized and secured for examination. Digital evidence—
■ Is latent, like fingerprints or DNA evidence. ■ Crosses jurisdictional borders quickly and easily. ■ Is easily altered, damaged, or destroyed. ■ Can be time sensitive.
possible places that digital evidence can reside, including: Computers External hard drives CDs and DVDs Thumb drives Floppy disks Cell phones Voice over IP phones Answering machines iPods
POSSIBLE PLACE WHERE DIGITAL
EVIDENCE FOUND……
Electronic game devices Digital video recorders (Tivos) Digital cameras PDAs GPSs Routers Switches Wireless access points Servers Fax machines Printers that buffer files Photo-copiers that buffer files Scanners that buffer files
Continue…..
First we will need to consider the complaint or the initial reason for conducting an investigation.
Some typical reasons that may warrant an investigation include but are not limited to:
Unauthorised access on computer or Network
Internet usage exceeds normUsing e−mail inappropriately
Why Investigate..??
Use of Internet, e−mail, or PC in a non−work−related manner
Theft of informationViolation of security policies or
proceduresIntellectual property Infringement Electronic tamperingOnline or Economic Fraud Software PiracyTelecommunication Fraud Terrorism (Homeland Security) Child Abuse or Exploitation
Continue…..
CARDINAL RULES OF COMPUTER FORENSIC…
The cardinal rules have been evolved to facilitate a forensically sound examination of computer media and enable a forensic scientist to testify in court in respect of their handling a particular piece of evidence.
The five cardinal rules are…Never
Mishandle the
EvidenceNever Work on
the original
Evidence
Never trust the
Subject’s Operating System.
Document everythin
g
The Result should be repeatable
and verifiable by
a third party.
SEIZURE
ACQUISTION
ANALYSIS
PRESENTATION
SEIZURE… Prior to the actual examination digital media
will be seized. In criminal cases this will often be performed
by law enforcement personnel trained as technicians to ensure the preservation of evidence.
In civil matters it will usually be a company officer, often untrained. Various laws cover the seizure of material.
In criminal matters law related to search warrants is applicable.
In civil proceedings the assumption is that a company is able to investigate their own equipment without a warrant, so long as the privacy and human rights of employees are observed.
ACQUISTION…
A Tableau forensic write blocker
Once exhibits have been seized an exact sector level duplicate (or "forensic duplicate") of the media is created, usually via a write blocking device, a process referred to as Imaging or Acquisition.
The duplicate is created using a hard-drive duplicator or software imaging tools such as DCFLdd, Iximager, Guymager, TrueBack, EnCase, FTK Imager or FDAS.
The original drive is then returned to secure storage to prevent tampering.
The acquired image is verified by using the SHA-1 or MD5 hash functions. At critical points throughout the analysis, the media is verified again, known as "hashing", to ensure that the evidence is still in its original state
Continue…..
Sector…. A sector, being the smallest physical storage
unit on the disk. A sector is a subdivision of a track on
a magnetic disk or optical disc. Each sector stores a fixed amount of user-
accessible data, traditionally 512 bytes for hard disk drive (HDDs) and 2048 bytes for CD-ROMs and DVD-ROMs
Write Blockers… Write blockers are devices that allow
acquisition of information on a drive without creating the possibility of accidentally damaging the drive contents.
There are two ways to build a write-blocker: the blocker can allow all commands to pass from the computer to the drive except for those that are on a particular list.
Alternatively, the blocker can specifically block the write commands and let everything else through.
There are two types of write blockers, Native and Tailgate. A Native device uses the same interface on for both in and out, for example a IDE to IDE write block. A Tailgate device uses one interface for one side and a different one for the other, for example a Firewire to SATA write block.
A hard drive attached to a portable write blocker
Analysis…A number of techniques are used during computer forensics investigations and much has been written on the many techniques used by law enforcement in particular…… Cross-drive analysisA forensic technique that correlates information found on multiple hard drives. The process, still being researched, can be used to identify social networks and to perform anomaly detection. Live analysis The examination of computers from within the operating system
using custom forensics or existing sysadmin tools to extract evidence.
The practice is useful when dealing with Encrypting File Systems, for example, where the encryption keys may be collected and, in some instances, the logical hard drive volume may be imaged (known as a live acquisition) before the computer is shut down.
Deleted files… A common technique used in computer
forensics is the recovery of deleted files.
Modern forensic software have their own tools for recovering or carving out deleted data.
Most operating systems and file systems do not always erase physical file data, allowing investigators to reconstruct it from the physical disk sectors.
File carving involves searching for known file headers within the disk image and reconstructing deleted materials
DIGITAL EVIDENCE ANALYSIS METHODOLOGY…
Protect the crime scene Force shutdown of the computer Document the hardware configuration of the system Transport the computer system to a Forensic Laboratory Make bit stream backups of Hard disk and floppy disk Authentication the data mathematically on all Storage
devices (Hash value) Document the System Date and time. List the key words for the search Evaluate the windows swap file Evaluate file slack Evaluation of unallocated Space (erased files) Searching files , file slack and unallocated space for key
words Document file names, dates and time Identify file, Programme and storage Anomalies Evaluation the programme functionality Document your findings Retain copies of software used
Protect the crime scene...
The first and fore most step is to protect the crime scene, for which access to the area around the suspect computer should be restricted only to the individual involved with the investigation.
The scene should be documented in great details. The computer and the surrounding area should be photographed from all angels.Force shutdown of the computer
This should be done as quickly as possible. Consideration should be given to possible destructive processes that may be operating in the background.
Do not shut down the computer abruptly.
Follow the detailed power shut down procedure for various operating system as given in chart….Operating system Power Shut Down ProcedureMS DOS Photograph screen and document any programmes running
Pull the power cord from the wall socket In case of laptop, remove the battery pack
UNIX/LINUX Photograph screen and document any programmes running Right click the menu Frome menu, click Console If root user prompt(#) not present , change user to root by typing su- If root password not available , pull power cord from the wall socket If password is available , enter it. At the # sign type sync;sync;halt and
the system will shutdown Pull power cord from wall socket
Mac Photograph screen and document any programmes running Click Special Click Shutdown The window will tell you it is safe to turn off the computer. Pull power cord from wall socket
Windows Photograph screen and document any programmes running Pull power cord from wall socket
3.X/95/98/Nt Pull power cord from wall socket In case of laptop, remove the battery pack
Document the Hardware Configuration of the System… Pay close attention to how the computer is
set up before it is dismantled, as it will have to be restored to its original condition at a secure location.
In additional to photography, diagram the computer configuration on paper and by labelling which cables are attached and what they are attached to.
Transport the computer system to a secure location(Forensic laboratory)….. Do not leave the subject computer
unattended unless it is locked up in a secure location.
Transport the seized equipment to a secure and controlled environment that is trusted to be free of any thing that could modify or destroy the evidence.
Make bit stream backups of Hard disked /floppy disks:
Bit stream format.???
A bit stream format is the format of the data
found in a stream of bits used in a digital
communication or data storage application.
Disconnect the hard drive and boot from a floppy disk (the BIOS may need to be modified to allow boot from a floppy).
The computer should not be operated and computer evidence should not be processed until bit stream backups of all hard disk drives and floppy disks have been made.
The evidence processing should be done on a restored copy of the bit stream backup rather than on the original computer.
The computer forensic scientist should make a bit stream image of the suspect hard drive before anything else
Authentication the data mathematically on all Storage devices…
Proof may have to provide that none of the evidence has been altered after the computer came into possession of the investigation team. Forensic tools are available to mathematically authenticate the data using a 128-bit level of accuracy.
Use a hash algorithm to generate a numeric expression and compare this to the same has algorithm an the data that was backed up, in order to mathematically authenticate the data.
This is used as proof that the files have not been changed.hash
algorithm ???
A hash function is any function that can be used to map data of arbitrary size to data of fixed size.
The values returned by a hash function are called hash values, hash codes, hash sums, or simply hashes.
One use is a data structure called a hash table, widely used in computer software for rapid data lookup.
Hash functions accelerate table or database lookup by detecting duplicated records in a large file
Document the System Date and time. The dates and times associated
with the computer files can be extremely important from an evidence standpoint.
However, the accuracy of the dates and times is just as important.
Document the system date and time setting at the time the computer is taken into possession.
List the key words for the search.. Forensic tools are available to
search for the relevant evidence. Usually, some information is known about the allegations, the computer user and the alleged associates that may be involved.
Information gathered from the individuals, who are familiar with the case, would help in compelling a list of key words that are relevant to the investigation.
These can be used to search the disk drives.
Evaluate the windows swap file
The windows swap file is a potentially valuable source of evidence and leads.
The evaluation of the swap file can be automated with forensic tools.
New technologies Inc. has tools and programmes that will capture erased file space and create a file that can be searched for key words that can be added to the list.
Evaluate file slack File slack is a data storage area about which
most of the computer users are not aware. It is a source of significant security leakage
and consist of raw memory dumps that occur during the work session, as the files are closed.
The data dumped from the memory ends up being stored at the end of allocated files, beyond the reach or view of the user.
Forensic tools are required to view and evaluate the file slack and it can provide a wealth of information and investigative leads.
Evaluation of unallocated Space (erased files)
The ‘delete’ function of DOS and Windows does not completely erase the file names or the file contents.
Unallocated space may still contain these erased files and the file slack associated with erased files.
The DOS undelete programme can be used to restore the previously erased files.Searching files, file slack and unallocated space for key words
The list of relevant key words, identified in the previous step, should be used to search all relevant computer hard disk drives and floppy disks.
Document file names, dates and time
From an evidence standpoint, file names, their date of creation and last modification can be relevant.
Therefore, it is important to catalogue all this date and time of existing and erased files.Identify file, Programme and storage
Anomalies Encrypted, compressed and graphic files
store data in binary format. As a result, a text search programme cannot
identify text data stored in these formats. Manual evaluation of these file is required
and in case of encrypted files, more efforts may be involved. Reviewing the portions on seized hard disk drive is also important.
Use disk utilise such as ‘undelete’ to recover as much of the deleted data as possible.
. Evaluation the programme functionality
Depending on the application software involved, running programmes to learn their purpose may necessary.
Document your findings As indicated in the preceding steps, it is very important to document
the finding as issues are identified and as evidence is found. It is also important to document the software that was used in the
forensic evaluation of the evidence, including the version numbers of the programmers.Retain copies of software
used As part of the documentation process, it is recommended that a copy of the forensic tool software used be include.
Often it is necessary to duplicate the forensic processing result during or before trial.
Duplication of result can be difficult or impossible to achieve if the software has been upgraded and the original version used was not retained.
Offence & Punishment under the Information Act ,2000Offence….
.The offences included in the IT Act 2000 are as follows:1. Tampering with the computer source documents.2. Hacking with computer system.3. Publishing of information which is obscene in electronic form.4. Power of Controller to give directions5. Directions of Controller to a subscriber to extend facilities to decrypt information6. Protected system7. Penalty for misrepresentation8. Penalty for breach of confidentiality and privacy9. Penalty for publishing Digital Signature Certificate false in certain particulars10. Publication for fraudulent purpose11. Act to apply for offence or contravention committed outside India12. Confiscation13. Penalties or confiscation not to interfere with other punishments.14. Power to investigate offences.
Punishment Section 43 of IT Act states any act of destroying,
altering or stealing computer system/network or deleting information with act of damaging data or information without authorization of owner of that computer is liable for payment to be made to owner as compensation for damages
Section 43A of IT Act states any corporate body dealing with sensitive information and negligent with implementing reasonable security practices causing loss or wrongful gain to any other person will also be liable as convict for compensation to the affected party
Section 66 states hacking of computer system by individual with dishonesty or fraudulently with 3 yrs. imprisonment with fine of Rs. 5,00,000 or both
Section 66A states any offensive information with demean character or information known as false but sent for purpose of causing annoyance, inconvenience, danger, enmity, hatred or criminal intimidation to mislead the recipient is liable for imprisonment upto 3 years with (or) without fine
Section 66 B,C,D for fraudulently or dishonesty using or transmitting information or Identity theft is punishable with 3 yr imprisonment or 1,00,000 fine or both
Section 66 E for Violation of privacy by transmitting image of private area is punishable with 3 yr imprisonment or 2,00,000 fine or both
Section 66 F on Cyber Terrorism affecting unity, integrity security, sovereignity of India through digital medium is liable for life imprisonment
Section 67 states publishing obscene information or pornography or transmitting obscene information in public is liable for imprisonment upto 5 years or penalty of Rs. 10,00,000 or both
Continue….
top related