1.1 Introduction
Computer forensics is the application of investigation and analysis techniques to gather and preserve evidence from a particular computing device in a way that is suitable for presentation in a court of law. The goal of computer forensics is to perform a structured investigation while maintaining a documented chain of evidence to find out exactly what happened on a computer device and who was responsible for it. Computer forensics is the equivalent of surveying a crime scene (Borek, 2001). Computer Digital forensics or digital forensic science concerns evidences from computers that should be convincing and sufficiently reliable to stand up in court. Digital forensics is the science of locating; extracting and analysing types of data from different devices, which are interpreted by specialists in order to be used as legal evidence (Sivaprasad et al., 2012).
As a prelude to other parts of this study, this chapter will discuss the background upon which this study was initiated, the statement of problems that led to this study, the Aim and Objectives of the study. Others are Significance of the study, Scope of work, Limitations of the Study and Definition of technical terms.
1.2 Background of Study
Forensics investigators typically follow a standard set of procedures; After physically isolating the device in question to make sure it cannot be accidentally contaminated, investigators make a digital copy of the devices storage media. Once the original media has been copied, it is locked in a safe of other secure facility to maintain its pristine condition. All the investigation is done on the digital copy. Investigators use a variety of techniques and proprietary software forensic applications to examine the copy, searching hidden folders and unallocated disk space for copies of deleted, encrypted, or damaged files. Any evidence found on the digital copy is carefully documented in a finding report and verified with the original in preparation for legal proceedings that involve discovery, depositions, or actual litigation.
Computer Digital forensics or digital forensic science concerns evidences from computers that should be convincing and sufficiently reliable to stand up in court. Digital forensics is the science of locating; extracting and analysing types of data from different devices, which are interpreted by specialists in order to be used as legal evidence (Sivaprasad et al., 2012).
The digital evidence can be found in computer (hard disks or RAMs), cell phones, iPods, pen drives, digital cameras, CDs, DVDs, floppies, computer networks, the Internet etc (Vacca, 2005) or it can be hidden in pictures (Steganography), deleted files, formatted hard disks, deleted emails, encrypted files, chat transcripts, password protected files and so on.
The world is becoming a smaller place in which to live and work. A technological revolution in communications and information exchange has taken place within business, industry and homes. Most developed and developing countries are substantially more invested in information processing and Management than manufacturing goods, and this has affected their professional and personal lives. We bank and transfer money electronically and we are much more likely to receive an E-mail than a letter. It is estimated that the worldwide internet population is 349 million (Commerce Net Research Council 2000).
Peter (2010) describes the computerized Forensics record system as one that will enable the police to have accurate statistics to draw analysis from, on information of a case, the year a crime was committed, who investigated it, etc”. The police may decide that an offence is not serious enough to warrant recording. It is important to observe that in Nigeria with, the high level of illiteracy amongst both the public and the police and the high level of corruption, it is not unlikely that it is only very few cases that will ever get recorded. In recent times, with the economic hardship the country is going through it is not uncommon for the police to complain about lack of stationeries in cases which they may wish to record James N. (2010).
In this information technology age, some traditional crimes especially those concerning finance and commerce, continue to be upgraded technologically. Crimes associated with theft and manipulations of data are detected daily. Crimes of violence also are not immune to the effects of the information age. A serious and costly terrorist act could come from the internet instead of a truck bomb. The diary of a serial killer may be recorded on a floppy disk or hard disk drive rather than on paper in a notebook. Just as the workforce has gradually converted from manufacturing goods to processing information, criminal activity has to large extent also converted from physical dimension. There calls a need for computer forensic experts and computer based monitoring and security system for easy capture of evidence of intruder who compromises a network or computer. In a nutshell, the digital evidence is information, stored or transmitted in binary form, which has to be reliable in court. It can relate to on-line share trading fraud, source code theft, on-line banking frauds, credit card fraud, tax evasion, virus attacks, cyber sabotage, phishing attacks, email hijacking, denial of service, hacking, murder cases, organized crime, terrorist operations, defamation, pornography, extortion, smuggling and so on.
Therefore, in Nigeria where the research was carried out, the activities that was conducted is to design and implement a Computer Forensics system
1.3 Statement of Problems
During the analysis and data collection of this project, it was discovered there has existed a manual form of storing and keeping information for future use on crime record at state CID Enugu. That is to say that the process of daily task and activities are done manually quite unfortunately, manually procedural for job execution delays and reduces ones output quality.
Manual forensics record keeping has resulted in many set lacks to the expected standard. The bottleneck encountered includes:
- Time wasted and resultants long quarries
- Partial or total loss of file or documents
- Under recording of criminal analysis
- Exposures of confidential matters
- Inefficiency of some members of staff due to laziness in searching of the files.
As a result of these problem, the manual system of crime record system information storage, input and retrieval is very clumsy: inefficient and unbelievable.
1.4 Aim and Objectives of Study
The aim of the system is to design and implement a Computer Forensics System. In achieving this aim, the following specific objectives were set out as follows:
- To develop a computer based security and monitoring system for forensic experts.
- To design a system that will capture, collect, analyze, preserve and present evidence of computer crime in an acceptable manner.
- To develop a system that will replace some extent of human role in cases of unavailability of job
- To develop a system that will provide quick reference to an expert opinion
1.5 Significance of Study
This project on computerized Forensics record system is developed to carryout tedious work and activities performed by human beings, in which they end up misplacing and discarding some important files and case records. But if this (computerized crime record) is installed it will render remedy to this case.
This application when implemented will be able to monitor the activities of a computer user by taking screenshots of internet activities, process capture and capture the content of the index.dat file which will help forensic expert with substantial evidence to prosecute cyber criminals.
This study will be of immense benefit to other researchers who intend to know more on this study and can also be used by non-researchers to build more on their research work. This study contributes to knowledge and could serve as a guide for other study.
1.6 Scope of Study
The study focuses on the design and implementation of Computer Forensics System. This project is designed to monitor the activities of computer users to investigate and fish out cyber criminals. The project employed Web programming language in ensuring the design and implementation of a Computer Forensics System that will aid forensic experts in their investigations and prosecution of criminals.
1.7 Limitations of the Study
During the course of this study, many things militated against its completion, some of which are:
- Time Constraint: The time frame given to accomplish this project was very short due to school academic calendar and it was carried out under pressure which made the researcher not to implement some necessary features.
- Research material: availability of research material is a major setback to the scope of the study.
- Frequent power failure: This made the researcher append more money on fuel to ensure sustainable power.
- Financial Constraint: Insufficient fund tends to impede the efficiency of the researcher in sourcing for the relevant materials, literature or information and in the process of data collection (internet).
1.8 Definition of Terms
E-mail − Electronic mail: Electronic mail, most commonly referred to as email or e-mail since approximately 1993, is a method of exchanging digital messages from an author to one or more recipients. Modern email operates across the Internet or other computer networks. CF − Computer
Forensic: Computer forensics is the application of investigation and analysis techniques to gather and preserve evidence from a particular computing device in a way that is suitable for presentation in a court of law. The goal of computer forensics is to perform a structured investigation while maintaining a documented chain of evidence to find out exactly what happened on a computing device and who was responsible for it.
PC − Personal Computer: A personal computer (PC) is a general-purpose computer, whose size, capabilities, and original sale price makes it useful for individuals, and which is intended to be operated directly by an end-user with no intervening computer operator. GUI −
Graphic User Interface: Graphical user interface (GUI, sometimes pronounced ‘gooey’) is a type of user interface that allows users to interact with electronic devices using images rather than text commands.
DOS − Disk Operating System: Disk Operating System (specifically) and disk operating system (generically), most often reveal themselves in abbreviated as DOS, refer to an operating system software used in most computers that provides the abstraction and management of secondary storage devices and the information on them (e.g., file systems for organizing files of all sorts).
OS − Operating System: An operating system (OS) is a collection of software that manages computer hardware resources and provides common services for computer programs. The operating system is a vital component of the system software in a computer system. Application programs usually require an operating system to function.
