1. Digital Evidence Acquisition Using Cyberforensics Tools Oral Paper Presentation Graduate Student Research Development Day Virtual Conference October 25, 2014 Regner Sabillon, Ph.D. Candidate Faculty of Legal and Political Sciences Ph.D. in Human, Social and Legal Sciences AU – Faculty of Business Instructor

2. Overview Authors Abstract Keywords The Cyberforensics models Software tools Hardware tools Anti-forensics tools Conclusion References Questions Agenda

3. Overview First published paper that is a part of the ongoing research for my dissertation “Digital Forensics: Cybercrime analysis and cyberforensics assessment to enforce Information Security” The paper was published on the ISSA Journal, July 2014 -Volume 12 - Issue 7 The ISSA Journal (1949-0550) is published by the Information Systems Security Association on a monthly basis The paper was part of a special issue called “Practical Use of InfoSec Tools”

4. Overview My dissertation will address and answer the following questions : What are the social, economic and technological effects of cybercrime for mankind? In order to identify and determine such effects, it will be required to research all aspects within cybercrime and the motivations of their followers. What are the Digital Forensics scientific methodologies to obtain and preserve digital evidence? By performing an in-depth analysis of all techniques, tools and scientific methodologies to obtain, manipulate and preserve digital evidence. How to detect and fight cybercrimes and digital fraud using Digital Forensics? We will develop some models to detect and fight cybercrime and digital fraud as well. Hence, we will identify behaviours and environments that are utilized by cybercriminals.

5. Authors

6. Abstract With the proliferation of digital devices comes the increase to commit cybercrimes or to use these digital devices to perpetrate common crimes. Hence, the use and sophistication of cyberforensics tools, techniques and methodologies are necessary to obtain digital evidence, enforce corporate InfoSec policies, mitigate security threats and fight anti-forensics practices.

7. Keywords Cyberforensics Cybercrime Anti-forensics Digital forensics

8. The Cyberforensics models Kruse and Heiser (2001) -Assess, Acquire, Analyze and Report Casey (2001) - Identification, Collection, Preservation, Examination, Analysis and Reporting Ambhire and Meshram (2012) - Planning phase, scene phases (Identification, Collection and Preservation) and the lab phases (Examination, Analysis and Report)

9. Software tools -Basic categories: Operating System utilities Open-source applications Commercial applications and suites -Functional categories: Physical media capture and analysis Memory capture and examination Application analysis Network capture and analysis - Mobile device forensics (MF) tools -Cloud computing tools

10. Hardware tools -Computer technician standard toolkit -Write-protected interfaces -Forensics workstations -Non-technical tools

11. Anti-forensics tools -Cryptography and steganography tools -Minimize the footprint like memory injection and buffer overflow exploits -Online storage and anonymous activities -Techniques to attack cyberforensic investigators

12. Conclusion Digital investigations can be time sensitive in order to identify, collect, preserve, assess, analyze and present digital forensic evidence. Cyber forensic investigators must have expertise in the tools, techniques and procedures that they use. Each tool does have weaknesses and strengths that require a substantial use in either corporate, lab or field environments. The challenges will continue to increase over the years but cyber investigators have to achieve common technical and legal standards; in order to create a strong model for the use of cyberforensic tools and the fight against anti-forensics practices.

13. References Amshire V. and Meshram, B. (2012). Digital Forensic Tools. IOSR Journal of Engineering, Vol. 2, Issue 3, March 2012, Pages 392-398. Barmpatsalou, K. et al. (2013). A critical review of 7 years of Mobile Device Forensics. Digital Investigation, Vol. 10, Issue 4, December 2013, Pages 323-349. Cano, J. and Cifuentes J. (2012). Analysis and Implementation of Anti-Forensics Techniques on ZFS. IEEE Latin America Transactions, Vol. 10, No 3, April 2012, pages 1757-1766. De Lucia, E. (2013). Anti-forensics – Part 1. http://resources.infosecinstitute.com/anti- forensics-part-1/http://resources.infosecinstitute.com/anti- forensics-part-1/ Dykstra, J. and Sherman, A. (2012). Acquiring forensic evidence from infrastructure-as-a- service cloud computing: Exploring and evaluating tools, trust, and techniques. Digital Investigation, Vol. 9, Supplement, The Proceedings of the Twelfth Annual DRRWS Conference, August 2012, Pages S90-S98. Garfinkel, Simson L. (2007). Anti-Forensics: Techniques, Detection and Countermeasures. ICIW 2007. http://simson.net/ref/2007/slides-ICIW.pdfhttp://simson.net/ref/2007/slides-ICIW.pdf Graves, Michael W. (2014). Digital Archaeology: The Art and Science of Digital Forensics. Addison Wesley, Upper Saddle River,NJ, USA. Pearson Education Inc. Hilley, S. (2007). Anti-forensics with a small army of exploits. Digital Investigation, Vol. 4, Issue 1, March 2007, Pages 13-15. Marcella, A.J. and Menendez D. (2008). Cyber Forensics: A Field Manual for Collecting, Examining and Preserving Evidence of Computer Crimes. Second Edition, Auerbach Publications, Boca Raton, FL, USA. Taylor & Francis Group.

14. Questions