Information Security and Computer Forensics

Computer forensics (also referred to as Computer forensic science) is a branch of digital forensic science regarding proof found in computers and digital storage media. The aim of computer forensics is to look at digital media in a very forensically sound manner with the aim of distinctive, preserving, recovering, analyzing and presenting facts and opinions concerning the digital info.

The computer forensics plays a significant role in a corporation because our dependency on computing devices and internet is increasing day-by-day. in step with a survey conducted by the University of California, 93% of all the information generated throughout 1999 was generated in digital type, on computers, only 7% of the remaining info was generated using different sources like paper etc. It not forever straight forward to gather pieces of evidence because the knowledge is also tempered, deleted, hidden or encrypted.
Digital forensics investigation could be an extremely hot task that desires the expose of varied tools, techniques, and tips for finding and ill the digital evidence from the crime scene or the digital equipment utilized in the crime. With digital equipment like smartphones, tablets, palmtops, smart tv, etc having increasing process capabilities and computation speed, the likelihood of use of those devices in cybercrime can’t be dominated out. A forensic investigator should not only have a deep understanding of the operating of those devices and conjointly active exposure to the tools for correct data retrieval in order that the worth and integrity of the information is preserved.

A computer is often used on purpose or accidentally to cybercrime. The intentional use is to use your computer to send hate mails or putting in a cracked version of an associate degree otherwise licensed code into your computer. Unintentional use is that the computer you’re victimization contains the virus and it unfolds into the network and out of doors the network inflicting major loss to somebody in monetary terms. Similarly, a computer is often directly wont to commit a digital crime. for instance, your computer is employed to access sensitive and classified knowledge and therefore the data is distributed somebody inside/outside the network, the World Health Organization will use this data for his own profit. The indirect use of the computer is once whereas downloading a crack of code, a trojan horse holds on within the computer, whereas creates a backdoor within the network to facilitate hacker. currently, the hacker logs into your computer and uses it for committing cybercrime. associate degree knowledgeable computer forensics investigator plays a vital role in identifying the direct and indirect attack. computer forensic consultants also are helpful for recovery of accidental knowledge loss, to sight industrial undercover work, counterfeiting, etc.

In massive organizations, as presently as cybercrime is detected by the incident handling team, that is liable for observance and detection of security events on a computer or network, initial incident management processes are followed. this is often an associate degree in-house method. It follows the following steps:

1. Preparation: The organization prepares tips for incident response and assigns roles and therefore the responsibilities of every member of the incident response team. Most of the large organizations earn a name within the market and any negative sentiment might negatively have an effect on the emotions of the shareholders. Therefore, efficient communication is needed to declare the incident. Hence, distribution of the roles supported the skill-set of a member is vital.
2. Identification: Supported the traits the incident response team verifies whether or not an occasion had truly occurred. one amongst the foremost common procedures to verify the event is
   examining the logs. Once the prevalence of the event is verified, the impact of the attack is to be assessed.
3. Containment: Supported the feedback from the assessment team, the longer term course of action to retort to the incident is planned during this step.
4. Eradication: During this step, the strategy for the wipeout or mitigate of the reason behind the threat is planned and dead.
5. Recovery: It’s the method of returning to the conventional operational state when eradication of the matter.
6. Lesson Learned: If a replacement form of the incident is an encounter, it’s documented in order that this knowledge is often wont to handle such things in the future.

The second step within the method is computer forensic investigation is doled out to search out the proof of the crime, which is usually performed by third-party corporations. the computer forensic investigation involves the following steps:

1. Establish incident and evidence: this is often the primary step performed by the system administrator wherever he tries to collect the maximum amount of info as attainable concerning the incident. supported this info the scope and severity of the attack are assessed. Once the proof of the attack is discovered, the backup of the identical is taken for the investigation purpose. The rhetorical investigation is rarely performed on the first machine however on the information that’s remodeled from the backup.
2. Collect and preserve evidence: varied tools like Helix, WinHex, FKT Imager, etc. are wont to capture the information. Once the backup of the information is obtained, the custody of the proof and therefore the backup is taken. MD5(message digest) hash of the backup is calculated and matched with the first one to test the integrity of the information. Other important sources of knowledge like system log, network info, logs generated by Intrusion Detection Systems(IDS), port and method info also are captured.
3. Investigate: The image of the disk is remodeled from the backup and therefore the investigation is performed by reviewing the logs, system files, deleted and updates files, processor uses and process logs, temporary files, secret protected and encrypted files, images, videos and knowledge files for attainable steganographic message, etc.
4. Summarize and Presentation: The summary of the incident is given in chronological order. supported the investigation, conclusions are drawn and the attainable cause is explained.

While finishing up the digital forensic investigation, rules and procedures should be applied. Especially whereas capturing the proof. It ought to be ensured that the actions that are taken for capturing the information don’t amendment the proof. The integrity of the information ought to be maintained. It should be ensured that the devices used for capturing the backup are free from contamination. Moreover, all the activities associated with seizure, access, storage or transfer of digital proof must be absolutely documented, preserved and obtainable for the review. prevention is usually higher than the cure. it’s forever counseled to fine tune your intrusion detection system like firewall occasionally perform penetration tests on your network to avoid pray to the hacker. however last but not the least, report the crime.