DIGITAL & CYBER FORENSICS (CUTM 2320)

Course Name: Digital & Cyber Forensics

Code(Credits): CUTM 2320(3+2+0)

Course Objectives

• To learn about basics of digital forensics.
• To learn about data recovery, registry and logging.
• To learn basics about mobile forensics

Course Outcomes

• Demonstrate the basic concepts of digital forensics.
• Gain skills in imaging and data recovery systems
• Gain skills in using softwares like FTK and Encase for solving cyber crimes

Syllabus

Unit I: Computer Organization & Architecture
Introduction, Central Processing Unit, Internal Communications, Machine Cycle, The Bus, Instruction set, Random Access Memory, Read only Memory, Storage System, Magnetic Storage System, Magneto Optical System, Solid-state storage devices, Storage evaluation criteria.

Input Devices: Keyboard, pointing devices, scanning devices, Optical Recognition devices, Digital Camera, Voice Recognition System, Data Acquisition Sensor, Media Input Devices, Display Monitors, Printers, Impact Printers, Non-impact Printers, Plotters, Voice Output Systems, Projectors, Terminals.

Output Devices: Media Input Devices, Display Monitors, Printers, Impact Printers, Non-impact Printers, Plotters, Voice Output Systems, Projectors, Terminals.

Unit II: Computer Codes
Introduction, Decimal System, Binary System, Hexadecimal System, Octal System, 4-bit Binary Coded Decimal (BCD) Systems, 16-bit Unicode, Conversion of numbers. Computer Arithmetic: Introduction, Binary Addition, Binary Multiplication, Binary Subtraction, Binary Division, Signed/Unsigned numbers, Complements of Binary Numbers, Binary Subtraction using compliments, Representing Numbers, Integer Arithmetic, Floating Point Arithmetic, Errors in Arithmetic, Laws of Arithmetic. Computer Networking: What is computer network, Communication Protocols, The Internet, Routers, Wireless Application Protocol. Internet Technology, Electronic Commerce, Electronic Payment Systems, The Electronic or Digital Cash Virtual Private Networks (VPN).

Unit III: Introduction to Cyber Forensics
Introduction, Information technology, The Cyberspace, Traditional Crimes Go Hi-Tech, Digital forms of Conventional Crimes, Digital Crime & Cybercrime, Computer Forensic. The Internet Crimes Modus operandi Used for Committing Internet Crimes, Different types of Internet Crimes, Cyber Laundering, Cyber Terrorism, Cyber Warfare, Prevention of Internet Crimes.
Computer Crimes: Classification of Computer Crimes, Computer Virus, Different types of Viruses, Computer worm, Trojan Horse, Trap Door, Super Zapping, Logic-bomb, Salami Logic, Characteristics of Computer Crimes, Characteristics of Computer Criminals, Common Targets of Computer Criminals.

Unit IV: Basics of Networking
Basics of Networking-Types of topologies, LAN, MAN, WAN, SAN, CAN etc. Types of internet connections (Dialup, DSL, Cable, broadband, leased line, satellite, Wi-Fi, 3G-4G) ISP, IP grouping. Network Security Measures: Basics Security Concepts, Safeguards Against the Computer Security Breaches, Secure Socket Layer Protocol. Vulnerability of Computer Network: Objective of Network Security, Classification of Computer Attacks, Common tools of Computer Attacks, Technical Reasons for the Vulnerabilities, Vulnerability Assessment, Sources of Computer Attacks.

Unit V: Computer Networking
What is computer network, Communication Protocols, The Internet, Routers, Wireless Application Protocol. Internet Technology, Electronic Commerce, Electronic Payment Systems, The Electronic or Digital Cash Virtual Private Networks (VPN). Digital Signatures: Signatures in Paper-based Society, Transfer of Computer-based Documents, Authentication of Computer Based Documents, Digital Signatures. Cryptography: Cryptography, Use of Hash Function, Digital Signature Generation, Certification of Public Keys, need for trusted Intermediary, Certification Authority, Issues in Asymmetric Cryptography, Steganography.

Unit VI: Computer Forensics
Computer Forensics, Cardinal Rules of Computer Forensics, Characteristics of Computer Forensics Scientist, Information Storage in a Computer, Existence of evidence in Different Formulas. Digital Analysis of Digital Evidence: Analysis Procedures, Data Validation Using MD5 Hash, Requirements for Forensic Imaging Tools, Commercial Forensic Imaging software’s, Forensic Examination of Storage Media, Status of Computer Forensics in India. Cyber Forensic Tools and Utilities: Introduction, examining a Breadth of Products Cyber Forensic, Tools Good, Better, Best: What’s the Right Incident Response, Tool for Your Organization, Tool Review Forensic Toolkit, Encase, Mobil edit, F-RAT, FTK, Cyber check suites, etc. Specifications for Forensic Tool Tested.

Unit VII: Investigation of Computer Crimes
The Characteristics Issues, the challenges, The Process of Investigation & Detection of Crime, Collection of Evidence from the Scene of Crime, Handling of Digital Evidence, Preserving the Digital Evidence, Examination of Digital evidence. The Cyber Laws: Need to Regulate the Internet, Country Specific Cyber Laws, The Indian Information Technology Act-2000, Salient Features of IT Act 2000, Legal Recognition of Legal Records, Legal Recognition of Digital Signatures, and Measures to Adapt Electronic governance, Computer Virus, Inadequacies in the IT Act 2000. National & International Coordination to handle Cyber Crimes: Need for International Co-ordination, The Present Structure to handle Computer Crimes, The Proposed Global Approach to Handle Computer crimes.

Suggested Readings

1. Joakim Kavrestad, Basics of Digital Forensics: Theory, Methods, and Real-Life Applications,
   1st Ed.2018Edition.
2. Joakim Kavrestad, Basics of Digital Forensics: Theory, Methods, and Real-Life Applications,
   1st Ed.2018Edition.
3. A Practical Guide to Computer Forensics Investigation by Released December 2014
   Publisher(s): Pearson IT Certification ISBN: 9780132756174

Practical's

1. To Study Computer Hardware Components
2. To study Internal & External ports of Computer
3. To study the Input devices of Computer, to study the Output devices of Computer.
4. To Study working of Ethernet (LAN cables), to Study the types of cables.
5. To Study Understanding LAN-client/server, user creation, password protection.
6. To study the Computer Network Security, to study Use of Hash Function.
7. To Study the use of Steganography.
8. To Study the Vulnerability of Computer Network.
9. To Study the communication Protocols layer by using cmd.
10. To detect deletions, obliterations and modifications of files using encase software.
11. To identify the IP address of the sender of e-mails.
12. To identify Encrypted files, to identify Hidden files.

Session Plan

Session 1

Computer Organization & Architecture

http://youtube.com/playlist?list=PLBlnK6fEyqRgLLlzdgiTUKULKJPYc0A4q

Input devices

https://www.youtube.com/watch?v=0brQGeoOkgA 

Output devices

https://www.youtube.com/watch?v=BfQMabfA4tI

Session 2

Numerical system of computer & Types of number system

https://www.youtube.com/watch?v=Nrw1vQrFSa8&list=PLBlnK6fEyqRgLLlzdgiTUKULKJPYc0A4q&index=49s

Session 3

Cyber Forensics

https://www.coursera.org/articles/computer-forensics

Session 4

Basics of Networking

https://www.ibm.com/topics/networking

Session 5

Computer networking

https://www.cisco.com/c/en_in/solutions/enterprise-networks/what-is-computer-networking.html

Session 6

Computer Forensics

Introduction_to_Computer_Forensics_and_D

Session 7

Investigation procedures involving in Computer Crimes

https://online.norwich.edu/academic-programs/resources/5-steps-for-conducting-computer-forensics-investigations

Session 8

Types of cyber crimes

https://blog.ipleaders.in/cyber-crime-investigation-conducted/

Session 9

Cyber forensic tools

https://www.globalscientificjournal.com/researchpaper/The_evaluation_of_the_Encase_and_FTK_forensic_tool_for_effective_evidence_extraction.pdf