By: varsonun
June 23, 2018
Introduction to Computer Forensics
By: varsonun
June 23, 2018
A computer is a device that solves problems, manipulates information, processes data, performs calculations, and stores and retrieves data. Computers are classified by size and power. Some categories of the computer are the personal computer, workstation, minicomputer, mainframe, and a supercomputer. It uses different programs to perform different tasks.
Forensics can be termed as the process of using different processes to gather evidence and also some scientific methods to help in solving crimes.
Computer Forensics
Computer forensics is the branch of forensic science in which evidence is found in a computer or digital device. The aim of computer forensics is to examine digital devices in a constructive way with the goal of identifying, preserving, recovering, analyzing, and presenting the evidence in a court of law.
Computer forensics uses a number of methods for investigation as per the guidelines of the law. Some of its methods are
- Cross Drive Analysis
- Live Analysis
- Deleted Files
- Stochastic Forensics
- Steganography
- Digital Forensics
- Open Computer Forensics Architecture
- Caine
- X-Ways Forensics
- EnCase
- Registry Recon
- Volatility and many more…
These tools can be further classified into:
- Disk and Data Capture Tools
- Database Forensics Tools
- File Viewers
- Network Forensics Tools
- File Analysis Tools
- MacOS Analysis Tools
- Internet Analysis Tools
- Mobile Devices Analysis Tools
- Email Analysis Tools
- Registry Analysis Tools
Processes in Computer Forensics
Evaluation
In this process of evaluation, computer forensics experts are given instructions, clarification of those instructions if not clear, guidelines for performing activities, and allocation of roles and resources. Such a process includes proper instructions on how to prepare systems for collecting evidence and where to store evidence. Instruction on documentation is also given to help ensure the authenticity of the data.
The process of computer forensics needs proper steps to determine the details of a case. It includes the proper reading of case briefs, understanding every fact, and obtaining permissions to continue the case.
Collection
This process involves the labeling and bagging of evidence from the crime scene. Secure and safe transportation of material is also important. Data is transferred to the expert’s system.
In this process, cyber forensics experts visit the crime scene and collect evidence that is helpful for the investigation of the crime. Documents are needed during and after this process and include detailed information on the evidence. In this process, copies of evidence are made so that no information is lost during the investigation process.
Analysis
Computer forensics experts use a variety of methods and approaches to examine the evidence. This can be done by using the various types of available forensic software. In this process, deleted data, sensitive data, recently used data, and all other important files, as well as programs, are examined. Analysis of evidence must be accurate and must be done within the allotted time; its details should be recorded properly. Experts analyze the evidence twice to verify the correctness of the results.
Presentation
This process involves the proper documentation of evidence and the examination process of evidence. It includes all the methods used in the process, the techniques used, and coping. The securing and transferring of evidence is also included.
These tasks help experts present the details of an investigation whenever asked when, how, and where the crime happened. It helps experts determine the validity of the evidence. It also helps experts in solving crimes and supporting claims with evidence in a court of law.
Advantages
Computer forensics has been very helpful in solving crimes like the following:
Financial Crimes
Financial crimes include bank fraud, credit card fraud, and net banking and phone banking fraud. Financial crimes affect individuals, companies, organizations, and even nations. They can have a negative impact on entire economic and social systems.
Intellectual Property Crimes
Intellectual property theft is defined as the theft of patents, trademarks, trade secrets, and copyrights. A patent grants property rights. A trademark identifies the source of a business. A trade secret is information for business advantage. A copyright is the legal right of an author, publisher, composer, or another person.
Cyber Forgery
Cyber forgery includes the modification of a document, false documents, illegal activity with legal contracts and certificates, and making false documents.
Cyber Stalking
Cyber stalking is the following of a user’s activity over the Internet and includes harassing or threatening the user or frightening someone by sending him threatening emails.
Web Defacement
Web defacement is an attack in which hackers compromise a website and change the content of that website, leaving social or political messages.
Email Attacks
An email attack is intentional deception made for personal gain or to damage another individual through email. Phishing emails are emails designed to get you to compromise your account. Fake email attacks can appear to come from external companies with a company email. The emails contain dangerous attachments that can download harmful software onto a device when opened. Criminals can spoof your mailbox. Hackers use emails for social engineering to build trust before stealing your data.
Cyber Terrorism
Cyber terrorism is the politically motivated use of computers to cause disruption or spread fear. It is the use of the Internet to commit violent acts that threaten or result in the loss of life or significant bodily harm.
Issues
- Encryption
- Increasing Storage Space
- New Technologies
- Anti-Forensics
- Legal Issues
- Administrative Issues
