Computer Forensics Securing and Analysing Digital Information
Aims What is a computer? Where is the evidence? Why is digital forensics important? Seizing evidence Encryption Hidden files and folders Live acquisitions Dead box acquisitions Forensic image, processing analysis and results Forensic tools how they work File Structure, metadata, exif data Bookmarks and reports Lab costs
What is a computer? Laptops Desktops Tablets Phones Storage Date Arial 14pt
Where is the evidence? Properties Internet Cloud People Corporate Networks Companies International Jurisdictions
Why is digital forensics important? What can we recover? Word Pictures Excel PowerPoint Adobe PDF Location data Time and date Illegal content Associates Email Internet Contacts Calendar
Seizing evidence Switched on? Call an expert! Switched off? Bag it!
Encryption Encryption may prevent data recovery Specialist techniques and training is required Specialist software and hardware is required If the computer is switched on, call an expert Where is the password? This is why live acquisition is important!
Freedom of Information Act Protective Marking Title: Publication Scheme Y/N: Summary: Branch / OCU: Date created: Review date: Version: Author: Keyspace Demonstration
Hidden Files and Folders Hidden files are difficult to find Specialist software is required If the computer is switched on, call an expert What software is being used? This is why live acquisition is important!
Freedom of Information Act Protective Marking Title: Publication Scheme Y/N: Summary: Branch / OCU: Date created: Review date: Version: Author: Hidden Picture Demonstration
Live Acquisition Why not turn it off and bag it? Allows us to recover volatile data RAM (Random Access Memory) Triage the evidence Programs Which can contain How? Specialist forensic tools Hidden Files Decryption Passwords Evidence Recent activity
Live Acquisition Specialist Forensic Tools
Freedom of Information Act Protective Marking Title: Publication Scheme Y/N: Summary: Branch / OCU: Date created: Review date: Version: Author: EnCase Portable Demonstration
Deadbox Acquisition Switched off? Bag it! What do we do with it? Create forensic Image Computer may have special boot mode Image using forensic imagers How? Image using forensic software What if you can t remove Remove the Hard drive
Deadbox Acquisition Forensic Imagers Provides a bridge between media Provides write protection for the evidence
Freedom of Information Act Protective Marking Title: Publication Scheme Y/N: Summary: Branch / OCU: Date created: Review date: Version: Author: Memory Card Acquisition Demonstration
Forensic Image What is a forensic image? Protected data container Given a unique identifier (Hash) Consists off: File Name Text File Case Info Notes Data Blocks Hash Hash important for exhibit continuity Image file types.eo1.e01. L01.Lx01.Ex01.AD1
EnCase Examiner Processing Analysis and Results Forensic Tools
Forensic Tool Kit (FTK) Processing Analysis and Results Forensic Tools
Processing Analysis and Results Internet Evidence Finder (IEF) Forensic Tools
Forensic Tools How they work Examining file structures All file types have a formal data structure Information inside the file File Identifiers Headers Footers
Forensic Tools How they work Examining the Master File Table Record of all the files stored on a drive Size File Name File Type Location Created Accessed Modified Deleted
Freedom of Information Act Protective Marking Title: Publication Scheme Y/N: Summary: Branch / OCU: Date created: Review date: Version: Author: FTK Memory Card Demonstration
Metadata and Exif Data What do we get? Information within a Picture file Camera, Make, Model GPS Location Dates Times Author
Freedom of Information Act Protective Marking Title: Publication Scheme Y/N: Summary: Branch / OCU: Date created: Review date: Version: Author: Exif Data Demonstration
Processing Analysis and Results Bookmark and Reports Highlights Files Add Comments Attach files Export to Reports
Lab Costs Staff Equipment Versus Contractors Training
Summary What is a computer? Where is the evidence? Why is digital forensics important? Seizing evidence Encryption Hidden files and folders Live acquisitions Dead box acquisitions Forensic image, processing analysis and results Forensic tools how they work File Structure, metadata, exif data Bookmarks and reports Lab costs
Freedom of Information Act Protective Marking Title: Publication Scheme Y/N: Summary: Branch / OCU: Date created: Review date: Version: Author: