COMPUTER FORENSIC

Presented by:
B . Hindu Madhavi
17K61A1207.
 List Of Contents
• Introduction.
• Computer Forensics Process.
• Diagram Representation.
• Computer Forensic Tools.
• What not to be done during investigation.
• Applications Of Computer Forensic.
• Skills required for Computer Forensic.
• Advantages Of Computer Forensic.
• Disadvantages Of Computer Forensic.
• Conclusion.
 Introduction
1.1 Definition
 “Forensic computing is the process of identifying, preserving ,
analysing and presenting digital evidence in a manner that is
legally acceptable.”
1.2 Why Computer Forensics?
-Employee internet abuse.
-Unauthorized disclosure of corporate information.
-Industrial espionage.
-Damage assessment.
-Criminal fraud and deception cases.
-Countless others!
  1.3 Characteristics Of Computer Forensics

- Identifying
- Preserving.
- Analysing
- Presenting.

 1.4 Goal Of Computer Forensics 

The main goal of computer forensic experts is not only to find

the criminal but also to find out the evidence and the presentation
of the evidence in a manner that leads to legal action of the criminal.
 1.5 History Of Computer Forensics

-Bankruptcy in Enron in December 2001.

-Hundreds of employees were left jobless while some executives seemed to benefit from the
company's collapse.
-The United States Congress decided to investigate and a specialized detective force began to
search through hundreds of Enron employee computers using computer forensics.

1.6 When and how is computer forensics used

-Intellectual Property theft
-Employment disputes
-Forgeries
-Invoice fraud, often enabled by phishing emails
2.Computer Forensics Process
*Identification
*Collection
*Examination
*Analysis
*Reporting

Identification:
The first process of computer forensics is to identify the scenario or to
understand the case . At this stage the investigator has to identify the purpose of
investigation , type of incident , parties that involved in the incidence and the
resources that are required to fulfill the needs of the case .
*Collection
The collection is the one of the important steps because your entire case is
based on the evidence collected from the crime scene . Collection is the data
acquisition process from the relevant data sources while maintaining the integrity
of data . Timely execution of the collection process is critical in order to maintain
the confidentiality and integrity of the data . Important evidence may lost if not
acted as required.

*Examination
The aim of third process is to examine the collected data by following standard
procedures , techniques , tools and methodology to extract the meanigful
information related to the case.
*Analysis
Since all five process are linked together , the analysis is the procedure to analyze the
data acquired after examination process . At this stage , the investigator search for the
possible evidence against the suspect , if any use the tools and techniques to analyze the
data . Techniques and tools should be justified legally , because it helps you to create and
present your report in front of court.

*Reporting
This is the final , but most important step . At this step , an investigator needs to
document the process used to collect , examine and analyze the data . The investigator
report also consists the documentation of how the tools and procedures were being selected
. The objective of this step is to report and findings justified by evidences.
Diagram Representation
*Computer Forensic Tools
-Disk imaging software.
-Hashing tools.
-File recovery programs.
-Encryption decoding software.
-Password cracking software.

*What not to be done during investigation?

-Avoid changing date/time stamps (of files for example)or changing data itself.
-Overwriting of unallocated space (which can happen on re-boot for example).
*Applications Of Computer Forensics
-Financial Fraud Detection.
-Criminal Prosecution
-Civil litigation.
-Corporate Security policy and Acceptable use Violations.

*Skills Required For Computer Forensics

-Proper knowledge of computer.
-Strong computer science fundamentals.
-Strong system administrative skills.
-Knowledge of the latest forensic tools.
*Advantages Of Computer Forensics
-Tracks complicated cases such as child pornography and e-mail spamming.
-Efficiency tracks down cyber criminals and terrorists from different parts of the world.
-Ensures the overall integrity and continued existence of an organization’s computer system
and network infrastructure.

*Disadvantages Of Computer Forensic

-Cost
-Anti-forensics
-Legal issues
-Increasing storage space
Conclusion
THANK YOU