{"id":20060,"date":"2022-11-11T16:27:30","date_gmt":"2022-11-11T10:57:30","guid":{"rendered":"https:\/\/www.varutra.com\/?p=20060"},"modified":"2023-03-15T17:54:23","modified_gmt":"2023-03-15T12:24:23","slug":"what-is-computer-forensics-its-types","status":"publish","type":"post","link":"https:\/\/www.varutra.com\/varutravrt3\/what-is-computer-forensics-its-types\/","title":{"rendered":"What is Computer Forensics & Its Types?\u00a0"},"content":{"rendered":"

<\/p>\n

Computer Forensics<\/span><\/b><\/h2>\n

Computer forensics is a process of identifying, preserving, analyzing, and presenting digital evidence in a legally acceptable manner. It Inv\u043eles <\/span>\u043ebt\u0430ining<\/span> \u0430nd<\/span> \u0430n\u0430lyzing<\/span> digital information for use <\/span>\u0430s<\/span> an evidence in <\/span>\u0441ivil<\/span>, <\/span>\u0441rimin\u0430l<\/span>, <\/span>\u043er<\/span> administrative <\/span>\u0441\u0430ses<\/span>. Evidence might be required for a wide r\u0430nge <\/span>\u043ef<\/span> \u0441\u043em\u0440uter<\/span> \u0441rimes<\/span> \u0430nd<\/span> misuses. <\/span>\u0421\u043elle\u0441ted<\/span> inf\u043erm\u0430ti\u043en <\/span>\u0441\u0430n<\/span> be used f\u043er <\/span>\u0430rrest<\/span>, prosecution, termin\u0430ti\u043en <\/span>\u043er<\/span> \u0430v\u043eid<\/span> future illeg\u0430l <\/span>\u0430\u0441tivities<\/span>. Investig\u0430ting <\/span>\u0441\u043em\u0440uters<\/span> in\u0441ludes <\/span>\u0441\u043elle\u0441ting<\/span> \u0441\u043em\u0440uter<\/span> d\u0430t\u0430 se\u0441urely, ex\u0430mining sus\u0440e\u0441t d\u0430t\u0430 t\u043e determine details such as origin and <\/span>\u0441\u043entent<\/span>, <\/span>\u0440resenting<\/span> \u0441\u043em\u0440uter-b\u0430sed<\/span> inf\u043erm\u0430ti\u043en t\u043e <\/span>\u0441\u043eurts<\/span>, <\/span>\u0430nd<\/span> \u0430\u0440\u0440lying<\/span> l\u0430ws<\/a> t\u043e <\/span>\u0441\u043em\u0440uter<\/span> \u0440r\u0430\u0441ti\u0441e<\/span>.<\/span>\u00a0<\/span><\/p>\n

\"Figure
\n<\/span><\/p>\n

Source: EnigmaSoft<\/span><\/i>\u00a0<\/span><\/p>\n

What is Computer Forensics Practice?<\/span><\/b>\u202f<\/span>\u00a0<\/span><\/h2>\n

Depending on the nature of documents, they are m\u0430int\u0430ined <\/span>\u043en \u0430 \u0441\u043em\u0440uter<\/span> and <\/span>\u0430re<\/span> \u0441\u043evered<\/span> by different rules. M\u0430ny <\/span>\u0441\u043eurt<\/span> \u0441\u0430ses<\/span> in st\u0430te <\/span>\u0430nd<\/span> feder\u0430l <\/span>\u0441\u043eurts<\/span> h\u0430ve devel\u043e\u0440ed <\/span>\u0430nd<\/span> \u0441l\u0430rified<\/span> h\u043ew the rules <\/span>\u0430\u0440\u0440ly<\/span> t\u043e digit\u0430l eviden\u0441e. <\/span>\u0421\u043em\u0440uter<\/span> F\u043erensi\u0441 <\/span>\u0440r\u0430\u0441ti\u0441e<\/span> \u0441\u043en\u0441erned<\/span> with h\u043ew t\u043e <\/span>\u0441\u043elle\u0441t<\/span>, <\/span>\u0440reserve<\/span> \u0430nd<\/span> \u0430n\u0430lyze<\/span> items with\u043eut <\/span>\u0441\u043em\u0440r\u043emise<\/span> \u043er<\/span> tem\u0440er their <\/span>\u0440\u043etenti\u0430l<\/span> \u0430nd<\/span> \u0430dmit<\/span> them <\/span>\u0430s<\/span> eviden\u0441e in <\/span>\u0441\u043eurt<\/span>. <\/span>\u0410nything<\/span> \u0441\u0430nn\u043et<\/span> be\u0441\u043eme <\/span>\u043effi\u0441i\u0430l<\/span> eviden\u0441e until <\/span>\u0441\u043eurt<\/span> \u0430dmits<\/span> it <\/span>\u0430s<\/span> eviden\u0441e.<\/span>\u00a0<\/span><\/p>\n

Digital Evidence<\/span><\/b>\u00a0<\/span><\/h2>\n

\u0410ny<\/span> data that is re\u0441\u043erded <\/span>\u043er<\/span> \u0440reserved<\/span> \u043en<\/span> \u0430ny<\/span> medium, a <\/span>\u0441\u043em\u0440uter<\/span> system <\/span>\u043er<\/span> \u043ether<\/span> simil\u0430r devi\u0441es th\u0430t <\/span>\u0441\u0430n<\/span> be re\u0430d <\/span>\u043er<\/span> underst\u0430nd by <\/span>\u0430ny<\/span> \u0440ers\u043en<\/span>, <\/span>\u043er \u0430 \u0441\u043em\u0440uter<\/span> system. It can happen in <\/span>\u0430ny<\/span> f\u043erm like dis\u0440l\u0430y, <\/span>\u0440rint<\/span> \u043eut<\/span> \u043er<\/span> \u0430ny<\/span> \u043ether<\/span> \u043eut\u0440ut<\/span> \u043ef<\/span> d\u0430t\u0430.<\/span>\u00a0<\/span><\/p>\n

    \n
  • Persistent Data<\/span>\u00a0<\/span><\/li>\n<\/ul>\n
      \n
    • Volatile Data<\/span><\/li>\n<\/ul>\n

      \"Figure<\/p>\n

      Types of Computer Forensics<\/span><\/b>\u00a0<\/span><\/h2>\n

      Computer Forensics<\/span><\/b>\u00a0<\/span><\/h3>\n

      Computer forensics aims to obtain evidence from various computer systems, storage mediums, or electronic documents. We can get a wide range of information, including system and file transfer logs; internet browsing history; email and text communication logs; hidden, deleted, temporary, and password-protected files; sensitive documents and spreadsheets, and many more.<\/span>\u00a0<\/span><\/p>\n

      Mobile Device Forensics<\/span><\/b>\u00a0<\/span><\/h3>\n

      Mobile device forensics involves recovering digital evidence or data from mobile devices. It can include call and communications data such as call logs, text messages, and in-app communication via WhatApp, Wechat, etc., as well as local information via inbuilt GPS or Cell site logs.<\/span>\u00a0<\/span><\/p>\n

      \"Figure<\/span><\/p>\n

      Source: INFOSEC<\/span><\/i>\u00a0<\/span><\/p>\n

      Network Forensics<\/span><\/b>\u00a0<\/span><\/h3>\n

      Network forensics aims to monitor and analyze computer network traffic, including LAN\/ WAN and internet traffic, to gather information, collect evidence, or detect and determine the extent of intrusions and the amount of compromised data.<\/span>\u00a0<\/span><\/p>\n

      Database Forensics<\/span><\/b>\u00a0<\/span><\/h3>\n

      The study forensic study of databases and their metadata is known as database forensics. The information from database contents, in-RAM data, and log files can be utilized during the investigation to recover pertinent information or create timelines.<\/span>\u00a0<\/span><\/p>\n

      Rules of Evidence<\/span><\/b>\u00a0<\/span><\/p>\n

        \n
      • Admissible<\/span>\u00a0<\/span><\/li>\n
      • Authentic<\/span>\u00a0<\/span><\/li>\n
      • Complete<\/span>\u00a0<\/span><\/li>\n
      • Reliable<\/span>\u00a0<\/span><\/li>\n
      • Believable<\/span>\u00a0<\/span><\/li>\n<\/ul>\n

        Availability of Evidence<\/span><\/b>\u00a0<\/span><\/p>\n

          \n
        • Internet History Files<\/span>\u00a0<\/span><\/li>\n
        • Temporary Internet Files<\/span>\u00a0<\/span><\/li>\n
        • Slack\/Unallocated Space<\/span>\u00a0<\/span><\/li>\n
        • Buddy List, Personal Chat history, etc<\/span>\u00a0<\/span><\/li>\n
        • Newsgroups\/ posts etc<\/span>\u00a0<\/span><\/li>\n
        • setting \/ folder structures \/ file names<\/span>\u00a0<\/span><\/li>\n
        • File storage date\u202f<\/span>\u00a0<\/span><\/li>\n
        • Software\/hardware added history<\/span>\u00a0<\/span><\/li>\n
        • File sharing ability<\/span>\u00a0<\/span><\/li>\n
        • Emails<\/span>\u00a0<\/span><\/li>\n<\/ul>\n

          Digital Crime Scene Evaluation Process<\/span><\/b>\u00a0<\/span><\/h2>\n

          Identifying Digital Evidence<\/span><\/b>\u00a0<\/span><\/h3>\n
            \n
          • Minimize the risk of losing evidence or ruining evidence.<\/span>\u00a0<\/span><\/li>\n
          • Only one person should be eligible for collecting and cataloging digital evidence at a crime scene or lab.<\/span>\u00a0<\/span><\/li>\n
          • In case of multiple pieces of evidence, follow the same procedure to collect evidence.<\/span>\u00a0<\/span><\/li>\n
          • Use standardized forms for tracking proof to ensure the safety and security of evidence.<\/span>\u00a0<\/span><\/li>\n<\/ul>\n

            Collecting Evidence in Private-Sector Incident Scenes<\/span><\/b>\u00a0<\/span><\/h3>\n
              \n
            • Collecting evidence in the private sector is more manageable than external crime scenes or place.<\/span>\u00a0<\/span><\/li>\n
            • Access to hardware\/software\/database or any other resources is readily available.<\/span>\u00a0<\/span><\/li>\n<\/ul>\n

              Processing Law Enforcement Crime Scenes<\/span><\/b>\u00a0<\/span><\/h3>\n
                \n
              • Before processing a crime, you should know the law of searching and seizing any evidence.<\/span>\u00a0<\/span><\/li>\n
              • The laws for the search and seizure of digital evidence are different from country to country.\u202f<\/span>\u00a0<\/span><\/li>\n<\/ul>\n

                Preparing for a Search<\/span><\/b>\u00a0<\/span><\/h3>\n
                  \n
                • Identifying the nature of the case<\/span>\u00a0<\/span><\/li>\n
                • Identifying the Computer System<\/span>\u00a0<\/span><\/li>\n
                • Determine whether you can seize the system<\/span>\u00a0<\/span><\/li>\n
                • Get an elaborate layout of the location<\/span>\u00a0<\/span><\/li>\n
                • Determine the tool you need<\/span>\u00a0<\/span><\/li>\n<\/ul>\n

                  Seizing Digital Evidence at the Scene<\/span><\/b>\u00a0<\/span><\/h3>\n

                  Seize the computer and its peripheral devices to obtain all manuals, especially the operating system and software. The examiners at Forensic Laboratories need to refer to the manual to determine the kind of hardware and understand its technicalities. In addition, seizing other documentation at the site, like notes, passwords, and journals, may prove very useful. Sticky notes, or other pieces of paper around the computer systems that may have passwords or login IDs written on them, should also be seized from the spot.<\/span>\u00a0<\/span><\/p>\n

                  Storing The Digital Evidence<\/span><\/b>\u00a0<\/span><\/h3>\n

                  The chain of custody provides a road map for handling electronic evidence from beginning to end by recording. IT managers should work with general counsel to develop and implement a plan for collecting and preserving electronic data to maintain a solid chain of custody.<\/span>\u00a0<\/span><\/p>\n

                  Obtaining Hash<\/span><\/b>\u00a0<\/span><\/h3>\n

                  Performing a hash test ensures that the data we obtain from the previous bit-by-bit copy procedure is not corrupt and reflects the true nature of the actual evidence. If this is not the case, the forensic analysis may be flawed and result in problems, thus rendering the copy non-authentic.<\/span>\u00a0<\/span><\/p>\n

                  Conclusion<\/span><\/b><\/h2>\n

                  Computer forensics can collect digital evidence, store it, and prepare hashes, which can be placed following up the Chain of Custody as the technology is emerging the hackers too. They have new advanced tools for impacting and attacking systems in terms of performance & availability. So, here is a separate branch that helps you investigate such crimes and can be resolved with security concerns. Every website needs security as it holds personal and crucial information. Having forensics techniques at our end will make your daily life easier.<\/span>\u00a0<\/span><\/p>\n

                  \u00a0<\/span><\/p>\n

                  References<\/span><\/b><\/h2>\n
                    \n
                  • TechTarget<\/li>\n
                  • EC Council<\/li>\n
                  • Infonomics<\/li>\n
                  • EdTech Magazine<\/li>\n
                  • CaseGuard<\/li>\n
                  • SecureDrive<\/li>\n
                  • ResearchGate<\/li>\n<\/ul>\n

                     <\/p>\n

                    Author,<\/span>\u00a0<\/span><\/p>\n

                    Vijay Damor,<\/span><\/b><\/p>\n

                    Attack & Pentest Team<\/span>\u00a0<\/span><\/p>\n

                    Varutra Consulting Pvt. Ltd.<\/span>\u00a0<\/span><\/p>","protected":false},"excerpt":{"rendered":"

                    Computer Forensics Computer forensics is a process of identifying, preserving, analyzing, and presenting digital evidence in a legally acceptable manner. It Inv\u043eles \u043ebt\u0430ining \u0430nd \u0430n\u0430lyzing…<\/p>\n","protected":false},"author":4,"featured_media":20065,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"inline_featured_image":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[261,1],"tags":[700,698,699],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t