Download as PDF, PPTX
Uploaded byZyxware Technologies
An introduction to cyber forensics and open source tools in cyber forensics
The document provides an overview of cyber forensics, which involves collecting and analyzing digital evidence for legal purposes. It details the phases of cyber forensics, methods for acquiring and analyzing data, and compares open source tools with proprietary tools' benefits and drawbacks. Additionally, it lists various open source initiatives and tools available for different stages of the forensic process.
More Related Content
Similar to An introduction to cyber forensics and open source tools in cyber forensics
An introduction to cyber forensics and open source tools in cyber forensics
- 1. An Introduction to CyberForensics and Open Source Tools in Cyber Forensics Anoop John Founder & CTO Zyxware Technologies
- 2. Cyber Forensics OSTools What is Cyber Forensics Cyber - A prefix used in a growing number of terms to describe new things that are being made possible by the spread of computers. Anything related to the Internet also falls under the cyber category. Forensics – Scientific tests and techniques used in connection with the detection of crime Cyber Forensics – Discipline that combines elements of law and computer science to collect and anlayze data from computer systems, mobiles, networks, communication systems, and storage devices in a way that is admissible in a court of law
- 3. Cyber Forensics OSTools What is Digital Evidence? Information and data of value to an investigation that is stored on, received, or transmitted by an electronic device. This evidence is acquired when data or electronic devices are seized and secured for examination.
- 4. Cyber Forensics OSTools Where do you find Digital Evidence? Digital Evidence may be found in Storage devices like hard disc CD DVD memory card USB drive mobile phones SIM card Online resources like mail servers cloud servers / data centers
- 5. Cyber Forensics OSTools How can you hide Digital Evidence? Digital Evidence can be hidden in Files Password protected files Encrypted files Steganography files Hard Drives Encrypted drives Formatted hard disc HPA (Host Protected Area) DCO (Device Configuration Overlay)
- 6. Cyber Forensics OSTools What can Digital Evidence be related to? Digital Evidence could be related Online fraud Organized crime Identity / Data theft Unauthorized access Malicious files / Virus attack / Cyber attack Data alteration Cyber defamation Cyber pornography Online gambling Sale of illegal items
- 7. Cyber Forensics OSTools Phases in Cyber Forensics Phase 1: Identification of storage media for potential evidence / Identification of transmission media for collection of potential evidence Phase 2: Acquisition of the storage media / collection of transmitted information Phase 3: Securing collected media / data and forensic analysis of the acquired media Phase 4: Documentation & Reporting
- 8. Cyber Forensics OSTools Analyzing acquired media/data Identifying traces of network / computer intrusion Processing network packets, log files Identifying & examining malicious files Employing techniques to crack file & system passwords Detecting steganography Recovering deleted, fragmented, hidden & corrupted data Analyzing online activities
- 9. Cyber Forensics OSTools Handling acquired media/data Maintaining evidence custody procedures Preventing tampering Identifying tampering Courtroom presentation
- 10. Cyber Forensics OSTools Pros of Open Source Tools Low capital cost Minimal / No operational cost Minimal / No maintenance cost Algorithm/logic is known to the user Source code is freely available for access, editing & customization Extensive support from the open source community Free usage to any number of users
- 11. Cyber Forensics OSTools Cons of Proprietary Tools High capital cost High operational cost High maintenance cost Algorithm/logic not known. No access to source Heavy dependency on the software manufacturer Restricted usage
- 12. Cyber Forensics OSTools Open Source Initiatives Belgian Federal Computer Crime Unit (FCCU) http://www.lnx4n6.be/index.php An advanced network forensic framework By: Australian Federal Police, Brisbane, Australia http://sourceforge.net/projects/pyflag/files/ Project in The Software and Systems Division supported by Law Enforcement Standards Office and Department of Homeland Security http://www.cftt.nist.gov/index.html
- 13. Cyber Forensics OSTools Open Source Initiatives (cont...) The Open Computer Forensics Architecture (OCFA) is a modular computer forensics framework built by the Dutch National Police Agency http://ocfa.sourceforge.net/ ForeIndex: A Framework for Analysis and Triage of Data Forensics http://www.basistech.com/wp- content/uploads/2014/04/osdf-2011-silva- foreindex.pdf
- 14. Cyber Forensics OSTools Open Source Tools in Acquisition Phase Digital Forensics Framework www.digital-forensic.org CAINE www.caine-live.net/ DEFT www.deftlinux.net/ OCFA http://sourceforge.net/projects/ocfa/ Sleuthkit http://www.sleuthkit.org
- 15. Cyber Forensics OSTools Open Source / Free Tools in Analysis Phase Digital Forensics Framework www.digital-forensic.org CAINE www.caine-live.net DEFT www.deftlinux.net SAFT Mobile Forensics www.signalsec.com/saft SANS Investigative Forensics Toolkit – SIFT http://digital- forensics.sans.org/community/downloads
- 16. Cyber Forensics OSTools Open Source / Free Tools in Analysis Phase (cont...) Sleuthkit Autopsy http://www.sleuthkit.org/autopsy/ Sleuthkit http://www.sleuthkit.org/sleuthkit/ Live View http://liveview.sourceforge.net/
- 17. Cyber Forensics OSTools Open Source / Free Tools in Analysis Phase (cont...) Analyzing RAM CMAT http://sourceforge.net/projects/cmat Volafox https://www.volatilesystems.com/default/volatility Volatile https://www.volatilesystems.com/default/volatility Network Forensics WireShark http://www.wireshark.org NetworkMinor http://networkminer.en.malavida.com/
- 18. Cyber Forensics OSTools Open Source / Free Tools in Analysis Phase (cont...) Registry analysis Registry Decoder http://www.digitalforensicssolutions.com/registrydec oder/ Password cracking Free Tools http://www.openwall.com/john Cracking Passwords for Windows, PDF, Word RAR , ZIP & Excel http://pcsupport.about.com/od/toolsofthetrade/tp/ password-cracker-recovery.htm
- 19. Cyber Forensics OSTools Open Source / Free Tools in Analysis Phase (cont...) Detecting Pornography Redlight Porn Scanner http://dfcsc.uri.edu/research/redLightTrial http://www.nij.gov/topics/technology/pages/software- tools.aspx
- 20. Cyber Forensics OSTools Questions? info@zyxware.com +91-9446069446
- 21. Cyber Forensics OSTools Thank you
- 22. Cyber Forensics OSTools Credits & References http://www.slideshare.net/SagarRahurkar/digital- forensics-best-practices-with-the-use-of-open- source-tools-and-admissibility-of-digital-evidence- in-courts https://en.wikipedia.org/wiki/Computer_forensics http://www.slideshare.net/prashant3535/digital- crime-forensics-15360016 http://resources.infosecinstitute.com/computer- forensics-tools/ http://www.gfi.com/blog/top-20-free-digital- forensic-investigation-tools-for-sysadmins/ http://www.digitalforensicsassociation.org/opensour ce-tools/