Beginner's Guide for Cybercrime Investigators, Nicolae Sfetcu [comprehension books TXT] 📗

Book Preview

Nicolae Sfetcu

Published by Nicolae Sfetcu

Copyright 2014 Nicolae Sfetcu

Computing devices

The computer itself is the main source of information for the investigator. In the computer, information is stored on the hard disk. A hard disk drive is a device that can record magnetic data, consisting of one or more rigid discs, read / write heads and mechanical mechanisms protected by a metal casing, hermetically sealed. The storage capacity of a hard disk is normal nowadays tens or hundreds of gigabytes. A computer may have one or more hard disks of different types and capacities.

Laptop computers are computers designed to be easily moved. Because of performance reached, some users may be used as permanent workstation.

Types of portable computers are:

transportable / smartphone

laptop

ultra-light

hand (also called Pocket PCs, Palm or PDAs , personal digital assistants)

Even if they are not used permanently, portable computers are an important source of information, because they can be used for storing data, confidential as possible, to be carried off locations where security is ensured.

Lately due to technical possibilities to miniaturize computing devices, they have been integrated into small portable equipments. The best example of this is the mobile phone which has got features mini-computer. Besides the recent calls log, a modern phone can contain lists of addresses, schedules meetings, documents and notes etc. with even higher capacities than PCs a few years ago.

Peripheral devices

the keyboard is not intended for information storage, being only an input device. However, there are some devices that can attach keyboards and can record keystroke sequences users. Although very little spread, these devices are very easily available.

monitors are capable of storing information. in the past, due to technical limitations could cause images or text that remained on the screen for a long time, the impressions produced on CRT phosphor. Modern monitors do not show this effect.

printers can be sources of important information. For example, laser printers allow revealing image type prints last. This technique should be used before disconnecting the printer from the mains electricity supply, which requires the presence of an expert at search. Some laser printers have a disk buffer that stores information to be printed. The capacity of such a disc is from 2 to 10 Mb. Data stored on these disks can be objectified according to a relatively simple procedure. For older models of printers that use cartridges Band (ribbon) can be reconstructed by examining the print ribbon. Assimilation analysis method is printed ribbon typewriter.

External drives for media storage

External drives for media storage are:

CD- ROM (acronym for Compact Disc -Read Only Memory) are data storage devices on optical disks using compact – disc technology. The data is read with a laser -based system and not on magnetic media used for other data storage methods. Some CD- ROM drives (CD recorders) can be used for recording data on optical media.

CD – Compact Disc

Diskettes. Floppy disks with 3.5 inches in size. Floppy disk is a data storage medium selective for the user. Saving data on disk is performed by users for various reasons, such as creating backups of important files recording data that the user wishes to store the computer company, copying files to transfer to another computer, etc.

Floppy Disks

Backup disks. Information from backups created to avoid loss of information in case of a power outage are an important source for investigators. Same time with the lifting of backup discs must be recorded as much information on how are achieved the backups, especially the types of equipment, software and procedures used. Safety information is usually stored in large-capacity optical discs, for this purpose, such as the type Zip or Jazz disks, Iomega products, but may exist on any storage medium. Lately became very popular flash memories, very small in size, with large enough capacity.

USB drives (Flash drives)

Optical discs (most popular being the CDs) are high capacity storage media for digital data. The capacity of these discs is 650 Mb (CDs) to 4 GB (DVDs). Optical discs can be either normal (read only without the possibility of data recording), recordable (possible reading and writing data to disk without deleting data) , or with the possibility of rewriting (it is possible to read, writing and erasing data on the disc).

Removable hard drives are also information storage mediums. They have capabilities similar to the fixed hard drives, and are generally used to transfer large files.

Removable hard disks

Typology of data stored on specific supports – File systems

The primary function of the information systems is to store and process data. Data processed and stored by the computer systems can be classified into four categories: active data, archived data, safety saved data, and residual data.

Active data: information available and accessible to users. They are presented in different forms, such as documents created by word processors, electronic calendars, mailing lists, files, graphics, audio files, etc. .

A special feature is that for computer data the copy is absolutely identical with the original (the copy does not change anything). Recording active data can be done with special software called file management, execution of specific commands, or operating systems.

Archived data are information that are no longer commonly used, and are stored separately, to free disk space. Archived data also include duplicate files. Duplicate files are automatically created as computer files in case of technical problems (such as system crashes, power supply interruption , etc.), with data recovery role. They have specific file endings, and are usually stored in different locations of the original files. Their importance lies in creating multiple copies of documents, copies that user can erase, and whose existence most often is not aware. By comparing the original with duplicate copy, can be made observations on the changes between different versions of the document.

Safety saved data security (or backup data) is information copied on removable media with the aim of making their data available to users for a power system intervention. How often backups it depends both on type of systems (network connected computer, or computer network ) and user procedures.

For networks, the typical practice is to create a full backup once a week, usually on Fridays, and daily implementation of additional copies aiming at saving the data modified that day, in these cases, usually copying only the information which is on network server, which is not the computers (terminals ) users. At the end of the month is backed the safety copy, which is stored separately and kept for a period of time ranging from several weeks to several months. In practical environments the support where is made the copy is to be used again after a month period.

For computers that are not connected to the network , without a proper backup system, their owners usually copy the files to which they attach more importance, on a storage media such as hard disks removable, recordable CDs, flash drives , etc.

Using information from the storage media for backup storage is useful due to the information kept for a long time. But, due to the lack of organization of the data on these environments, and that usually safety saved files are compressed for the economy of space, it makes it more difficult for investigation.

Residual data is information that apparently were removed from the system but persist in specific forms and can be recovered. Such residual data are deleted files that are still on the disk, temporary files, file exchange, data in the active space, the data buffer and clipboard.

If normal file deletion, data is not removed from the disk, but the computer marks the portion where file was placed as free and can thus be rewritten. If the override does not take place (where deletion was recent, or if there is enough free disk space, and there were no operation of routine system maintenance, such as defragmenting or optimizing), the file, or portions of it, were still on the disk, and can be recovered. For recovery are using special programs. In fact, data becomes unrecoverable on the disk space only after the data have been overwritten 7 times. Special programs can do this operation (overwriting 7 times) to permanently delete some data.

Temporary files are files created by the operating system or another program to be used during the session. In many cases, temporary files are not deleted from the disk, and so can be recovered information contained in them.

Files exchange (or swap files) are hidden files created by the operating system to be used for the preservation of portions of program and data files that do not fit in memory. Exchange files are a form of virtual memory. The information from exchange files can be analyzed with the help of special programs.

“Inactive” area (slack space) is the space located in a physical unit of data storage on disk (cluster) that is not covered by the portion of the file occupying that unit. Because DOS operating system does not allow to store more than one file in a storage unit, the difference between the current file size and the size of the storage space is considered “inactive”, unused. This space can contain information that can be recovered using specific programs. Also this space, as considered damaged drives, can be used by advanced users of information systems to conceal information.

Program that allows working with ” inactive” space

Buffer is a memory area reserved for use as temporary storage, where there are temporarily stored data waiting to be transferred from one location to another . Data in the buffer can be retrieved with the help of special programs.

Clipboard is a portion of memory, having special character, maintained by the operating systems based on windowed mode (such as Windows). The clipboard is storing data being transferred from one