Desktop Forensics

What is forensics?

• Finding something

• application of science to criminal and civil investigations

• Science of using police

• IT science of security

What do Forensic scientists do?

• Connect to internet

• Design software applications

• Collect, preserve, and analyze scientific evidence

• Arrest IT criminals

Do all forensic scientists work in a lab?

• Yes

• No

What 2 tasks must be performed in order to complete forensic investigations thoroughly and securely?

• Confiscation of Devices

• Training Forensic scientists

• Arresting cybercriminals

• Reviewing Files & Settings

Desktop forensics is the investigation of computer systems and networks to identify evidence of cybercrimes.

• True

• False

What does it mean to 'Confiscate Devices'

• Taking custody of affected devices

• Locking devices

• Searching affected devices

• Marking affected devices

Why do we confiscate devices involved in a cyberattack?

• To make a point to the criminals

• To perform our investigation without contaminating evidence on the original device.

• To help cybercriminals escape

• To replace them with new ones

Why do we take a system image of confiscated devices?

• As a backup in case we damage the original device.

• So we can restore the device to its original state once the investigation is complete.

• To perform our investigation without contaminating evidence on the original device.

• We should never take a system image as it can corrupt the evidence.

Which of the following information is available from the system logs? (Choose 3)

• Login usernames and passwords.

• Web browser history.

• When the computer was turned on or off.

• Login times & dates.

What is live forensics?

• Where an investigation is current and ongoing.

• Where we perform our analysis on a system that has been restored from the image of an infected device.

• Where we investigate a computer unaffected by an attack to compare against the affected system.

• Where we perform our analysis on the original system while it is still running.