What if someone has to face cyber attack? What next? The next step is to report cyber crime. But if a person comes in contact with cyber forensic principles, then the possibility is reduced that the person accidentally destroys the important cyber evidence.
Computer Forensic: There is a branch of cyber forensic science related to equipment and techniques to examine digital data to find evidence against a crime that can be produced in court. This is a practice of preserving, extracting, analyzing and documenting evidence from digital devices such as computers, digital storage media, smartphones, etc., to be used to make specialist opinions in legal/administrative matters.
Computer forensic plays an important role in any organization because our dependence on computing equipment and internet is increasing day by day. According to a survey conducted by the University of California, 93% of all the information generated during 1999 was generated on a computer, produced on the computer, using only 7% paper of the remaining information, etc. It is not always easy to collect evidence because the data can be replaced, removed, hidden or encrypted. Digital forensic investigation is a highly efficient function, which requires the discovery of various devices, techniques, and guidelines to find and recover digital equipment from the crime site or to reconstruct digital devices. Due to the processing capacity of digital devices such as smartphones, tablets, pampatops, smart TVs, etc., the possibility of using these devices in cyber crime cannot be ruled out. A forensic investigator should not only have a deeper understanding of the functioning of these devices, but should also have a practical experience of the equipment for accurate data recovery, so that the value and interestingness of the data remains preserved.
Computer can be used intentionally or unknowingly for cyber crime. It is deliberately used to use your computer to send hate -filled mails or install a crafted version of any other licensed software in your computer. Inadvertently the use made is that the computer you are using has a virus and it spreads in the network and outside the network, causing a big loss to a person. Similarly, computers can be used directly to perform digital offenses. For example, your computer is used to access sensitive and classified data and data is sent to someone inside/outside the network who can use this data for its advantage. The indirect use of a computer is when downloading a software crack, a trojan horsepy in the computer is stored, while a rear door is made in the network to facilitate hackers. Now the hacker logs into your computer and uses it to commit cyber crime. An experienced computer forensic investigator plays an important role in differences in direct and indirect attacks. Computer forensic experts are also useful for recovery of casual data loss, industrial espionage, forgery etc.
In large organizations, as soon as the event management team detects cyber crime, which is responsible for monitoring and detection of safety event on computer or computer networks, initial event management processes are followed. This is an internal process. It has the following stages: 1. Preparation: The organization prepares guidelines for the event response and the event reaction assigns roles and responsibilities to the team. Most large organizations earn reputation in the market and any negative emotion can negatively affect the feelings of shareholders. Therefore, effective communication is required to declare the event. Therefore, it is important to specify roles based on the skill-set of a member. 2. Identification: Depending on the symptoms, the event response team verification whether an event actually occurred. One of the most common processes to verify the event is to check the log. Once the incident is confirmed to occur, the impact of the attack is to be assessed. 3. Prevention: Based on feedback received from the evaluation team, future proceedings are planned to react to the incident at this stage. 4. Abolition: In this stage, the abolition or mitigation of the cause of the danger is planned and implemented. 5. Recovery: This is the process of returning to normal operations after the abolition of the problem. 6. Learning: If a new type of event is encountered, it is documented so that this knowledge can be used to deal with such situations in future.
The second phase of the process is a forensic investigation to find evidence of crime, mostly done by third party companies. Computer Forensic Investigation includes the following stages: 1. Identify the event and evidence: This is the first step to a system administrator where he attempts to gather more information about the incident as much as possible. Based on this information, the scope and seriousness of the attack are assessed. Once the proof of the attack is found, its backup is taken for the purpose of the investigation. Forensic investigation is never done on the original machine but is done on the replaced data from backup. 2. Collect and preserve evidence: Various devices like Helix, Winhex, FKT imagers etc. are used to collect data. Once the data is received backup, evidence and backup are taken to them. To check the integrity of the data, the MD5 (message digest) of the backup is calculated and matched with the original. Other important sources of information such as the system log, network information, infiltration identification system (IDS) log, port and procedure information are also collected. 3. Investigation: The image of the disc is restored from the backup and log, system files, removed and updated files, CPU use and process log, temporary files, passwords protected and encrypted files, images, videos and data files for potential stegriographic messages etc. are investigated. 4. Summary and presentation: The summary of the incident is presented in the chronological order. Conclusions are drawn on the basis of investigation and the possible cause is explained.
Rules and procedures should be implemented while conducting digital forensic examination. Especially while collecting evidence. It should be ensured that there is no change in evidence from actions to collect data. The integrity of data should be maintained. It should be ensured that the equipment used to backup is free from contamination.
In addition, all activities related to seizure, access, storage or transfer of digital evidence should be fully documented, preserved and available for review. Prevention is always better than treatment. To avoid praying to the hacker, it is always recommended to fix its infiltration system such as firewalls and sometimes conduct admission tests on your network. Last but important, report crime.
Why should we report cyber crime: Some companies do not report the incident of cyber crime as they fear that this will harm their reputation among shareholders. Some data are very sensitive and its disclosure can negatively affect their business. However, the fact is that cyber criminals will never be caught by law enforcement agencies until the incident of cyber crime is reported. This will make the conditions worse and criminals will be encouraged to repeat such incidents with the same or other organizations. Therefore, it is very important to identify them and prosecute them. This will not only help in identifying the current threats for the economy and infrastructure but will also help in identifying new threats. Depending on the scope of cyber crime, cyber crime should be reported to international institutions like cyber cell, state cyber cell, CBI, IBs like Cyber Cell, State Cyber Cell, IB, or international institutions like Interpol.
The number of internet users in India is more than 560 million, which is the…
Cyber crime is a crime that involves computers and networks. Finding any computer at a…
As the world is moving forward in the field of digitalization, the threat of cyber…
Digital world creates conditions where nothing remains confidential or secret.’ Has the present world really…
‘Cybercrime in India’ is the term used to describe criminal activities involving a computer or…
Police is an organization of the government, which has to work promptly to maintain law…