Digital Forensics
Unit No. 1 Computer Forensics
When and how is computer forensics used, Guidelines for successful computer forensics, the stages
of a computer forensics examination, what issues do computer forensics examiners face? Risks in
Computer Forensics, Standard Procedure, Incident Verification, System identification, Recovery of
Erased and damaged data, Disk imaging and preservation, Data encryption and compression,
Forensic software.
Unit No. 2 Network & Internet Forensics
Overview of OSI Model, Introduction to NAT, Network Information-Gathering Tools, Monitoring User
Activity, Investigating Routers, Hacking Routers, SNORT, Analysis using Wireshark, , tcpdump,
Tracking Network Traffic, Reviewing Network Logs, Network Tracking Tools, Live Acquisition of
Network Traffic, Order of Volatility, Standard Procedure. Internet & World wide web threats, Domain
Name Ownership Investigation, Reconstructing Past Internet Activities and Events, Email Forensics:
E-mail Analysis, Email Forensics: Email Headers and Spoofing, Messenger Forensics: AOL, Yahoo,
MSN, and Chats, Browser Forensics: Analyzing Cache and Temporary Internet Files, Browser
Forensics: Cookie Storage and Analysis, Browser Forensics: Web Browsing Activity Reconstruction.
Unit No. 3 Forensic Investigation, Evidence Presentation and Legal aspects of Digital Forensics
Authorization to collect the evidence, Authentication of the evidence, Performing RAID Acquisition,
Remote Network Data Acquisition Tools, Validating Forensic Data, Analysis of the evidence,
Reporting on the findings, Testimony, Writing Investing Reports.
Definition of Cyber Crime in IT Act, Structure of IT Act, Adjudications and Criminal Provisions,
Tampering with computer source documents and Hacking, Online Obscenity & Pornography, Cyber
Stalking, Theft of Identity, Cyber Defamation, Admissibility of Digital Evidence.
Unit No. 4 Mobile & Memory Forensics, Steganography
Collecting and Analyzing Evidence, analyzing other Storage Devices, Digital Camera Forensics,
Recovering and Reconstructing Deleted Data, Introduction to Steganography, Steganography
Background, Steganography Functions, Robustness and Cryptography, Steganalysis, Image
Steganalysis, Digital Image and Audio- Audio Steganalysis, Video Steganalysis, Tools for
Steganography, Data Hiding, Data Hiding -Generic, Data Hiding and Steganography, Alternate Data
Stream (ADS), Data Recovery, Reasons for Data Recovery, Data recovery Chances, Data Recovery
Technique, Data Loss prevention, Specific Do’s and Don’ts in extracting data from Memory
Knowledge and usage of special and general purpose tools for Memory Forensics
Unit No. 5 Malware Analysis
Different types of malware, Analyzing Live Windows System for Malware, Analyzing Live Linux
System for Malware, Analyzing Physical and Process Memory Dumps for Malware, Discovering and
Extracting Malware from Windows Systems, Technical Analysis of malware from Digital Forensics
perspective, Discovering and Extracting Malware from Linux Systems, Rootkits and Rootkit
Detection and Recovery, Reverse Engineering Tools and Techniques, Reversing and Fuzzing of
malware from Digital Forensics perspective.
Lab Exercises –
1. Forensics with Autopsy
2. Packet Capturing with Wireshark
3. Packet Analysis With TCPDUMP
4. Reviewing Network logs
5. Analysis using Sysinternals Analysis using Knoppix
6. Live Acquisition Forensics
7. Data Recovery with Runtime Software (www.runtime.org) and R-Tools Technologies
8. Investigating the Reverse DNS
9. Investigating the Webserver Owner
10. Finding Information in Cookies
11. Examining Artifacts with E-mail Examiner
12. Examining Artifacts with EnCase
13. Examine E-mail Headers
14. Web browsing analysis using Pasco
15. Packet Capture using ProDiscover Investigator
16. hard drive diagnostics using HDDScan
17. Data Restoration with Office FIX
18. Simple LSB Steganalysis (LSB extraction) for bitmap images
