COMPUTER FORENSIC

Introduction

1.1 Background of the study

Digital forensics is a rapidly developing field that continues to evolve, both in practice and in research. Technology continues to advance, as does the sophistication of anti-forensics techniques, which forces digital forensics researchers and practitioners to adapt. Moreover, rules for admissibility are becoming more stringent because the legal community is continuing to better understand technology and digital forensics. The legal community is requiring that digital forensics become more scientifically rigorous, much like traditional forensics. Digital forensics is still in its infancy, especially when compared to other areas of forensic science. The term “computer forensics” was first defined in 1991 by the International Association of Computer Investigative Specialists (IACIS) and the term has since evolved into “digital forensics” to encompass all digital media. Various U.S. government agencies have performed digital forensics since the mid-1980s; the FBI’s Computer Analysis and Response Team (CART), for instance, was formed in 1984.

Computer forensics is around for a while and is rapidly becoming a specialized and accepted investigative technique with its own tools and legal precedents that validate the discipline. The domain of computer forensics is not to assign guilt or innocence but rather to find facts in the form of electronic evidence that can be presented in a coherent way so that others may weigh the evidence and then assign guilt or innocence where appropriate.
The goal of cyber forensics is to examine digital media in a sound manner to identify, recover, analyze and present facts and opinions about the information. Forensics, and, more generically, Computer Security Incident Response (CSIR), is an important part of cyber security. It operates on the corrective or repressive side of security, i.e. it comes into play after a security breach has occurred and attempts either to correct the problem as quickly as possible, or to find evidence to be able to identify and prosecute the culprit [6]. The aim of Cyber forensics is not to prevent the crime as and when it happens, but to identify the victim and criminal after the attack or incident occurs in the system or in the network, analyze it in depth and record it for further reference.

Computer forensics can be defined as “the application of computer investigation and analysis techniques in the interests of determining potential legal evidence”. David Bennett states that legal evidence might be sought constitute a wide range of computer crimes or misuses such as child pornography, use of abusive languages, audio or video, including theft of trade secrets, theft of or destruction of intellectual property and fraud. Computer specialists have many ways of discovering data that reside in a computer system, or of recovering deleted, encrypted, or damaged file information. So, the key question is: what is the most effective way to collect the evidence of a digital crime. Usually digital evidences are the event logs generated by application software as well as operating system software. In modern Operating Systems, even a privileged application process will be running in a restricted virtual environment and Operating System will make sure that an application has minimal knowledge of any other application process or, in general, about the host system. So, naturally, evidence data as event logs generated by such application processes lacks the overall system perspective. The data discovered is important in forensic analysis and in solving various computer crimes through proper log or record preservation which leads to profiling.

With the enactment of the evidence Act of 2011, and Cybercrime Acts of 2015 by the government of the federal republic of Nigeria, it now becomes imperative that computer forensics professionals be trained in other to protect the National Cyberspace from National cyber security threats such as malicious hacking, cybercrime, cyber terrorism, espionage and cyber scam just to mention but a few. The dynamism of computer and digital devices, such as computer, mobile phones et cetera, and their attaining rapid evolution make it difficult to detect, track, retrieve, process and report digital evidence vital in cracking cybercriminals and cybercrime cases.

However, the responsibility of securing the Nigerian cyber space rests on the ability of computer forensics examiners to carry out thorough investigation with the purpose of curbing and reducing cybercrime to its lowest ebb hence fostering National security. This can only be achieved if a robust education backbone and framework is put in place to educate and train computer forensics professionals at all levels and positions. This paper aims at highlighting the implications, and impact of promoting computer forensics education on Nigeria national security.
Organizations are increasingly reliant upon information systems for almost every facet of their operations. As a result, there are legal, contractual, regulatory, security and operational reasons why this reliance often translates into a need to conduct digital forensic investigations (Rowlingson, 2004). However, conducting digital forensic investigations and collecting digital evidence is a specialized and challenging task exacerbated by the increased complexity of corporate environments, diversity of computing platforms, and large-scale digitisation of businesses (Taylor et al., 2010). There is agreement in both professional and academic literature that in order for organizations to meet this challenge, they must develop ‘digital forensic readiness’ − the proactive capability to collect, analyse and preserve digital information (Grobler et al. 2010). Unfortunately, although digital forensic readiness (DFR) is becoming a legal and regulatory requirement in many jurisdictions in the western world, studies show that most organizations especially in Australia have not developed a significant capability in this domain (e.g. The Australian Institute of Criminology reports that less than 2% of Australian organizations have a plan for digital forensics, see AIC (2009)).

A key issue facing organizations intending to develop a forensic readiness capability is the lack of comprehensive and coherent guidance on how forensic readiness can be achieved in both the professional and academic literature (Mouhtaropoulos, Li, & Grobler, 2014). A review of the literature conducted as part of this study found that the academic and professional discourse in forensic readiness is fragmented and dispersed in that it does not build cumulatively on prior knowledge (Elyas et al. 2014). Further, there is a lack of maturity in the discourse that is rooted in the reliance on informal definitions of key terms and concepts. For example, there is little discussion and understanding of the key organizational factors that contribute to forensic readiness, the relationships between these factors and the precise definitions including the scope and boundaries of these factors. Importantly, there is no collective agreement on the primary motivating factors for organizations to becoming forensically ready (Elyas et al., 2014).

This chapter aims to give an understanding of the need for computer forensics, statement of problem, aims and objectives, significance of the study, scope of the study and definition of terms.

1.2 Statement of problem

Due to rapid evolution of the Information Technology, now almost everything is computerized or electronic based such as e-Banking, eLearning, e-Commerce etc. Due to busy schedules, people always need easy and short ways to do their day today activities using technology. As a result, computer or cybercrimes reported as the second most crime in the world recently.

According to the 19th CEO survey reported that 32% of organizations affected and 34% think they will be affected in the next two years. Most companies are still not adequately prepared for or even understand the risks faced. Only 37% of organizations have a cyber incident response plan. 61% of CEOs are concerned about cyber security but less than half of board members request information about their organization’s state of cyber-readiness.

Palmer (2001) defined computer forensic investigation as the application of scientific, systematic and proven methods towards the preservation, collection, validation, identification, analysis, interpretation and presentation of digital evidence derived from digital sources for the purpose of facilitating or furthering the reconstruction of events found to be criminal or perceived to anticipate the unauthorised actions shown to be disruptive to planned operations. By this definition, it is important to demonstrate proofs of the integrity of digital crime object. Digital forensic investigators are constantly trying to find better and more efficient ways of uncovering evidence from digital sources. The challenge here is that beyond the presumptions of the occurrence of a crime, it is important to prove the integrity of the source of digital evidence. Law enforcement and corporate professionals require tools for effective digital evidence acquisition and analysis.

According to (Rogers and Seigfried, 2004) cyber crime challenges are technical challenges that hinder law enforcement’s ability to find and prosecute criminals operating online, legal challenges resulting from laws and legal tools needed to investigate cyber crime being unable to catch up with developing technological, structural, social changes and the resource challenge. Some of these tools already exist to capture, preserve and analyse data from hard drives, memory and network streams. They are available through commercial or open-source licences with their own unique user interface, features, and run on different operating systems. However, this presents a challenge to digital investigators because tools, systems and networks are vulnerable to threats or attacks. Therefore, this study sought to examine computer forensics; it’s application, implication and uses.

1.3 Aims and objectives of the study

Main aim

The main aim of the research is to examine thoroughly the application of computer forensics and its implications to national security.

Specific objectives

The specific objectives include:

1. To develop a background understanding of computer forensics.
2. To determine the state of computer forensics education in Nigeria.
3. To examine the current issues and trends around computer forensics.
4. To identify the implication of computer forensics to National security in Nigeria.
5. To examine the application of computer forensics.

1.4 Scope of the study

This study examines computer forensics. The study focuses on national security in Nigeria as a whole.

1.5 Significance of the research work

The past decade has seen previously unimagined advances in technology, and although those developments have benefited individuals and businesses alike, they have also become tools for fraudsters and cyber criminals to steal money and data, and avoid detection.

This study is particularly useful in tracing the path of an advanced persistent threat (APT) which uses a variety of tricks and tools to achieve its ends. APTs are highly targeted, and usually stay undetected on the victim’s network for months, performing reconnaissance and exfiltrating data. Computer forensics also helps to trace these attacks and discover what motivated them.

Security professionals routinely use such tools to analyze network intrusions− not to convict the attacker but to understand how the perpetrator gained access and to plug the hole. Data recovery firms rely on similar tools to resurrect files from drives that have been inadvertently reformatted or damaged.

Computer forensics is necessary for law enforcement and investigation, but also has applications in commercial, private, or institutional organizations. All activity conducted on an individual’s computer systems as well as on a company network leaves computer traces, which can range from web browser history caches and cookies, all the way to document metadata, deleted file fragments, email headers, process logs, and backup files.

This study is also significant to teachers, students, scholars and practitioners within the scope of the educational sector as it will serve as a material guide for further research in related topics.

1.6 Definition of terms

Computer forensics:

Computer forensics is a branch of digital forensic science pertaining to evidence found in computers and digital storage media. The goal of computer forensics is to examine digital media in a forensically sound manner with the aim of identifying, preserving, recovering, analyzing and presenting facts and opinions about the digital information.

Computer:

A computer is a machine that can be instructed to carry out sequences of arithmetic or logical operations automatically via computer programming.

Crime:

A crime is an unlawful act punishable by a state or other authority. The term crime does not, in modern criminal law, have any simple and universally accepted definition, though statutory definitions have been provided for certain purposes.

Cybercrime:

Cybercrime, or computer-oriented crime, is a crime that involves a computer and a network such as committing fraud, trafficking in child pornography and intellectual property, stealing identities, or violating privacy. The computer may have been used in the commission of a crime, or it may be the target.

Digital forensics:

Digital Forensics is defined as the process of preservation, identification, extraction, and documentation of computer evidence which can be used by the court of law. It is a science of finding evidence from digital media like a computer, mobile phone, server, or network.