Jawaharlal Nehru Technological University Hyderabad B.Tech IV COMPUTER FORENSICS Previous Question Paper (March - 2021 - R15)

Professional forensic methodology ensures that digital evidence is collected, preserved, and analyzed in a manner that is legally admissible, repeatable, and scientifically sound. The primary benefits include maintaining the integrity of evidence, preventing spoliation, establishing a clear chain of custody, and ensuring that findings can withstand scrutiny in a court of law.

Computer forensics specialists typically follow these systematic steps:

1. Identification: Determining the scope of the investigation and identifying potential sources of digital evidence.
2. Preservation: Securing the scene and isolating the digital media to prevent unauthorized access or data modification.
3. Collection: Creating bit-stream images of the original media using write-blocking hardware to ensure the original data remains unaltered.
4. Examination: Using specialized tools to extract, recover, and analyze data, including hidden, deleted, or encrypted files.
5. Analysis: Interpreting the extracted data to reconstruct events and answer investigative questions.
6. Reporting: Documenting the entire process, findings, and conclusions in a clear, objective report suitable for legal proceedings.

Controlling contamination is critical in computer forensics to prevent the introduction of extraneous data or the alteration of existing evidence during the investigation process. Contamination can occur through accidental user interaction, software execution, or hardware failure.

Key strategies for controlling contamination include:

• Use of Write Blockers: Hardware or software write-blocking devices must be used during the acquisition phase to prevent the operating system or forensic tools from writing data to the original evidence media.
• Working on Copies: All analysis must be performed on a bit-stream image or a clone of the original media, never on the original evidence itself.
• Verification via Hashing: Cryptographic hash functions, such as MD5 or SHA-256, are calculated for the original evidence and the forensic copy. Matching hashes prove that the copy is an exact, unaltered replica.
• Environment Control: Maintaining a secure, logged environment where only authorized personnel have access to the evidence.
• Chain of Custody: Maintaining a rigorous log that documents every person who handled the evidence, the time, the location, and the purpose, ensuring no gaps exist where contamination could have occurred.