An Introduction to Computer Forensics Jim Lindsey Western Kentucky University
What are we talking about? Forensic … Forensic …
What are we talking about? Forensic Science is the use of science to investigate and establish facts in criminal and civil cases. Forensic Science is the use of science to investigate and establish facts in criminal and civil cases.
What are we talking about? Computer Forensics is the discovery, collection, and analysis of evidence found on computers and networks. Computer Forensics is the discovery, collection, and analysis of evidence found on computers and networks.
Many Hats Law Investigative Skills Technology
An Exam May Explain … Hidden data Hidden data Most recently used applications Most recently used applications Origin of documents Origin of documents Evidence of “wiping” Evidence of “wiping” Visited Internet sites Visited Internet sites
An Exam May Require … Cloning Cloning Write Blocker Write Blocker MD-5 & SHA-1 MD-5 & SHA-1 Cataloging Cataloging Recovery of Deleted Files Recovery of Deleted Files Search for hidden, disguised or encrypted files Search for hidden, disguised or encrypted files Viewing files Viewing files Analysis of time/date stamps Analysis of time/date stamps
Deleted Files
An Examiner Should … Possess requisite training and equipment Possess requisite training and equipment Be able to provide training Be able to provide training Be knowledgeable of data relevant to computer-related crimes Be knowledgeable of data relevant to computer-related crimes Be able to effectively testify as an expert in a court of law Be able to effectively testify as an expert in a court of law
What to do? If the computer is off, do not turn on. If the computer is off, do not turn on. If the computer is on, do not shut down normally – call for instructions. If the computer is on, do not shut down normally – call for instructions. Do not “browse” the files! Do not “browse” the files!
What to do? Document, document, document - W H Y ? Document, document, document - W H Y ? Records chain of custody: Records chain of custody: Where the evidence came from Where the evidence came from When it was obtained When it was obtained Who obtained it Who obtained it Who secured it Who secured it Who has had control of it Who has had control of it Where it is stored Where it is stored
Final Notes Forensic Examinations Forensic Examinations Normally 1-2 hours to forensically image a hard drive Normally 1-2 hours to forensically image a hard drive Exams can take 4-40 hours, depending on requests Exams can take 4-40 hours, depending on requests Helpful if “keywords” provided Helpful if “keywords” provided Know what you want to search for….. Know what you want to search for…..
Final Notes Average HD Volume590 GB* Gigabyte1,073,741,824 bytes Subtotal633,507,676,160 bytes Page size3000 bytes Pages211,169,225 Ream500 pages Reams422,338 Reams Ream height2” Total height844,676” Height in feet70,389 feet Height of Mt Everest29,029 feet** Note these figures are conservative! * **
Explain what the 'Chain of Custody' is in computer forensics. Furthermore, explain why it is important for forensic examiners to establish 'Chain of Custody' as soon as they arrive on a scene and maintain it throughout the life of a case. Explain what the 'Chain of Custody' is in computer forensics. Furthermore, explain why it is important for forensic examiners to establish 'Chain of Custody' as soon as they arrive on a scene and maintain it throughout the life of a case. We spent a day discussing computer forensics. How could knowledge of this topic help a human resources manager do their job? How could knowledge of this topic help a police officer do their job? We spent a day discussing computer forensics. How could knowledge of this topic help a human resources manager do their job? How could knowledge of this topic help a police officer do their job?
Are there any questions?