Digital Forensics Investigation And Analysis For Exotic Mountain Tour Service Company

Objective

In Exotic Mountain Tour Service Company partnership with superior bicycle and to identify the customer requirement. Through this analysis EMTS Company publish advertisement for its new product. Inappropriately, Bob Aspen employee of EMTS Company has stealing property of the new marketing information and retailing to another bicycle contender. Now this company in danger position and necessity to protect the advertising material. Now the manager of EMTS Company identified that the USB drive on the cabin of Bob. The task is to identify that drive contain information about EMTS or superior bicycle. The using of web server manager collect some exciting data that is web filter is activated during web based email is received. The web filter interfere uncompleted email that lead to Bob Aspen has tied up in this action.

The main objective is to identify the information contain in USB drive and who do this activity. It is determine by according to the manager idea that is wed filter. To rectify the problem and maintain the status of the company is another objective and then to recovery the data if it is possible. By using of email traffic travelling we have to detect the doubtful attachment and determine who send and receive the email. 

• Win hex
• Pro discover Basic
• Hex Workshop

It is a tool to investigative directly the digital broadcasting and after that various freeware which means usage at no economic cost and other branded tool were developed to investigate deprived of any change in media. In traditional tool are only used in computer but now used in mobile also. The available tools in the market Win hex, ProDiscover Basic, and Hex Workshop.

DFS:

The method are used to derive the scientific tools, they are collection, validation, analysis, identification and presentation. The digital source are most important for gathering the evidence.

• Law Enforcement
• Military
• Business and Industry

Digital Forensics Science: 

The DFS activities are naturally investigated by the following Process are given below:

• Identification
• Examination
• Analysis
• Decision

Three types of the DFS Analysis are given below:

• Media Analysis
• Code Analysis
• Network Analysis

Computer are mainly used to refer the Media. Media is the major parts of the Digital Forensics Science. Media analysis is the stored medium, it could be focused on the flash Memory and RAM. Media Analysis is also called as the network Analysis. Media data are analyzed to check the reliability. Identity theft is the crime activity which is done using media. Types of data acquisition raw format, proprietary format, advanced forensic format. Snapback Data Arrest, NTFI safe back, DIBS USA RAID  these are the other data acquisition tool.

• Acquire
• Authenticate
• Analyze 

Tools used for Digital Forensics

Taking a systematic Approach

In computer forensic first make an initial assessment about the type of care you are investing. Determine a general step you need to follow during investigation. Determine the approach to the case. Create a detailed evidence collection form and create a detailed check list. Determine the software you need .Identify the risk and list the number of problems you expect. Try to minimize the risk .Test the design information which collected from the digital forensics tools are tested and analyzed. Recover the digital evidence. Recover deleted files and damaged files. Investigate the data you recover from the digital forensic tools. Complete the case report. Write a detailed report what you found.

You need the following items

• Bit stream imaging tool -Win Hex
• ProDiscover basic software
• Evidence custody form to get the feed back
• Evidence folder  for the storage media
• Computer to store the collected evidence and evidence locker  

 Evidence collection  form must contains  number of the case, investigator name , investigation organization ,investigator personal details, Nature of case ,where the evidence was collected, Evidence description , vendor name and details , Model number of case  and serial number, Evidence recovery tools used, data and time of evidence collection .   

ProDiscover basic is a digital forensic tools provided by Technology pathways. ProDiscover basic is used to acquire, analyze and investigate data from several different file system. Before starting investigation you need to create tour work folder. Create two folders named Bop and bicycles. Connect the USB drive to your computer. Copy the folder into USB drive .Now delete those files.

Installing ProDiscover basic editio 

ProDiscover Basic tool used to acquires an image of the USB drive. When it’s completed, it displays a message to check the log file created during the acquisition. This log file contains extra and additional information if errors were identified during the data acquisition. ProDiscover also creates an SHA1 and MD5 hash output file. In digital forensic you need to recover data using tools like ProDiscover. 

Entering the keyword in search dialogue box

You need to select the Disk/Image you want to search in,  

Using this activity first forensics data acquisition is completed. Next, we have to learn how to locate Data in an acquisition. Then Start ProDiscover Basic, as you did in the previous activity.

If you want to create a new case file then, click File, click New Project from the menu.   

ProDiscover basic find the deleted file list. Deleted files are show with red color  

After analysing the evidance ,youneed to find the answer for the below questions

• How did Bob Aspen’s investigator acquire the disk?
• Did Bob Aspen perform the work on computer, which is his own computer? Is so did he conduct side business on his free hours?
• Did you retrive any  unrelated  files ?  How did you get the evidance ?
• Which company policy apply?

This the report obtained during investication.   

DFS Analysis

This is the basic structure of computer forensic  lab

Computer forensic lab structure  

Evidence collected during Investigation.  A typical inexpensive USB external connector  

Report contaisns detailed information of the incident and check the accuracy.Report  clearly say how the data is gathering the data and analysis report.report contains all information which is necessary to explain conclusion. Report contains rough draft and we need to revising the rough draft. Organizing the report. Report contains all the evidance which is saved in  a separate folders and need to be product that document. Computer forensic security is needed. First need to develop policy and procedure development.then we need to do evidence assesment it’s the key componet.its done on server, email , worksation and web history. After evidence collection we need to do evidence examination retrieving, coping, storing the evidence. After that we need to document the file. Document contains all the actions related to specific case should be stored in a secure place.  

Investicating Organisation: Exotic Mountain Tour Service (EMTS)

Investigator: Major at EMTS

Nature of the case:  conducting side business by releasing information about advertisement.

Location of the evidence: Bop’s cabin   

Type of evidence: USB drive and hard disk.

Operating system: Microsoft Windows 8.1.

Known disk format: FAT16.

Location of evidence: One USB drive and hard disk recovered from the employee’s assigned

Work station. 

Conclusion

Using digital forensic technology the hidden information are recovered. Digital Forensic mainly used for the purpose of data recovery. Major role of the Digital forensics is to investigation and analysis. Steganography tools and techniques are mainly used for the data hiding process. This tool is used to recover the hidden data or information from other file. We are using the two forensic tool. Hex editor and pro discover tool are mainly used to recover the encrypted data. These the tools are user friendly, it can be easily access to recover the data easily. The tool fetch the data converted into the hex decimal data, that data should be shifting using the above tool. Finally generated the original plain text. This tools are based on the source code. The pro discover basics tools are used to recover deleted and damaged information. 

References

Bashinski, J.  Review of: Techniques of Crime Scene Investigation, 7th edition, and Techniques of Crime Scene Investigation Interactive Training CD-ROM. Journal Of Forensic Sciences, 50(1), 1-1. doi: 10.1520/jfs2004351

Casey, E. (2007). Attacks against forensic analysis. Digital Investigation, 4(3-4), 105-106. Doi: 10.1016/j.diin.2008.01.001

Dudley-Gough, N. (2006). Digital Forensic Certification Board. Digital Investigation, 3(1), 7-8. doi: 10.1016/j.diin.2006.01.005

Forensic Evidence and Crime Scene Investigation. (2013). Journal Of Forensic Investigation, 01(02). Doi: 10.13188/2330-0396.1000004

Gabbay, E. (1998). Crime investigation. London: E. & J. Gabbay.

Hosmer, C. (2006). Discovering Hidden Evidence. Journal Of Digital Forensic Practice, 1(1), 47-56. doi: 10.1080/15567280500541447

Kanellis, P. (2006). Digital crime and forensic science in cyberspace. Hershey PA: Idea Group Pub.

Mistry, D. (2016). PLOUGHING IN RESOURCES: The investigation of farm attacks. South African Crime Quarterly, (6). Doi: 10.17159/2413-3108/2003/v0i6a1057

National Academy Press. (1996). the evaluation of forensic DNA evidence. Washington, D.C.

Nove, P. (1999). Fraud Investigation and Prosecution — the Way Forward. Journal Of Financial Crime, 6(4), 370-372. doi: 10.1108/eb025912.

Vacca, J. (2005). Computer forensics. Hingham, Mass.: Charles River Media.

Casey, E. (2007). Attacks against forensic analysis. Digital Investigation, 4(3-4), 105-106. doi: 10.1016/j.diin.2008.01.001

Chung, H., Park, J., Lee, S., & Kang, C. (2012). Digital forensic investigation of cloud storage services. Digital Investigation, 9(2), 81-95. doi: 10.1016/j.diin.2012.05.015

Deslauriers-Varin, N., & Beauregard, E. (2014). Consistency in crime site selection: An investigation of crime sites used by serial sex offenders across crime series. Journal Of Criminal Justice, 42(2), 123-133. doi: 10.1016/j.jcrimjus.2013.09.005

Roussev, V. (2011). An evaluation of forensic similarity hashes. Digital Investigation, 8, S34-S41. doi: 10.1016/j.diin.2011.05.005

Wilson, J. (2001). Riverboat Gambling and Crime in Indiana: An Empirical Investigation. Crime & Delinquency, 47(4), 610-640. doi: 10.1177/0011128701047004006