Jawaharlal Nehru Technological University Hyderabad B.Tech IV COMPUTER FORENSICS Previous Question Paper (December - 2020 - R16)

Digital forensics is the systematic process of identifying, preserving, extracting, analyzing, and documenting digital evidence to be presented in a court of law. It plays a critical role in cybercrime investigations by transforming raw binary data into actionable intelligence.

The investigation process typically follows a structured lifecycle:

1. Identification and Seizure: Investigators identify potential digital sources of evidence, such as hard drives, mobile devices, or cloud storage. The primary goal is to secure the scene and ensure the integrity of the hardware, often using write-blockers to prevent any alteration of the original data.
2. Preservation and Imaging: A bit-stream image (a forensic duplicate) of the storage media is created. This ensures that the original evidence remains untouched while investigators work on the copy. Cryptographic hash functions, such as MD5 or SHA-256, are used to verify that the image is an exact replica of the original.
3. Analysis: Forensic tools are used to recover deleted files, analyze system logs, examine registry keys, and reconstruct user activities. This stage involves correlating timelines, identifying malware, and tracking unauthorized access or data exfiltration.
4. Reporting and Presentation: Findings are documented in a comprehensive report that details the methodology, tools used, and the evidence discovered. The report must be clear, objective, and legally sound to withstand scrutiny during judicial proceedings.

Digital forensics is used to address various cybercrimes, including:

• Unauthorized Access: Tracing IP addresses and login timestamps to identify intruders.
• Financial Fraud: Analyzing transaction logs and communication records to track illicit transfers.
• Intellectual Property Theft: Identifying the unauthorized copying or distribution of proprietary data.
• Malware Analysis: Reverse-engineering malicious code to understand its functionality and origin.

By maintaining a strict chain of custody, digital forensics ensures that evidence is admissible, reliable, and capable of proving the 'who, what, when, where, and how' of a cybercrime.

The initial response methodology is a critical phase in computer forensics designed to preserve evidence, ensure chain of custody, and prevent data loss during the immediate aftermath of a security incident. The primary activities involved in this methodology are as follows:

1. Preparation: Before an incident occurs, forensic teams must have established policies, tools, and trained personnel. This includes having a pre-configured forensic toolkit (e.g., write blockers, imaging software, and secure storage media) ready for deployment.
2. Identification and Verification: The first step upon incident notification is to confirm that an incident has actually occurred. This involves analyzing logs, system alerts, or user reports to determine the scope of the compromise and the systems affected.
3. Containment: Once an incident is verified, the goal is to limit further damage. This involves isolating affected systems from the network to prevent the spread of malware or unauthorized access, while being careful not to destroy volatile data (e.g., avoiding a hard power-off if RAM data is needed).
4. Collection and Preservation: This is the most critical technical phase. Investigators must collect evidence in a forensically sound manner, prioritizing volatile data (RAM, network connections, running processes) followed by non-volatile data (hard drives). All evidence must be hashed (e.g., MD5 or SHA-256) to ensure integrity.
5. Documentation and Chain of Custody: Every action taken must be meticulously documented. This includes recording the time, the individual performing the action, the tools used, and the state of the system. A strict chain of custody log is maintained to track the movement and handling of evidence from the scene to the laboratory to ensure it remains admissible in legal proceedings.
6. Initial Assessment: After securing the evidence, an initial analysis is performed to determine the nature of the attack, the potential impact, and the next steps for a full-scale forensic investigation.