Electronic Crime and Digital Forensics Analysis

Question: As part of the auditing team in capacity of a Digital Forensics expert, prepare digital forensics investigative plan to enable a systematic collection of evidence and subsequent forensic analysis of the electronic and digital data. Assuming all systems are Windows based, this plan should detail following: 1. justify why use of the digital forensic methodology and approach is warranted including procedures for corporate investigation. 2. describe the resources required to conduct a digital forensic investigation, including team member skill sets and required tools. 3. outline an approach for data/evidence identification and acquisition that would occur in order to prepare the auditors for review of the digital evidence. 4. outline an approach and steps to be taken during the analysis phase making the assumption the computer system is a Microsoft Windows-based computer. 5. create a table of contents for the investigative plan describing what the primary focus of the report would be. Answer: Introduction World philosophies are starting ever-increasing needs on digital systems and networks. This reliance is charming ordinary and in certain cases essential in numerous peoples has some types of standard day-to-day actions which presumes considerable similarity to the additional traditional variations that have enthused in to adjust our lives, the obtain ability of digital technology unavoidably leads to misappropriation by anti-social or wicked persons as well as normal populations. Digital Forensic is a division of forensic discipline that involves investigation of contents and material present in any digital devices often Computers and Mobiles. It know how to have number of use in order to support any hypothesis or evidence in courts. Whenever the crime involves any network or computer it is termed as Electronic or Computer offense. Such crime are frequently committed either next to any individual or it involves a group maybe a company or any organization.[1] Digital Forensics provides Digital evidence associated with e-crime. Digital evidence is any information stored in the form of binary digits and can be offered in court. It can be any hard drive, a CD, a flash card or a mobile phone. An additional vital feature of any digital forensic is that it can be used as private investigation while following legal consideration and international legislation. Thus in order to proceed in any investigation, a digital forensic investigation plan is developed which includes different forensic methodologies to be followed after analyzing the whole case and then preparing an outline of the procedure followed along with the evidence. In this case study a computer forensic team and laboratory needs to be setup including the necessary equipment and facility required. Total budget involved in the setting needs to be determined along with the type of experts needed in the team and thus creating a Digital forensic plan. Current Perception of Forensic Science Before hand deliberating the present awareness with regards to the forensic science, this conversation emphases on phases usually elaborated in familiarizing societys idea of hatefulusage of numerous technologies. First is aunderstanding by customers that the novel technology can be cast-off for unlawful and perhapsillegalresolutions. Risingapprehensionshadows as occurrencesyield andconvertedinto more thoughtful. The cumulativecapacity of misappropriation and percentage of illegalactionfinallyreasonsspecialists to distinguish that they necessitate some level of proficiency to assistancein reorganization, knowing, and frustrate any future incorrectdoing. Specialists then nurturequalified expertise, edifice on a profounderindulgent of the difficulty, its indications, and the incentives of those tangled in unlawfulactions. Founded on these phases, the complexity of their applicationconverts to a gathering of numerousconnected factors. The first featurereports the difficultyelaborate in the knowledge. True themematerialspecialists are compulsory to have a comprehensiveconsiderate of the accompanyingskill as a precondition to utteringsuppositionsnearby the confirmations. The second influence is that adequateinvestigation must service the techniques required to scrutinize and investigatesuggestions that could convertedto evidence. Till now, movements to report both of these connectedinfluences have been carefullyassociated with the construction and development of maximum forensic corrections. Digital Forensic Methodologies Normal forensic examination methods comprise the subsequent: Chromatography, hair, spectroscopy and fiber analysis. Pathology, toxicology, anthropology, examination of questionable documents odontology andstructural engineering. Behavioral outlines exposed by assessments, such as polygraphs and psychological exams We can see in broad way as: a) Identification recognizing a happening from indicators and crucial its sort. this can be not expressly at intervals the sphere of forensics, however important as a result of it impacts alternative steps. Here the case is identified as misuse of emails and leaking of crucial information from the main office desk. b) Preparation making ready the techniques we need to apply using tools aided for applications like search warrants, and watching authorizations and management hold up. Preparation of an investigation plan to proceed is done in this step. c) Preservation cut off, protect and conserve the condition of physical and digital proof. This comprises stopping individuals from victimization digital device also permitting alternative magnetic attraction devices which are needed to be utilized at intervals associate affected radius. d) Assortment documentation of the physical view and photocopy digital evidence victimization homogeneous and conventional procedures. f) Examination in detail methodical search of proof concerning the suspected offense. This centers on distinguishing and position probable proof, presumably at intervals unusual locations. Proper Documentation and legal legislation requests to be followed and scrutinize in order to catch the suspect. g) Presentation Recapitulate and supply rationalization of wrapping up this could be in print in an exceedingly common persons terms victimization abstracted classification. All abstracted classification ought to allusion the particular particulars. After collecting relative information and evidence it can be presented in an investigation report format to the concerned official and discuss its consequences. h) Returning proof guaranteeing substantial and digital correctly is came to appropriate owner similarly as crucial however and what criminal proof should be detached. once more not an exact forensics step, but any representation that grab hold of proof seldom deal with this facet. Proper investigation will always lead to the correct suspect with proof.Different Forensic equipment used helped in locating the evidence and the case comes at final step. Why Digital Forensics The massive common of investigative methods laboring by old-style forensic science cultivated out of laboratories. Finished time, supplementary federal, public, and local powers that be understood the significance and requirement of methodical examination. Specialist with specific attention in the forensic characteristics of investigation initiated to change over their observes to recently recognized laboratories that absorbed on forensic investigation in upkeep of the courts. This tendency leftover true to this day, though, as detailed beforehand, forensic examination of computer structures has occupied a dissimilar evolutionary route. In totaling, the courts also assumed that these investigative methods were not unquestionable. They were consequent by investigation that controlled (or should comprehend) procedures of fault and other catalogues to support pronounce the authenticity of figures and description results. This thought directed to the expansion of principles and guidelines of acceptability of professional demonstration that must escort scientifically consequent reference confirmation (Eckert, 1997) Frequently in criminal chronicles, the courts and public views have derived to be dependent profoundly on assured confirmation consequent by the systematic method. Possibly the furthermost frequently quantified but minimum agreed is DNA profiling. This some what novel method is completed for the courts as a procedure recycled by criminological serologists. It is trusted upon since of its alleged capability to distinguish despondent to the side by side of the specific, as a result exchange other, elder methods comparable to blood typing for example a principal evidentiary contrivance. Till very lately, the scientific communal has been noticeably inattentive from the expansion of values, procedures, and conventions connected to forensic examination of digital mechanisms. This tendency has commanded to court dependencies on instance relatively than arithmetical consequence and repeatability when governing on acceptability of suggestion consequent from digital foundations. As judges, juries, resistance prosecutors, and quality managers developed well-informed in digital technology and appreciate its complication entirely, it is probable that we will perceive the call for an additional difficult method to digital forensic examination. How it will come in action When this practice activates, decision-makers will request additional convincing questions and anticipate more thorough, methodically established clarifications from those providing testament or convincing opinions. This novel opinion of proof, coupled with progressively active, networked surroundings, will strength a example change. This pattern change will gradually adjust law implementations usage of knowledge and permit for broader usage of forensic practices in commercial, business, management, and the military. Solution Path : Digital Forensic The forensic examination of computer systems, whether in provision of the courts or decision-makers in occupational or military processes, has the identical objective: persuasion based on factual evidence. The evidence essential be enough to assistance to bind a judge and jury to a judgment or assisting a decision-maker to alter supply distributions or operational objectives. At the essential, they are fundamentally matching but are acknowledged by dissimilar names. Resources and Budget involved Various Software help in the investigation process in case of any electronic crimes and thus their utilization comes into existence. The resources required would be some hardwares as well as some softwares.Some of type of forensics needed to be done are Network Forensic It is connected to the checking and study of computer network transfer for the reasons of in sequence meeting, legal proof, or interruption detection[5] Email Forensic Wipe away or removing an email doesnt of necessity denote that it is gone everlastingly frequently emails can be forensically take out even following removal. Forensic tracing of e-mail is alike to conventional police officer work. As here in this incident the case is about misuse of email and network traffic. Hacking of some passwords and increase in number of spams are also some of the aspects to ponder. The resources required can be categorized on the basis of hardware and softwares. Hardware Required S.no. Hardware Properties Estimated Cost 1 Forensic Systems It consists of integrated processing platforms and it can handle challenging computer cases. It bring the aptitude to easily duplicate proof in a straight line from IDE/SAS/SATA drives, USB devices, Firmware devices, CDs, DVDs, LTO-4 tape and PC Card/Smartmedia/SD-MMC/Memory Stick/Compact Flash media in a forensically sound environment. $6,712 2 FREDC Forensic network A Forensic system is a sequence of dispensation and imaging computers linked and integrated in a straight line with a high-speed and high-capacity server to distribute resources. The file member of staff serving at table function as the core of the Forensic Network and can be used as a central storage facility for Forensic Images as well as applications software for use by the client processing and imaging stations. $4,671 3 Forensic devices Standalone forensic devices which address specific needs of the Computer Forensics Investigator $2,545 4 Other Accessories These accessories may include different adapters, enclosures, protocol modules and many more $1,289 Expertise of assembling forensic team The assembling team for forensics must include a number of experts ranging from the field of Law to the system expert. The experts to be included must in the team are A Lead investigator A lead investigator leads the case and identifies and analyses every aspect of case taken. They have all basic knowledge in every proceeding and accomplishes task at his intelligence level They gather clues, evidences and suspects and collects every detail of the proceeding Co-Investigator They assist the lead investigators in collecting relevant information and providing details to the other department members present in the investigation team. They act as a bridge between the departments and lead investigator Legal Expert They are responsible for taking in account all legal considerations and legislation while collecting information. They take into account every step and procedure being followed by the investigators under law. They also advise the legal restrictions while investigation. Security Department Officer Their role is to provide information and evidence regarding the incidents that is happening. They are accountable to all those security steps being followed and care taken in the organization. Technical Expert To carry out the identification process and analysis there comes the need of a Technical expert. As we see here there is a misuse of email then respective software must be used by the expert to identify the loophole. Conclusion Events of dependability and correctness for the procedures and approachescast-off in examinationcustomarilyspread the level of self-assurancepredictable in the proof and complementarywitness. Evidenceconsequent from computer criminologicalinvestigation has however to be opposed to any excessive range by security lawyers in jurisdictional reports or specialists in inquiries of computer misapplication. Most procedurescast-off nowadays are anticipated conceivable if not unquestionablesince they are established by reliable companies, used by specialists or experts in the field, and recycled beforehand in benches or other backgrounds to influence experts. In the nearby future, the gathering, synthesis, and association of data after all of these foundations and more will be self-motivated to soundings, both public and criminal. Of cumulativesignificance will be the requirement for suggestion, and the approaches and practices used to reveal it, to be precise, consistent, and recognized as average preparation in digital forensic investigation. References Computer forensic tool testing program, computer imaging specification, version 3.1.6, national institute of standards and technology. Available at: www.cftt.nist.gov Eckert, w. G., introduction to forensic sciences, 1997, crc press. Federal rules of evidence, article vii. Opinion and expert testimony, rule 702 rule 703. Available at: www.house.gov/judiciary/evid00.pdf Foster, k., r huber, judging science: scientific knowledge and the federal courts, 1997, mit press. Koehler, j. J., a. Chia, s. Lindsey, , the random match probability in dna evidence: irrelevant or prejudicial, jurimetrics journal, 1995, winter, pp. 201-219. Pollack j., us district court, pa: u.s. V plaza, acosta (cr. No. 98-362-10, 11,12), strengthening the criteria for admissibility of fingerprint evidence, judicial opinion. Computer crime investigation computer forensicssource: information systems security, summer 97, vol. 6 issue 2, p56, 25p. an examination of digital forensic models international journal of digital evidence fall 2002, volume 1, issue 3 mark reith, clintcarr, gregggunsch, department of electrical and computer engineering, graduate school of engineering and management,air force institute of technology,wright-pattersonafb, oh 45433-7765