CYBER FORENSICS PRINCIPLES
Jayaram P
CDAC
Wednesday, August 11, 2021 1
Plan
Cyber Crime
Cyber Forensics Steps
Live Forensics
Wednesday, August 11, 2021 2
Wednesday, August 11, 2021 3
Wednesday, August 11, 2021 4
Wednesday, August 11, 2021 5
Wednesday, August 11, 2021 6
Wednesday, August 11, 2021 7
Wednesday, August 11, 2021 8
Wednesday, August 11, 2021 9
Wednesday, August 11, 2021 10
Wednesday, August 11, 2021 11
Wednesday, August 11, 2021 12
Wednesday, August 11, 2021 13
Wednesday, August 11, 2021 14
Wednesday, August 11, 2021 15
Wednesday, August 11, 2021 16
Wednesday, August 11, 2021 17
Wednesday, August 11, 2021 18
Wednesday, August 11, 2021 19
Wednesday, August 11, 2021 20
Wednesday, August 11, 2021 21
Wednesday, August 11, 2021 22
Wednesday, August 11, 2021 23
Wednesday, August 11, 2021 24
Wednesday, August 11, 2021 25
Wednesday, August 11, 2021 26
Wednesday, August 11, 2021 27
Wednesday, August 11, 2021 28
Wednesday, August 11, 2021 29
Wednesday, August 11, 2021 30
Wednesday, August 11, 2021 31
Live Forensics
Wednesday, August 11, 2021 32
Live Forensics - Challenges
Need access to the system
Minimize impact on system.
Some tools leave footprint and hence proper
audit/notes to be made.
Timely evidence acquisition and analysis.
Wednesday, August 11, 2021 33
Conducting Live Forensics
1. Retrieval of volatile data
2. Forensic imaging of live system
3. Analysis of evidence collected
Wednesday, August 11, 2021 34
Scenario : Ongoing Crime
Want to catch them “in the act”
See how things change (web pages, file access
times, registry, memory, etc.)
Want to understand:
How they got in
What they compromised
Where they are
Who they are
Wednesday, August 11, 2021 35
Live Data
Process memory
System time Network status
Logged-on user(s) Clipboard contents
Open files Service/driver information
Network information Command history
Network connections Mapped drives
Process information Shares
Process-to-port mapping
Wednesday, August 11, 2021 36
Non-volatile Data
Event logs
Registry
Disks
Wednesday, August 11, 2021 37
Memory Analysis
Memory Acquisition
Perform Ram Dump to a
file [Using Tools like Dump file
DumpIt, mdd etc]
Dump File Analysis
Report Generation
Dump file
Analyzed using tools
(eg.Volatility , Win-LiFT)
Wednesday, August 11, 2021 38
Live Forensics Tools
Wednesday, August 11, 2021 39
C-DAC’s Win-LiFT
COFEE(Computer Online
Forensic Evidence Extractor )
EnCase Portable
Wednesday, August 11, 2021 40
https://cyberforensics.in/
Wednesday, August 11, 2021 41
Investigator’s
Machine
Suspect’s
Machine
Investigator’s
Machine
Wednesday, August 11, 2021 42
Wednesday, August 11, 2021 43
Wednesday, August 11, 2021 44
Wednesday, August 11, 2021 45
Wednesday, August 11, 2021 46
Live Forensic Tools - COFEE
Wednesday, August 11, 2021 47
Easy to use
Capture important "live" computer
evidence
Special forensics expertise not
needed.
Computer Online Forensics Evidence Extractor
Wednesday, August 11, 2021 48
Computer Online Forensics Evidence Extractor
Wednesday, August 11, 2021 49
Live Forensic Tools - Encase
Portable
Easy to Use
Forensically Sound
Ultra-Portable
Stealth
Wednesday, August 11, 2021 50
Forensic Tools in Kali Linux
Wednesday, August 11, 2021 51
More than 200 penetration testing tools are packaged in Kali Linux.
More than 20 tools for forensics packaged inside Kali Linux.
1. Binwalk tool:
searches a specified binary image for executable code and files.
2. Bulk extractor tool:
Extracts credit card numbers, URL links, email addresses etc..
Works on compressed data and incomplete or damaged data.
3. HashDeep tool:
For hashing of files.
4. Magic rescue tool:
Performs scanning operations on a blocked device.
Recovers files deleted or from corrupted partition.
5. Guymager tool:
Used to acquire media for forensic imagery
Wednesday, August 11, 2021 52
6. Pdfid tool:
Scans pdf files for specific keywords.
7. Pdf-parser tool:
8. Peepdf tool:
9. Autopsy tool:
An autopsy is all in one forensic utility for fast data recovery and hash
filtering.
This tool carves deleted files and media from unallocated space.
10. img_cat tool:
Wednesday, August 11, 2021 53
THANK YOU
jayaram@cdac.in
Wednesday, August 11, 2021 54
