Technology in Computer Forensics  Alicia Castro  Thesis Defense  Master of Software Engineering  Department of Computer Science  University of Colorado, Colorado Springs

Technology in Computer Forensics  Author: Alicia Castro  Committee Members:  Dr. C. Edward Chow  Dr. Jugal K. Kalita  Dr. Xiaobo Zhou

Computer Forensics Facts  Computer forensics is about investigating digital evidence related to criminal or suspicious behavior where computers or computer and related equipment may or may not be the target.  Internet crime has increased 22.3% in 2009 over 2008.

Computer Forensic Background  Digital evidence includes computer generated records such as the output of computer programs and computer-stored records such as messages  It is difficult to attribute certain computer activities to an individual especially in a multi-access environment.

Computer Forensics Legal Issues  Understand fundamentals of:  Search and Seizure laws  Electronic Communication Privacy Act  Wiretap Statute  Pen/Trap Statute  Patriotic Act  State Laws about Search and Seizure

Forensic Investigation Accessories to a Crime

…Forensic Investigation Accomplices of a Crime Suspect

Utilities used with Nica Forensic Tool  IECacheView  MozillaCacheView  ChromeCacheView  IEHV  Outlook Redemption  Microsoft Log Parser Nica Forensic Tool uses external tools to help parse the cache files from IE, Mozilla Firefox and Google Chrome browsers and also to gain access and parse the Outlook.pst files

Nica Forensic tool functionality  Use the cache files parser information and determine what information is valuable.  Get cookies and history files of each web browser, Skype logs, Instant Messenger and Outlook logs.  Store information in a database  Display any necessary output.  Design of all GUI displays

Nica Forensic Tool  Unlike most the forensic tools, it finds all the users on the computer not just the logged on users.  Unlike similar forensic tools, it does not need the investigator to enter the path where the information would be found. Nica Forensic Tool does it for the investigator.

Nica Forensic Tool Design Enter Case Number Case Description Forensic Investigator Notes

Run the parser to find entries by activities. Note the time stamp for date that the investigation was done and also the times it takes to find all the activities

Timeline Viewer Report by user, date time and activities

Finding the Evidence

Selecting the Evidence

Displaying selected suspected activities

Evidence’s Classification  Inclusion Criteria  More than one activity  Time between activities is less than 15 minutes  Previous history of web sited visited  Exclusion Criteria  One isolated activity and no previously history  Two or more activities with time intervals of more than 15 minutes between each activity

Nica Forensic Tool Logic Flow Chart

Nica Forensic Tool Implementation  Number of End Users = 6 (it can be unlimited)  Effects on change of task and responsibilities of End Users: Tool is so portable, investigators can carry it with them. It works so fast, that it can be run when a suspect just moves away from his/her computer for a few minutes. It is still a forensic tool, all the legal steps should be followed before trying to run the tool.

Nica Forensic Tool Limitations  Forensic can be done only to computers that are using the windows platform.  Currently set to use the most popular browsers, instant messengers, and Outlook client but more can be added easily to the scalable architecture.

Conclusion  Only portable Forensic Tool that automatically looks for login paths and all user profiles  Capture relevant Evidence  Easy to use  Assist Investigators obtaining reliable evidence

References  Please refer to Thesis Document 