Anti Forensics Paper

When faced with problems as a computer forensics investigator you must be very flexible. There are many different types of computer related crimes in today’s society. They may range from child pornography to identity theft to even insider trading on Wall Street. The possibilities for the criminals in our world to use computers and the Internet against us are endless. The computer forensics or cyber forensics fields are growing but are still learning every day because it is such a young field of study. New things emerge every day that computer forensic investigators must adapt to and begin to learn to help combat these criminals. Investigators will use many tools to help them find incriminating evidence. These investigators must learn these tools inside and out to make sure every test they run can be valid. The computer forensics field is growing rapidly and there are a lot of real world threats that we need these investigators to help us solve.

Review the information in the text sheet entitled “Overview of Evidence and Digital Forensic Analysis Techniques,” which describes different types of digital forensic analysis techniques, such as disk forensics and e-mail forensics.

It is critical that evidence is collected in the correct manor to ensure that evidence is not destroyed. The investigator who is collecting the evidence should be properly trained in collection of evidence (Cosic, 2011). One example of proper protocol would be if a computer or cell phone is turned on when found, then it should not be turned off to prevent possible destruction of evidence or prompting for a password for access. The collection process can sometimes prove to be the most difficult because it evidence can easily be compromised or even destroyed (Manes,

The crucial step of the investigation is the transport and storage of evidence recovered from the crime scene. Tightly controlled access during transport and storage will prevent any unauthorized contact and possible tampering or loss of evidence. The evidence that is recovered at the scene must reach a forensic laboratory as quickly as possible, appropriate conditions will prevent deterioration of evidence during transport and storage. Evidence might have to be stored for some years until a case goes to court or if the case is unsolved so labelling and storing evidence must be appropriately done to avoid contamination or disintegration etc.

Electronic evidence is very fragile because it can be destroyed or altered very easily, therefore it is imperative that investigators follow very careful all the procedural steps when collecting electronic evidence (Diversified Forensics). Before any electronic evidence is gathered investigators should determine whether there is probable cause that a crime has been committed, or if the crime was committed somewhere else the investigator should determine whether the electronic evidence will aid the investigation process to prove or disapprove the crime, if a warrant is needed it must be obtained prior to collecting the evidence (Diversified Forensics). Hard drives, computers, and other electronic devices must be turned off, unplug all cables,

For this reason, it is imperative that the information gathered is reliable and accurate to ensure the evidence collected can be utilized by the digital forensic investigator for the current case (Ingalls & Rodriguez, 2011). Additionally, cyber incidents require digital forensic investigators to interview various individuals regarding the information needed for the case. According to the National Institute of Justice (2004), interviewing the system administrator, users, and employees of an organization regarding a cyber incident would provide investigators with valuable information; for example, user accounts, email accounts, network configuration, logs, and passwords. Furthermore, for digital forensic investigators to conduct an effective interview, they must have the proper tools and training to employ the interview process. For instance, formal procedures or instructions should be developed and implemented to ensure that the investigator follows a standard during all investigations. Additionally, training should be provided to ensure that digital forensic investigators comprehend by what means to prepare, conduct, and evaluate an interview. Furthermore, resources should be made available for digital forensic investigators to accomplish their tasks; for example, recording devices and references. Also, definitions should be provided to the digital forensic investigators for

A computer forensic investigation typically includes the collection, examination, analysis, and reporting of data. These steps could have been used to extract and preserve the data in the U.S. versus AOL case. Collection involves seizing digital evidence. Examination is where techniques are applied in order to identify and extract data. Analysis is using the data and resources to prove a case (Brecht, 2015). Reporting involves presenting the documentation gathered during the investigation. Investigators use these steps to examine evidence that could be needed in a trial. Following these steps is one way to ensure that the findings are sound and admissible in court. “The purpose of a computer forensic examination is to recover data from computers seized as evidence in criminal investigations (Brecht, 2015)”. Forensic tools are used by investigators to provide their collection, indexing and detailed analysis

a. Particular care was taken in the discovery, recovery, preservation and control of electronic data, documents and E-evidence.

Improvements in technology have demonstrated that with relative ease nefarious individuals can acquire various types of information with the use of computers, cellphones, tablets, databases and the internet. This information can be used for a large array of deeds, illegal activity being a major one. In an effort to combat this emerging type of crime, the Department of Justice, local law enforcement agencies, banks, retail stores, and investment firms are integrating computer forensics into their organizations. These crimes range from network security breaches at companies like Target and Home Depot to child pornography, the common thread is that the implicating evidence was found on an electronic media device.

The OS provides digital forensic investigators with the primary application where the files, folders, and logs of every event that has occurred involving the suspect’s information system can be located. Furthermore, this information can be utilized by the investigator’s to understand how incidents like network intrusion, malware installation, and insider file deletions have occurred. As a result, OS’s is the location where relevant information on incidents or unlawful activities can be discovered with the proper collection and examination

The first thing to do when to a computer investigation is to know the correct steps to make sure that the investigation is done correctly. The steps of preparing for a computer investigation are as follows; identifying the nature of the case, identifying the type of OS or digital device, determining whether you can seize the computers or digital devices, getting a detailed description of the location, determining who is in charge, using additional technical expertise, and determining what tools you need. These steps are the foundation of the investigation. If there is no strong foundation in the beginning of the

This manual is to assist forensic technicians who may be responsible for preserving electronic crime scene and recognizing, collecting, preserving, and storing digital evidence. When dealing with digital evidence, these principles apply: The process of collecting, securing, and transporting digital evidence should not change the evidence in anyway. Only trained forensic technicians specifically for digital evidence should conduct the analysis. Everything done during the search, seizure, transportation and the storage of the digital evidence should be documented, preserved and ready for review.

The aim of this report is to investigate where and how anti-forensic tools work as well as looking at the challenges forensic investigators are faced when such tools are used. After anti-forensic tools are used certain artefacts will be left behind, this report will also cover the procedures and difficulties when trying to uncover these artefacts as well as the tools used to find them.

Since the widespread use of computers, computer crime has caused an increase in computer investigations during the twenty first century. Some reasons for investigation include: identity theft, such as stolen social security and credit card numbers, to find evidence of a cheating spouse, to investigate hackers on a computer system, to find evidence of child pornography, and much more.

Certified that Sakshi Bansal (21341314008), has carried out the research work presented in this thesis entitled "A PROPOSED FRAMEWORK FOR NETWORK FORENSICS INQUISITION & RELATIVE SUBSTANTIATION WITH OTHER FRAMEWORKS" for the award of Master of Technology from Uttaranchal University, Dehradun under my supervision. The thesis embodies results of original work, and studies are carried out by the student herself and the contents of the thesis do not form the basis for the award of any other degree to the candidate or to anybody else from this or any other University/Institution.