Welcome message from author
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
CYBER CRIMES
REAL-WORLD & VIRTUAL- WORLD
Current approaches evolved to deal with real-world crime
Cybercrime occurs in a virtual-world and therefore presents different issues
EXAMPLE : THEFT
Real-world theft: Possession of property shifts completely
from A to B, i.e., A had it now B has it
Theft in Virtual-world (Cyber-theft): Property is copied, so A “has” it and so does B
Think before Think before
you Clickyou Click
What is Computer Crime
“Unlawful acts wherein the computer is either a
tool or a target or both".
Two aspects:
•Computer as a tool to commit crime
Child porn, Threatening email, identity
theft, sexual harassment, defamation,
phishing.
•Computer itself becomes target of crime
Viruses, worms, software piracy, hacking.
TYPES OF COMPUTER CRIME
HACKINGHacking in simple terms means illegal
intrusion into a computer system without the permission of the computer owner/user.
SOFTWARE PIRACYAn unauthorized copying of software.
PORNOGRAPHYComputer pornography covers pornographic
websites, pornographic magazines produced using computers (to publish and print the material) and the Internet (to download and transmit pornographic pictures, photos.
FORGED DOCUMENTSTo create fake documents such as, fake
academic certificates, mark sheets etc.
CREDIT CARD FRAUDCredit card fraud is a wide-ranging term for
theft and fraud committed using a credit card or any similar payment mechanism as a fraudulent source of funds in a transaction.
Computer STALKINGUse of the e-mail, Internet to harass or
threaten an individual.
CONT… TYPES OF COMPUTER CRIME
PHISHINGIn the field of computer security, phishing is the
criminally fraudulent process of attempting to acquire sensitive
information such as usernames, passwords and credit card details by masquerading as a trustworthy entity in an electronic communication.
Computer DEFAMATIONThis occurs when defamation takes place with the help of
computers and / or the Internet.e.g. Mr. X publishes defamatory matter about Ms. Y on a
website or sends e-mails containing defamatory information to Ms. Y’s friends.
CONT… TYPES OF COMPUTER CRIME
WHAT IS DIGITAL EVIDENCE?
Digital Evidence is any information of
probative value that is either stored or
transmitted in a binary form.
Digital Evidence includes computer evidence,
digital audio recorder, digital video recorder,
mobile phones, pen drives, CD, DVD etc.
ELECTRONIC RECORD
Electronic record - is that which is generated,
stored, sent or received by electronic means and
includes data, image or sound.
CHALLENGES FOR INVESTIGATING AGENCIES
Difficulty in collection of evidence
Fragility of Computer data
Fear of destruction of vital data
Vast volume to be examined
Diversity of hardware & Software.
Admissibility in the courts.
COMPUTER FORENSICS
Definition:
Identification, Extraction, Documentation, and
Preservation of computer media for
evidentiary and/or root cause analysis using
well-defined methodologies and procedures.
COMPUTER FORENSICS
Methodology:
Acquire the evidence without altering or
damaging the original.
Authenticate that the recovered evidence is the
same as the original seized.
Analyze the data without modifying it.
COMPUTER FORENSICS-STEPS
Identification
Seizure
Authentication
Acquisition
Analysis
Presentation
Preservation
Scene of Crime
Forensics Lab
What to carry?
Camera Note or Sketch Pads
– Blank CDs, DVDs, Pen Drives, Hash Calculator, Write-Blocker, Cross-Over cable etc.
Sealing Material – Labels, Pens, Markers
Storage Containers – Anti Static Bags, Plastic Bubble Wrap
Software / Hardware for onsite virtual data retrieval and imaging
How to secure the crime scene?
The entire work area, office, or cubicle is a
potential crime scene, not just the
computer itself.
No one should be allowed to touch the
computer, to include shutting the computer
down or exiting from any programs/files in
use at the time or remove anything from
the scene.
How to secure the crime scene?
Continued….
Disconnect the power supply. Else there
can be a loss of files to hard drive crash.
If required access system to take backup of
volatile data
Computer Forensic Steps - Scene of Crime
Backup Volatile data in RAM / Router etc.
Photograph / Video the scene of incidence /
crime
Identifying Digital storage media
Draw Network Topology
Questions to be asked the
Scene of crime• Login Details : User Name/s and Password/s
• Encryption
• Files of interest
• E-mail accounts
• Internet service provider(s)
• Off site storage
• Hidden storage devices
WHY PRECAUTIONS REQUIRED ?
The integrity of data is essential for making it
presentable in court of law with in acceptable
limits of law.
The active data recovered can give us vital links.
The deleted data too can be recovered and used
for reconstruction of events.
Certain damaged media too can be read/viewed.
Computer Forensic Steps - Scene of Crime
Identification
Seizure
Acquisition
Exhibits Seized
Identification
Identification
Front Side ofCPU Cabinet orCase or Chasis
Back Side ofCPU Cabinet orCase or Chasis
The CPU
Identification Continued….
Internal Hard Disk
Identification Continued….
External Hard Disk
Identification Continued….
FloppyCD/DVD
Identification Continued….
Mobile Phones
SIM Card Memory Cards
Identification Continued….
Skimmer Credit Cards
Identification Continued….
Dongle and Pen Drives
Identification Continued….
Identification Continued….
Identification Continued….
Seizure
What is Seizure?
Definition :-
Seizure is the process of capturing the
suspect computer or storage media for
evidence collection.
The case related reference documents should also be seized from the crime scene.
For Example - In case of Economical Crime look for Account Book Details, Passbook details, Bank Transaction Details, ATM Credit/Debit Card Details.
In case of Forged Documents look for reference documents such as, Academic Certificates, Bill Receipts, Passport, Legal Property Papers etc.
If video files or picture image files of a particular person are to traced, then provide the photographs of the same for identification.
Seizure
Labeling
Labeling
Labeling
Labeling
Labeling
Packaging and Transportation
Properly document and label the evidence before packaging.
Use anti-static wrap or bubble wrap for magnetic media.
Avoid folding, bending or scratching the computer media such as diskettes, CDs, removable media etc.
Labeling
Packaging and Transportation
While transporting, place the computer securely on the floor of the vehicle where the ride is smooth.
Avoid radio transmissions, electromagnetic emissions, moisture
in the vicinity of digital evidence.
Dealing with the Suspected Mobile Phone• At the time of seizing mobile phone, its
components like Battery, SIM card(s),
Memory card(s) should be removed.
• The User Manuals
should also be seized
from the scene,
if present.
Guidelines from Forensics Continued….
If CPU Cabinet is seized from the crime scene,
bring only hard disks for analysis. Not to bring CPU
cabinet.
Printer, Scanner, Monitor, Keyboard, Mouse etc.
should not be seized
Only digital storage media like Hard Disk, Pen
Drive, Floppies, CDs, DVDs, Mobile Phone etc. are
analyzed.
If an exhibit is a hard disk then needs to provide a
blank hard disk with more(double) capacity.
Acquisition
&
Authentication
Precautions while Acquisition
• Use of Write Blocker devices:
Thumbscrew
FAST BLOC
Tablue
• Need of Write Blocker
Acquisition & Authentication
Making Forensic Duplicate copy of the Suspect
Storage
media is Acquisition.
A Forensic Duplicate is a file that contains every
bit of
information from the source disk.
Two Ways
Using Software
Using Hardware
Acquisition & Authentication
Using Software Tool requires a hardware
write blocker at source end e.g. FASTBloc FE /
Tablue and Software EnCase, FTK Imager used to
for Acquisition
Using Hardware Tool has inbuilt write
blocker and gives better speed for acquisition
e.g. TD2, Talon, SOLO, Dossier by LogiCube etc.
Laboratory Work
Authentication
Analysis
Presentation
Preservation
Authentication : Hash Value
How to verify the integrity of Forensic
Duplicate?
It is also known as, “Message Digest” or
“Fingerprint”, is basically a digital signature.
The checksum is created by applying algorithm to
the file. The checksum for each file is unique to
that file.
E.g.
4a24e1e50622c52122406b77e8438c5a
(MD5)
Analysis
Current and Emerging Cyber Forensic Tools of Law Enforcement
Analysis Process
The Process of searching for crime relevant data and extract it.
The analyst has to search data inDeleted Files Slack Space
Unallocated Space Free Space
Log Entries Registry Entries
System Files Printer Spool Files
Cookies Keywords
Analysis Process Continued….
Why is Slack Space Important?
Unallocated Space(New Drive)
Allocated Space
Unallocated Space(After File deletion)
Allocated Space(Reallocated, new file)
Slack SpaceWhy isn’t this also slack space?
Analysis Process Continued….
• “Keyword Search” is one of the most
important
steps of analysis.
• The keywords should be listed for getting
better
and sorted search results. These
keywords
should be case-relevant.
Documentation & Preservation
• Report writing & preparation of notes
• Store the Magnetic Storage Media in a secure area.– Cool– Dry– Away from:
GeneratorsMagnets
Prevention Of Computer Crime
Safe Computing Tips
Do not reveal personal information to unknown
people or websites.
Create hard to guess passwords and keep them
private & change them regularly.
Use anti-virus and update them regularly.
Back up your important files regularly.
Never reveal your true identity while chatting.
Safe Online Banking
Keep your passwords/PIN codes safe and memorize them.
Check that the online banking website is secure.
Logout immediately after you have completed your transaction.
Do not respond to emails asking for your personal information. When in doubt, call the institution that claims to have sent this email.
Read privacy and policy statements before any transaction.
Check your account statements to ensure that no unauthorized transaction has taken place.
Tips for Safe Social Networking
Don’t reveal too much information about yourself online.
Add people as friends to your site only if you know them personally.
Delete inappropriate messages from your profile.
Do not post information about your friends as you may put them at risk. What you post online is not private. It can be seen by everyone.
Related Documents
