Computer Forensics Presented By Anam Sattar Anum Ijaz

Computer Forensics

Presented By: § § § Anam Sattar Anum Ijaz Tayyaba Shaffqat Daniyal Qadeer Butt Usman Rashid

The Field of Computer Forensics What is Computer Forensics? n Scientific process of preserving, identifying, extracting, documenting and interpreting data on computers. n used to obtain potential legal evidence. n computer forensic is the application of computer investigation and analysis techniques in the interests of determining potential legal evidence. n computer forensic is also called digital forensic, network forensic, or cyber forensic.

History of Computer Forensics 1. father of computer Forensic n "Michael Enderson" n 2. meeting in 1988 (Portland , Oregon) Creation of IACIS. n

Advantages of Computer Forensics n Ability to search through a massive amount of data ð Quickly ð Thoroughly ð In any language

Disadvantages of Computer Forensics 1. privacy concern 2. data corruption

Importance of computer forensic. n Computer evidence are popular in cases such as fraud, harassment, theft of trade secrets. n Computer forensic experts are often the only ones that can crack technology-based cases. Anyone can turn on a computer and do a basic search for a missing file but not everyone can find a missing file that someone else doesn’t want found. So if you want a wining case, hiring highly qualified experts makes all the difference.

Computer Forensics process

Computer Forensics process n Can be simple or complex depending upon circumstances. n Specialist looks for the information related to the incident. n It may be limited by a search warrant or time.

Gathering of Information

First Step: Gathering of Information n Investigator is guided by search warrant to seize all the material. n Corporate forensics specialist is guided by the availability of equipment. n Despite of provided guidelines, many items are considered for collection & examination.

Items needed to be considered for collection n 1. 2. 3. 4. 5. Computer Media: Hard Disk Removable Hard Disk USB flash drives Flash memory card Optical disc

Computers and Peripherals

Computers and Peripherals n Every part of the computer needs to be considered for examination. & all the equipment must be taken under possession. n

Other computer and network hardware

Other computer and network hardware n The computers forensics should also include digital devices like routers, digital cameras, smart phones and other personal mobile devices. n Should also look for computers connected with wireless connection.

Computer software

Computer software n Its is impossible to examine files without the proper application software. n The user of the suspect computer might have installed specialized, custom or a very old software. n So the specialist should also look out for the proper software.

Step 2: In the computer Forensics Lab

In the computer Forensics Lab n When the gathered material are in the forensics lab, the investigation can begin. It compromises of following steps 1. Preserve the media 2. Extract evidence 3. Analyze computer media 4. Document results n

During this process n We should make sure that 1. No information is modified. 2. The original hard disk should never be used to boot a computer. 3. Specialized tools must be used to maintain the integrity of the data and make sure that it stays in its original form.

Computer Forensics Tools

Computer Forensics Tools n A computer forensic tool refers to software used in the investigations of computer-related crimes, include software for: - Disk imaging n Forensic media preparation n Mobile devices n String search n

The Forensic Recovery Of Digital Evidence: n Workstation n Imaging application n Analysis tools

Fire chief hardware: n Working n How it can use? Connected with computer via fire wire connection n

Fire fly hardware: It can plug directly into an Eide , IDE , SAS or SATA hard disk. n It is more preferable than the road master n easier way of transferring data than road master n

Working of computer forenics n The purpose of computer forensics techniques is to search, preserve and analyze information on computer systems to find potential evidence for a trial. n Many of the techniques detectives use in crime scene investigations have digital counterparts but there also some unique aspects to computer investigations.

Working n Analyzing deleted files n Traking packet routes n Analyzing network traffic

Working n Analyzing internet provider logs n Analyzing chat logs n Analyzing packet trace

working n Analyzing personal mobile devices n Analyzing browser history logs

Conclusion n n Computer forensics is very important. The procedures are important to follow, because doing so ensures evidence will be admitted and suspects will be more likely to face the consequences if found guilty.

The End. Questions? ?