About
the Author

Mohsin
Baig is a Scottish writer who was born and raised in Glasgow (Ibrox) and has
over 15 years of professional IT working experience in the UK Investment
Banking, Retail Banking and IT Technology Consultancy services sector based in Canary
Wharf-London and in the North West of England. His academic achievements are
that, he has gained a Bachelor degree in Financial Services from Glasgow
Caledonian University, Executive MBA from the University of Strathclyde and a
Master’s degree in Computer Science from the University of Hertfordshire. In
his career as a technical contractor he has performed numerous the following
roles:  IT Business Analyst, Senior System Analyst, ETL Datwarehouse Analyst,
Data Architect, Solution Architect, System Architect, IT System Trainer and
Enterprise Architect with extensive project consultancy experience in the
following programs: IT System Transformation, Digital Banking Channels,
UK/European Payment Channels (SEPA, BACS, CHAPS), Electronic Trading Platforms (Forex,
Equities, Commodities), Data Migration, Network Infrastructure Decommissioning,

Mohsin
has delivered plausible technical architecture solutions to the following
financial services and consultancy clients: Merrill lynch Bank of America,
Barclays Wealth Management, Goldman Sachs, Lloyds International Banking,
Aldermore Bank, HSBC, Co-operative Bank, Tata Consultancy, Sopra Steria Group,
JP Morgan,

50
Reasons Collection books

The “50 Reasons”
is a series of books which is designed to provide detailed summaries about
topics which will give the reader a strong grasp of the essentials and core
fundamentals that are involved in the topic.

The “50 Reasons”
will provide further coverage on the following Book titles:

Strategic Analysis Techniques

Business Requirements Analysis

System Requirements Analysis

Data Requirement Analysis

Business Analysis Techniques

Enterprise Architecture Vision (TOGAF Phase A)

Business Architecture (TOGAF Phase B)

Information System Architecture (TOGAF Phase C)

Technology Architecture (TOGAF Phase D)

Certified Federal Enterprise Architecture (FEA)

Solution Architecture

Project Management

Portfolio Management

System Modelling

Network Architecture

Data Architecture

Security Architecture

Software Architecture & Design

Business Architecture

Cloud Design Fundamentals

Wireless Network Architecture

ITIL Service Strategy

Software Engineering

Business Process Modelling

Penetration Testing

Cyberwarfare

Cyber Security

SOAP Messaging

Who
is this book for?

Entry level and
experienced Solution Architects, Enterprise Architects, Integration Solution
Architects and Senior Management Technology professionals.

Network Security
Analysts, Forensic Analysts, IT Security Consultants, Security Practitioners

Strategic
Objectives of this Book

This book will help
you understand the following based on a fast track summary

Define the role of a Forensic Analyst with
regards to collating Digital Evidence, Symmetric
encryption, and Steganography

Define Cyber Forensic Elicitation
Techniques and methods that can be incorporated for Forensic Analysis,

Outline the Process of Firewall, Network,
Database and Port Communication Forensic Analysis

Define Social Media Technologies, Malware,
Data Recovery, Cryptology Analysis, Evidence
Management and Modern Cryptography

Outline the role of a Cyber Forensics Lab

Contents Page

Reason 1

Cyber Forensics

Reason 2

Cyber Investigation

Reason 3

Cyber Forensics Application

Reason 4

Forensic Working Principles

Reason 5

Cyber Forensics Domain

Reason 6

Evidence Management

Reason 7

Forensic Toolkits

Reason 8

Write Protected Storage Devices

Reason 9

USB Drives

Reason 10

Remote Devices

Reason 11

Evidence Tracking

Reason 12

Evidence Storage Locations

Reason 13

Military Guidelines

Reason 14

Digital Evidence

Reason 15

Forensics Evidence Gathering

Reason 16

Data Recovery

Reason 17

Data Carving

Reason 18

Diligence

Reason 19

Planning Quality Control

Reason 20

Forensic Analysis

Reason 21

Deleted Files

Reason 22

Cryptology Analysis

Reason 23

Modern Cryptography

Reason 24

Symmetric encryption

Reason 25

Steganography

Reason 26

Cryptanalysis

Reason 27

Traceability

Reason 28

Network forensics

Reason 29

Port Communication

Reason 30

Website Attacks

Reason 31

Firewall forensics

Reason 32

Network forensics

Reason 33

Forensic Analysts

Reason 34

Virtual Services

Reason 35

Forensic Analysts

Reason 36

Vmware Virtual Machines

Reason 37

Mobile Forensics

Reason 38

Network Categories

Reason 39

Operating Systems

Reason 40

Cell Phone Forensic

Reason 41

Forensic Data Analysis

Reason 42

Analyst Techniques

Reason 43

iPhone Analysis

Reason 44

Application Forensics

Reason 45

E-mail File Extensions

Reason 46

Database Forensics

Reason 47

Malware

Reason 48

Social Media Technologies

Reason 49

Electronic Discovery

Reason 50

Big Data

Reason 1

Cyber forensics refers to the process of
collating, analyzing, and consolidating scientific knowledge which can be served
as evidence to the courts. The forensics element largely focuses on the
recovery of latent evidence which is usually very diverse ranging from
fingerprints left on window to DNA evidence that could be retrieved in the
scenario where blood has been left on files within a hard drive,

Reason 2

The core objectives of cyber forensics to
identify the relevant scenarios with the view of validating what data has been
compromised and what has been done with the data. Consequently, this triggers
the fact finding and collating data investigation.

Reason 3

Cyber forensics can be used towards any physical
device which contains data such as smart phones, routers, printers, tablets, etc.

Reason 4

The following working principles are often
incorporated with regards to cyber forensics, ringfencing the scene, and
maintaining audit trail documentation from initial crime scene to the last
stages when evidence is presented towards legal proceedings. In view of Scientific
principles, cyber forensics entail establishing a hypothesis, testing the
hypothesis and documenting the results.

Reason 5

Cyber forensics involves the study of the
following knowledge areas:  Hardware, Hard drives, RAM, Operating Systems, File
and File Systems, Networks, Connection devices (Hub, Switch, router etc.), Data
Packets, IP addresses, MAC addresses, Network utilities,

Reason 6

Evidence Management is the process which is
characterized by collating detailed evidence, chain of custody, and management
of the investigation. Documenting Evidence is the step which involves detailing
all the relevant hardware, devices etc. that are connected to the crime scene.
Evidence preservation is performed through steps of integrity when evidence is
collated, which is guided by the principles of ensure that evidence is tampered
with or destroyed.

Reason 7

Forensic toolkits such as Access Data,
Guidance Software Encase are resources can enable investigators to create a
copy image of any disk, or storage device, that enables evidence to be
transferred.  This protects the integrity of the evidence and ensures the
original evidence isn’t tampered incidentally

Reason 8

Write protected storage devices play an
important role within evidence preservation which can be pursued via Hardware
or Hard drive disk controllers Write blockers devices which enable a drive to
be secured for forensic purposes.

Reason 9

Kanguru USB drive, Imation USB drive are
prominent devices which contain write protection features on the drives

Reason 10

Remote devices such as tablets, smartphones
etc. could still be accessed remotely, a Faraday cage is established to offset
any potential possibility of data being transmitted or deleted.  A Faraday cage
is a mesh of conducting materials which hinders all devices from sending any
data remotely from within the Cyber forensic labs.

Reason 11

Evidence tracking within a Cyber Forensics
lab could be performed in the following ways: Logs which are the basic form of
tracking and maintaining log evidence, software tracking via solutions such as
Evidence Tracker, ASAP Systems and Fusion RMS, Barcode tracking is another
popular method of evidence tracking and Radio Frequency ID (RFID) chops can
also be implemented which enable tracking of the exact location of the device
with evidence.

Reason 12

Evidence must be stored in locations which
have extensive protection against environmental hazards, inaccessible, secure
from electromagnetic interference.

Reason 13

The US Military provides the following
guidelines with regards to digital evidence storage; digital media evidence
should be kept in dust free temperature, humidity controlled. Evidence is not
kept near batteries, generators, electromagnets, magnets, chemicals and
periodic checks must be maintained at all times.

Reason 14

Digital Evidence should be divided into four
main categories: Database, Computer, Network and Mobile. Moreover, further
categories could also be Source, Format, and Type

Reason 15

Forensics Evidence can be elicited from the
following sources: hard drives, network traffic, memory, USB, File Systems, File
Format, File Types, Header Analysis,

Reason 16

Data Recovery is driven by physical damage
to the storage media or logical damage to the file that has become corrupt

Reason 17

Data Carving is the process of recovering
data from a disk which has been damaged or the file has become corrupt.
Prominent method of data recovery especially for scenarios where the file
metadata has been damaged. File and Metadata carving can be performed by the
following tool, Carver Recovery. Meta data entails eliciting data about the
file which is associated with when the file was created, modified and last
accessed. Metadata can be analyzed using tools such as Sleuth Kit. Known File
Filtering is a process which involves filtering out files that are known

Reason 18

Forensic evidence requires diligence and
surety that no evidence is lost, therefore it is important that some of the
following steps are performed before a Storage Media device is shut down:
Running Processes are checked from the Task Manager, Netstat command is
reviewed which depicts the network statistics and current connections,
Openfiles is reviewed to identify any open shared files and Net sessions to
evaluate if network communications are established and users are logged onto
the system

Reason 19

Planning and Quality control are essential
phases for the all forensic investigation analysis. The analysis would
typically entail collating the evidence, analyzing the evidence, validate all
findings, manage the evidence handling. Case notes and forensic reports and
expert reports must be created.

Reason 20

Hardware forensic analysis involves looking
at Hardware physical drives such as IDE, EIDE, PATA, SATA, which can be
partitioned into the following types: Primary partition, Active partition,
Extended Partition and Logical Partitions. It must be noted other non standard
partitions include Encrypted, Hidden partitions, Unallocated space and Slack
space. RAID levels are typically the following; RAID 0, RAID 1, RAID 3, 4, RAID
5, RAID 6, and RAID 1+0. Operating Systems comprise of the following types;
Multiuser, Multiprocessing, Multitasking, Multithreading. Hardware Interfaces
are also part of the forensic analysis and come in the following forms: USB,
Serial Ports, Communication Ports, Video Ports, Digital Visual Interface and
HDMI interfaces. Forensic Analysts must also be aware about the following File
types: JPEG, GIF, TIFF, EXIF, PNG, AFF, AFD, Encase Format, GfZIP, Compressed
files, ISO, DLL, EXE and data files-.dat, db, mdb, mdf and nsf.

Reason 21

Deleted files can be recovered using the
following types of Window tools: Diskdigger, WinUndelete, NTFS undelete,
Scrubbing Files. Files and hard drives can be encrypted using the following:
Encrypted File Systems (EFS), TrueCrypt,

Reason 22

Cryptology analysis, involves implementing
methods for encrypting and decrypting a message. Cryptography is the study of
methods to break cryptography.  The following are historical methods which can
provide a ground understanding in how historical cryptography works: Caesaer
Cipher, Multialphabet Substitution, ROT 13, Scytale, Vigenere Cipher,
Transposition Ciphers, Engima Machine,

Reason 23

Modern Cryptography can be broken down into
Symmetric and Asymmetric. Symmetric cryptography entails the same key being
used to decrypt a message as was used to encrypt it. However, with asymmetric
cryptography, the key used to encrypt a message cannot decrypt it, a second key
is a requirement, Symmetric cryptography can be further categorised into block
ciphers and stream ciphers. Block ciphers involve plain text being divided into
blocks (64 or 32 bits) and each block is encrypted.  Stream ciphers, plain text
is encrypted in a stream, one bit at a time. Modern ciphers incorporate binary
operations.

Reason 24

Symmetric encryption refers to the
following types of prominent methods: Data Encryption Standard, Feistel
Ciphers, Blowfish, Advanced Encryption Standard (AES), IDEA Encryption, GOST,
Serpent, SkipJack and RC 4. Asymmetric cryptography refers to the following
types of prominent methods: RSA, Diffie Hellman, Digital Signature Algorithm
and Elliptic Curve.

Reason 25

Steganography refers to the science where
hidden messages can only be interpenetrated by the sender and receiver within
video or sound files. The following tools are known for implementing
steganography: QuickStego, Invisible Secrets, MP3Stego, Stealth Files 4, Snow,
StegVideo,

Reason 26

Cryptanalysis involves breaking the
encryption in order to decrypt the message. Success criteria’s can be based on
the following criteria’s; total break, global deduction, instance(local)
deduction, information deduction, and distinguishing algorithm. The following
methods are commonly applied; Frequency Analysis, Kasiski, Known Plain Text
Attack, Chosen Plain Text Attack, Cipher Text Only, Related Key Attack,
Differential Cryptanalysis, Linear Cryptanalysis,

Reason 27

An attacker can hide there tracks through
log tampering, Log deletion, Auditor, WinZapper, Onion Routing, Spoofing,
Wiping and Tunneling

Reason 28

Network forensics involves packet analysis
where packets are often divided into header, data and footer. Packet sniffers
such as Wireshark, HTTP Sniffer can be used to intercept network traffic which
would enable you to view the packets. Nmap is a prominent port scanner which is
even used by hackers to scan networks. Moreover, Snort is also used as an open
source IDS and can perform packet sniffer functions, has the capacity to
operate in the following modes: sniffer, packet logger and network intrusion
detection.

Reason 29

Ports are critically important for types of
communication, the following are essential for network forensic analysis:  20
and 21 - FTP, 22 SSH and Secure FTP, 23 Telnet, 25 SMTP, 43 WhoIS, 53 DNS, 69
TFTP, 80 HTTP, 88, 110 POP3, 137-138-139-NetBIOS, 161/162 SNMP, 179 BGP, 194
IRC, 220 IMAP, 389 LDAP, 443 HTTPS, 445 Active Directory, 464 Kerberos Change
Password, 465 SMTP over SSL, 54320/54321 -B02K port, 6666-Beast Port,
43188-Timbuktu Port, 407-Timbuktu Port, 3389-Windows Remote Desktop,

Reason 30

Websites can experience attacks in the
following ways: SQL Injection, Parameter Tampering, Cross Site Scripting.
Networks can be attacked in the following ways: Denial of Service, Ping of
Death Attack, Teardrop Attack, SYN Flood Attacks and Smart Attacks.  Router
attacks can occur through router table poisoning and the following commands are
important for router forensics examinations: show version; show running-config;
showstartup-config, show IP router.

Reason 31

Firewall forensics can be performed by
looking at the firewall logs for any signs of an attack. Stateful packet
inspection (SPI) examine each and every packet, using protocol analysis
attackers can be identified,

Reason 32

Network forensics further involve looking
at the following logs: Windows logs via Administrative tools and event viewer,
Security log, Application log, System log, ForwardedEvents Log, Applications
and Services Log.

Reason 33

Forensic Analysts must be aware about the
different types of Virtual Systems which exist which range from the virtual
machine to the locally operating system and to the cloud based services.
Virtual machines enable a computer hard drive and RAM to be partitioned and
operate in Isolation, users are able to install multiple operating systems on a
virtual machine.  Virtual machines come in two categories: system virtual
machine which hosts a complete operating system, and process virtual machine
which operates on a single application to enable the application to be separate
from the rest of the operating system.  The Virtual machine architecture
consists of the following:  Physical machine which is the virtual machine known
as the host machine which also contains the host operating system. The virtual
machine is also referred to as the Guest machine. The hypervisor is an
essential component of all Virtual Machines which facilitate the guest machine
to host a virtual operating platform. Virtualizing software is required by the
Virtual Machine which plays the essential role of communicating with the
hardware. The virtualization process comprises of mapping resources such as the
virtual hard disk, and virtual memory to the actual hardware resources.

Reason 34

Forensic Analysts must be aware about
Virtual services from where forensic evidence can be collated.  Virtual services
consist of the following: Software as a Service (Application services provided
via web interface), Platform as a Service (Operating system provided via virtual
means), Infrastructure as a Service (Infrastructure Services such as virtual
servers, etc. are provided via virtual means)

Reason 35

Forensic analysts must be aware about the
different types of clouds such as Public, Private, Community, and how evidence
can be elicited from cloud services and systems. Evidence in the cloud could
exist within the following components: Virtual Storage, Audit Monitor,
Hypervisor and Logical network perimeter

Reason 36

Forensic analysts must be aware about the
following types of files which exist within a VMware Virtual Machines from
where forensic evidence can be elicited: .log files,. vmdk,.vmem, vmsn, .nvram,
vmx, vmss. Virtual PC files will comprise of the following types: .vhx, .bin
files, .xml files. Virtual box will comprise of the following files: vdi,
/config/virtualbox, .vbox

Reason 37

Forensic Analysts must be aware about
Mobile forensics and the types of devices/components that can contain forensic
evidence:  Subscriber Identity Module (SIM), International Mobile Subscriber
Identify (IMSI), Integrated Circuit Card Identification (ICCID), Electronic
Serial Number (ESN), International Mobile Equipment Identity (IMEI), Personal
Unlock Number (PUK), Public Switched Telephone Network (PSTN), Mobile Switching
Center (MSC), Base Transceiver Station (BTS), Home Location Register (HLR),
Vistor Location Register (VLR), Short Message Service (SMS),

Reason 38

Forensic analysts must be aware about the
following different types of Networks which can be used to elicit cell phone
forensic evidence from:  Global System for Mobile Communications (GSM)<
Enhanced Data Rates for GSM Evolution (EDGE), Universal Mobile
Telecommunications System (UMTS), Long Term Evolution (LTE), WiFi, Integrated Digitally
Enhanced Network (iDEN).

Reason 39

Forensic Analysts must be aware about the
following operating systems that can be used to elicit cell phone forensic
evidence: iOS, Android, Windows, Blackberry, Kindle, and Apps

Reason 40

Forensic Analysts can elicit the following
types of evidence from mobile devices via cell phone forensic: Cell phone
records, Photos and Videos, GPS records, Evidence from the Apps, Details of the
Phone, Call History, Network and GPS information. Moreover, analysts must be
aware about the following type states of a mobile device when data is
extracted: Nascent State/Factory Default State, Active State, Quiescent State
and Semi Active State.

Reason 41

Forensic Data Analysis is associated with
Digital forensics, which studies the structured data with regards to financial
crime activities and the intent of the analysis is to identify patterns and
behaviour which depict fraudulent activities.

Reason 42

Forensic Analysts can pursue the following
types of techniques when eliciting evidence from a cell phone: Logical
Acquisition (entails replicating the whole file system from device into another
file), Physical Acquistion (entails creating bit by bit copy of the file
system.  Paraben, Encase, Data Recovery, Oxygen, software’s are tools which can
be used to perform acquisition.

Reason 43

Forensic Analysts can pursue the following
types of iphone analysis:  Manual Extraction (physically viewing the data that is
held within the phone), Logical Extraction (Copying all files into a file),
Physical Extraction -most preferred method (Involves copying the phone data
storage on an incremental basis)

Reason 44

Application forensics entails e-mail
forensics, database forensics, files and web based application forensics.
Forensic Analysts must be aware about the following types of files which are
integral to the operating systems:  1) Registry which is divided into 5
sections: HKCR, HKCU, HKLM, HKLM, HKU, HCU 2) Network Adapters, 3) Windows Swap
File, 4) Index.dat, 5) Recent Documents,

Reason 45

Forensic Analysts must be aware about the
following e-mail client file extensions which contain data: .pst, .ost, mbx,
dbx, emi. File formats associated with e-mail server softwares are the
following: .edb, pub.edb, priv.edb, priv.stm, .nsf, .db, wphost.db, userxx.db.
E-mail evidence can also be collated from the Senders e-mail server, receiver
e-mail server, senders e-mail client, recievers e-mail client.

Reason 46

Forensic analysts must be aware about the
following technologies which are integral to Database forensics: Microsoft SQL
Server, Oracle, Microsoft Access, MySQL, NoSQL, PostGres.

Reason 47

Malware can take place in many forms such
as Trojan horses, spyware, rootkits, logic bombs, ransomware etc. Forensic
analysts must be aware about the different types of viruses which exist:
Armored Virus, Spare Infection Virus, Macro Virus, Multipartite Virus,
Polymorphic virus. Malware Forensic analysis can be pursued via Static Analysis
(process of studying a program) and Dynamic Analysis (involves studying the
program as it is executing). System Analysis tools for Windows such as
Procomon, RamMap, can provide detailed views of what is happening to the memory
and the processes which are running.

Reason 48

Forensic analysts must be aware about the
following types of existing and new Social media and other technologies which
will have a great impact on cyber security: Google Glass which is used for
recording videos, Cars now contain GPS Data, Medial Devices sending data via
wireless networks, Control Systems and Infrastructure, Online gaming, LInkedin,
Facebook,

Reason 49

Electronic discovery is the process which
involves producing evidence that is stored electronically and incorporates the
following steps: Identify, Collect, Reduce, Review, and Produce

Reason 50

Forensic analysts must be aware about Big
data which contains large amounts of data which is usually held on the Storage
Area Network (SAN) that consist of servers and network storage devices connected
via high speed cabling and switches. Performing forensic investigation on SAN
data requires a wide array of tools and techniques as data is most likely to be
spread across multiple storage devices.