investigation of white-collar crime using mobile forensics ... · investigation of white-collar...

52
Investigation of white-collar crime using Mobile Forensics Analysis Dr. Max Mustermann Referat Kommunikation & Marketing Verwaltung

Upload: others

Post on 25-Mar-2020

6 views

Category:

Documents


0 download

TRANSCRIPT

Page 1: Investigation of white-collar crime using Mobile Forensics ... · Investigation of white-collar crime using Mobile Forensics Analysis Acquisition Examination Analysis Presentation

Investigation of white-collar crime using Mobile Forensics Analysis

Dr. Max MustermannReferat Kommunikation & Marketing Verwaltung

Page 2: Investigation of white-collar crime using Mobile Forensics ... · Investigation of white-collar crime using Mobile Forensics Analysis Acquisition Examination Analysis Presentation

Investigation of white-collar crime using Mobile Forensics Analysis

Page 3: Investigation of white-collar crime using Mobile Forensics ... · Investigation of white-collar crime using Mobile Forensics Analysis Acquisition Examination Analysis Presentation

Investigation of white-collar crime using Mobile Forensics Analysis

Page 4: Investigation of white-collar crime using Mobile Forensics ... · Investigation of white-collar crime using Mobile Forensics Analysis Acquisition Examination Analysis Presentation

Investigation of white-collar crime using Mobile Forensics Analysis

Page 5: Investigation of white-collar crime using Mobile Forensics ... · Investigation of white-collar crime using Mobile Forensics Analysis Acquisition Examination Analysis Presentation

Investigation of white-collar crime using Mobile Forensics Analysis

Page 6: Investigation of white-collar crime using Mobile Forensics ... · Investigation of white-collar crime using Mobile Forensics Analysis Acquisition Examination Analysis Presentation

Investigation of white-collar crime using Mobile Forensics Analysis

Page 7: Investigation of white-collar crime using Mobile Forensics ... · Investigation of white-collar crime using Mobile Forensics Analysis Acquisition Examination Analysis Presentation

Investigation of white-collar crime using Mobile Forensics Analysis

Page 8: Investigation of white-collar crime using Mobile Forensics ... · Investigation of white-collar crime using Mobile Forensics Analysis Acquisition Examination Analysis Presentation

Investigation of white-collar crime using Mobile Forensics Analysis

Page 9: Investigation of white-collar crime using Mobile Forensics ... · Investigation of white-collar crime using Mobile Forensics Analysis Acquisition Examination Analysis Presentation

Investigation of white-collar crime using Mobile Forensics Analysis

Page 10: Investigation of white-collar crime using Mobile Forensics ... · Investigation of white-collar crime using Mobile Forensics Analysis Acquisition Examination Analysis Presentation

Investigation of white-collar crime using Mobile Forensics Analysis

Page 11: Investigation of white-collar crime using Mobile Forensics ... · Investigation of white-collar crime using Mobile Forensics Analysis Acquisition Examination Analysis Presentation

Investigation of white-collar crime using Mobile Forensics Analysis

´

Page 12: Investigation of white-collar crime using Mobile Forensics ... · Investigation of white-collar crime using Mobile Forensics Analysis Acquisition Examination Analysis Presentation

Investigation of white-collar crime using Mobile Forensics Analysis

Page 13: Investigation of white-collar crime using Mobile Forensics ... · Investigation of white-collar crime using Mobile Forensics Analysis Acquisition Examination Analysis Presentation

Investigation of white-collar crime using Mobile Forensics Analysis

Page 14: Investigation of white-collar crime using Mobile Forensics ... · Investigation of white-collar crime using Mobile Forensics Analysis Acquisition Examination Analysis Presentation

Investigation of white-collar crime using Mobile Forensics Analysis

a = 0

b = 0

a = 1

b = 0

a = 0

b = 1

a = 1

b = 1

p1action1

p1action2

p1action2

p1action1

Page 15: Investigation of white-collar crime using Mobile Forensics ... · Investigation of white-collar crime using Mobile Forensics Analysis Acquisition Examination Analysis Presentation

Investigation of white-collar crime using Mobile Forensics Analysis

Page 16: Investigation of white-collar crime using Mobile Forensics ... · Investigation of white-collar crime using Mobile Forensics Analysis Acquisition Examination Analysis Presentation

Investigation of white-collar crime using Mobile Forensics Analysis

▪ ℵ

𝐴 → 𝐵

𝑅

Page 17: Investigation of white-collar crime using Mobile Forensics ... · Investigation of white-collar crime using Mobile Forensics Analysis Acquisition Examination Analysis Presentation

Investigation of white-collar crime using Mobile Forensics Analysis

Information System (IS)

Application System

ClientServer

ERP Database Server

Microsoft Windows Server

2008 R2 SP 1

Persons

(AutoIt)GUI

ERP Client

Component

Microsoft Windows 7

SP 1

KVM (Hypervisor)

Page 18: Investigation of white-collar crime using Mobile Forensics ... · Investigation of white-collar crime using Mobile Forensics Analysis Acquisition Examination Analysis Presentation

Investigation of white-collar crime using Mobile Forensics Analysis

Page 19: Investigation of white-collar crime using Mobile Forensics ... · Investigation of white-collar crime using Mobile Forensics Analysis Acquisition Examination Analysis Presentation

Investigation of white-collar crime using Mobile Forensics Analysis

Page 20: Investigation of white-collar crime using Mobile Forensics ... · Investigation of white-collar crime using Mobile Forensics Analysis Acquisition Examination Analysis Presentation

Investigation of white-collar crime using Mobile Forensics Analysis

Page 21: Investigation of white-collar crime using Mobile Forensics ... · Investigation of white-collar crime using Mobile Forensics Analysis Acquisition Examination Analysis Presentation

Investigation of white-collar crime using Mobile Forensics Analysis

Page 22: Investigation of white-collar crime using Mobile Forensics ... · Investigation of white-collar crime using Mobile Forensics Analysis Acquisition Examination Analysis Presentation

Investigation of white-collar crime using Mobile Forensics Analysis

Page 23: Investigation of white-collar crime using Mobile Forensics ... · Investigation of white-collar crime using Mobile Forensics Analysis Acquisition Examination Analysis Presentation

Investigation of white-collar crime using Mobile Forensics Analysis

Page 24: Investigation of white-collar crime using Mobile Forensics ... · Investigation of white-collar crime using Mobile Forensics Analysis Acquisition Examination Analysis Presentation

Investigation of white-collar crime using Mobile Forensics Analysis

Page 25: Investigation of white-collar crime using Mobile Forensics ... · Investigation of white-collar crime using Mobile Forensics Analysis Acquisition Examination Analysis Presentation

Investigation of white-collar crime using Mobile Forensics Analysis

Page 26: Investigation of white-collar crime using Mobile Forensics ... · Investigation of white-collar crime using Mobile Forensics Analysis Acquisition Examination Analysis Presentation

Investigation of white-collar crime using Mobile Forensics Analysis

193.174.122.141 - - [13/Feb/2015:14:10:00 +0100] "GET / HTTP/1.1" 200 39 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:35.0) Gecko/20100101 Firefox/35.0"193.174.122.141 - - [13/Feb/2015:14:18:53 +0100] "GET / HTTP/1.1" 200 39 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:35.0) Gecko/20100101 Firefox/35.0"193.174.122.141 - - [13/Feb/2015:14:20:27 +0100] "GET / HTTP/1.1" 304 - "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"193.174.122.141 - - [13/Feb/2015:14:21:42 +0100] "GET / HTTP/1.1" 304 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"

Page 27: Investigation of white-collar crime using Mobile Forensics ... · Investigation of white-collar crime using Mobile Forensics Analysis Acquisition Examination Analysis Presentation

Investigation of white-collar crime using Mobile Forensics Analysis

Acquisition Examination Analysis Presentation

Decide which evidence/data is relevant to the case

Secure and collect digital evidence from the crime scene

Interpretation of data

Correlate evidence

Handle uncertainty

assess likelihood of events

Write a Report

Present evidence in a court of law

Page 28: Investigation of white-collar crime using Mobile Forensics ... · Investigation of white-collar crime using Mobile Forensics Analysis Acquisition Examination Analysis Presentation

Investigation of white-collar crime using Mobile Forensics Analysis

Acquisition Examination Analysis Presentation

Page 29: Investigation of white-collar crime using Mobile Forensics ... · Investigation of white-collar crime using Mobile Forensics Analysis Acquisition Examination Analysis Presentation

Investigation of white-collar crime using Mobile Forensics Analysis

Acquisition Examination Analysis Presentation

Page 30: Investigation of white-collar crime using Mobile Forensics ... · Investigation of white-collar crime using Mobile Forensics Analysis Acquisition Examination Analysis Presentation

Investigation of white-collar crime using Mobile Forensics Analysis

Acquisition Examination Analysis Presentation

Page 31: Investigation of white-collar crime using Mobile Forensics ... · Investigation of white-collar crime using Mobile Forensics Analysis Acquisition Examination Analysis Presentation

Investigation of white-collar crime using Mobile Forensics Analysis

Acquisition Examination Analysis Presentation

Page 32: Investigation of white-collar crime using Mobile Forensics ... · Investigation of white-collar crime using Mobile Forensics Analysis Acquisition Examination Analysis Presentation

Investigation of white-collar crime using Mobile Forensics Analysis

Page 33: Investigation of white-collar crime using Mobile Forensics ... · Investigation of white-collar crime using Mobile Forensics Analysis Acquisition Examination Analysis Presentation

Investigation of white-collar crime using Mobile Forensics Analysis

Page 34: Investigation of white-collar crime using Mobile Forensics ... · Investigation of white-collar crime using Mobile Forensics Analysis Acquisition Examination Analysis Presentation

Investigation of white-collar crime using Mobile Forensics Analysis

Page 35: Investigation of white-collar crime using Mobile Forensics ... · Investigation of white-collar crime using Mobile Forensics Analysis Acquisition Examination Analysis Presentation

Investigation of white-collar crime using Mobile Forensics Analysis

Page 36: Investigation of white-collar crime using Mobile Forensics ... · Investigation of white-collar crime using Mobile Forensics Analysis Acquisition Examination Analysis Presentation

Investigation of white-collar crime using Mobile Forensics Analysis

Page 37: Investigation of white-collar crime using Mobile Forensics ... · Investigation of white-collar crime using Mobile Forensics Analysis Acquisition Examination Analysis Presentation

Investigation of white-collar crime using Mobile Forensics Analysis

Page 38: Investigation of white-collar crime using Mobile Forensics ... · Investigation of white-collar crime using Mobile Forensics Analysis Acquisition Examination Analysis Presentation

Investigation of white-collar crime using Mobile Forensics Analysis

Page 39: Investigation of white-collar crime using Mobile Forensics ... · Investigation of white-collar crime using Mobile Forensics Analysis Acquisition Examination Analysis Presentation

Investigation of white-collar crime using Mobile Forensics Analysis

Page 40: Investigation of white-collar crime using Mobile Forensics ... · Investigation of white-collar crime using Mobile Forensics Analysis Acquisition Examination Analysis Presentation

Investigation of white-collar crime using Mobile Forensics Analysis

Page 41: Investigation of white-collar crime using Mobile Forensics ... · Investigation of white-collar crime using Mobile Forensics Analysis Acquisition Examination Analysis Presentation

Investigation of white-collar crime using Mobile Forensics Analysis

Page 42: Investigation of white-collar crime using Mobile Forensics ... · Investigation of white-collar crime using Mobile Forensics Analysis Acquisition Examination Analysis Presentation

Investigation of white-collar crime using Mobile Forensics Analysis

Page 43: Investigation of white-collar crime using Mobile Forensics ... · Investigation of white-collar crime using Mobile Forensics Analysis Acquisition Examination Analysis Presentation

Investigation of white-collar crime using Mobile Forensics Analysis

Digital forensics

Urgent measures

Normaloperation

Incidentresponse

Emergencymode

Normaloperation

Restart

Restoring

Page 44: Investigation of white-collar crime using Mobile Forensics ... · Investigation of white-collar crime using Mobile Forensics Analysis Acquisition Examination Analysis Presentation

Investigation of white-collar crime using Mobile Forensics Analysis

n = 59

Page 45: Investigation of white-collar crime using Mobile Forensics ... · Investigation of white-collar crime using Mobile Forensics Analysis Acquisition Examination Analysis Presentation

Investigation of white-collar crime using Mobile Forensics Analysis

Page 46: Investigation of white-collar crime using Mobile Forensics ... · Investigation of white-collar crime using Mobile Forensics Analysis Acquisition Examination Analysis Presentation

Investigation of white-collar crime using Mobile Forensics Analysis

Page 47: Investigation of white-collar crime using Mobile Forensics ... · Investigation of white-collar crime using Mobile Forensics Analysis Acquisition Examination Analysis Presentation

Investigation of white-collar crime using Mobile Forensics Analysis

Page 48: Investigation of white-collar crime using Mobile Forensics ... · Investigation of white-collar crime using Mobile Forensics Analysis Acquisition Examination Analysis Presentation

Investigation of white-collar crime using Mobile Forensics Analysis

Towards a Capability Maturity Model for Digital Forensic Readiness

Page 49: Investigation of white-collar crime using Mobile Forensics ... · Investigation of white-collar crime using Mobile Forensics Analysis Acquisition Examination Analysis Presentation

Investigation of white-collar crime using Mobile Forensics Analysis

Page 50: Investigation of white-collar crime using Mobile Forensics ... · Investigation of white-collar crime using Mobile Forensics Analysis Acquisition Examination Analysis Presentation

Investigation of white-collar crime using Mobile Forensics Analysis

Page 51: Investigation of white-collar crime using Mobile Forensics ... · Investigation of white-collar crime using Mobile Forensics Analysis Acquisition Examination Analysis Presentation

Investigation of white-collar crime using Mobile Forensics Analysis

51

Contact details

Ludwig Englbrecht, [email protected]

@LJESec

Chair of Information Systems I (Prof. Dr. Günther Pernul)

University of Regensburg

http://www-ifs.uni-regensburg.de

Page 52: Investigation of white-collar crime using Mobile Forensics ... · Investigation of white-collar crime using Mobile Forensics Analysis Acquisition Examination Analysis Presentation

Investigation of white-collar crime using Mobile Forensics Analysis