FORENSICS

1
FORENSICS
COMPUTER
2
Overview

• What is Computer Forensics?
• Conceptual Knowledge.
• Forensic Examinations.
• Who needs Computer Forensics?
• Forensics Benefits.
• Awareness
• What is your Role?

3
What is Computer Forensics?

• Is the application of computer skills and
  investigation techniques for the purpose of
  acquiring digital media evidence.
• The basic methodology involves collecting,
  examining, preserving, and presenting evidence
  that is stored or transmitted in an electronic
  format.

4
Conceptual Knowledge

• New field that emerged in law enforcement
• Scientific methods
• Specialized tools and techniques

5
Computer Forensic Examination

• Deleted/Hidden Files
• Software
• Encryption Software
• Published
• Shares/Permissions
• Password Files
• Network Architecture/ Trusted Relationships

• Operating System
• Services
• Applications/processes
• Hardware
• LOGFILES!
• System, Security, and Application
• File System

6
Who needs Computer Forensics?

• The Victim!
• Law Enforcement
• Insurance Carriers
• Ultimately the Legal System

7
Forensics Benefits

• Computer evidence can be used in criminal cases,
  civil disputes, and human resources/employment
  proceedings.
• Completely recover, lost or deleted information.
• ID the perpetrator and the method used to gain
  access into the system.
• Conduct a damage assessment of the victimized
  network.

8
Awareness

• Management and Employees
• Incident response plan
• Contingency Plan
• Understanding
• Criminal Proceedings
• Documentation

9
What is your Role?

• Network Administrators
• Computer Security Managers
• Chain of Custody
• Preservation of Evidence
• Collection of Evidence

10
Conclusion

• Computer forensics is yet another computer
  security topic.
• Involves investigating computer systems to
  determine whether they are or have been used for
  illegal or unauthorized activities.
• Computer forensics experts investigate data
  storage devices, either fixed like hard disks or
  removable like compact disks and solid state
  devices.

11
Computer Forensics

• Questions?