CYBER FORENSICS KRISHNA SASTRY PENDYALA Cyber Forensic Division Central Forensic Science Laboratory Hyderabad. 11
DIGITAL EVIDENCE? Cyber crimes Digital evidence Digital evidence is any information of probative value that is either stored or transmitted in a binary form (SWG, IACIS). Characteristics Identification of digital evidence Invisible Collection of evidence System is on, can I shutdown? - Volatile evidence? Time sensitive Changes with time May be lost log files, data of volatile memory Highly fragile Tampered, manipulated 2
TYPICAL SCENARIO WHAT IS THE EVIDENCE? IS EVIDENCE VISIBLE? WHERE IS THE EVIDENCE? HOW TO COLLECT? 3
WHAT IS CYBER FORENSICS? Youngest branch of Forensic Science. The process of identifying, preserving, analysing and presenting digital evidence in a manner that is legally acceptable in any judicial or administrative hearing. Acquire authenticate- analyze-document-depose Peer reviewed & tested tools & techniques. Goal: Successful criminal prosecution. To determine the root cause of an event. To determine who was responsible. THE LAW CYBER FORENSICS TECHNOLOGY 4
Sub-branches Disk/Media Forensics Analysis & retrieval of various files User created, user protected & system created Retrieval of data from unallocated & slack space; Network Forensics Analysis of log files - System logs, IDS logs etc., Memory Forensics: Collecting data from system memory (e.g., system registers, cache, RAM) in raw form and carving the data from the raw dump; Malware Forensics: Analyzing Malicious Code for identification and to study their payload; Database Forensics : relating to the forensic study of databases and their related metadata. Software Forensics: Analysis of software for it s functioning Embedded Forensics: Analysis of pre-programmed chips 5
Case study-1 Case of Software Forensics Data Didling Secondary state board. Private students topped over govt students No Govt student getting full marks IO seized the hard disk & Forwarded to lab. Q ire: Give the printout of all the files!!!!!! The Forensic expert, studied the case history & asked for the software. Case of software manipulation 6 DIGIT ROLL NUMBER GOVT STUDENTS STARTS WITH 3 PRIVATE STUDENTS STARTS WITH 4 FOR ROLL_ NO 3 > 68 <= 100 DEDUCT 9 FOR ROLL_ NO 4 > 68 < 88 ADD 9 Several recruitment scams 66
Case study-2 Case of Malware Forensics. Software firm Pink slip was given, June 29 th, 2009. Left the company. On 7 th July, the systems were crashed Forensic analysis of program files indicate Code of a Logic bomb with parameter set as the date 7 th July 0830 hrs. 7
Case study 3 Data carving from unallocated space Case of Chennai. Victim Director of a company His wife s nude photographs were circulated to all the members in address book Accused Disgruntled employee Kept a camera in victim residential bath room Know the e-mail & password of the victim Circulated the same. Formatted the Hard-disk Entire data of unallocated space was carved for a file thumbs.db. 8
Mining Thumbs.db Thumbs.db contains cached thumbnails of the images in a folder. embedded data present in the Thumbs.db file In many cases, the images may have been deleted from the directory but they may still be available in the thumbs.db cache! Tools: Encase, Accessdata FTK, Cyber Check suite. Ontrack recovery. Windows File Analyzer. 9
Case study 4 Paper leak. Connected the pen drive to a desktop computer & printed the question paper. Hard-disk received & windows XP. Print spooler files Two files in the C:\Windows\System32\spool\Printers folder..spl - The print job s spooled data is contained in a spool file..shd - The shadow file contains the job settings Registry analysis USB view 10
Case study 4 ( cont d) Spool Viewer view.shd files Splview.exe (available at http://undocprint.printassociates.com) This tool allows you to view the metadata of the print job! Spool Viewer http://www.codeproject.com/dotnet/e MFSpoolViewer/EMFSpoolViewer.zip This tool allows you to view the actual spooled pages! 11
CHALLENGES INCRESE IN ANTI-FORENSIC TRENDS EVIDENCE ELIMINATOR/ FILE SHREDDER DATA HIDING TECHNIQUES ENCRYPTION/PASSWORDS/ STEGANOGRAPHY DEVELOPMENTS IN OS & APPLICATIONS FORENSIC ANALYSIS OF ROUTER, HUBS MAINFRAME DIGITAL FORENSICS DATABASE FORENSICS MEMORY FORENSICS CLOUD COMPUTING Wi-Fi FORENSICS 12
CHALLENGES ANALYSIS OF TERABYTES OF DATA Satyam fraud case Data mining & data ware housing Need intelligent systems to classify data STANDARDIZATION OF TOOLS, TECHNIQUES Analysis of China made phones. Indigenous tool development. DATA FROM BROKEN DISKS Scanning Electron Microscope. Clearly defining the best practices in cyber forensics Std. Of methods, tools, Peer reviewed,tested in court In line with international legal requirements where relevant 13