1. Dr. Bhavani Thuraisingham The University of Texas at Dallas
Digital Forensics
Dr. Bhavani Thuraisingham
The University of Texas at Dallas
Lecture #1
August 30, 2013

2. Outline Introduction Applications
Law enforcement, Human resources, Other
Services
Benefits
Using the evidence
Conclusion

3. Digital Forensics
Digital forensics is about the investigation of crime including using digital/computer methods
More formally: “Digital forensics, also known as computer forensics, involved the preservation, identification, extraction, and documentation of computer evidence stored as data or magnetically encoded information”, by John Vacca
Digital evidence may be used to analyze cyber crime (e.g. Worms and virus), physical crime (e.g., homicide) or crime committed through the use of computers (e.g., child pornography)

4. Relationship to Intrusion Detection, Firewalls, Honeypots
They all work together with Digital forensics techniques
Intrusion detection
Techniques to detect network and host intrusions
Firewalls
Monitors traffic going to and from and organization
Honeypots
Set up to attract the hacker or enemy; Trap
Digital forensics
Once the attack has occurred or crime committed need to decide who committed the crime

5. Computer Crime Computers are attacked – Cyber crime Computer Virus
Computers are used to commit a crime
E.g., child predators, Embezzlement, Fraud
Computers are used to solve a crime
FBI’s workload: Recent survey
74% of their efforts on white collar crimes such as healthcare fraud, financial fraud etc.
Remaining 26% of efforts spread across all other areas such as murder and child pornography
Source: 2003 Computer Crime and Security Survey, FBI

6. Objective and Priority
Objective of Computer Forensics
To recovery, analyze and present computer based material in such a way that is it usable as evidence in a court of law
Note that the definition is the following: “computer forensics, involves the preservation, identification, extraction, and documentation of computer evidence stored as data or magnetically encoded information”, by John Vacca
Priority
Main priority is with forensics procedures, rules of evidence and legal processes; computers are secondary
Therefore accuracy is crucial

7. Accuracy vs Speed Tradeoffs between accuracy and speed
E.g., Taking 4 courses in a semester vs. 2 courses; more likely to get Bs and not As
Writing a report in a hurry means likely less accurate
Accuracy: Integrity and Security of the evidence is crucial
No shortcuts, need to maintain high standards
Speed may have to be sacrificed for accuracy.
But try to do it as fast as you can provided you do not compromise accuracy

8. The Job of a Forensics Specialist
Determine the systems from which evidence is collected
Protect the systems from which evidence is collected
Discover the files and recover the data
Get the data ready for analysis
Carry out an analysis of the data
Produce a report
Provide expert consultation and/or testimony?

9. Applications: Law Enforcement
Important for the evidence to be handled by a forensic expert; else it may get tainted
Need to choose an expert carefully
What is his/her previous experience? Has he/she worked on prior cases? Has he/she testified in court? What is his/her training? Is he CISSP certified?
Forensic expert will be scrutinized/cross examined by the defense lawyers
Defense lawyers may have their own possibly highly paid experts?

10. Applications: Human Resources
To help the employer
What web sites visited?
What files downloaded
Have attempts been made to conceal the evidence or fabricate the evidence
s sent/received
To help the employee
s sent by employer – harassment
Notes on discrimination
Deleted files by employer

11. Applications: Other Supporting criminals
Gangs using computer forensics to find out about members and subsequently determine their whereabouts
Support rogue governments and terrorists
Terrorists using computer forensics to find out about what we (the good guys) are doing
We and the law enforcement have to be one step ahead of the bad guys
Understand the mind of the criminal

12. Services Data Services Seizure, Duplication and preservation, recovery
Document and Media
Document searched, Media conversion
Expert witness
Service options
Other services

13. Data Services Data Seizure
The expert should assist the law enforcement official in collecting the data.
Need to identify the disks that contain the data
Data Duplication and Preservation
Data absolutely cannot be contaminated
Copy of the data has to be made and need to work with the copy and keep the original in a safe place
Data Recovery
Once the device is seized (either local or remote) need to use appropriate tools to recover the data

14. Data Services: Finding Hidden Data
When files are deleted, usually they can be recovered
The files are marked as deleted, but they are still residing in the disk until they are overwritten
Files may also be hidden in different parts of the disk
The challenge is to piece the different part of the file together to recover the original file
There is research on using statistical methods for file recovery
data---how asp
wolfgarten-assignment2.pdf

15. Document and Media Services
Document Searches
Efficient search of numerous documents
Check for keywords and correlations
Media Conversion
Legacy devices may contain unreadable data. This data ahs to be converted using appropriate conversion tools
Should be placed in appropriate storage for analysis

16. Expert Witness Services
Expert should explain computer terms and complicated processes in an easy to understand manner to law enforcement, lawyers, judges and jury
Computer technologists and lawyers speak different languages
Expertise
Computer knowledge and expertise in computer systems, storage
Knowledge on interacting with lawyers, criminology
Domain knowledge such as embezzlement, child exploitation
Should the expert witness and the forencis specialist be one and the same?

17. Service Options Should provide various types of services
Standard, Emergency, Priority, Weekend After hours services
Onsite/Offsite services
Cost and risks – major consideration
Example: Computer Forensics Services Corporation
As stated in the above web site, this company provides “expert, court approved, High Tech Investigations, litigation support and IT Consulting.” They also "Preserve, identify, extract, document and interpret computer data. It is often more of an art than a science, but as in any discipline, computer forensic specialists follow clear, well-defined methodologies and procedures.”

18. Other Services
Computer forensics data analysis for criminal and civil investigations/litigations
Analysis of company computers to determine employee activity
If he/she conducting his own business and/or downloading pornography
Surveillance for suspicious event detection
Produce timely reports

19. Benefits of using Professional services
Protecting the evidence
Should prevent from damage and corruption
Secure the evidence
Store in a secure place, also use encryption technologies such as public/private keys
Ensure that the evidence is not harmed by virus
Document clearly who handled the data and when - auditing
Cleint/Attoney privilege
Freeze the scene of the crime – do not contaminate or change

20. Using the Evidence: Criminal and Civil Proceedings
Criminal prosecutors
Civil litigation attorneys – harassment, discrimination, embezzlement, divorce
Insurance companies
Computer forensics specialists to help corporations and lawyers
Law enforcement officials
Individuals to sue a company
Also defense attorneys, and “the bad guys”

21. Issues and Problems that could occur
Computer Evidence MUST be
Authentic: not tampered with
Accurate: have high integrity
Complete: no missing points
Convincing: no holes
Conform: rules and regulations
Handle change: data may be volatile and time sensitive
Handle technology changes: tapes to disks; MAC to PC
Human readable: Binary to words

22. Legal tests Countries with a common law tradition
UK, US, Possibly Canada, Australia, New Zealand
Real evidence
Comes from an inanimate object and can be examined by the court
Testimonial evidence
Live witness when cross examined
Hearsay
Wiki entry “Hearsay in English law and Hearsay in United States law, a legal principle concerning the admission of evidence through repetition of out-of-court statements”
Are the following admissible in court?
Data mining results, s, printed documents

23. Traditional Forensics vs Computer Forensics
Materials tested and testing methods usually do not change rapidly
Blood, DNA, Drug, Explosive, Fabric
Computer Forensics
Material tested and testing methods may change rapidly
We did not have web logs in back in 1990
We did not have RAID storage in 1980

24. Conclusion
Important to have experts for computer forensics evidence gathering and analysis
Important to secure the evidence: authenticity, completeness, integrity
Important to have the proper tools for analysis
Important to apply the correct legal tests
Computer forencis can be used to benefit both the “good and bad guys”
Need to be several steps smarter than the enemy