Discovering Cyber Forensics

Follow

Cyber forensics is a new and fast growing field that involves carefully collecting and examining electronic evidence that not only assesses the damage to a computer as a result of an electronic attack, but also to recover lost information from such a system to prosecute a criminal. With the growing importance of computer security today and the seriousness of cyber crime, it is important for computer professionals to understand the technology that is used in cyber forensics.

Introduction

Cyber forensics involves the preservation, identification, extraction, documentation and interpretation of computer data.

The three main steps in any computer forensic investigation are acquiring, authenticating, and analyzing of the data. Acquiring the data mainly involves creating a bit-by-bit copy of the hard drive. Authentication is the ensuring that the copy used to perform the investigation is an exact replica of the contents of the original hard drive. Analysis of the data is the most important part of the investigation since this is where incriminating evidence may be found.

Part of the analysis process is spent in the recovery of deleted files. The job of the investigator is to know where to find the remnants of these files and interpret the results. Any file data and file attributes found may yield valuable clues. If deleted data could not be recovered through the use of common forensic tools, more sensitive instruments can be used to extract the data.

Data recovery is only one aspect of the forensics investigation. Tracking the hacking activities within a compromised system is also important. With any system that is connected to the Internet, hacker attacks are as certain as death and taxes. It is impossible to completely defend against all attacks. As soon as a hacker successfully breaks into a computer system the hacker begins to leave a trail of clues and evidence that can be used to piece together what has been done and sometimes can even be used to follow a hacker home. Computer forensics can be employed on a compromised system to find out exactly how a hacker got into the system, which parts of the system were damaged or modified.

What is Cyber Forensics?

If you manage or administer information systems and networks, you should understand computer forensics. Forensics is the process of using scientific knowledge for collecting, analyzing, and presenting evidence to the courts. Forensics deals primarily with the recovery and analysis of latent evidence. Latent evidence can take many forms, from fingerprints left on a window to DNA evidence recovered from blood stains to the files on a hard drive.

Because computer forensics is a new discipline, there is little standardization and consistency across the courts and industry. As a result, it is not yet recognized as a formal “scientific” discipline. We define computer forensics as the discipline that combines elements of law and computer science to collect and analyze data from computer systems, networks, wireless communications, and storage devices in a way that is admissible as evidence in a court of law.

Why is Cyber Forensics Important?

Adding the ability to practice sound cyber forensics will help you ensure the overall integrity and survivability of your network infrastructure. You can help your organization if you consider computer forensics as a new basic element in what is known as a “defense-in-depth”.

For instance, understanding the legal and technical aspects of computer forensics will help you capture vital information if your network is compromised and will help you prosecute the case if the intruder is caught. What happens if you ignore computer forensics or practice it badly? You risk destroying vital evidence or having forensic evidence ruled inadmissible in a court of law.

Computer forensics is also important because it can save your organization money. Many managers are allocating a greater portion of their information technology budgets for computer and network security. From a technical standpoint, the main goal of computer forensics is to identify, collect, preserve, and analyze data in a way that preserves the integrity of the evidence collected so it can be used effectively in a legal case.

What are some typical aspects of a computer forensics investigation? First, those who investigate computers have to understand the kind of potential evidence they are looking for in order to structure their search. Crimes involving a computer can range across the spectrum of criminal activity, from child pornography to theft of personal data to destruction of intellectual property. Second, the investigator must pick the appropriate tools to use. Files may have been deleted, damaged, or encrypted, and the investigator must be familiar with an array of methods and software to prevent further damage in the recovery process.

System administrators and security personnel must also have a basic understanding of how routine computer and network administrative tasks can affect both the forensic process and the subsequent ability to recover data that may be critical to the identification and analysis of a security incident.

Conclusion

Network and computer forensic tools are used depending on the need to investigate and the type of incident. If , by using a network forensic tool, we can confirm that the concerned attack is a positive one, then we need to move to the computer level forensics to check the damage done at the system level. Even if the hacker was smart enough to wipe out the logs from the system level, the network forensic tool will be useful because it would have recorded that information.

References:

[1] S. Bui, M. Enyeart, J. Luong, Issues in Computer Forensics, COEN 150, 2003
[2] Cyber-Criminal Activity and Analysis, White Paper, Fall 2005
[3] Cyber Forensics and Areas of Focus, TATA, White Paper