According to digital devices involved in an investigation, particularly from the technical point of the investigation computer forensics includes several sub-branches, and following are some of the its most well-known branches:
1.File System Forensics
Data on a physical medium, such as a hard drive or flash drive, is organized, labeled, and governed by a file system; FAT, NTFS, and EXT are the most commonly used file systems, but there are many more, and it is also possible that a suspect could have created their own file system, in order to complicate an investigation.
File System Forensics is generally used for discovering the locations of files that are more useful as evidence than the file system itself; however, the presence of a custom file system, as well as the presence of anomalies in the locations of data (namely, data existing where it shouldn’t), are
usually proof of immoral activities.
2. Memory forensics
This term refers to the application of forensic techniques on any/all volatile memory, which includes RAM, caches (of all levels), and registers (not to be confused with registries). Memory forensics must be performed during live analysis, because the contents of volatile memory are permanently lost when the system is shut down.
3. Operating System Forensics
Logfile analysis is a major part of operating system forensics, because logfile formats differ wildly between operating systems.
To perform operating system forensics, the investigator must have deep and thorough knowledge of multiple operating systems, as well as the ability to understand the meaning of logs generated by different operating systems.
4.Multimedia Forensics
Multimedia forensics refers to the application of computer forensics techniques on files that contain more audio/visual data than text, such as sound recordings, music files, videos, and pictures. There are many possible cases where multimedia files would be useful as evidence: Pirated music files, sound and video recordings of crimes, and illegal pornographic images, are all some examples.
5. Network Forensics
IP Tracing and Network Traffic Monitoring are the major components of Network Forensics. The main objective is to look for evidence of illegal activities that involve a transfer of files or information.
It is important to note that while most applications of Network Forensics make use of the Internet, LANs, local ad-hoc networks, and emulated network connections between virtual
machines (VMs) and their host machines, can all be analyzed with the same techniques.
The analysis of social media accounts could be considered a combination of Network and Multimedia Forensics, depending on which techniques are used.
6.Database Forensics
Databases are, understandably, full of different types of information. The data can be investigated for its malicious uses, or to determine how/whether some legitimate data was stolen or deleted. Sometimes, the database itself is valuable information as well as the relations between tables in the database can reveal important details of how, for example, a criminal organization, is structured.
7.Malware Forensics
Malware Forensics refers to the reverse engineering of malware, but also covers the detection of existing or possible malware.
One of the most immediately useful approaches is to use a goat file (named so because the file is a scapegoat, sacrificed for the benefit of the investigator). Goat files are designed to make it very easy for an investigator to see how malware modifies the
file once it is infected.
8.Mobile Device Forensics
Today’s mobile devices are basically smaller computers, having their own operating systems, and usually serving a specialized purpose. All of the above forensics types and more are applicable to Mobile Device Forensics.
Some mobile devices use proprietary operating systems, such as iOS, Windows Mobile while others are built on open source systems, such as Android; an investigator would need to know all of them to be effective in the field.
9.E-mail Forensics
A lot of information can be found in even the most ordinary emails. Malicious people can harvest
email addresses (both sender and receiver) and begin spamming these accounts in the hopes of phishing them, or propagating malware; IP addresses can obtained as part of a recon mission, aiding the attacker in visualizing how the network is constructed; headers contain a plethora of information that is just as useful to a hacker, and these factors are all present even before considering the content of an email, a leakage of which could have any variety of consequences in the real world.
Emails are just as useful to forensic investigators however, as they can be analyzed to discover details about the sender and his/her motives, and even submitted as court evidence.
10. Firewall Forensics
Firewalls are used to grant or restrict access based on a set of rules defined by the administrator. They are designed to be a first line of defense against information theft and cyber attacks, and as such, are forensic-friendly.
Firewalls keep extremely detailed activity logs, which can be mined for data. Because of this, log file analysis is a big part of firewall forensics. Firewall logs contain information about programs that attempted to access information, the information that was requested, the user account or IP address requesting the information, and the port it was requested on (among other things).
All of this information can be useful in detecting an attack and discovering details about it, which can not only be used to create defenses against future attacks, but may even identify the party responsible.
Leave a Reply