Computer Forensics

OVERVIEW OF SEMINAR Introduction Introduction Defining Cyber Crime Defining Cyber Crime Cyber Crime Cyber Crime Cyber Crime As Global Problem Cyber Crime As Global Problem Frequently Used Cyber Crime Frequently Used Cyber Crime Cyber Criminals Cyber Criminals Cyber Crime in India Cyber Crime in India Prevention Of Cyber Crime BY Indian Govt. Prevention Of Cyber Crime BY Indian Govt. The I T ACT The I T ACT Future of Cyber Crime. Future of Cyber Crime. Conclusion. Conclusion.

INTRODUCTION THREATS TO THE SYSTEM THREATS TO THE SYSTEM COMPUTER FORENSICS COMPUTER FORENSICS IDENTIFYING IDENTIFYING PRESERVING PRESERVING ANALYSING ANALYSING PRESENTING PRESENTING

IMPORTANCE OF SYSTEM FORENSICS IMPORTANCE OF SYSTEM FORENSICS RECOVER DATA THAT YOU THOUGHT WAS LOST FOREVER RECOVER DATA THAT YOU THOUGHT WAS LOST FOREVER ADVICE YOU ON HOW TO KEEP YOUR DATA AND INFORMATION SAFE FROM THEFT OR ACCIDENTAL LOSS ADVICE YOU ON HOW TO KEEP YOUR DATA AND INFORMATION SAFE FROM THEFT OR ACCIDENTAL LOSS EXAMINE A COMPUTER TO FIND OUT WHAT ITS USER HAS BEEN DOING EXAMINE A COMPUTER TO FIND OUT WHAT ITS USER HAS BEEN DOING SWEEP YOUR OFFICE FOR LISTNENING DEVICES SWEEP YOUR OFFICE FOR LISTNENING DEVICES HI-TECH INVESTIGATION HI-TECH INVESTIGATION

COMPUTER FORENSIC METHODOLOGYCOMPUTER FORENSIC METHODOLOGY 1. Shut Down the Computer 2. Document the Hardware Configuration of The System 3. Transport the Computer System to A Secure Location 4. Make Bit Stream Backups of Hard Disks and Floppy Disks 5. Mathematically Authenticate Data on All Storage Devices 6. Document the System Date and Time 7. Make a List of Key Search Words

Cont… 8. Evaluate the Windows Swap File 9. Evaluate File Slack 10.Evaluate Unallocated Space (Erased Files) 11.Search Files, File Slack and Unallocated Space for Key Words 12.Document File Names, Dates and Times 13.Identify File, Program and Storage Anomalies 14.Evaluate Program Functionality 15.Document Your Findings

APPLICATION OF COMPUTER FORENSICSAPPLICATION OF COMPUTER FORENSICS FINANCIAL FRAUD DETECTION FINANCIAL FRAUD DETECTION CRIMINAL PROSECUTION CRIMINAL PROSECUTION CIVIL LITIGATION CIVIL LITIGATION CORPORATE SECURITY POLICY AND ACCEPTABLS USE VIOLATIONS CORPORATE SECURITY POLICY AND ACCEPTABLS USE VIOLATIONS

INVESTIGATION OF COMPUTER CRIMES INTRODUCTION INTRODUCTION IMPORTANCE OF INVESTIGATION IMPORTANCE OF INVESTIGATION INVESTIGATION INVESTIGATION It helps to understand the system security weaknesses It helps to understand the system security weaknesses It helps to understand security violation techniques It helps to understand security violation techniques It helps to identify future security needs It helps to identify future security needs It helps to prosecute criminals It helps to prosecute criminals

COMPONENTS OF INVESTIGATION COMPONENTS OF INVESTIGATION Evidence Evidence Linking the chain of evidence Linking the chain of evidence Documentation Documentation STEPS FOR INVESTIGATION STEPS FOR INVESTIGATION COLLECTING EVIDENCE COLLECTING EVIDENCE ANALYZING EVIDENCE ANALYZING EVIDENCE PRESERVING EVIDENCE PRESERVING EVIDENCE

TYPES OF INVESTIGATION PHYSICAL INVESTIGATION PHYSICAL INVESTIGATION LOGICAL INVESTIGATION LOGICAL INVESTIGATION requirements : requirements : No modifications No modifications Log date and time stamp Log date and time stamp Logs of the system Logs of the system System registry System registry forensic imaging tool forensic imaging tool

COMPUTER FORENSIC TECHNOLOGY TYPES OF LAW ENFORCEMENT COMPUTER FORENSIC TECHNOLOGY TYPES OF LAW ENFORCEMENT COMPUTER FORENSIC TECHNOLOGY MIRROR IMAGE BACKUP SOFTWARE MIRROR IMAGE BACKUP SOFTWARE ANADISK DISKETTE ANALYSIS TOOL ANADISK DISKETTE ANALYSIS TOOL TEXT SEARCH PLUS TEXT SEARCH PLUS INTELLIGENT FORENSIC FILTER INTELLIGENT FORENSIC FILTER

TYPES OF BUSINESS COMPUTER FORENSIC TECHNOLOGYTYPES OF BUSINESS COMPUTER FORENSIC TECHNOLOGY REMOTE MONITORING OF TARGET COMPUTERS REMOTE MONITORING OF TARGET COMPUTERS CREATES TRACKABLE ELECTRONIC DOCUMENT CREATES TRACKABLE ELECTRONIC DOCUMENT THEFT RECOVERY SOFTWARE FOR YOUR PC’s AND LAPTOPS THEFT RECOVERY SOFTWARE FOR YOUR PC’s AND LAPTOPS BASIC FORENSIC TOOLS AND TECHNIQUES BASIC FORENSIC TOOLS AND TECHNIQUES

FORENSIC SERVICES AVAILABLEFORENSIC SERVICES AVAILABLE Lost password and file recovery Lost password and file recovery Location and retrieval of deleted Files Location and retrieval of deleted Files File and decryption File and decryption supervision and authentication supervision and authentication Threatening traced to source Threatening traced to source Identification of internet activity Identification of internet activity

Cont… Computer usage policy and supervision Computer usage policy and supervision Remote PC and network monitoring Remote PC and network monitoring Tracking and location of stolen electronic files Tracking and location of stolen electronic files Location and identity of unauthorized SW users Location and identity of unauthorized SW users Theft recovery s/w for laptops and PCs. Theft recovery s/w for laptops and PCs. Investigative and security software creation Investigative and security software creation Protection from hackers and viruses Protection from hackers and viruses

Skills Required to Conduct Forensic Computer Investigations TRAINING TRAINING eSec Limited and Foundstone Education eSec Limited and Foundstone Education Guidance Software Guidance Software

CONCLUSION

.

THANK YOU