- Cyber Security Forensics or Digital Forensics
has been a growing interest among many organizations
and individuals.
And this is due to the large number
of breaches during the last few years, right? So,
many folks choose digital forensics as a career path
in law enforcement and corporate investigations as well.
So, during the last few years
there have been an advent of many technologies
and forensic processes that are designed
to meet the growing number of cases
relying on digital evidence, right? So,
there's a shortage of well trained experienced personnel
that are experts in cyber security forensics.
Cyber security forensics practitioners are at a crossroads
in terms of changes, affecting evidence recovery
and also management.
Forensics evidence is actually used
to be brought into courts, right?
The courts of law.
And this is why it is extremely important
for digital forensic experts to collect
and maintain reliable evidence and a good analysis,
that's actually done of their findings, right? So,
also there's a huge increase in cyber crime
that has increased the need for enhanced
information security management, right? So.
It also requires forensics experts to
help remediate the network and affect the systems.
And also try to reveal who was the responsible threat actor.
Right? So, this is actually often called
threat actor attribution.
Now, desktops, laptops, mobile devices, servers
firewall logs, any type of logs
from networking infrastructure devices,
are rich information of evidentiary.
So, that can be value for evidence
that can assist forensics experts
in reconstructing the attack
and also gaining an understanding
on the threat actor, responsible for the attack.
There are 3 categories for cybersecurity investigations.
The first one is public investigations
which is actually resolving the court of law.
The second one is private investigation
which corporate investigations is an example of
and then also individual
which is actually often in the form of e-discovery.
In addition to cyber crime and cyber attacks,
evidence found on a system or in a network in this case,
may actually be presented in a court of law
to support accusations of crime
or civil action, right?
And this is a listing here that I'm including
but it is actually not limited to just this, right? So.
Examples of this civil actions or even crimes
are extortion, domestic violence, fraud.
That includes money laundering and theft
drug related crimes, murder, and acts of violence,
pedophilia, and cyber stalking, cyber attacks and terrorism.
And of course the list goes on around, right? So
Usually criminal investigations
and prosecutions involve government agencies that work
within the framework of the criminal law, right? So,
cyber security forensics practitioners are expected to
provide evidence that may help the court make their decision
in the investigative case, right? So,
also practitioners must constantly be aware
and comply with regulations
and laws during the case examination
and also the evidence presentation as well.
Right? So, now it is important to know
that the factors that maybe detrimental
to the disclosure of evidence,
that will actually challenge the validity of that evidence,
Right? So, if anything actually change
in the evidence per se, I mean of course,
it may not be able to actually be presented in court.
Now, digital forensics evidence is information
in digital form found in a huge range
of endpoint server and network devices, right.
And basically, digital evidence is
any information that can be processed
by a computing device
or store in any media, right?
A digital media.
So, evidence tender in legal cases includes
things like criminal trials like we mentioned before,
or, you know, cyber attacks or a breach.
All these evidence is actually classified
as witness testimony or direct evidence.
There's also another category of indirect evidence
in the forms of an object, such as a physical document
the property owned by persons and you know, so on, so forth.
Cyber security forensics evidence can take many forms
depending on the conditions of each case
and the devices from where that evidence
was actually collected.
There are 3 general types of evidence, right? So.
The first one is best evidence.
The second one is corroborating evidence
and the third one is indirect or circumstantial evidence.
Right? So, historically, the term best evidence
refers to the evidence that can be presented
in a court of law...
in a court of law, in the original form.
However, of course in cyber forensics, data photography
and things like copy machines,
computer storage, cloud storage,
you may ask "so what is actually the original," right? So.
Typically, properly collected system images,
you know, and appropriate copies of files
can be used in court in that case, right? So
So again, that's one of the differences
whenever we actually refer to or historically refer to,
to best evidence, right? So
In this case, the original form, can be of course
a properly collected copy of that original evidence, right?
So, System image for example.
Now corroborating evidence or corroboration
is evidence that tends to support a theory
or an assumption deduced from
some initial evidence, right? So,
this corroborating evidence,
it confirms the proposition in the law,
in the court of a law, right? So.
Now indirect or circumstantial evidence relies
on a extrapolation to a conclusion of fact,
that includes things like a fingerprint, right? Or
DNA evidence collected from a subject, right?
Now, this of course is actually a lot different
than direct evidence, right? So,
direct evidence supports the truth
of an proclamation without the need
of additional evidence or interpretation, right? So.
Forensic evidence provided by an expert witness
is typically considered as circumstantial evidence,
Right? So, indirect or circumstantial evidence
is actually often used in a civil
or criminal cases lacking of direct evidence, right? So,
if you don't have direct evidence you may actually
recur to indirect or circumstantial evidence, right? So.
Digital information stored
in electronic database in audit logs
That are of course, computer generated.
And that does not contain information generated by humans
has been challenged in the past, right?
In some court trials, right? So,
law enforcement and courts can also demand proof
that the creation and also the storage
of evidence records are actually part
of the organization's business activities.
Right? So, that is actually very important.
And throughout this course
you will learn how to handle detailed evidence
which is actually really important that you preserve
the evidence to be valid in a court of law.