Digital Forensics

1
Digital Forensics Services
I. DigitalI.Evidence Recovery Recovery Service
Digital Evidence

II. Forensic Data Analytics

III. Cyber Investigation

IV. E-Discovery Management

2
Digital Forensic Methodology
Phase I: Identification of
Evidence
• We identify the areas where
electronic indications and
evidence can be found, taking into
account locally available data
sources and network structures
with external data pools (e.g.
cloud services).
• Our investigations focus on all
available data storage media Such
as from laptops to the Unix
mainframe, from mobile phones to
GPS device
Phase II: Preservation of
Evidence
• All evidence must be inventoried
and secured to preserve its
integrity; the aim is to map the
digital footprint in a way that is
admissible as evidence in court.
• This can be carried out either in
our Forensic laboratory or directly
at our clients’ premises.
• We locate deleted or hidden files
(or fragments) and preserve
evidence that the perpetrators
believed to be untraceable.
• Neither the original data nor the
systems are compromised or
impaired in this process.
Phase III: Analysis of
Evidence
• With the use of powerful systems
and tools, we analyse the secured
data in our laboratory according to
case-specific requirements and
put the jigsaw together, enabling
differentiated evidence
management.
• In some cases we already perform
an initial analysis on site.
Phase IV:Presentation of
Evidence
• The secured evidence, initially
available only in electronic form, is
processed in accordance with
formal legal requirements and
presented in a way that can be
used in court.
• Our approach and results are
always clearly traceable,
repeatable and transparent.
• We can also provide expert
witness testimony if required.
3
Digital
Evidence
Recovery
Digital Evidence Recovery Services
Digital Evidence Recovery can be seen as:
• The use of science or technology in an investigation to establish facts and evidence found in
computers and digital repositories and ensuring its accuracy and reliability.

Digital Evidence Recovery comprise of:

• Identifying

• Preserving

• Analysing

• Presenting digital evidence in a manner that is legally acceptable in any judicial or administrative
hearing.

5
Digital Evidence - Sources

• Documents •Contact Details • System logs

• Financial Records •Call Logs • Server Access Logs
• Log files •SMS & MMS • ERP Logs
• IM Chat Logs •Documents • User ID audit trails
• Internet History files •Emails • I.P. Addresses
• E-Mails •IM chat logs • MAC Addresses
• Temporary Files •Internet History Files • E-Mail messages
• Deleted files etc.. •Deleted Files etc.. • Firewall audit trails etc..

6
The Digital Forensic Examiner must
serve Two Masters

Technology

The Law

7
 Admissibility of Electronic Evidence
• Information Technology Act,2000
• Indian Evidence Act ,1872
• Last 40 years have witnessed rapid development in
technology
• Many features such as low cost, ease of use and anonymity
have fuelled cyber fraudulent activity
• Criminal activity + technology = abundance of evidence
• Stored data and messages are now a valuable source of
evidence in civil and criminal proceedings

8
The nature of Digital Evidence
Admissibility of digital evidence can easily be lost due to its mere nature.

Digital Evidence is:

• Intangible in nature
• Volatile
• Susceptible to manipulation
• Located on IT Systems worldwide
• In need of forensic technology to examine
• Transient in nature

9
Chain of Custody
An important tool used by investigators to safeguard evidence is the “Chain of Custody”

• It is a means of accounting who has touched a given piece of evidence

• When they touched it; and
• What they did to the evidence.

• It is a way of demonstrating that evidence hasn’t

been damaged or tampered with while in the care
of the investigator
• NO item should ever be left alone unless stored
in a secure place of storage
• Whenever items are handed to another party it has
to be recorded for future reference.

10
Sample reports

11
Forensic Data
Analysis
Forensic Data analytics Framework

Data Database Processing Reporting

- SAP - MySQL
- Oracle - Microsoft
SQL Server
- SQLite
Analytics scripts

13
Forensic Data Analytics in different Sectors
Financial Services
• AML Analytics
• Compliance Analytics
• Loan Analytics
• Credit Card Analytics
• Claims Analytics
• Cyber Analytics
• Transaction Analytics
Mining
• ABC Analytics
• Compliance Analytics
• Procurement Analytics
• Payroll Analytics
• T&E analytics
• Cyber Analytics
Manufacturing
• Procurement Analytics
• Sales Analytics
• Payroll Analytics
• Spend Analytics
• Compliance Analytics
• Cyber Analytics
Retail
• Supply Chain Analytics
• Customer Analytics
• POS Analytics
• Compliance Analytics
• Vendor Analytics
• Stores review Analytics
• Cyber Analytics
Life Science Oil and Gas
• Sales Analytics
• ABC Analytics
• Marketing Analytics
• Compliance Analytics
• Compliance Analytics
• Procurement Analytics
• ABC Analytics
• T&E analytics
• T&E Analytics
• Cyber Analytics
• Cyber Analytics
Automobile Telecom
 Warranty Analytics • Procurement Analytics
 Compliance Analytics • Revenue Analytics
 Procurement Analytics • Payroll Analytics
 Payroll Analytics • Compliance Analytics
• Cyber Analytics
14
 Financial Sector Analytics
Compliance Credit Card Loan
AML Analytics Analytics
Analytics Analytics

AML Analytics help the banks to
uncover illicit activity and comply
with AML regulations and CTF
regulations.
Compliance analytics helps to
identify behavioral anomalies,
Unusual patterns , trends, hidden
relationship and high level of
activities with high risk countries
and entities. Helps to comply with
CSSF regulations.
Credit card analytics helps the
bank to identify the high
volumes of transactions,
unsecured lending, default
patterns and credit limit
alterations.
Loan analytics helps the bank
to identify the fraudulent loans
both in retail sector and
corporate finance

Cyber Transaction Claims

Analytics Analytics Analytics

Cyber analytics helps the bank
to identify and monitor any
Cyber attack on their IT
Infrastructure, Core Banking
application and Swift etc.
Transaction analytics helps the
bank to identify any anomalies in
the online transaction happened
in online banking and mobile
banking.
Claims analytics helps the
insurance companies to
identify the fraudulent claims
and leakages in different
insurance policies.

15
Retail Analytics
Customer Inventory POS Compliance
Analytics Analytics Analytics
Analytics
Compliance analytics helps to
Analyzing data related to
Understanding Customer identify behavioral anomalies,
Evaluating stock demand customer orders, invoices,
needs by analyzing data to Unusual patterns , trends,
and its movements and freight and evaluating OTC
Identify relationships Profiles, hidden relationship and high
creating flexibility process and identify areas of
trends and anomalies level of activities with high
improvement
risk countries and entities

Supply Procurement
Cyber Chain Analytics
Analytics Analytics
Cyber analytics helps the bank Identify and tracks most Procurement analytics helps
to identify and monitor any profitable products, supplier the organization to identify the
Cyber attack on their IT management bottlenecks, coalition between employee &
Infrastructure, Core Banking quality issues and track vendors, leakages in
application and Swift etc. operational performance to procurement .
improve customer satisfaction

16
Life Science Analytics
Marketing Sales ABC
Analytics Analytics Analytics

Sales analytics helps the ABC analytics helps the

Marketing Analytics helps the organization to identify the
organization to identify the organization to drill down the
sales performance by payment made for the third
marketing expenses by sales person , in detail by
employees, by region etc. party i.e. who, what, when,
region, district and why.
country.

Compliance
Cyber T&E Analytics
Analytics Analytics

Cyber analytics helps the bank
to identify and monitor any
Cyber attack on their IT
Infrastructure, Core Banking
application and Swift etc.
T&E Analytics help the Compliance analytics helps to
organization to identify the identify behavioral anomalies,
employee expenses i.e. Unusual patterns , trends,
who, where, when, why, what hidden relationship and high
level of activities with high
& how.
risk countries and entities.

17
Manufacturing Analytics
Procurement
Analytics
Procurement analytics helps
the organization to identify the
coalition between employee &
vendors, leakages in
procurement .
Cyber
Analytics
Cyber analytics helps the bank
to identify and monitor any
Cyber attack on their IT
Infrastructure, Core Banking
application and Swift etc.
Sales
Analytics
Sales analytics helps the
organization to identify
the sales performance
by sales person , in detail
by region , district and
country.
Compliance
Analytics
Compliance analytics helps to
identify behavioral anomalies,
Unusual patterns , trends,
hidden relationship and high
level of activities with high
risk countries and entities
Payroll
Analytics
Payroll analytics helps the
organization to find the ghost
employees, leakages in
payroll, coalition between
vendor & employees.
ABC
Analytics
ABC analytics helps the
organization to drill down the
payment made for the third
party i.e. who, what, when,
why
18
Oil & Gas Analytics
ABC Compliance T&E
Analytics Analytics Analytics

ABC analytics helps the
organization to drill down the
payment made for the third
party i.e. who, what, when,
why
Compliance analytics helps to T&E Analytics help the
identify behavioral anomalies, organization to identify the
Unusual patterns , trends, employee expenses i.e.
hidden relationship and high who, where ,when, why , what
level of activities with high & how.
risk countries and entities

Cyber Procurement
Analytics Analytics

Cyber analytics helps the bank Procurement analytics helps

to identify and monitor any the organization to identify the
Cyber attack on their IT coalition between employee &
Infrastructure, Core Banking
vendors, leakages in
application and Swift etc.
procurement .

19
Automotive Analytics
Procurement
Analytics
Procurement analytics helps
the organization to identify the
coalition between employee &
vendors, leakages in
procurement .
Cyber
Analytics
Cyber analytics helps the bank
to identify and monitor any
Cyber attack on their IT
Infrastructure, Core Banking
application and Swift etc.
Sales
Analytics
Sales analytics helps the
organization to identify
the sales performance
by sales person , in detail
by region , district and
country.
Warranty
Analytics
Warranty analytics helps the
organization to keep track of
warranty and also provide
with any anomalies pattern of
misuse of warranty by the
customers .
Payroll
Analytics
Payroll analytics helps the
organization to find the ghost
employees, leakages in
payroll, coalition between
vendor & employees.
Compliance
Analytics
Compliance analytics helps to
identify behavioral anomalies,
Unusual patterns , trends,
hidden relationship and high
level of activities with high
risk countries and entities
20
Telecom Analytics
Procurement
Analytics
Procurement analytics helps
the organization to identify the
coalition between employee &
vendors, leakages in
procurement .
Cyber
Analytics
Cyber analytics helps the bank
to identify and monitor any
Cyber attack on their IT
Infrastructure, Core Banking
application and Swift etc.
Compliance
Analytics
Compliance analytics helps to
identify behavioral anomalies,
Unusual patterns , trends,
hidden relationship and high
level of activities with high
risk countries and entities
Sales
Analytics
Sales analytics helps the
organization to identify the
sales performance by sales
person , in detail by region ,
district and country.
Revenue
Analytics
Revenue analytics helps the
client to recognize their
revenue generated in the
CDR and reconcile with the
different plans/ Schemes
Payroll
Analytics
Payroll analytics helps the
organization to find the ghost
employees, leakages in
payroll, coalition between
vendor & employees.
21
Mining Analytics
ABC Compliance T&E
Analytics Analytics Analytics
ABC analytics helps the Compliance analytics helps to
organization to drill down the T&E Analytics help the
identify behavioral anomalies, organization to identify the
payment made for the third Unusual patterns , trends,
party i.e. who, what, when, employee expenses i.e.
hidden relationship and high who, where ,when, why , what
why. level of activities with high & how .
risk countries and entities

Cyber Procurement
Analytics Analytics

Cyber analytics helps the bank Procurement analytics helps

to identify and monitor any the organization to identify the
Cyber attack on their IT coalition between employee &
Infrastructure, Core Banking vendors, leakages in
application and Swift etc. procurement .

22
Sample Report

23
Cyber
Investigations
It’s All About the Data
Sensitive information is being shared using many forms of data transfer, with multiple stakeholders
using the data for different business purposes. Organizations need to understand where sensitive
data is being handled by the organization and on its behalf by third parties.

Data Storage Data Sharing

Data Collection Data Usage Data Destruction

& Retention

In terms of data protection (Information security, Cyber Security ), history has proven that protective
technologies are not sufficient enough to protect organizations from Cyber criminals.
Early Detection and Quick Response are the keys to effective data protection.

25
 Types of Data
Websites

Databases

Email technologies (Exchange)

Devices (digital, cameras, smartphones, gps)

Social media

Mobile Apps

Computers (servers, laptops, desktops, tablets etc)

Networking (Logs, IDS, IPS)

Storage technologies (CD, DVD, USB, HDD, SSD,

tapes)

Internet

Audio records

Files etc

26
Cyber Investigations
■ Cyber Fraud Risk Assessment
■ On Demand Cyber Investigation
■ Email Forensics
■ ERP and Application Forensics
■ Network Forensics
■ Database Forensics
■ Cloud Forensics
■ Data Leak Forensics
■ Pre-exit Forensics
■ Malware Forensics and Analysis
■ Cyber Evidence Recovery
■ Cyber Expert Testimony

27
Sample Reports

28
E-Discovery
Management
E-Discovery Management
Methodology
Processing

Preservation

Information
Management Identification
Review Production Presentation

Collection

Analysis

30
E-Discovery Framework

Risk & Compliance

31
Digital Forensics Apply to All sectors
Financial
Pharmaceutical
Oil & Gas
Media
Transport
Commerce
Health
Legal
Government
Construction
Education etc.

32
Digital Forensic Lab

33
Contact
■ Name: Karthik Palaniappan
■ Email: jkarthik142@gmail.com
■ LinkedIn: www.linkedin.com/in/karthikpalaniyappan

34