Teaching IT Hardware Concepts, Term Paper Example

Professional Forensics

Discussing computer forensics in the context of law enforcement agencies or in corporate security, it will lead to a conclusion of a subject that covers the utilization of computers to catalog physical evidence that is analyzed in other forensics techniques including biometric identification, analyzing DNA and dental evidence. Current technological trends have revolutionized the methods of storing data along with different advanced access mechanisms. These systems facilitate law enforcement agencies by providing instant access to these characteristics. Although, computer forensics also facilitates in investigation of crimes within themselves in order to gather evidence associated with criminal activities that breaches violation of an organizations policy. The data can be extracted from storage devices including hard drives, flash drives, memory cards etc. (Fernandez, Smith, Garcia, & Kar, 2005). Due to the rise in usage the Internet, federal bureau of investigation (FBI) has concerns related to organized crimes and cyber fraud over the Internet. Hackers and cyber criminals conduct crimes that are associated with Internet fraud. Moreover, phishing is another way of extracting personal information from the user and use it for financial gains. Phishing works on a fake page identical to the original web page. A cyber-criminal or hacker may provide forms to update personal information of customers including bank account details, credit card details etc.. Phil Williams of Carnegie Mellon University’s CERT Coordination Center mentioned seven trends from which the businesses should be conscious. One of the seven trends involve organized crimes that is implemented for activities related to fraud and theft including  ‘pump and dump’ stock schemes and mob activities such as money laundering and most common threats known as viruses, theft and embezzlement.

Organization employees must encompass several techniques and methodologies for countering a compromised computer network within minimum time possible. As we can see that attacks are far more intelligent and uses new techniques every time. Initially, it is very difficult to trace the worm that has already intruded within the system and continues to spread. Network administrators need to configure network security appliances intelligently. Moreover, after detecting the threat, there is a requirement of identifying systems, where the worm is located and continues to spread. However, identification of systems is not enough, network administrators have to identify and trace effected network ports and services, as the worm will use these ports and network associated services to spread. After identifying infected systems and network ports, network administrators can make decisions, as they now come to know the affected systems and the affected network ports and services. Lastly, in order to trace the source, there is a requirement to trace the intruder. This may be a challenging task, as evidence is limited and the time stamps are not always correct. Network administrators can use packet marking and analyze packet header to focus on two areas of interest i.e. time stamps and record route.

Every online user leaves behind logs related to activities that he or she performs online. This digital traceability can reveal activities that are performed by the user on the Internet by identifying who has identified which files along with logs of each website visited. Temporary files can also reveal flash templates and buffered videos. These traceable logs, files, cookies, templates can facilitate a great deal to analyze crimes that are committed from computers and may provide solid evidence against the hacker or cybercriminal. However, many users trust in files after deleting them from the hard drive but there are many ways and methods via which these files can be recovered. The operating system usually does not delete complete files from the hard drive, even if the user deletes the files from the recycling bin. The files are still present, until they are replaced or overwritten by new files. These traceability factors can lead to aid in forensic investigations and can track down criminals by investigating their computer. For instance, during the execution of a search warrant at the residence of John Robinson who was a serial killer, law enforcement agencies discovered two bodies that were badly decomposed along with seizing of five computers (Fernandez, Smith, Garcia, & Kar, 2005). After investigating computers, it was discovered that the serial killer John Robinson was using internet to find people to schedule a meeting. Afterwards they were killed by sexually assaulting them. These facts were only possible by forensic computing techniques and were not possible by physical evidence and investigation (Fernandez, Smith, Garcia, & Kar, 2005). However, many techniques are associated with forensic computing, few techniques are categorized in to two groups i.e. Graphical User Interface (GUI) based forensic tools and Command line forensic tools (Conklin 2005). The command line tools are relatively small, they can be stored in floppy disks as compared to heavy, and slow GUI based forensic tools. However, command line tools also share some disadvantages in terms of their limitations as they are not capable to identify .zip files and .cab files. GUI based tools provide a graphical user interface and is said to be user friendly because specialized knowledge is not required as compared to command line tools requiring commands on every operation. The disadvantage for GUI based tools is that they are large and cannot be saved in a floppy disk (Conklin, 2005). One more method called as log file forensics using the Internet Information Services (IIS) logs integrated with SQL queries and Microsoft’s Log Parser tool. There is a security issues when an e-commerce based organization receives complains from the customers related to unknown orders in their account. No one knows precisely where these email came from as web based intrusion investigation is a daunting process, where there is no information to work on. The organization then analyses their web based ordering system in order to collect log files from several IIS based servers. Log files provide correct date and time but the IP addresses are anonymous due to the usability of proxy server by the attacker. Email security is also rising in terms of spam emails and phishing. In order to eliminate o prevent email threats, Email Data acquisition tool are developed that supports 40 email formats and email client software integration along with many webmail services. Moreover, it also supports services associated with remote accounts via Internet Message Access Protocol (IMAP). The tool is platform independent and supports files from Mac and Linux without any translation procedures. The file formats that are supported includes MSG files, PST files, MAPI profiles, Microsoft Exchange via MAPI profiles, Outlook Express, Windows Live mail, Apple mail, Eudora and much more. Testing has been successfully conducted on 264 GB mailbox containing 3 million emails (Doherty, 2012). Organizations suffer from valuable data storage in terms of duplicate emails. In order to eradicate this issue, Aid4Mail provides a feature named as ‘de- duping’, which provides options on the folder level to delete duplicate emails from all folders. Also, integration of this tool with the search engine provides analysis of large email datasets and extracts appropriate records efficiently. Furthermore, wildcards are also supported (Doherty, 2012).

References

Conklin, M. S. (2005). Teaching IT hardware concepts using computer forensics as a motivator. SIGITE Newsl., 2(1), 3:1-3:4. doi:10.1145/1869667.1869670

Doherty, E. P. (2012). Digital forensics for handheld devices Taylor & Francis.

Fernandez, J. D., Smith, S., Garcia, M., & Kar, D. (2005). Computer forensics: A critical need in computer science programs. J.Comput.Sci.Coll., 20(4), 315-322.