Digital Forensics: Unravelling Cyber Crimes and Investigative Techniques
Digital forensics is the field of computer science and engineering, which is used to investigate the cyber crimes as well as collect and analyse the digital evidence in such a manner that it should maintain integrity and admissibility of the evidence in the court. The cybersecurity team and law enforcement agencies use various digital forensics tools to identify the cybercriminal behind the malware attack as well as analysing the data from the devices of suspects of any crime. Most used digital forensics tools are EnCase Forensic, Autopsy, X-Ways Forensics, Sleuth Kit, FTK (Forensic Toolkit), Volatility, Magnet AXIOM, Cellebrite UFED, OpenText Encase, Wireshark and many more. These tools are essentially used by the digital forensics practitioners to conduct investigations as well as preserve, collect, analyse and present the evidence in the court of law. Without digital forensics, it is impossible to proof the cyberattack and also protect the any individual and organization.
Steps in Digital Investigation Process:-
Identification:- Identifying the scope of investigation as well as possible sources of digital evidences of the crime.
Collection:- Collecting digital evidences from the various sources such as mobile, laptop, desktop, network logs, IoT devices, cloud storage, external devices such as pen drive etc to maintain its integrity and chain of custody.
Examination:- Examine the various collected digital evidence by using the above mentioned digital forensics tools to extract relevant information of the crime.
Analysis:- Translating the findings to reconstruct the event, identifying the pattens and evaluating severity of the incident.
Documentation:- Documenting the entire investigation process with finding and conclusion in the form of the report.
Presentation:- Concise and summarize report includes the findings and conclusion about the crime is presented in the court or other stakeholders for the legal purpose.
There are various branches in the Digital forensics field. Computer Forensics that involves investigating the digital evidences from the computing devices such as Desktop, laptop, servers etc. Mobile Device Forensics deals with investigating data from smart phones, tablets, call log etc. Network Forensics examines the traffic and network log to identify incidents such as intrusion and data breaches. Memory Forensics deals with extracting and analysing the data from the volatile memory for the malicious activities and advance threat. Cloud Forensics investigates the digital evidence in the cloud services.
Many MNCs offering jobs in the field of cyber security and digital forensics such as Cyber Crime investigation and research centre Delhi, Orion Secure, Cellebrite etc. To upskill in this field many certifications are available such as Certified Forensic Computer Examiner (CFCE), Certified Information Systems Security Professional (CISSP), EnCase Certified Examiner (EnCE), GIAC Certified Forensic Examiner (GCFE) etc.
Students can explore and enrolled in the emerging area:- Cyber Security and Digital Forensics. Indian government offering many jobs in this field. The NorthCap University in Gurugram offers Cyber Security and Forensics specialization with aim to equip students with the skills and knowledge to address this field. The curriculum of this field include various topics such as network security, cryptography, ethical hacking, incident response, digital forensics, etc. Through cyber security and forensics specialization labs, students can perform experiments and projects. The NorthCap u`niversity organises training and awareness programme about the upcoming tends and certification required in this domain. University also offers internship and placement in the cyber security and digital forensics. University also motivates students and faculty members to pursue research in this area by providing financial assistance.
Authored By
Dr.Yogita Gigras
Associate Professor
Department of CSE
The NorthCap University, Gurugram