Computer Forensic

Project and Seminar Material for Computer Science and Computer Engineering

Project and Seminar Material for Computer Science and Computer Engineering


Abstract


This study examined computer forensics. The rapid evolution and development of computers and other digital devices has orchestrated a geometric increase in the severity and rate of cybercrimes committed the world over, Nigeria inclusive. These proliferations of cybercrimes pose threats to cyber and national security as a whole. The only way to combat cybercrime is to train competent computer forensics professionals who will investigate and help prosecute these cybercrimes and cybercriminals as well. The research identified the implications promotion of computer forensics education has on overall national security. It was deduced from the research that there is no tertiary institution offering computer forensics education at any level in Nigeria, creating scarcity of computer forensics professionals.Finally the paper recommends immediate attention to be geared towards introduction and promotion of computer forensics education in Nigeria in other to foster national cyber security.


Chapter One


Introduction

1.1 Background of the study

Digital forensics is a rapidly developing field that continues to evolve, both in practice and in research. Technology continues to advance, as does the sophistication of anti-forensics techniques, which forces digital forensics researchers and practitioners to adapt. Moreover, rules for admissibility are becoming more stringent because the legal community is continuing to better understand technology and digital forensics. The legal community is requiring that digital forensics become more scientifically rigorous, much like traditional forensics. Digital forensics is still in its infancy, especially when compared to other areas of forensic science. The term “computer forensics” was first defined in 1991 by the International Association of Computer Investigative Specialists (IACIS) and the term has since evolved into “digital forensics” to encompass all digital media. Various U.S. government agencies have performed digital forensics since the mid-1980s; the FBI’s Computer Analysis and Response Team (CART), for instance, was formed in 1984.

Computer forensics is around for a while and is rapidly becoming a specialized and accepted investigative technique with its own tools and legal precedents that validate the discipline. The domain of computer forensics is not to assign guilt or innocence but rather to find facts in the form of electronic evidence that can be presented in a coherent way so that others may weigh the evidence and then assign guilt or innocence where appropriate.
The goal of cyber forensics is to examine digital media in a sound manner to identify, recover, analyze and present facts and opinions about the information. Forensics, and, more generically, Computer Security Incident Response (CSIR), is an important part of cyber security. It operates on the corrective or repressive side of security, i.e. it comes into play after a security breach has occurred and attempts either to correct the problem as quickly as possible, or to find evidence to be able to identify and prosecute the culprit [6]. The aim of Cyber forensics is not to prevent the crime as and when it happens, but to identify the victim and criminal after the attack or incident occurs in the system or in the network, analyze it in depth and record it for further reference.

Computer forensics can be defined as “the application of computer investigation and analysis techniques in the interests of determining potential legal evidence”. David Bennett states that legal evidence might be sought constitute a wide range of computer crimes or misuses such as child pornography, use of abusive languages, audio or video, including theft of trade secrets, theft of or destruction of intellectual property and fraud. Computer specialists have many ways of discovering data that reside in a computer system, or of recovering deleted, encrypted, or damaged file information. So, the key question is: what is the most effective way to collect the evidence of a digital crime. Usually digital evidences are the event logs generated by application software as well as operating system software. In modern Operating Systems, even a privileged application process will be running in a restricted virtual environment and Operating System will make sure that an application has minimal knowledge of any other application process or, in general, about the host system. So, naturally, evidence data as event logs generated by such application processes lacks the overall system perspective. The data discovered is important in forensic analysis and in solving various computer crimes through proper log or record preservation which leads to profiling.

With the enactment of the evidence Act of 2011, and Cybercrime Acts of 2015 by the government of the federal republic of Nigeria, it now becomes imperative that computer forensics professionals be trained in other to protect the National Cyberspace from National cyber security threats such as malicious hacking, cybercrime, cyber terrorism, espionage and cyber scam just to mention but a few. The dynamism of computer and digital devices, such as computer, mobile phones et cetera, and their attaining rapid evolution make it difficult to detect, track, retrieve, process and report digital evidence vital in cracking cybercriminals and cybercrime cases.

However, the responsibility of securing the Nigerian cyber space rests on the ability of computer forensics examiners to carry out thorough investigation with the purpose of curbing and reducing cybercrime to its lowest ebb hence fostering National security. This can only be achieved if a robust education backbone and framework is put in place to educate and train computer forensics professionals at all levels and positions. This paper aims at highlighting the implications, and impact of promoting computer forensics education on Nigeria national security.
Organizations are increasingly reliant upon information systems for almost every facet of their operations. As a result, there are legal, contractual, regulatory, security and operational reasons why this reliance often translates into a need to conduct digital forensic investigations (Rowlingson, 2004). However, conducting digital forensic investigations and collecting digital evidence is a specialized and challenging task exacerbated by the increased complexity of corporate environments, diversity of computing platforms, and large-scale digitisation of businesses (Taylor et al., 2010). There is agreement in both professional and academic literature that in order for organizations to meet this challenge, they must develop ‘digital forensic readiness’ – the proactive capability to collect, analyse and preserve digital information (Grobler et al. 2010). Unfortunately, although digital forensic readiness (DFR) is becoming a legal and regulatory requirement in many jurisdictions in the western world, studies show that most organizations especially in Australia have not developed a significant capability in this domain (e.g. the Australian Institute of Criminology reports that less than 2% of Australian organizations have a plan for digital forensics, see AIC (2009)).

A key issue facing organizations intending to develop a forensic readiness capability is the lack of comprehensive and coherent guidance on how forensic readiness can be achieved in both the professional and academic literature (Mouhtaropoulos, Li, & Grobler, 2014). A review of the literature conducted as part of this study found that the academic and professional discourse in forensic readiness is fragmented and dispersed in that it does not build cumulatively on prior knowledge (Elyas et al. 2014). Further, there is a lack of maturity in the discourse that is rooted in the reliance on informal definitions of key terms and concepts. For example, there is little discussion and understanding of the key organizational factors that contribute to forensic readiness, the relationships between these factors and the precise definitions including the scope and boundaries of these factors. Importantly, there is no collective agreement on the primary motivating factors for organizations to becoming forensically ready (Elyas et al., 2014).

This chapter aims to give an understanding of the need for computer forensics, statement of problem, aims and objectives, significance of the study, scope of the study and definition of terms.


1.2 Statement of problem

Due to rapid evolution of the Information Technology, now almost everything is computerized or electronic based such as e-Banking, eLearning, e-Commerce etc. Due to busy schedules, people always need easy and short ways to do their day today activities using technology. As a result, computer or cybercrimes reported as the second most crime in the world recently.

According to the 19th CEO survey reported that 32% of organizations affected and 34% think they will be affected in the next two years. Most companies are still not adequately prepared for or even understand the risks faced. Only 37% of organizations have a cyber incident response plan. 61% of CEOs are concerned about cyber security but less than half of board members request information about their organization’s state of cyber-readiness.

Palmer (2001) defined computer forensic investigation as the application of scientific, systematic and proven methods towards the preservation, collection, validation, identification, analysis, interpretation and presentation of digital evidence derived from digital sources for the purpose of facilitating or furthering the reconstruction of events found to be criminal or perceived to anticipate the unauthorised actions shown to be disruptive to planned operations. By this definition, it is important to demonstrate proofs of the integrity of digital crime object. Digital forensic investigators are constantly trying to find better and more efficient ways of uncovering evidence from digital sources. The challenge here is that beyond the presumptions of the occurrence of a crime, it is important to prove the integrity of the source of digital evidence. Law enforcement and corporate professionals require tools for effective digital evidence acquisition and analysis.

According to (Rogers and Seigfried, 2004) cyber crime challenges are technical challenges that hinder law enforcement’s ability to find and prosecute criminals operating online, legal challenges resulting from laws and legal tools needed to investigate cyber crime being unable to catch up with developing technological, structural, social changes and the resource challenge. Some of these tools already exist to capture, preserve and analyse data from hard drives, memory and network streams. They are available through commercial or open-source licences with their own unique user interface, features, and run on different operating systems. However, this presents a challenge to digital investigators because tools, systems and networks are vulnerable to threats or attacks. Therefore, this study sought to examine computer forensics; it’s application, implication and uses.


1.3 Aims and objectives of the study

Main aim

The main aim of the research is to examine thoroughly the application of computer forensics and its implications to national security.

Specific objectives

The specific objectives include:

  1. To develop a background understanding of computer forensics.
  2. To determine the state of computer forensics education in Nigeria.
  3. To examine the current issues and trends around computer forensics.
  4. To identify the implication of computer forensics to National security in Nigeria.
  5. To examine the application of computer forensics.

1.4 Scope of the study

This study examines computer forensics. The study focuses on national security in Nigeria as a whole.


1.5 Significance of the research work

The past decade has seen previously unimagined advances in technology, and although those developments have benefited individuals and businesses alike, they have also become tools for fraudsters and cyber criminals to steal money and data, and avoid detection.

This study is particularly useful in tracing the path of an advanced persistent threat (APT) which uses a variety of tricks and tools to achieve its ends. APTs are highly targeted, and usually stay undetected on the victim’s network for months, performing reconnaissance and exfiltrating data. Computer forensics also helps to trace these attacks and discover what motivated them.

Security professionals routinely use such tools to analyze network intrusions—not to convict the attacker but to understand how the perpetrator gained access and to plug the hole. Data recovery firms rely on similar tools to resurrect files from drives that have been inadvertently reformatted or damaged.

Computer forensics is necessary for law enforcement and investigation, but also has applications in commercial, private, or institutional organizations. All activity conducted on an individual’s computer systems as well as on a company network leaves computer traces, which can range from web browser history caches and cookies, all the way to document metadata, deleted file fragments, email headers, process logs, and backup files.

This study is also significant to teachers, students, scholars and practitioners within the scope of the educational sector as it will serve as a material guide for further research in related topics.


1.6 Definition of terms

Computer forensics:

Computer forensics is a branch of digital forensic science pertaining to evidence found in computers and digital storage media. The goal of computer forensics is to examine digital media in a forensically sound manner with the aim of identifying, preserving, recovering, analyzing and presenting facts and opinions about the digital information.

Computer:

A computer is a machine that can be instructed to carry out sequences of arithmetic or logical operations automatically via computer programming.

Crime:

A crime is an unlawful act punishable by a state or other authority. The term crime does not, in modern criminal law, have any simple and universally accepted definition, though statutory definitions have been provided for certain purposes.

Cybercrime:

Cybercrime, or computer-oriented crime, is a crime that involves a computer and a network such as committing fraud, trafficking in child pornography and intellectual property, stealing identities, or violating privacy. The computer may have been used in the commission of a crime, or it may be the target.

Digital forensics:

Digital Forensics is defined as the process of preservation, identification, extraction, and documentation of computer evidence which can be used by the court of law. It is a science of finding evidence from digital media like a computer, mobile phone, server, or network.


Chapter Three


3.1 Application Areas

Computer crime or cyber-crime can be done by hacking, fraud, DOS attack and holding evidences in the form of emails or internet history & files related to crime. Due to increases of computer and cyber-crimes, many organizations used computer forensics to get various benefits by detecting Industrial espionage, Intellectual property theft, Professional spies and saboteurs, Dishonest or disgruntled employers, Spreading Malicious Programs and Inappropriate emails and internet use etc.

Examination of computer forensics discloses content of email, metadata associated with files related to the crime. And it also possible to reveal the document related to the crime first appeared on the computer, the day it was last modified, when it was last saved or printed and which user has done these actions.

There are many aspects of computer forensics investigation, at first investigators have ability to identify possible evidence in order to construct and proceed their investigation or search. Then they have to select the most appropriate tool(s) for their investigation. The investigator must be aware with any number of methods and software to avoid further damage while investigating. Because files may have been modified, damages, deleted, corrupted or encrypted.

Persistent and Volatile data are the two types of data are collected in computer forensics. Persistent data is stored on a local hard drive and is conserved when the computer is turned off. Whereas the Volatile data is stored in memory, or exists intransit, that will be lost when the computer loses power or is turned off. Volatile data resides in registries, cache, and Random Access Memory (RAM). Since volatile data is temporary, it is essential an investigator knows reliable ways to capture it.

The Areas of specialization in a computer forensics investigation include:

  • Computer forensics
  • Network forensics
  • Database forensics
  • Mobile forensics

3.2 Discussion

As discussed in previous chapters, computer forensics plays an significant role in the criminal justice system as we continue to incorporate a range of technologies into our everyday lives. Evidence of all most the types of crime are increasingly found in digital devices that either the perpetrator or the victim used. As a result of this potential evidence which did not exist in the past, investigators of conventional crimes increasingly need to consider any digital evidence that may be available.

In addition, Security professionals routinely use such tools to analyze network intrusions not to convict the attacker but to understand how the perpetrator gained access and to plug the hole. Data recovery firms rely on similar tools to resurrect files from drives that have been inadvertently reformatted or damaged.

In the future, digital forensics will play an increasingly significant role in the criminal justice system as we continue to incorporate a range of technologies into our everyday lives. As the digital forensic discipline continues to mature, those in the criminal justice system will more readily understand and accept the contribution it can make to the discovery and production of evidence.


3.3 Summary

The proliferation of criminal activities on the internet and on other digital devices like identity theft, spamming, cyber terrorism, economic frauds etc. computer forensics will continually increase the demand for computer forensics investigators in line with law enforcement and national security. Computer forensics investigators work with changing technologies, and are expected to learn the most recent versions, tools and processes in fraud and crime detection. Hence their education in very paramount and should be kept dynamic amidst rapidly evolving technologies.


3.4 Conclusion

A person who is responsible to investigate a crime should be conversant with the basic technologies involved in gathering the information, how to gather data properly, and how to confirm that the information will be valid as evidence during investigation. It is important to acquire, authenticate and analyze data stored in electronic devices, whether they run in which platform such as Microsoft or Linux operating systems. Moreover, an experienced investigator should understand the technologies involved in tracing and identifying the actions of a specific computer user.

The main objective of this paper is to bring together the use of computer forensics, digital forensics tools & issues facing computer forensics and legal aspects of computer forensics & its application in Nigeriacontext, but it is not meant to be a complete description of the computer forensic field. Furthermore, computer forensics is an emerging field that will continue to grow, especially as the laws evolve and computer technology becomes more pervasive.
One of the key contributions of this study is that stakeholders in the forensic program cannot be treated as one entity. The study reveals that organizations have to deal with two distinct groups of stakeholders, forensic and non-forensic. Forensic stakeholders take the lead by being directly responsible for training, policy, and other key aspects of the forensic program. On the other hand, non-forensic stakeholders are required to develop basic forensic awareness, so that they learn how to behave in a way that does not compromise the integrity of potential digital evidence. The engagement of non-forensic stakeholders in forensic training and policy is important as the first responder to an incident can be anyone in the organization. It is hoped that this research will draw attention to the important role played by those not directly involved in the forensic program ‘nonforensic stakeholders’. One implication of this is that forensic training and policy will no longer be exclusive to those directly involved in the forensic program. All staff will be required to attend forensic awareness training and comply with forensic policy.
Lastly, it is important to avoid becoming a criminal by breaking the law whereas investigating criminal activities.


3.5 Recommendation

This research recommends that organizations of all sizes should develop a forensic capability.
The focus group experts recommends that organizational IT security can greatly benefit from having a forensic capability. Organizations may take advantage of the forensic investigative reports to review and improve their security strategy.


3.6 Further research

Due to the limitation of this study, some areas remained untouched. These areas are suggested for further below and are given below

  1. The application of computer forensics in the financial sector
  2. The application of computer forensics in government parastatals.
  3. To examine the use of computer forensics in the educational sector.

Get Complete Project Material

5,000 5000

The Complete Material Will Be Sent to You in Just 2 Steps

Quick & Simple…


Step One Purchase

Make Payment (Through Transfer) of ₦5,000 to the Account Below

Zenith BankAcc No: 1225513212
Samphina Academy
Current Account

Or CLICK HERE To Pay With Debit Card


FOR STUDENTS OUTSIDE NIGERIA
CLICK HERE To Purchase Material ($15)

Step Two Purchase

Send the Following Details on WhatsApp ( 08143831497) After Payment

  1. Payment Details

  2. TOPIC: Computer Forensic

The Complete Material Will Be Sent To You On WhatsApp After Receiving Your Details
T & C Apply


  Contact Our Help Desk


Need a Different Topic? Perform a Quick Search



List of Related Works

Click on Any Topic to Preview the Content

samphina.academy

Samphina Academy

Samphina Academy is an Online Educational Resource Center that is aimed at providing students with quality information and materials to aid them in succeeding in their academic pursuit.