Digital Forensics and Evidence Collection Methodology

I. Introduction

Digital forensic is a branch of forensic science dealing with the extraction of data and investigation of the material recovered from the digital devices.

Normally in relation to cyber-crime. In the 21st Century, the use of computers is increasing more and more. This has allowed the development of the internet. In turn, the web has brought many benefits, but the web has also contributed to the increase of cyber-crime. So, with the increase of cybercrime, it's become critical to extend and develop computer systems security.

Each time, the techniques used by cyber criminals are more advanced, making it more difficult to protect corporate networks. Because of this, the technological security of those companies has been violated, and it's here at now when digital analysis forensic is required to get cyber criminals.

So, with the increase of cybercrime, digital forensics is increasingly gaining importance within the area of data technology. For this reason, when a criminal offense is completed, the crime information is stored digitally. Therefore, it must use appropriate mechanisms for the gathering, preservation, protection, analysis, and presentation of digital evidence stored in electronic devices.

Advancement in technology and ease of personal computing has expanded the orbit of this branch of forensic science. A human being in today’s era is constantly equipped with a digital device, which has enabled digital devices as a shred of evidence to user’s daily life actions. Digital forensic investigations have enormous fields of applications. The most discussed is refute or confute of an argument before criminal or civil courts. The digital devices acquired from the accused in any such cases can be solid constructive forensic evidence which is often referred to as electronic discovery. It is further bifurcated in relation to the type of digital evidence involved, computer forensics, network forensics, forensic data analysis, and mobile device forensics.

The normal procedure followed in forensics is a seizure, forensic imaging, and analysis of digital media, and creation of reports in relation to the collected pieces of evidence.

Traditionally digital forensics was used in criminal law to prove or negate the accusations by traces of mobile phone records in relation to the mobile tower location and mobile range fetched from the tower.

In recent times, intellectual property has evolved as a valuable asset that is compromised and stolen, Digital forensics has also interplayed with the concept of “evaluation source” of such intellectual property to prove the original owner of the intangible yet valuable asset of a legal person.

While talking about digital evidence used in courts, these shreds of evidence fall in the same criteria and same legal guidelines as other forms of evidence. The concept of authenticity and integrity are considered Integrity is ensuring that the act of seizing and acquiring digital media does not modify the evidence (either the original or the copy). Authenticity refers to the ability to confirm the integrity of information and its evidential importance with respect to the case.

The Information technology act, 2000 is considered the main root source of evolution and formation of the digital devices as a piece of evidence and digital forensic as investigation of such digital devices for necessary pieces of evidence for related crimes and Illegal acts.

Section 43 of the Information technology act, 2000 emphasizes certain acts which are prohibited but not considered as cyber-crime but are of such nature that might cause damage to an individual. Securing unauthorized or illegal access, downloading, copying, extraction of data or information, the introduction of the virus, computer contamination, assistance in committing any contravention, deleting, destroying, stealing, concealing, altering any information residing in the computer are some acts which are contraventions under IT act of 2000.

Such prohibited acts have remedies to the victims of such acts, section 66 of IT act, 2000 prescribes the Remedies to the victim y suggesting punishment (of imprisonment for a term which may extend to three years and a fine not exceeding ten lakhs [further amended to the removal of cap of ten lakhs]) to the person who has dishonestly and fraudulently does any act referred under section 43 of the IT act, 2000.²

The act of taking control of the digital device and networks through unauthorized access to an account or any system. Hacking any system compromises the data and current tasks running on the system and makes them available to the hacker, it’s a common practice which is interlinked with the illegal activities which are implemented with intention of data theft by cyber criminals.

The History traces back to 1980’s where an article inspired teenagers cracked a computer systems of major organizations, which led in legislation to pass bills related to the computer crimes. The ease of technology and availability of internet has made more opportunities and more scope to the Hacking activity. The boom in this field has increase the number of such con artists, where there has been a subdivision in the definition of Hackers, There are 3 types of hackers The Black hat hackers, White hat hackers, Grey hat hackers, as the name suggests these hackers either are criminals, anti-criminals or the third kind which sit in between the good guys and bad guys and focus on the common societarial good.

The motive of hacking systems or digital devices or websites are segregated over four goals, that are

1. financial gains.

2. Corporate espionage.

3. Motive to gain respect and notoriety for hacking talent.

4. State sponsored hacking aims to steal business information and defense the national intelligence information.

II. Cyber forensic technique to deal with the hacking

Hacking or unauthorized access to any digital device with motive to gain financial profits, or commission of a crime that involves the usage of computer, phone or any digital device connected to the network, or even the network for matter of fact since a compromised network can become the stream flow to the data being accessed through that network source.

The investigation of such act is done by the digital forensics team, where the investigator investigates the compromised device, or the accused hacker’s system and scrutinizes the whole system for evidence.

The investigation is a process which includes investigating, analyzing and recovering the critical digital forensic data, the investigators must be ready to face the decryption and usage of various tools, since these black hats have inbuilt habit of increasing the complexity of their system so that it is tough to breach-in, The investigators must not only understand the software but also the operating systems, file system, network analysis, hardware works and working of all the devices, availing so will make the officers understand the questions such has why, what, how exactly the crime was committed and how victims can protect themselves in future.

III. The forensic techniques involved in investigation are as follows

Background check

Creating and defining the background of the crime with the related known facts which helps in understand the investigators as to where exactly is the start point, to what exactly are they facing towards, and what are the exact steps to implement in the following investigation.

Gathering the information

Understanding the crime scene and gather the information about the incident, by doing so will explain the investigator as to whether the attack was automated, Mirrored, human target, opportunity of attack to take place again, potential suspects, potential future threats, vulnerability of attack and post-effects of the attack and most importantly the person performing the attack is an experienced or not. Evidence assessment is a critical part of digital forensics as it provides a clear understanding of the case details and includes examining hard drives, email accounts, social networking sites, and other digital archives for digital evidence linking someone to the crime. The investigators should also preserve the acquired evidence properly.

Forensic Investigation and Required Techniques.

The analysis of digital evidence provides details like the date, time, and location where the data were created and downloaded. It also helps the investigators to find the connection between uploading of files from storage devices to a public network.

The actual investigation starts in this step where acquisition of evidence takes place, the computer forensic investigators are subjected to follow the policies dedicated to preserving the integrity of potential evidence.The investigator goes through the gathered information and uses his required tools , softwares to dive into the data ocean available, for the online data available, investigator uses the surface browser to understand the online structure of the system and gathers the information available online from the DNS records, sub domains, SSL certificates, etc. The following data is used to trace back and reconstruct the wiped history/ data from the network.

The DNS records are an infinite source of intelligence data when it comes to cyber security, these records hold whole of the information.

The followed technique of WHOIS timeline.

When the attack is not on server or the app, but on the domain then such technique of scrutinizing the WHOIS history makes it available to the investigator as to where else has the attacker robbed the data from domains or systems assigned to the domains.

In case where there is involvement of companies where the cyber-attack is done for espionage, there the Blocked IP ADDRESS data is considered critical since, it assists to prove the system used to breach the victim system was owned by the accused company. Doing so will avail the whole IP map followed for the whole breach.

The reverse DNS is kind of engineered practice which helps to understand and extract the information which retraces back the massive hidden rDNS data which helps to investigate the IP addresses easily, basically it helps to understand the cross data exchange which took place between the systems with IP addresses and DNS.

Reporting

Lastly, investigators need to report the whole process of investigation and evidences acquired and examined to the authorities. This is needed to ensure that all the guidelines, policies, and procedures have been followed throughout; it also ensures the authenticity and integrity of the data retrieved for the evidential reasons.

IV. Forensic technique to deal with phishing attack

The phishing is a trap or a socially engineered attack often used to steal the data which normally includes login credentials and credit card, debit card numbers, or bank details. In the said illegal act the attacker masquerading as a trusted entity, dupes a victim to open the mail or instant message, or text message. The said mail/ message consists of a link which at times opens automatically or the victim opens the link which is a carbon copy of the original website, where the victim enters the information and that confidential information is compromised. Such compromised data is then used by the attacker to fraudulently take over the access to the account which, generally happens to be an investment account or bank account. From which the amount is transferred without the consent of the actual owner of the account.

Let us techniques to prevention against phishing, first of all we must be equipped with safe and trusted web browser and must be on the latest version of the same. Doing so will reduce the risk of data leak, since the security patches are updated which makes them breach free. Further on, deployment of SPAM filter is a necessary step which detects virus, blank senders, etc. The updated browsers are equipped with ad blockers which prevent the user to redirect on suspicious links. Even if yet the user gets in the phishing attack then the digital forensic team has its ways to trap the attacker.

The known technique of trapping the phisher is by counter phishing them, which is done by way of tracing the live phishing attack. Once when the live phishing attack is traced then the forensic team advices the victim to enter the tacker information which is given by the forensic team, as soon as the tracker information is entered by the victim, the phisher gets the information of the victim’s financial accounts, which in real is the bait information which is continuously monitored by the forensic team.

Thinking the “bait information” as the real one the phisher enters that information on the related official site of that financial organization.

The following bait information is no different than the normal information, the only difference is that, the bait information is being tracked and that the bait information leads the phisher to a staged, set-up cloaked website of that real financial website. Further that bait information diverts the phisher to a simulation vault of the bank where a simulation of transaction is done which is done by the phisher, the transaction is done in such way that it feels normal to the phisher, but while doing so, the bait information entered by the phisher, simultaneously takes the monitoring forensic team to the pool of information which was gathered by the various phishing attacks done by that phisher.

The whole act is basically a trap which is set-up by the forensic team to lure the phisher in to a fake system, which results in trapping the phisher and also capturing the information which was illegally acquired by the phisher.

Web-Bug

The advancement in the following method have been seen where the forensic team shuts down the lucrative business of phishing by pulling down the website by gathering evidences through the method given above, where the experts input the information by using “web bug”, by doing so the bait information is also secured and is seen as real information by the phisher.

Phoneytoken Machine

The successor of “web bug” which has more advancements and has more efficiency is the phoneytoken machine, it exactly does the same work but at the same time it scams, generates, and enters the bait information on phishing sites to pull them down.

Phoneypot

While usage of these tools one has to be careful that the main site of that financial organization is not affected. The same is taken care of by the phoneypot, the tool traps the phisher into a visual space which exactly is the replica of the original website of financial organization but not the original one. By doing so the phisher is trapped in that virtual space and cannot affect the official site.

All these tools are collectively implemented to lockdown the phishing sites and to pull down the phishing attacks.

V. How to detect and collect evidence in case of Nigerian Frauds

The Nigerian fraud is also known as advance fee fraud where the fraud creator sends message on victim’s phone saying surprisingly you have won a lottery to claim call the certain number and share the bank details for the same. At times the fraud style was different, where the scam involved promise of getting big lump sum amount in return of small upfront amount, which the fraudster supported the up-front amount as the claiming/registration amount. The following scam is also called 419 fraud scheme, the number refers to the section of Nigerian law. The said scam got new platform all thanks to internet, the new way was so sugar sweet and tempting where the individual receives an email asserting that the mail sender needs help in transferring money out of Nigeria. The following amount of money is in form of asset or some large amount of cash which requires laundering. The mail concerns the receiver to cover the cost of moving funds and its carrier charges, which in return will give the larger sum of amount to the recipient of the mail/ the victim in near future, which never happens or even worse the victim is asked for more money since there are some complications or so… The following scam can be pulled off by basic cyber forensics techniques where analysis of data is the main method to understand or detect the Nigerian fraud. The TRIAGE is a forensic software tool which helps in segregation of mails, messages and cell phone numbers, which are used to contact victims. TRIAGE identifies complex patterns in data, unveiling sometimes varying relationships among series of connected or disparate events. TRIAGE is best described as a security tool designed for intelligence extraction helping to work out the patterns and behaviors of the intruders. The following process is done by filtration of mails, messages sent by categorizing them with subject line, sender, date, reply address, phone number or any other email found in the body of the mail. The whole process consists of usage of pre-existing library of such fraud mails or texts available to understand the fraud technique more and determine the same efficiently.

The whole detection and capture of evidence is based on the pre-existed data gained out from various past occurred Nigerian frauds, or attempt of Nigerian fraud.

VI. How to collect evidence through WhatsApp

The admissibility of WhatsApp messages in court was seen in judgements of 2020 where the reference of sec1 (t) of the Information technology act of 2000 which explains that an electronic recording is data or record or data generated, image or sound stored, received or sent in an electronic form or micro film or computer generated micro fiche. Section 3 of the Indian Evidence Act, 1872 defines evidence as all documents including electronic records produced for the inspection of the court. All such documents are considered as documentary evidence. The following section 65A and 65B of the Indian Evidence Act, 1872. also supports the admissibility of WhatsApp messages as evidence, as the section explains any information contained in an electronic record which is printed on a paper stored, recorded or copied in optical or magnetic data produced by a computer will be deemed to be a document, but at the same time the section also prescribes the document to be complied with the conditions which are mentioned below.

(1) The computer output containing such information should have been produced by the computer during the period when the computer was used regularly to store or process information for the purpose of any activities regularly carried on during that period by the person having lawful control over the use of the computer.

(2) During such period, information of the kind contained in the electronic record was regularly fed into the computer in the ordinary course of such activities.

(3) Throughout the material part of such period, the computer must have been operating properly. In case the computer was not properly operating during such period, it must be shown that this did not affect the electronic record or the accuracy of the contents.

(4) The information contained in the electronic record should be such as reproduces or is derived from such information fed into the computer in the ordinary course of such activities.³

There are 2 ways to collect evidence from WhatsApp

1. Presenting the primary evidence that is by means of presenting the computer/laptop/tablet/cell-phone in court by the owner himself in the witness box. Where the owner has to prove that the electronic device is owned and operated by him and the evidence recorded are stored by Him whole and solely.

2. Creation of the secondary evidence from the primary electronic data, That is printed on a paper stored, recorded or copied in optical or magnetic data, which is accepted with respect to complying the same evidence with the section 65A 65B of Evidence act.

However, A WhatsApp forward is not considered as a document in terms of evidence act since it is not the original nor the copy of it will be original since the main source itself is a copy of an original document not owned or stored by the presenter.

5. How to collect evidence through social media such as Facebook, Twitter.

Social media knowing unknowingly is a crucial aspect while looking for evidence in today’s world, since we are connected 24/7 to one or other social media platforms be it Facebook, Twitter, Instagram, WhatsApp, basically all the products owned by Mark Zuckerberg. The time stamps, posts, location tags etc. are very important in terms of digital evidence. The following can be proved perhaps all the above examples can describe where exactly the person was and what that person was doing, in that particular time frame.

The following are some important techniques suggest and used while collecting evidence from social media accounts.

USE DEX

Digital Evidence Exchange (DEX) is a standard of digital evidence provenance that explicitly defines the set of tools and transformations that led from acquired raw data to the resulting product. It is an XML format and is independent of the forensic tool that discovered the evidence. Digital Forensics XML (DFXML) is another more recent XML language for digital forensics research and is designed to be an interchanging format between forensic tools while representing range of forensic information acquired from the social media accounts.

WARC

The WARC is a web archive format in which the whole of the website is available. The WARC files display website or webpage created by prior saving the web crawls, can accurately capture how a web page looks or how it looked at a point of time. Mere screenshotting the image wont fetch enough proofs rather collecting WARC format of the same social media account might do the job perfectly for you, since the data which is captured by WARC method is not static but dynamic, which means the videos, messages, posts, etc. everything is captured, with working links and other dynamic elements

Collect Key Metadata

Capture all metadata related to the content to prove authenticity (IP addresses, timestamps, URLs, etc.). Even if you don’t think you’ll need it, it’s always safer to gather it from the beginning.

Collect the Evidence through API’s

Collecting evidences by way of API’s will not only make the videos and posts available but also avail the hash reports, that can be used to prove the authenticity of the evidences and be easy to prove that they weren’t tampered.

Inter-change format between forensic tools, to represent a wide range of forensic information and forensic processing results.