Digital Forensik-21: Muhammad Ridho

Summary

This presentation on digital forensics covers essential concepts such as crime scene investigation (TKP), evidence collection, and the analysis of digital devices. Topics include removable media, storage devices, mobile phones, and data protection from networks. The script also explains techniques like static and live forensics, order of volatility in evidence collection, and the use of photography to document evidence at crime scenes. Through practical examples, the presentation illustrates how forensic experts use these tools and methods to uncover digital evidence, ensuring data integrity for criminal investigations and legal proceedings.

Takeaways

• 😀 Digital forensics is the study of investigating and analyzing digital devices, primarily for criminal investigations, and has evolved since the 1970s.
• 😀 The 'Place of Incident' (TKP) refers to where a crime occurred and where evidence is gathered, emphasizing the importance of preserving digital evidence in its original form.
• 😀 Digital forensics includes two main types: static forensics, where data is analyzed from powered-off devices, and live forensics, where data is collected from powered-on devices.
• 😀 Removable media such as USB drives, CDs, and DVDs are crucial for transferring data between devices and are commonly analyzed in criminal investigations for evidence.
• 😀 Removable storage media like external hard drives are used to store large amounts of data and can be key in investigating crimes like illegal file sharing or data theft.
• 😀 Mobile devices (phones, tablets) are important sources of digital evidence, storing messages, call logs, GPS data, and media files, which can be used in investigations.
• 😀 Protecting mobile devices from networks during forensic analysis is crucial to prevent data modification or loss during the investigation process.
• 😀 The principle of 'Order of Volatility' dictates the sequence of data collection, prioritizing the most volatile data (such as RAM and network traffic) before powering down devices.
• 😀 Digital forensics involves careful documentation of devices and their surroundings using photography, which helps maintain the integrity of the evidence and aids in reconstructing the crime.
• 😀 Real-world examples like data theft via USB drives, pirated content distribution, and narcotics trafficking using mobile phones highlight the practical application of digital forensics techniques.

Q & A

What is digital forensics?

Digital forensics is the branch of forensic science that deals with the identification, collection, preservation, and analysis of digital evidence. It is often used in criminal investigations to gather information related to cybercrimes or other criminal activities involving digital devices.

What are the two main types of digital forensics mentioned in the script?

The two main types of digital forensics mentioned in the script are static forensics and live forensics. Static forensics involves analyzing data from powered-off devices, while live forensics involves collecting data from active, running devices.

How does static forensics work?

Static forensics involves analyzing data from a device that is powered off. In this process, investigators focus on storage devices such as hard drives and ensure that the data is not altered during examination. A bit-by-bit image of the storage device is often created for analysis.

What is live forensics, and when is it typically used?

Live forensics refers to the process of collecting data from devices that are still running. This is especially useful when investigating active network breaches or when investigators need to gather information about the device's state before it is turned off, such as in the case of encrypted hard drives or running programs.

What are removable media, and how are they used in digital forensics?

Removable media are storage devices that can be easily connected or removed from a computer without shutting down the system. Examples include USB drives, DVDs, and SD cards. In digital forensics, these media are often analyzed to recover files, documents, multimedia, or other data related to a crime.

Can you give an example of a case involving removable media?

An example case involves an employee using a USB drive to steal confidential company data. Forensic investigators analyzed the USB drive to verify if any data was stolen, recovering deleted files and tracking any attempts to remove evidence.

What is the role of mobile devices in digital forensics?

Mobile devices, such as smartphones, store a vast amount of digital evidence, including call logs, text messages, GPS data, and multimedia files. In digital forensics, investigators extract and analyze this data to uncover communications, locations, and other evidence related to a criminal investigation.

What is the concept of 'Order of Volatility' in digital forensics?

The 'Order of Volatility' refers to the principle of prioritizing the collection of the most volatile data first. Volatile data is information that can be quickly lost or altered, such as data stored in RAM or CPU registers. Investigators prioritize these data types before powering down the device to preserve evidence.

How is photography used in digital forensics?

Photography in digital forensics is used to document the crime scene and the position of digital devices before they are moved or tampered with. This provides a visual record that can assist in reconstructing the events during the investigation and helps maintain the integrity of evidence.

What happens in a case where a server has been compromised in a cyberattack?

In a case where a server has been compromised, forensic investigators prioritize collecting volatile data such as RAM and CPU registers before the server is powered down. This helps preserve evidence of the methods used by the attacker, including IP addresses and traces of malicious activity.