Technology in Computer Forensics

Alicia Castro Thesis Defense

Master of Software Engineering Department of Computer Science

University of Colorado, Colorado Springs

Technology in Computer Forensics

Author: Alicia Castro

Committee Members: Dr. C. Edward Chow

Dr. Jugal K. Kalita Dr. Xiaobo Zhou

Computer Forensics Facts

Computer forensics is about investigating digital evidence related to criminal or suspicious behavior where computers or computer and related equipment may or may not be the target.

Internet crime has increased 22.3% in 2009 over 2008.

Computer Forensic Background Digital evidence includes computer

generated records such as the output of computer programs and computer-stored records such as email messages

It is difficult to attribute certain computer activities to an individual especially in a multi-access environment.

Computer Forensics Legal Issues Understand fundamentals of:

Search and Seizure laws Electronic Communication Privacy Act Wiretap Statute Pen/Trap Statute Patriotic Act State Laws about Search and Seizure

Forensic Investigation

Accessories to a Crime

…Forensic Investigation

Accomplices of a Crime

Suspect

Utilities used with Nica Forensic Tool

IECacheView MozillaCacheView ChromeCacheView IEHV Outlook Redemption Microsoft Log Parser

Nica Forensic Tool uses external tools to help parse the cache files from IE, Mozilla Firefox and Google Chrome browsers and also to gain access and parse the Outlook .pst files

Nica Forensic tool functionality

Use the cache files parser information and determine what information is valuable.

Get cookies and history files of each web browser, Skype logs, Instant Messenger and Outlook logs.

Store information in a database Display any necessary output. Design of all GUI displays

Nica Forensic Tool

Unlike most the forensic tools, it finds all the users on the computer not just the logged on users.

Unlike similar forensic tools, it does not need the investigator to enter the path where the information would be found. Nica Forensic Tool does it for the investigator.

Nica Forensic Tool Design

Enter Case NumberCase DescriptionForensic InvestigatorNotes

Run the parser to find entries by activities. Note the time stamp for date that the investigation was done and also the times it takes to find all the activities

Timeline Viewer Report by user, date time and activities

Finding the Evidence

Selecting the Evidence

Displaying selected suspected activities

Evidence’s Classification

Inclusion Criteria More than one

activity Time between

activities is less than 15 minutes

Previous history of web sited visited

Exclusion Criteria One isolated

activity and no previously history

Two or more activities with time intervals of more than 15 minutes between each activity

Nica Forensic Tool Logic Flow Chart

Nica Forensic Tool Implementation Number of End Users = 6 (it can be

unlimited) Effects on change of task and

responsibilities of End Users: Tool is so portable, investigators can carry it

with them. It works so fast, that it can be run when a

suspect just moves away from his/her computer for a few minutes.

It is still a forensic tool, all the legal steps should be followed before trying to run the tool.

Nica Forensic Tool Limitations Forensic can be done only to computers

that are using the windows platform. Currently set to use the most popular

browsers, instant messengers, and Outlook email client but more can be added easily to the scalable architecture.

Conclusion

Only portable Forensic Tool that automatically looks for login paths and all user profiles

Capture relevant Evidence Easy to use Assist Investigators obtaining reliable

evidence

References

Please refer to Thesis Document http://cs.uccs.edu/~chow/master/acastro/doc/

MasterThesisV6.doc