10-04-2017, 07:56 PM
What is Digital Forensics?
It may be defined as the collection of specialized techniques, processes, and procedures used to preserve, extract, analyze, and present electronic evidence.It is a methodology for computer investigation and analysis techniques for determining potential legal evidence.digital forensics is also known as computer forensics.Its goal is to explain the current state of a digital artifact which may be a computer system, a storage medium (such as a hard disk or CD-ROM), an electronic document etc. computer forensics also has sub branches within it such as firewall forensics, network forensics, database forensics and mobile device forensics.
The Forensic Process:
The five basic steps
1)Preparation (of the investigator, not the data)
2)Collection of the data
3)Examination
4)Analysis
5)Reporting
Collecting Digital Evidence
Digital evidence can be collected from sources likecomputers, cell phones, digital cameras, hard drives, CD-ROM, USB memory devices, digital thermometers, black boxes inside automobiles, RFID tags, and web pages . it is common practice to calculate a cryptographic hash of an evidence file and to record that hash elsewhere. This is because once changed it is usually impossible to detect that a change has taken place in the evidence.
Imaging electronic media (evidence):
The process of creating an exact duplicate of the original media is often called Imaging. the entire hard drive is completely duplicated using software imaging tools such as DCFLdd, IXimager, Guymager, EnCase or FTK Imager. The imaging process is verified by using the SHA-1 message digest algorithm.
Analysis:
forensic collection and analysis tools include: AccessData's FTK, Guidance Software's EnCase, Technology Pathways' ProDiscover, Dr. Golden Richard II's file carving tool Scalpel, and Brian Carrier's Sleuth Kit.SANS Investigative Forensic Toolkit (SIFT) is a popular open tool for forensic analysis.
For more details ,visit:
http://en.wikipediawiki/Digital_forensics
[attachment=2079]
also visit this thread:
http://seminarsprojects.net/Thread-Compu...esentation