JAWAHARLAL NEHRU TECHNOLOGICAL UNIVERSITY HYDERABAD B.Tech IV Year CYBER FORENSICS Previous Question Paper (July/August - 2022 - R18)

In the context of cybercrime, a computer can play three distinct roles: as a target, as an instrument, or as a repository of evidence.

1. Computer as a Target: The computer or network is the primary victim of the attack. This includes unauthorized access, denial-of-service (DoS) attacks, malware infections, and data theft aimed at compromising the integrity, availability, or confidentiality of the system.

2. Computer as an Instrument: The computer is used as a tool to facilitate or commit a crime. Examples include using a computer to conduct phishing, distribute illegal content, engage in cyberstalking, or perform financial fraud. The computer is the means by which the perpetrator achieves their criminal objective.

3. Computer as a Repository of Evidence: The computer acts as a storage device for digital evidence related to a crime, whether physical or cyber-related. This includes logs, emails, documents, or images that provide proof of criminal activity, even if the crime itself did not involve a computer directly.

The initial response phase is critical for preserving digital evidence and ensuring the integrity of the investigation. The primary activities include:

• Securing the Scene: Ensure the physical safety of the environment and prevent unauthorized access to the computer systems. This involves cordoning off the area and documenting everyone present.
• Documentation: Carefully record the state of the system, including taking photographs of the screen, physical connections, and the surrounding environment. Maintain a detailed log of all actions taken.
• Identification and Collection: Identify all relevant hardware, storage media, and network devices. Determine the volatile (RAM) versus non-volatile data and decide on the appropriate order of collection based on the volatility order.
• Preservation: Create bit-stream images of the storage media to ensure the original data remains unaltered. Use cryptographic hashing (e.g., MD5 or SHA-256) to verify that the forensic image is an exact replica of the original evidence.
• Chain of Custody: Establish and maintain a rigorous chain of custody log, documenting who handled the evidence, when, where, and why, to ensure its admissibility in a court of law.