POWERPOINT

Cyber Security Fundamentals
1506140
Digital Forensics
Digital forensics definition
 Digital forensics is a branch of forensic science that uses scientific

knowledge for collecting, analyzing, documenting, and presenting
digital evidence related to computer crime for using it in a court of law.
The ultimate goal is knowing what was done, when it was done, and who
did it.
 Under this wider definition, digital forensics is also responsible for
investigating nearly all cyberattacks against computerized systems like
ransomware, phishing, distributed denial-of-service (DDoS) attacks, data
breach, and other related cyberattacks that can cause commercial or
reputation loss
Digital Forensics Goals
1. Finding legal evidence in computing devices and preserving its integrity in a way that is
considered acceptable in a court of law.
2. Preserving and recovering evidence following court-accepted

technical procedures.
3. Attributing an action to its initiator.
4. Identifying data leaks within an organization.
5. Accessing possible damage occurring during a data breach.
6. Presenting the results in a formal report suitable to be presented

in court.
Cybercrime
 Cybercrime includes any illegal activity committed using a type of

computing device or computer networks such as the Internet.
 Example of Cybercrime.
 Malware Distribution
 Ransomware Distribution
 Hacking
 Phishing
 Identity Theft
 DDoS Attacks
 Social Engineering
Digital Forensics Categories
1. Computer Forensics
 This is the oldest type of digital forensics; it is

concerned with investigating digital evidence found
on desktop computers, on laptops, on digital storage
devices (like external hard drives, thumb drives, and
SD cards), and in random access memory (RAM), in
addition to operating systems and installed
application traces and their associated logs. The main
activity of this type is recovering deleted data from the
target device’s storage and analyzing it for incriminating
or exonerating evidence.
2. Mobile Forensics
 Mobile forensics is a type of digital forensics concerned

with acquiring digital evidence from mobile devices.
Mobile devices include any computing device (such as
phones, smartphones, tablets, and wearable devices such
as smart watches) able to make phone calls using
standard communication networks like GSM, 3G, 4G,
and so on. Such a device is usually location aware,
meaning that it has a built-in GPS or similar satellite
positioning system. The spread of mobile technology
among users globally make mobile forensics the most
used branch among other digital forensics types
3. Network Forensics.
 This type of digital forensics is concerned with
monitoring and analyzing traffic flow in computer
networks to extract incriminating evidence (e.g.,
discovering the source of security attacks) or to
detect intrusions. Data flow through networks can
be captured as a mass in real time and stored for
later analysis or analyzed in real time with an
option to save only segments of interesting events
for further offline analysis (this option require less
storage space). Network forensics deals with
volatile (live) data only, unlike other digital
forensics types.
4. Database Forensics.
 Database forensics is concerned with the

analysis of data and metadata existing
within a database such as Microsoft SQL
Server, Oracle, MySQL, and others.
Database forensics looks for who accesses
a database and what actions are performed
to help uncover malicious activities
conducted therein.
Forensics Readiness
 Forensics readiness is about the ability of a particular

organization to collect, preserve, protect, and analyze digital
evidence in a forensically sound manner. The process should
proceed without disrupting current operations to minimize
investigation cost.
The Importance of Forensic Readiness for Organizations
1. High response to incidents with digital evidence.
2. Compliance with government-applied regulations.
3. Strengthening organizational security defense.
4. Minimizing internal attacks.
5. Increasing an organization’s security posture .

POWERPOINT

Uploaded by

Copyright:

Available Formats

POWERPOINT

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

POWERPOINT

Uploaded by

Copyright:

Available Formats

Cyber Security Fundamentals

 Digital forensics is a branch of forensic science that uses scientific

2. Preserving and recovering evidence following court-accepted

3. Attributing an action to its initiator.

4. Identifying data leaks within an organization.

5. Accessing possible damage occurring during a data breach.

6. Presenting the results in a formal report suitable to be presented

 Cybercrime includes any illegal activity committed using a type of

 This is the oldest type of digital forensics; it is

 Mobile forensics is a type of digital forensics concerned

 Database forensics is concerned with the

 Forensics readiness is about the ability of a particular

1. High response to incidents with digital evidence.

2. Compliance with government-applied regulations.

3. Strengthening organizational security defense.

4. Minimizing internal attacks.

5. Increasing an organization’s security posture .

You might also like