Lecture 1_Part_1 "Introduction to Digital Forensic" 2019-2020
Introduction to Digital Forensics
1.1 Forensics Science
Forensic science is a special branch of crime investigation that utilizes
scientific principles to support or negate نفيtheories surrounding the evidence
discovered at the scene of a crime مسرح الجريمة.
Forensic scientists analyze evidence gathered from crime scenes in order to
develop reasonable hypothesizes فرضبيات معقوله ومقبولةwhich led up تقودto discover
the evedents that prove how the crime happened.
The evidences ranges from images of child pornography صور االطفال ذات الطابع الجنسي
الفاضحto encrypted data considered as criminal activities. Even in investigations that
are not primarily electronic in nature ليس اساسا يكون ذات طابع الكترونيat some point in the
investigation computer files may be discovered and further analysis required.
1.2 Subdivisions of Forensic Science
Forensic science encompasses a broad spectrum of subdivisions تشتمل على طيف واسع من
الفروعin order to provide answers to questions of interest for the legal system. Due to
the large number of subdivisions within forensics, next sections will focus on some of
the divisions relating to criminal justice.
1- Computational مهم
Computational forensics defines as the branch of forensics where specialists can
accurately assess data اختبار البيانات بدقةusing computer software through the
development of algorithms to assist forensic examination.
1
Lecture 1_Part_1 "Introduction to Digital Forensic" 2019-2020
2- Digital مهم
digital forensics provides our legal system with a way to recover data from
electronic or digital devices.
االنواع التالية لالطالع فقط
3- Criminalistics
4- Anthropology
5- DNA Analysis
6- Psychology
7- Toxicology
Each division has a different purpose, but they all work together to analyze
evidence from a crime scene. The fingerprint analysts will determine which people
may have been in a certain area of the crime.
1.3 What Is Digital Forensic Science?
Because computer forensics is a new discipline )( فرع من فروع المعرفة, there is little
standardization معايير محددةand consistency التوافقacross the courts and industry. As a
result, it is not yet recognized as a formal “scientific” discipline.
Digital forensics can be defined as the process of interpreting electronic data for use
in a court of law. The goal of the process is to preserve حفظany evidence in its most
original form while performing a structured investigation اجراء تحقيق ممنهجby
collecting, identifying and validating يتحققthe digital information for the purpose of
reconstructing past events.
Another Defintion for the Computer forensics is the application of science and
engineering to the legal problem of digital evidence. This definition is NOT
eexplaining the term in deep.
2
Lecture 1_Part_1 "Introduction to Digital Forensic" 2019-2020
Digital forensics can be seen as a matter of looking at computer systems and
networks to determine who, what, when, where, how and why of things happening.
1.4 Why Computer Forensics is Important?
If you work as an information system and network administerator, you should
understand computer forensics. Why??
Computer forensics will help you ensure
1- The overall integrity
2- survivability of your network infrastructure.
You can help your organization if you consider computer forensics as a new basic
element in what is known as a “defense-in-depth” approach to network and computer
security. For instance, understanding the legal and technical aspects of computer
forensics will help you
1- capture vital information if your network is compromised
2- prosecute مقاضاةthe intruder (if he/she caught) اذا تم االمسك بهم.
What happens if you ignore computer forensics or practice it badly?
1- You risk destroying اتالفvital evidence ) أدلة مهمة (ذات تأثير كبيرor having
forensic evidence considered inadmissible غير مقبولin a court of law.
2- You or your organization may run afoul متعارضةwith new laws that mandate
( )تفوض او تأمرregulatory compliance التزامات تنظيميةand assign liability if
certain types of data are not adequately protected يتم حمايتها بصورة مالئمة.
Recent legislation in some countries makes it possible to hold organizations liable
in civil or criminal court if they fail to protect customer data.
ما هي عقوبة االفصاح عن معلومات االخرين بدون مواقتهم حسب القانون العراقي
3
Lecture 1_Part_1 "Introduction to Digital Forensic" 2019-2020
Digital Forensics can save organization money where managers usually allocating
a greater portion of their information technology budgets for computer and
network security. International Data Corporation (IDC) reported that the market for
intrusion-detection and vulnerability-assessment software will reach 1.45 billion dollars
in 2006. In increasing numbers, organizations are deploying network security devices
such as intrusion detection systems (IDS), firewalls to report the security status of
networks. All these devices and softwares are not achieve its purpose of there is no one
can do more investigation and help decition makes.
Two basic types of data are collected in computer forensics.
A- Persistent data: It is the data that is stored on a local hard drive (or
another medium) and preserved when the computer is turned off.
B- Volatile data: It is any data that is stored in memory, or exists in transit,
but got lost when the computer loses power or turned off. Volatile متطايرة
data resides تقعin registries, cache, and random access memory (RAM).
Since volatile data is ephemeral سريعة الزوال, it is essential مبدأ اساسيan
investigator knows reliable ways to capture it.
System administrators and security personnel must also have a basic
understanding of how routine computer and network administrative tasks
can affect both the forensic process (the potential admissibility of evidence
at court) and the subsequent ability to recover data that may be critical to
the identification and analysis of a security incident.
Q what is Defense in depth principle?
