Computer forensics and investigation module 1 topic 2
- 1. Computer Forensics And Investigation Module 1:Understand the importance of computer forensics Topic2:Rules of Computer Forensics, Computer Forensic Evidence By, Neha Raju K Assistant Professor BCA-Cloud Technology and Information Security Management
- 2. Contents Rules of Computer Forensics Computer Forensics Evidence
- 3. Rules of Computer Forensics • There are various rules employed during and after the forensic examination Process. Some of the most common rules are categorised as follows: • Rules for admissibility of evidences • Rules for Chain of custody • Rules for Evidence Integrity
- 4. 1.Rules for Admissibility of Evidences • Rule 1: To be admissible in the court of law, all evidences must be relevant to the case in question. • Rule 2: To be identifiable and authentic, all evidences must be sufficient to support a claim, illustrative, self-authentication (without extrinsic evidences) such as public records, govt.official docs and govt.certified records with seal.
- 5. 2.Rules for Chain of Custody • The chain of custody is important to the investigation process because it is the first step when authenticating digital audio and video evidence. • Identifying this chain of custody provides information about whether or not this evidence has been copied or cloned. • The chain of custody document contain the following information. 1.Who seized the evidence : Name, designation, e-mail,phone number,etc. 2.When the evidence was seized: Actual time and date, the system CMOS date and time . 3.Physical description of the evidence item: serial no,tag,make and model, etc.
- 6. 3.Rules for Evidence Integrity • To ensure that the evidence is not altered, various methods are employed. Some of these are: 1)Bit by bit copy 2)Evidence is locked in safe and limited access cabinets called safes,or vaults. 3)The use of crypto graphic hashes like MD5,SHA1,SHA2,etc. to ensure the integrity of the original evidence media. 4)The use of write blocker to protect the evidence from modification. 5)To create and maintain chain of custody documents.
- 8. • Computer forensics investigation is an organised process just like any other traditional law enforcement investigation. • Specially trained forensics investigators follow specific computer forensics methodology. • Evidence must be relevant to a case in question and sufficient enough to prove a point.
- 9. Where can we find evidence? • During investigations, we need to collect ,preserve and analyse computer hard drives and media such as USB drives,floppy disks,zip drives and optical media like CDs and DVDs. • Data that is not found on the disk can be found in the RAM. • The information that is found in memory includes the user ids and passwords,encryption keys,chat sessions,unencrpted data,emails,unsaved documents,hidden code such as rootkits,registry information and other critical evidence. • This data can provide related information about the target’s activity on the computer.
- 10. • Evidence may be stored in 1)CDs/DVDs 2)Hard Disk Media 3)USB drives 4)Memory Cards 5)Text messages 6)Phone Records 7)E-mails 8)Digital images 9)Various application records 10)web-sites 11)Browser history
- 11. Conclusion • There are various rules employed during and after the forensic examination Process. • Evidences are not only related to eyewitness,Blood DNA etc. Digital evidences also make a big impact on the case.
- 12. THANK YOU