Transcription
Proceedings of the 2nd International Conference on Computer Science and Electronics Engineering (ICCSEE 2013)Research On Some Relevant Problems in Computer ForensicsYongquan Wang 1, 2Henry C. Lee 21. Department of Information Science and TechnologyEast China University of Political Science and LawShanghai 201620, P. R. Chinae-mail: wangyongquan@ecupl.edu.cn2. The Henry C. Lee Institute of Forensic ScienceUniversity of New HavenCT 06516, U. S. Ae-mail: hlee@newhaven.eduAbstract—In order to effectively combat and control thecybercrime, the crucial precondition to solve those problems isto study how to quickly and efficiently collect evidences whichcan be accorded with legal requirements. From the features ofcomputer forensics and Based on the thought, theory andmethod of traditional crime scene investigation, this paper hasmade a thorough thinking, research and analysis on computerforensics and its relevant problems involved in it, such as thelaw, the theory, the technology and the procedure rule bycombining law and technology. At last, the future direction ofcomputer forensics has been presented. That will be benefit tothe justice practice and the development of theory andtechnology of computer forensics.Keywords-computer forensics; black box; law; technology;procedure ruleI.INTRODUCTIONWith the rapid development of information technologiesand wide use of computer networks, computer forensics hasbecome an active research area due to increasingly criminalactivities in communication networks and informationsecurity.According to the 30th Statistical Survey Report onInternet Development in China [1], as of 30 June 2012, thenumber of Internet users has reached 538 million along withan increase of 39.9% in the use of Internet. We have alsowitnessed an explosive growth in the number of blog usersfrom over 63 million in 31 December 2010 to more than 353million with an about increasing rate of 560.3%. Ecommerce activities such as online shopping and networktransaction such as online bank and online paying have alsoexpanded rapidly. Network applications such as instantmessaging, search engines, business transactions, onlinemusic, online news, online video, and micro-blog have alsobecome the major interests of Internet users. Therefore, thereis an increasing demand on Internet and network applications.In USA, more than 90% large enterprises and 80% smallmedium enterprises use Internet for business transaction.Computers and networks have become an important part ofsocial and economic life.Computer and network crimes such as attacks caused bycomputer virus or Trojan, network Infringement disputes,network frauds, online pornography and gambling are gettingworse because of the wide penetration of computers andInternet which leads to tremendous economic loss andincreasingly prominent social problems.Recent years, with the appearance and promotion of thenew technologies such as the Internet of things, cloudcomputing and the confusion of the three networks, thetechnologies of computer network are improving. At thesame time, computer (cyber) crimes are presented with newvariations with characteristics of difficulties of discovering,capturing, proving and controlling.To solve these civil disputes or fight with the criminalactivities in computer communication networks, we willneed to find adequate, reliable and convincing evidence.Computer-related crime cases usually play three roles the target of hacking, crime tools and criminal informationstorage [2], with each case having a large amount of dataretained in computers and their peripherals. It is of vitalimportant to find the evidence of a crime case using relevanttechniques and methods. Therefore the research on computerforensics related to criminal activities in communicationnetworks is receiving more and more attention in theinterdisciplinary field of computer and law. Currently,computer forensics has many definitions. We argue thatcomputer forensics is a process of finding evidence fromcomputer systems to prove the existence of an objective factmaking use of computer related technologies and approaches.Computer evidence refers to computer materials and theirderivatives which can be used as evidence against criminalactivities. It is related to electronic evidence but they are notequally equivalent. In most cases, computer evidence isdifferent from the electronic evidence in the extension, dueto the reason that mechanical computer, optical computer,bio computer based evidence can only be used as electronicevidence with an equivalent function. In addition, computerevidence is different from electronic evidence in the aspectof content. For example, the fixed telephone is a moderncommunication means which builds on semiconductortechnology using analog electronics. The recorded materialsbelong to electronic evidence but not computer evidence.Electronic technology made of modern communication tools,it recorded telephone information on electronic evidence arenot part of computer evidence. Although computer evidencediffers from electronic evidence in the aspects of connotationand extension of the concept, we normally do not differentiaethem. We can follow a standardization approach to specifythe complete or partial evidence type. This paper uses theword of computer forensics and presents in depth an analysisand an exploration on criminal activities in communicationnetworks based on forensics tools or software being used.Published by Atlantis Press, Paris, France. the authors1564
Proceedings of the 2nd International Conference on Computer Science and Electronics Engineering (ICCSEE 2013)In order to effectively combat and control the computercrime or cybercrime, the crucial precondition to solve thoseproblems is to study how to quickly and efficiently collectevidences which can be accorded with legal requirements.From the features of computer forensics and Based on thethought, theory and method of traditional crime sceneinvestigation, this paper has made a thorough thinking,research and analysis on computer forensics and relevantproblems involved in it, such as the law, the theory, thetechnology and the procedure rule by combining law andtechnology. That will be benefit to the justice practice andthe development of theory and technology of computerforensics.II.THE LEGAL ISSUES OF COMPUTR FORENSICSThe legal issues of computer forensics main focus on thefollowing three topics: computer crime, computer forensics,the subject and procedure of computer forensics, andelectronic evidence.A. Implications of Computer crime and computer forensicsComputer crime refers to the severe act against societywhich endangers the order of the computer industry, violatesthe laws and regulations for the protections of computersoftware and information security system, infringes the rightsand interests of obliges, and other acts who severely posesdangers to society, it is usually a covert, cross-border actimplemented by intelligent, anonymous criminals with lowcost but high loss to the society. It involves a wide range ofinteresting, it is difficult to let the victims to startproceedings [3-5].Computer forensics refers to the process of verifying,protecting, extracting and documenting the electronicevidences in computer and related equipment which shouldbe reliable, persuasive and sufficient enough to be acceptedby the count. Compared with the traditional crime sceneinvestigation and evidence, Because computer data isvulnerable to tampering, forgery and deletion, in order tomake electronic data be collected as evidence, its probativeforce must be strengthened to ensure that, in its generation,storage and delivery process it should maintain its originality,credibility and integrity, and the continuity of the evidence,so as to be accepted by court. To meet these requirements,the following points must be paid attention to in the processof computer forensics: (1) Do not analysis the original datadirectly. (2) The software for data analysis must be ensuredto be safe and credible. (3) Analysis of the data should havedigital signature before analyzing the data. (4) It is necessaryto describe in detail and file the damaged computers,including the original state and surrounding environment ofdamaged computer system, analysis methods, the specificoperation, results and the result of analysis. (5) It must bebacked up after the analysis is complete each time. (6) Theevidence obtained must be preserved properly to prevent itfrom being damaged, altered, which causes it to lose thelegal effect. The common forensics technology includes:monitoring technology for electronic evidence, physicalevidence, and access to technology, electronic evidencecollection and preservation of electronic evidence handlingand identification techniques, electronic evidenceexamination and submission technology and so on.B. Problems of the main body of computer forensics andprocedure lawBecause of the high requirements of electronic evidencecollection techniques, the main body of computer forensicsneeds to have some computer knowledge and to follow strictstandards and procedures in the process of forensics [6, 7]. Incomputer forensics, we need to delegate or to employ aparticular group of electronic technical experts or computerexperts to assist in evidence collection. In criminalproceedings, the evidence given by electronics expert orcomputer expert needs to be under the guidance of theinvestigators or the network police.For the program of computer forensics, electronicevidence obtaining should follow the principle of fairness,voluntariness and truth, and the parties shall not trespasscomputer information system to obtain evidence. If theevidence is provided by a third party, the third party shouldbe issued to ensure that the evidence generated or receivedmust always maintain the original state and that he willprovide documents of evidence of digital signaturevoluntarily. Due to the fact that it is difficult to obtain otherevidences for the parties, the burden of proof in disputes dueto the infringement shall be borne by the tortfeasor. There aremany ways to obtain evidence, but they must be in the formof legislation, which offers procedures and authority toobtain electronic evidence. In particular, when asking for anitem of evidence from the ISP, professional networkcompanies or a data company, one should strictly abide bythe confidentiality agreement and the terms of service signedwith the customers because it is not allowed to discloseusers’ personal information and usurp the privacy materialsand confidential information in the name of litigation needs.Electronic evidence collection, application and determinationshould undergone a process of improvement andstandardization gradually, which depends on thedevelopment and promotion of technology to a large extent.Therefore, the legislation should advance with flexibility,and not develop the terms with large quantity. At the sametime, we should have to note a harmful tendency: aselectronic evidence is both invisible and destructive, wedemand harsh requirements for electronic evidence. It seemsthat all the electronic evidence can only be counted asindirect evidence and that we cannot ensure its credibilityunless it is in complete safety. But this incline should not betaken. In fact, virtually any kind of evidence can be forged,altered and destroyed, and any traditional evidence has thethreats of loss and the difficulty of reproduction. With regardto selection and recognition of the evidence, each contractorhas different levels of using of the principle of freeevaluation of evidence, so the law should set too manyobstacles for judicial officials to judge the evidence.C. Legal issues of electronic evidenceElectronic evidence, also known as computer forensics,computer data evidence, documentary evidence, generallyrefers to that, in the process of computer crime, evidence isPublished by Atlantis Press, Paris, France. the authors1565
Proceedings of the 2nd International Conference on Computer Science and Electronics Engineering (ICCSEE 2013)physically stored within the computer system memory toprove the computer crime. Compared with traditional typesof evidence, it is accurate, fragile, perishable, concealed,complex, diverse and easy to diffuse. In addition to that,electronic evidence collection is rapid to collect, easy to store,taking up little space with great capacity, transmission andconvenient transportation. It can be reproduced, with simpleapplication and operation.Concerning electronic evidence eligibility, the hearsayrule and the best evidence rule hinder the electronic evidenceto be admitted into evidence in common law, but countriesmake the evidence qualifications by extending the originalconnotation and replacement of the original method.Countries in continental law system generally require it toprovide original evidence. Provisions in many countries ofcontinental law system are relatively broad and generalprinciples recognize the electronic evidence. Procedure lawsof China holds that “facts that prove the real situation of thecase are all evidence” and this general provision offers thespace and the legal basis for the use of electronic evidence inlitigation. Therefore, whether the electronic evidence can beevidence is not so controversial in China.We can also use positive identification method to provethe power of electronic evidence, i.e., to start fromidentifying the evidence itself, or the other side of evidence.We review the following aspects using the positive methodsto find the probative force of electronic evidence: (1) Thegeneration of electronic evidence; (2) The storage ofelectronic evidence; (3) The transmission of electronicevidence; (4) Electronic evidence collection; (5) Whether theelectronic evidence has been deleted. Positive method provesthe power of electronic evidence based on the identificationof the ordinary evidence principles. However, due to the factthat electronic evidence is vulnerability, easy to be altered,increased and deleted, which is often difficult to detect, it isunrealistic to have the integrity of electronic evidence frombeing tampered, increased and excision. Then we must usethe presumption to ensure the integrity of electronic evidence.Of course, the defence can research on the electronicevidence in computer crime and its rules of evidence todebate.For the position of the electronic evidence, this subjectidentities it as independent types of evidence. The reason isthat it is different from the audio-visual materials, thetraditional evidence and the mixed evidence.In making the electronic evidence into the audio-visualmaterials, we need to expand the interpretation of audiovisual materials, and to break the boundaries of audio-visualmaterials on the evidence of the tapes, video tapes and so on;In addition, the electronic evidence is expressed in binarydata to a digital signal, which the other kind of evidence doesnot possess. Finally, the position of the audio-visualmaterials in the law of evidence is limited. At best, it is a toolfor confirming the parties’ statements, evidence, and so on.Therefore, we believe that bringing electronic evidence intoaudio-visual materials simply will limit its effectiveness ofevidence, and it is not conducive to the facts of the case.Electronic evidence should also not be included in thetraditional documentary evidence. First, it is difficult for theelectronic evidence’s long-term storage and safety.Electronic evidence in computer and network may beexposed to viruses, hacker attacks, misuse, and also be easilydamaged or eliminated, while the traditional documentaryevidence do not have these troubles; Secondly, electronicevidence can not be read directly and its access andtransmission depends on the support of modern informationtechnology service system. If there is no appropriate ITequipment, it is difficult to see the fact that the evidencereflected upon, and the extraction of electronic evidence ismuch more demanding than traditional documentaryevidence; finally, although the content recorded in thetradition documentary evidence is also easy to be changed, asin judicial practice, there have been many situations that theparties change or add the contents of the documentaryevidence for self-interest, the electronic evidence stored inthe computer is more convenient for the correction,modification or supplement of a variety of data, even if thedata encrypted has the possibility to be decrypted.Electronic evidence is different from the mixed evidence.For mixed evidence, we believe that the mixed evidence isopen to question for the classification. First, the informationstored in a disk and CD-ROM is not the objective existencefor its own property, the external characteristics or existenceto prove the case. Therefore, the disk or CD-ROM is not theevidence; Secondly, using computer for simulating crime todetermine the possibility of a crime is not the record ofinspection; Finally, the evidence from computer and itstesting system must be divided into two parts.Because the standards and methods for reviewingelectronic evidence are different from the traditional ones,the rules and methods for collection, extraction, applicationrules and preservation of electronic evidence are differentfrom the traditional ones. Only by giving electronic evidenceindependent legal status, can it provide effective protectionfor the sound and orderly development of the application ofinformation technology for e-commerce.III.THE TECHNICAL AND THEORETICAL QUESTIONS OFCOMPUTER FORENSICSThis part, we investigate the technical methods andmodels, then propose a computer forensic black box systemmodel.A. Technical methods of computer forensics Forensic Technologies based on Algorithms andSoftware Analysis. (1) Cryptography. In many cases,computer forensics needs to deal with the problemson how to decrypt the encrypted data. Currentlythere are a number of encryption and decryptionalgorithms and relevant tools. The cryptographictechniques and methods used in computer forensicsmainly include: ① Cryptanalysis: The technologyrequires that a password forensic expert havespecialized knowledge in the field of cryptography.It is worth noting that the existing software tools arenot practically applied. ② Password crackingtechniques: These include passwords dictionary, keyPublished by Atlantis Press, Paris, France. the authors1566
Proceedings of the 2nd International Conference on Computer Science and Electronics Engineering (ICCSEE 2013) guessing,brute-forcetechniques.Passworddictionary is generally based on software and thereare a variety of dictionaries available. Manydictionary-based password cracking softwarepackages are available with a relatively highcracking rate. For example, AOPR is such a crackingtool dedicated to Office files. ③Password search:These include physical search in the physicalenvironment around the computer, logical search inthe documents of computer systems, and networkeavesdropping in email messages and networkenvironments. ④ Password extraction: In general,many of the Windows passwords are in plain textform and stored in the registry or other designatedplaces. Therefore, passwords can be extracted fromthe registry files. ⑤ Password recovery: Usingpassword recovery mechanism, password can beobtained from the system administrator. (2) DataMining Technology. Data mining is a decisionsupport process, mainly based on artificialintelligence (AI), machine learning, statisticaltechniques and methods, highly automated analysisof massive amounts of data obtained, and theinductive reasoning. In this way, knowledge can beobtained to predict the behaviour trends of theanalyzed objects which can help decision-makers ormanagers to adjust strategies to make the rightdecisions. Data mining is highly valuable inanalyzing criminal behaviours. The criminal patterns,trends, and the associations among criminalbehaviours can be found by designing high qualitydata mining algorithms to analyse large amounts ofhistorical criminal records which are stored in datawarehouses and maintained in a consistent way. Theobtained knowledge is of value to police and judicialdepartments.Hardware-based Forensics. (1) Data RecoveryTechnology. Data recovery technology is primarilyused to recover the data from the deleted files andformatted disk of the suspects. Disk formatting onlyre-organizes the entries to file systems. Data will stillbe available if it is stored before disk formatting.Disk formatting will create a new blank index tablelinks with unallocated data blocks. The operation ofdeleting files does not permanently remove the filesfrom disk, but put the data blocks back into the filesystem which is invisible for normal read and writeoperations. Therefore, we can use popular andpromising forensic software tools such as TCT andENCASE to recover data. Based on optics principles,these tools recovers data by analyzing the refraction,spectral radiation and diffraction. Many companiesprovide such data recovery services such as Ontrackcompany and Ibas laboratory. (2) ComputerForensics Chip Design. It is understood that amongthe products in computer forensics in China, the"forensics machine" produced by the ComputingCenter of the Institute of High Energy Physics, Chinese Academy of Sciences can detect the waysthat hackers intrude and produce analysis reportswhich can be used as legal evidence. In addition, thedetection box of computer evidence mainlydeveloped by Xiamen Meiya Pico Information Co.Ltd. in Xiamen city, China, has the functions such asevidence extraction, cracking, analysis and recovery.Many forensic tools are also available in othercountries, notably TCT and EnCase. TCT cananalyze the activities of the running machines in realtime and capture the current state information.EnCase is a product that is recognized by the U.S.government for computer forensics. EnCase is anintegrated forensics application based on Windowsinterfaces. Its features include data browsing, search,disk browsing, creation of evidence files, savingcases. Among the existing computer forensics tools,hardware based products are mainly focused on theaspects of "data erase forensics interface of harddisk", "hard disk data cloning" and "networkmonitoring", whereas software products are mainlyon "file content browsing (text and images)", "textsearch using keywords", "undelete ", "drive imaging(copying the full storage space bit by bit). Currentlythere are no uniform standards and specificationsthat forensics tools can follow in the study ofcomputer and network related crimes. It is thereforehard for users to compare the effectiveness andreliability of these tools. To this end, Brain Carrierproposed to use open source tools to ensure thereliability of the forensics tools [8]. Although thereliability can be improved through the testing workcontributed by many researchers, the ownerships andinterests of these tools have to be reflected.Forensics based on Tightly Coupled Hardware andSoftware. (1) Post-Event based Static Analysis.Regardless of the roles that computer crimes playlike "hacker intruder", "crime tool" or "criminalinformation storage", a large amount of crimerelated data will be left in the computer and itsperipheral equipment. Therefore, this data can beobtained through static analysis (i.e. static computerforensics which is also referred to as computerforensic) to be used as the evidence of litigation. Thenature of static analysis is that it considers computeras a crime scene, and analyzes the criminalbehaviours in network communications in the formof forensic anatomy and also conducts a detailedanalysis on the data stored in various computingmedias. In this way, the important data and reportsassociated with the facts can be obtained. Post-eventbased static analysis includes two stages: " physicalevidence acquisition" and "information discovery".The former refers to the process that investigatorssearch for relevant computer hardware at computercrime or intrusion scene and keep it for investigation.The latter searches for evidence from the originaldata including files and logs which can be used tosupport the associated facts or refute them. SimilarPublished by Atlantis Press, Paris, France. the authors1567
Proceedings of the 2nd International Conference on Computer Science and Electronics Engineering (ICCSEE 2013)to other evidence, computer evidence or electronicevidence must be true, reliable, complete andcomplies with relevant laws and regulations andjudicial procedures. It should be pointed out thatphysical evidence acquisition is the basis of thewhole forensics process. When obtaining physicalevidence, the most important thing is to ensure thatthe evidence obtained is original without anydamage. It is extremely difficult to find all therelevant data as computer crime evidence may existin the system log, data files, hidden files, registers,swap buffer, user process memory, stack, file buffers,the file system itself, free disk space, the printerbuffer, network data buffer, and the counter location.To this end, trade-offs have to be made through athorough analysis and judgement. In static computerforensics, information discovery comes afterphysical evidence has been obtained. Computercrime cases have different requirements oninformation discovery. Some cases only need the keydocuments, pictures or email messages, while othersmight need to reproduce the details of the workhappened. Unless there are special needs, undernormal circumstances, information discovery is aprocess that makes a physical copy of the originaldata with an aim to protect the original data.Typically, forensics experts also use MD5 algorithmto summarize the data in the original evidence andkeep the evidence and the summary in a safe place.Considering the files that contain evidence of acrime may have been deleted, data recovery isneeded to recover the key files, communicationrecords and other clues. In the mean time, thisprocess also facilitates acquisition of file attributesand document processing. After data is recovered,forensics experts should carefully conduct queriesbased on keywords, analysis, analyze file attributesand digital summary, search for system logs, decryptdocuments, access Windows swap buffers. Theresults of information discovery largely depends onforensics experts' experience and wisdom due to thelack of tools for comprehensive data analysis. Thisrequires that a qualified forensics personnel musthave a profound understanding of informationsystems with an expertise in computer architecture,operating systems, distributed computing, databasetheory and applications, network architecture andprotocols. In this way, forensics experts can producecomprehensive reports based on the results ofinformation discovery which will become animportant basis in against crime. (2) Pre-EventPrediction and dynamic Detection. With thepopularity and penetration of network applications, itis difficult to use static analysis which is mainly usedfor standalone computer forensics to detect andacquire evidence in real time to meet the growingnumber of cyber crimes. To minimize the defects ofpassive firewall technologies and intrusiondetections, forensics can be conducted via pre-eventprediction and dynamic detection method referred toas dynamic computer forensics (DCF). DCFincorporates forensics technology into firewallsystems, intrusion detection systems and honeypotsto dynamically detect all the possible computercrimes in communication networks, capture data inreal-time and analyze the intentions of intruders.DCF takes effective measures to cut off the networkconnections or to induce the intruders to providemore information. In this way, as much as possibledata can be obtained and analyzed with a saferunning of the system. It can be noted that DCF canproduce complete and true evidence. In the meantime, it can also analyze the means and motivationsof crimes for right decisions which triggers relevantfirewall and detection systems to action on intrusions.This facilitates the interactions between computerforensics, firewall and detections systems. Throughsystem self structure changes and backup strategies,all the aspects in the communication network can beprotected which leads to an integrated securityinfrastructure. DCF can record the working status ofthe system especially the whole process of hackerintrusion. It can capture and analyze the intrusionbehaviours through which self defence strategies canbe generated. DCF mainly involves the stages ion, preservation of evidence and evidencesubmission as following in detail [9]. ① DataAcquisition: The volume of data in data acquisitionphase is very large and data is updated from time totime, (e.g. on a daily basis, millions of event recordsmay be generated on a Web). This kind of dataincludes system logs, logs related to firewall, FTP,WWW, and anti-virus software, system audit records,network traffic monitoring, the relevant operatingsystem (such as the Windows operating system) andthe hidden files or temporary files of databases,database operation records, hard drive swap, slackdata and free buffers, software configuration data;script files, Web browser data buffers; e-mail; realtime chat records, bookmarks, history records orsession logs. For the acquisition of these massivedata, the network data can be obtained via adedicated hardware. The core idea is to set thenetwork card to promiscuous mode in order tomonitor the data passing through the networksegment. The header of every packet received willbe analyzed and matched with certain rules. Thematched data will be stored in network data files.Unmatched data will be discarded. In general,network data files are stored in a binary format basedon time intervals for subsequent analysis. ②DataAnalysis: In the data acquisition stage, the use ofdata acquisition software (technology) to coll
computer forensics is a process of finding evidence from computer systems to prove the existence of an objective fact making use of computer related technologies and approaches. Computer evidence refers to computer materials and their d
