Digital Forensics in Distributed Environment

Digital Forensics

The application of scientifically established methods in collecting, preserving, validating, identifying, analyzing, interpreting and presenting digital evidence to the court of law after obtaining the evidence from the reconstruction of events if possible.

Memory Forensics

It is the forensic analysis of a computer's memory dump. Advanced computer attacks will use stealth techniques to avoid leaving traceable evidence data on the computer's non-volatile memory (hard drive, SSD etc). In those situations, the computing system's memory (RAM) dump is taken using OS tools or third-party tools for further forensic analysis. Using OS tools and symbolic debugging information of the OS components, it is possible to substantially recreate the state of the computing system to a reasonable analysis at the process and resource level.

Disk Forensics

It is the analysis of storage devices which comes in numerous categories in terms of physical interfaces and storage technologies. The forensic analysis of disks mainly consists of the application and operating system logs, picture analysis, signature/keyword analysis of known digital entities of criminal nature, timeline analysis, mailbox, databases, cookies, registry – virtually any persistent data that is commonly used by various application software and operating system.

Network Forensics

It is all about the monitoring and analysis of computer network traffic for evidence collection, information gathering or even intrusion detection. Compared to the other areas of digital forensics, network forensics deal with more volatile data and thus it is considered as a proactive approach to forensic investigation (Sammons, 2015)

Network security should be a huge concern to all of us since the networks are under near-constant attack from lone hackers, organized criminals, and foreign countries. Cybercrime, Cyberwar, and cyberterrorism are major problems threatening not only our countries and companies but our personal computers as well. Networks represent a far greater challenge, from a forensic standpoint. They vary wildly in size and complexity. There are several tools to help us protect our critical network infrastructure, including firewalls and intrusion detection systems. Smart organizations plan for security breaches enabling them to respond efficiently and effectively minimizing the damage and increasing the odds that they can identify the perpetrator(s) (Shrivastava et al., 2016; Shrivastava, 2016).