What is ‘cyber forensics’, which is used in investigating various types of crimes?

 What is ‘cyber forensics’, which is used in investigating various types of crimes?

In today’s era, our life is incomplete without mobile phones, computers and the internet. But this technology has also increased the risks as much as it has provided convenience. From fraud on social media, banking hacking, character assassination to theft of confidential information, incidents of ‘cyber crimes’ are increasing day by day. To reach the perpetrators of such invisible crimes and bring them to justice, investigative agencies around the world, including the Nepal Police, use a powerful scientific weapon. Its name is – cyber forensics.

Cyber ​​forensics is the espionage of the digital world that reveals the truth by following the digital footprint of the crime. This article discusses cyber forensics.

What is cyber forensics?

Although many consider cyber forensics, digital forensics, and computer forensics to be the same, there are some differences between them:

Computer forensics: This is the method of investigating what happened on a computer.

Digital forensics: This is the investigation of computers as well as other digital devices such as mobiles, pen drives, and digital cameras.

Cyber ​​forensics: This is the broadest field. It covers every activity that occurs on digital devices as well as the Internet and cyberspace (virtual world).

In simple words, cyber forensics is the science of finding, collecting, preserving, and analyzing evidence from digital devices and the Internet used as evidence in any crime.

What can cyber forensics do?

Cyber ​​forensic experts make even the seemingly impossible possible by using special techniques:

Data recovery: Can recover files, photos, videos, chats, and emails that have been intentionally deleted from a computer or mobile.

Mobile research: Can bring back deleted SMS, call logs, contact numbers, and even recorded voices.

Activity detection: Can find out who used the Internet or computer system, at what time, and from which device.

Password cracking: In some cases, can break the password of an encrypted file or system.

Evidence from damaged devices: Can also extract data from crashed servers, failed hard disks, or formatted memory cards.

Historical development: How did it start?

The history of cyber forensics begins in the 1980s, when computers became accessible to the general public.

America: In the 1980s, the FBI in the United States launched the ‘Magnetic Media Program’. Michael Anderson of the FBI is considered the 'father of computer forensics'.

UK: In the UK, a computer crime unit was also established under the 'Fraud Squad'. It took institutional form after the 'Association of Chief Police Officers' (ACPO) created a guideline on digital evidence in 1998.

Today, this technology has become very sophisticated in countries like the US and the UK, where the government collaborates with private companies in investigating terrorism, human trafficking and organized crime.

How is the investigation done?

Cyber ​​forensics investigation is carried out according to a systematic process so that the credibility of the evidence is maintained.

1. Identification: Finding out where the evidence related to the crime is (computer, mobile, server) and in what form it is.

2. Preservation: Keeping the evidence found safe so that no one can delete or alter it. For this, an 'image' or exact copy of the evidence is made.

3. Analysis: Experts use special software and equipment to conduct an in-depth analysis of the evidence. Deleted data is recovered at this stage.

4. Documentation: A detailed report is prepared by including all the facts and conclusions obtained from the analysis.

5. Presentation: The report is presented as evidence in court, where experts interpret it.

Major Types of Cyber ​​Forensics

There are different branches of forensics according to the nature of the crime:

Disk Forensics: Examination of storage devices such as hard disks, pen drives.

Network Forensics: Monitoring and analysis of data traffic on the Internet.

Wireless Forensics: Investigation of wireless networks such as WiFi.

Database Forensics: Extracting and analyzing information from databases.

Malware Forensics: Identification and analysis of malicious software such as viruses, worms.

Email Forensics: Investigation of the source and content of suspicious emails.

Memory Forensics: Collection of evidence from the computer's temporary memory (RAM).

Mobile forensics: Detailed examination of mobile phones and tablets.

Digital DNA: A cutting-edge method for identifying criminals

Just as every person's fingerprints and DNA are different, so too is the way each person uses a computer or mobile (typing speed, mouse movement style, etc.). Based on this behavior, a unique 'digital DNA' is created for him. This cutting-edge technology can distinguish who used what even if many people use the same computer and help in reaching the real criminal.

Major tools used in investigation

Experts use various powerful software and tools for cyber investigation, such as:

Kali Linux: An operating system used for forensic and security testing.

EnCase: Professional software used to extract and analyze data from hard drives.

Ophcrack: A tool used to find Windows passwords.

Data Dumper : Helping to make an exact copy of a disk.

Challenges, Privacy and Misconceptions

As powerful as cyber forensics is, it also has its challenges and limitations.

Right to Privacy: Legal procedures (e.g., court permission) must be followed to ensure that an individual’s right to privacy is not violated during the investigation.

Encryption: If a criminal encrypts data with a strong password, it is very difficult and time-consuming to break it.

Jurisdiction: Internet crime is not limited to the borders of a single country. This creates legal complications in investigation and prosecution.

Common Misconceptions:

‘Data can be recovered from a burned or completely destroyed hard drive.’ - This is almost impossible. If new data is overwritten on the data, the old data cannot be recovered.

‘Any blurry photo can be made HD.’ - It is not as easy as it is shown in the movies. If the photo is really low quality, it cannot be miraculously improved. The degree of blurriness of the photo also makes a difference. However, the latest tools of artificial intelligence developed recently can remove the blurriness of the image to some extent. However, it is not true that AI creates real photos in the name of making HD.

In today's technology-based society, cyber forensics has become an indispensable part of crime investigation. It plays an important role in providing justice to the victims and punishing the criminals by scientifically and factually analyzing invisible and complex cyber crimes. Only the correct use of technology can make the digital world safer and cyber forensics is a strong step in that direction.