Figure 2 - uploaded by Lalitha Bhaskari
Content may be subject to copyright.
Source publication
As threats against digital assets have risen and there is necessitate exposing and eliminating hidden risks and threats. The ability of exposing is called "cyber forensics." Cyber Penetrators have adopted more sophistical tools and tactics that endanger the operations of the global phenomena. These attackers are also using anti-forensic techniques...
Contexts in source publication
Context 1
... computer situated in Britain as a launch pad for his attack. Challenges behind these situations are both technological and jurisdictional. Confidentiality, integrity and availability are the cardinal pillars of cyber security and they should not be compromised in any manner [2]. Attackers also begin using anti-forensic techniques to hide evidence of a cybercrime. They may hide folders, rename files, delete logs, or change, edit or modify file data [7]. To combat these kinds of crimes, Indian Government established Cyber Forensics Laboratory in November, 2003. Cyber forensics II. P becoming HASES OF C as YBER a source F ORENSICS of investigation because Cyber human forensics expert has witnesses four are distinct important phases: since incident courts will identification, not recognize acquisition software of evidence, tools such analysis as Encase, of evidence, Pasco, Ethereal and reporting as an with expert storage witness of [8]. evidence Cyber forensics [10]. Figure 2 is useful shows for many various professionals phases of cyber like military, forensics private process sector and and each industry, phase academia, responsibility. and The law. These identification areas have phase many mainly needs deals including with data incident protection, identification, data evidence acquisition, collection imaging, and checking extraction, of the interrogation, evidence. The normalization, acquisition phase analysis, saves and the reporting. state of a computer system It is that important can be for further all professionals analyzed. The working analysis in phase the emerging collects the field acquired of cyber data and forensics examines to it have to find a working the pieces and of functioning evidences. The lexicon reporting of terms phase like comprises bookmarks, of cookies, documentation webhit etc., and evidence that are uniformly retention. applied throughout the profession and industry. Cyber forensics international guidelines, related key terms and tools are focused in the cyber forensics field manual [7]. The objective of Cyber forensics is to identify digital evidence for an investigation with the scientific method to draw conclusions. Examples of investigations that use cyber forensics include unlawful use of computers, child pornography, and cyber terrorism. The area of cyber forensics has become prominent field of research because: 1) Forensics systems allow the administrator to diagnose errors 2) Intrusion detection systems are necessary in avoiding cyber crimes 3) Change detection can be possible with proactive forensics Cyber forensics can be used for two benefits [9]: 1) To investigate allegations of digital malfeasance 2) To perform cause analysis II. P HASES OF C YBER F ORENSICS Cyber forensics has four distinct phases: incident identification, acquisition of evidence, analysis of evidence, and reporting with storage of evidence [10]. Figure 2 shows various phases of cyber forensics process and each phase responsibility. The identification phase mainly deals with incident identification, evidence collection and checking of the evidence. The acquisition phase saves the state of a computer system that can be further analyzed. The analysis phase collects the acquired data and examines it to find the pieces of evidences. The reporting phase comprises of documentation and evidence retention. The identification phase is the process of identifying evidence material and its probable location. This phase is unlike a traditional crime scene it processes the incident scene and documents every step of the way. Evidence should be handled properly. Basic requirement in evidence collection is evidence must be presented without alteration. This requirement applies to all phases of forensics analysis. At the time of evidence collection, there is a need of thorough check of system logs, time stamps and security monitors. Once evidence collected, it is necessary to account for its whereabouts. Investigators would need detailed forensics to establish a chain of custody, the documentation of the possession of evidence. Chain of custody is a vital part of computer forensics and the legal system [11] and the goal is to protect the integrity of evidence, so evidence should be physically secured in a safe place along with a detailed log. Figure 3 shows the evidence and chain of custody which is useful during incident investigation. Handling specific type of incidents like Denial of Service, Malicious Code, Unauthorized access etc are described in computer security incident handling guide [12]. The acquisition phase saves the state of evidence that can be further analyzed. The goal of this phase is to save all digital values. Here, a copy of hard disk is created, which is commonly called as an image. Different methods of ...
Context 2
... computer situated in Britain as a launch pad for his attack. Challenges behind these situations are both technological and jurisdictional. Confidentiality, integrity and availability are the cardinal pillars of cyber security and they should not be compromised in any manner [2]. Attackers also begin using anti-forensic techniques to hide evidence of a cybercrime. They may hide folders, rename files, delete logs, or change, edit or modify file data [7]. To combat these kinds of crimes, Indian Government established Cyber Forensics Laboratory in November, 2003. Cyber forensics II. P becoming HASES OF C as YBER a source F ORENSICS of investigation because Cyber human forensics expert has witnesses four are distinct important phases: since incident courts will identification, not recognize acquisition software of evidence, tools such analysis as Encase, of evidence, Pasco, Ethereal and reporting as an with expert storage witness of [8]. evidence Cyber forensics [10]. Figure 2 is useful shows for many various professionals phases of cyber like military, forensics private process sector and and each industry, phase academia, responsibility. and The law. These identification areas have phase many mainly needs deals including with data incident protection, identification, data evidence acquisition, collection imaging, and checking extraction, of the interrogation, evidence. The normalization, acquisition phase analysis, saves and the reporting. state of a computer system It is that important can be for further all professionals analyzed. The working analysis in phase the emerging collects the field acquired of cyber data and forensics examines to it have to find a working the pieces and of functioning evidences. The lexicon reporting of terms phase like comprises bookmarks, of cookies, documentation webhit etc., and evidence that are uniformly retention. applied throughout the profession and industry. Cyber forensics international guidelines, related key terms and tools are focused in the cyber forensics field manual [7]. The objective of Cyber forensics is to identify digital evidence for an investigation with the scientific method to draw conclusions. Examples of investigations that use cyber forensics include unlawful use of computers, child pornography, and cyber terrorism. The area of cyber forensics has become prominent field of research because: 1) Forensics systems allow the administrator to diagnose errors 2) Intrusion detection systems are necessary in avoiding cyber crimes 3) Change detection can be possible with proactive forensics Cyber forensics can be used for two benefits [9]: 1) To investigate allegations of digital malfeasance 2) To perform cause analysis II. P HASES OF C YBER F ORENSICS Cyber forensics has four distinct phases: incident identification, acquisition of evidence, analysis of evidence, and reporting with storage of evidence [10]. Figure 2 shows various phases of cyber forensics process and each phase responsibility. The identification phase mainly deals with incident identification, evidence collection and checking of the evidence. The acquisition phase saves the state of a computer system that can be further analyzed. The analysis phase collects the acquired data and examines it to find the pieces of evidences. The reporting phase comprises of documentation and evidence retention. The identification phase is the process of identifying evidence material and its probable location. This phase is unlike a traditional crime scene it processes the incident scene and documents every step of the way. Evidence should be handled properly. Basic requirement in evidence collection is evidence must be presented without alteration. This requirement applies to all phases of forensics analysis. At the time of evidence collection, there is a need of thorough check of system logs, time stamps and security monitors. Once evidence collected, it is necessary to account for its whereabouts. Investigators would need detailed forensics to establish a chain of custody, the documentation of the possession of evidence. Chain of custody is a vital part of computer forensics and the legal system [11] and the goal is to protect the integrity of evidence, so evidence should be physically secured in a safe place along with a detailed log. Figure 3 shows the evidence and chain of custody which is useful during incident investigation. Handling specific type of incidents like Denial of Service, Malicious Code, Unauthorized access etc are described in computer security incident handling guide [12]. The acquisition phase saves the state of evidence that can be further analyzed. The goal of this phase is to save all digital values. Here, a copy of hard disk is created, which is commonly called as an image. Different methods of ...
Citations
... Different specialities focus on specific computing topics: network forensics deals with investigations in network infrastructures; and e-mail forensics, as the name states, investigates e-mail related cases; mobile forensics specialises in handset devices. Figure 1, which is based on Sridhar's [5] research, includes some of the main digital forensics specialities: As said earlier, cloud computing makes uses of many different technologies to provide services. This heterogeneity in cloud computing means an investigation in such environment needs to make use of many different forensic investigation types. ...
The aim of digital forensics is to extract information to answer the 5Ws (Why, When, Where, What, and Who) from the data extracted from the evidence. In order to achieve this, most digital forensic processes assume absolute control of digital evidence. However, in a cloud environment forensic investigation, this is not always possible. Additionally, the unique characteristics of cloud computing create new technical, legal and architectural challenges when conducting a forensic investigation. We propose a hypothetical scenario to uncover and explain the challenges forensic practitioners face during cloud investigations. Additionally, we also provide solutions to address the challenges. Our hypothetical case scenario has shown that, in the long run, better live forensic tools, development of new methods tailored for cloud investigations and new procedures and standards are indeed needed. Furthermore, we have come to the conclusion that forensic investigations biggest challenge is not technical but legal.
... Forensics is the science of investigating and presenting ideas or digital evidence in the court according to the law [8]. Forensics involves procedures, steps, phases or processes in order for the investigation to be successful. ...
Mobile technology, over the years, has improved tremendously in sophistication and functionality. Today, there are mobile phones, known as smartphones, that can perform virtually most functions associated with personal computers. This has translated to increase in the adoption of mobile technology. Consequently, there has been an increase in the number of attacks against and with the aid of this technology. Mobile phones will often contain data that are needed as evidence in a court of law. And, therefore, the need to be able to acquire and present this data in an admissible form cannot be overemphasized. This requires the right forensic tools. This is the focus of this study. We evaluated the ability of four forensic tools to extract data, with emphasis on deleted data, from Android phones. Our results show that AccessData FTK Imager and EnCase performed better than MOBILedit Forensic and Oxygen Forensic Suite at acquiring deleted data. The conclusion is that, finding a forensic tool or toolkit that is virtually applicable across all mobile device platforms and operating systems is currently infeasible.
La ciencia informática forense estudia y analiza una amplia gama de evidencias de delitos, es así que el forense informático requiere de un profundo conocimiento técnico y manejo de herramientas especializadas. El actual trabajo presenta una revisión sistemática cuyo objetivo fue conocer los sistemas informáticos que se usan en esta ciencia y los componentes tecnológicos que más se analizan. Se exponen las soluciones forenses evaluadas científicamente, utilizadas para exámenes en hardware y software, ya sea a través de desarrollos propios o comerciales, aplicados específicamente a las computadoras, redes, dispositivos digitales y la información en la nube; adicionalmente, se despliegan las propuestas de modelos de confiabilidad de evidencias analizadas, con el fin de que el forense informático pueda dar opiniones y emitir informes técnicos, cumpliendo con una correcta metodología forense. Los software comerciales de apoyo a la labor del forense informático, tienen como limitante que van solo dirigidos a un trabajo específico; por lo cual se evidencia que hay mucho por desarrollar en aplicaciones para esta actividad. Otros resultados encontrados señalan que el área legal y la de informática son las que tienen predominio de aplicabilidad de esta ciencia.
Network forensics vis-a-vis cloud computing offerings can be leveraged to address the needs of enterprise-grade
spyware solutions online. A modular, extensible cloud architecture with intrinsic support for efficient security
monitoring is proposed and an implementation architecture which facilitates dynamic interface with OpenFlow
hardware to create infinite flexibility in managing security decisions is presented. A forensic DataCenter model
that integrates remote security monitoring using an intelligent Virtual Security Gateway in a cloud domain
was developed as part of the work. An OpenFlow Virtual Appliance is proposed as a security hardware
interface for thin clients connected to the Cloud Sypware Robot (CSR) server. The cloud ontology-Software
as a Service (SaaS) model was used for the CSR application conveying several security benefits. The goal is
to facilitate an open, service-based, online network forensics application that is transparently provisioned
for users. The paper proposes a security foundation for next-generation enterprise-grade cloud computing.
Internet network attacks are complicated and worth studying. The attacks include Denial of Service (DoS). DoS attacks that exploit vulnerabilities found in operating systems, network services and applications. Indicators of DoS attacks, is when legitimate users cannot access the system. This paper proposes a framework for Internet based forensic logs that aims to assist in the investigation process to reveal DoS attacks. The framework in this study consists of several steps, among others : logging into the text file and database as well as identifying an attack based on the packet header length. After the identification process, logs are grouped using k-means clustering algorithm into three levels of attack (dangerous, rather dangerous and not dangerous) based on port numbers and tcpflags of the package. Based on the test results the proposed framework can be grouped into three level attacks and found the attacker with a success rate of 89,02%, so, it can be concluded that the proposed framework can meet the goals set in this research.
