Social Issues in Computing : Forensics

1. Forensics: New dimension for Governance
Presented By
Name : Karuna Kak and Anirudh Munj
PRN :12030121030 and 12030121031
Course : BCA
Batch :2012-15
Division : A
Course :Social Issues In Computing

2. INTRODUCTION TO FORENSICS
Forensics in ICT terms generally includes
two distinct fields:
• using ICT to enhance information
gained about a crime (for example,
software that can process database
searches faster than humans can), and
• gathering information about a crime
from a computer that contains data
related to the crime.

3. DEFINITION OF FORENSICS
• Forensics is the use of science
and technology to investigate
and establish facts in criminal
and civil courts of law.
• The goal of any forensic
investigation will be to
prosecute the criminal or
offender successfully,
determine the root cause of an
event and determine who was
responsible.

4. TECHNIQUES USED IN FORENSICS
• Stringing
• Total station
• Photo composites
• Computerized matching
• Ballistics
• Fingerprints
• DNA
• Handwriting/graphology

5. STRINGING
• One traditional procedure at a crime scene is
to document the locale.
• On a road, the distances, speeds, directions
are part of the data set that defines the events.
Prior to the availability of high-tech IT
equipment, this process involved “stringing”: a
police technician would use string to measure
distances and angles.
• Today, laser controlled digital cameras and
computer generated algorithms have replaced
the somewhat imprecise techniques of earlier
years.

6. TOTAL STATION
• A device called the “Total Station” began to
replace that imprecise technology of using
strings, paper and pencils and analog
photographs during the middle of the 20th
century.
• It was a device used by engineers that was
easily adapted to forensic use because of
the (then) precise nature of the data it
provided, as opposed to the use of string,
for example.

7. PHOTO COMPOSITES
• One of the classic results of a police investigation
into a crime is the “Wanted” poster.
• In pre-digital times, highly skilled artists were part
of the staff of a police force: people who could
interpret witness descriptions and turn them into
visual elements.
• Today, using a combination of digitally captured
images and special software, police are able not
only to create likenesses that are indistinguishable
from actual photographs, but they are also able to
put special algorithms to work that can
authentically “age” a victim/suspect within
reasonably accurate limits.
WANTED

8. COMPUTERIZED MATCHING
• There are a number of traces that might be left at a
crime scene that can be used to identify the
criminal.
• When there is so much data to sort, catalogue and
search through, a computer or a computerized
database makes the work both faster and less
prone to error.
• Special software and hardware adapted to specific
uses also increases the likelihood of positive
identification, whether it means reconstructing a
scene from limited or missing information or
whether it means searching a large database to
find matching patterns.

9. BALLISTICS
• Prior to the arrival of computer technology, police
experts would examine the markings on bullets
found at a crime scene under a microscope.
• They still do; however, the process has been
considerably enhanced with the assistance of
computers: much of the visual comparison can
now be automated.
• Similarly, rather than having a desk clerk search
through long files in search of serial numbers – on
weapons recovered or ammunition – centralized
databases and logged electronic records allow
police to make better use of their time.

10. FINGERPRINTS
• The use of fingerprints to identify individuals was
known back as far as ancient times, Greek and
Babylonian records show the use of fingerprints as a
signature.
• However, it was only about the 1850s when police
investigations began to make extensive use of
fingerprints as “proof positive”.
• Although no two people have the same fingerprints,
police are often limited by the amount of data they can
search through.
• Today, police detectives can work online, with access
to a national digital archive of known fingerprints.

11. DNA
• Similar to the case of fingerprints, but even more recent a
development is the use of DNA as positive identification in
a crime.
• DNA identification can work with any body parts to create
a very clear profile of the person the sample comes from.
• Again, the chance of identification is made better when
you have a larger database to work from.
• Police is allowed to build a better DNA database by giving
the police the legal right to collect and save a digital DNA
file for anyone who is taken to the police station.
• The fact that the police are allowed to take a DNA “swab”
even of people who are not charged with a crime has
become a major issue of privacy rights.

12. HANDWRITING/GRAPHOLOGY
• Handwriting analysis involves
forensic examination of such
factors as (pen) pressure, slant or
angle of letters, deviation above and
below imaginary “standard” lines
and other factors such as the size of
loops in the letters.
• While much of this is based on
visual observation, software that
can scan and then automatically,
digitally compare these features is
making this science more reliable
as a tool for detection.

13. STUXNET
• Largest and costliest development effort in malware history
• A team of highly capable programmers
• In-depth knowledge of industrial processes
• The complexity of the code indicates that only a nation-state
would have the capabilities to produce it
• The self-destruct and other safeguards within the code imply
that a Western government was responsible, with lawyers
evaluating the worm's ramifications

14. DIGITAL FORENSIC (DF)
• DF involves the
 preservation
 identification
 extraction
 documentation
of digital evidence stored as data or
magnetically encoded information.
• This includes the
 recovery
 analysis
 presentation
of digital evidence in a way that is admissible
and appropriate in a court of law.

15. DIGITAL FORENSICS
AS A MULTI-DIMENSIONAL DISCIPLINE
• We consider the dimensions of Information Security as a baseline
when defining dimensions for DF.
• The following dimensions were identified for digital forensics:
Corporate Governance
Policy
Legal and Ethical
People
Technology
• The dimensions are inter-related and can not exist in isolation.

16. CORPORATE GOVERNANCE DIMENSION
• The Corporate Governance dimension will handle the management
aspects of DF in an organization.
• Management is responsible for the security posture of an
organization.
• Management can only manage security incidents if for example the
root cause of the event is determined and appropriate action to
rectify it can be taken – this may involve forensic investigations.
• The Corporate Governance dimension includes strategic governance
and operational governance.
• Typically strategic governance will be from a strategic perspective,
while operational governance will provide management directives on
an operational level.

17. POLICY DIMENSION
• A general forensic investigation policy is required to provide a
framework for DF policies in the organisation.
• Examples of other policies are how to handle evidence, how to
seize evidence and how to conduct covert or overt investigations.
Policies are normally supported by procedures and guidelines.
• Procedures also need to be set up so that the investigations will be
able to stand up to legal scrutiny in court.
• These procedures must also be scientifically sound and proven to
maintain the integrity of the evidence and process.

18. POLICY DIMENSION
Six categories of policies to facilitate Digital Forensic Investigations (DFI):
Retaining Information
Planning the Response
Training
Accelerating the Investigation
Preventing Anonymous Activities
Protecting the Evidence

19. LEGAL AND ETHICAL DIMENSION
• The Legal and Ethical dimension of DF is very important in
organizations.
• In Cyberspace there is no universal or common ‘Cyber law’.
Various judiciary systems exist in different countries.
• The forensic investigator must be familiar with local legal and
international laws, treaty requirements and industry specific
legal requirements when preparing to present a case that will
be able to stand up to legal scrutiny in court.
• Ethical aspects of DF is becoming more and more important.

20. PEOPLE DIMENSION
• People are the most important part of any organisation and normally
the weakest link in the security chain of the organization.
• When an incident occurs it is most likely that people will contaminate
the evidence while figuring out what has happened. Training is
therefore essential. Therefore, there is a huge need for forensic
awareness training.
• This dimension will look at training and awareness programs in an
organization.
• The profile and composition of a DF team is also very important.
• One person normally does not have all the required skills to conduct
an investigation. Therefore the team should consist of a team leader,
network specialist, code specialist, business process specialist and
a quality manager.

21. TECHNOLOGY DIMENSION
• No DF investigation can be conducted without a DF toolkit.
• Various specialised software and / or physical hardware tools will
make up the DF toolkit as different tools are used for different
purposes.
• The way the tools are utilised as well as the acceptance of a
specific tool by the legal authorities are vital for any forensic
investigation.
• The forensic and legal community has accepted certain industry
standard tools e.g. EnCase (Meyers M, Rogers M, 2004).

22. REFERENCES
• Digital Forensics: A Multi-dimensional Discipline,
CP Grobler, Prof B Louwrens, University of Johannesburg,
Department of Business IT
• Developing digital forensic governance, Marthie Grobler,
Council for Scientific and Industrial Research (CSIR)
• Social Issues in Computing, Exploring the Ways Computers
Affect Our Lives, Colin Edmonds, June 2009