Digital Forensics: Electronic Crime Investigation Report

This report provides a detailed overview of electronic crime investigation using digital forensics. It introduces various tools such as OSForensics, FTK, Sleuthkit, Autopsy, and Volatility, explaining their functionalities and applications in analyzing digital evidence. The report covers the usage of OSForensics to examine USB drives, RAM dumps, and hard disk images, outlining the steps involved in each type of investigation. It also presents the flow and details of an investigation, breaking it down into sections and parts to illustrate the investigative process. The report emphasizes the importance of these tools in uncovering hidden files, tracking credentials, identifying spy activities, and characterizing individuals involved in electronic crimes. It also provides installation and usage instructions for the mentioned tools. Finally, the report concludes with a summary of the findings and references for further study.

ELECTRONIC CRIME

Table of Contents
1. Introduction........................................................................................................................................2
2. Digital Forensics Tools........................................................................................................................2
2.1 FTK.............................................................................................................................................2
2.2 Sluethkit.......................................................................................................................................8
2.3 Autopsy.....................................................................................................................................18
2.4 Volatility....................................................................................................................................20
2.5 OSForensics...............................................................................................................................22
3. Usage of OS Forensics to examine USB, RAM dumps and Hard disk........................................23
3.1 Using OS Forensics to investigates USB drive.........................................................................23
3.2 Using OS Forensics to investigates RAM dumps.....................................................................25
3.3 Using OS Forensics to investigates Hard disk images...............................................................29
4. Flow and details of investigation....................................................................................................30
4.1 Section 1....................................................................................................................................30
4.1.1 Part A.................................................................................................................................30
4.1.2 Part B.................................................................................................................................32
4.2 Section 2....................................................................................................................................33
4.2.1 Part A.................................................................................................................................33
4.2.2 Part B.....................................................................................................................................34
4.3 Section 3....................................................................................................................................34
4.3.1 Part A.................................................................................................................................34
4.3.2 Part B.................................................................................................................................35
4.4 Investigation results...................................................................................................................35
4 Conclusion........................................................................................................................................37
References................................................................................................................................................38
2

1. Introduction
The main objective of the project is
 To find out crimes on the system such as hiding files, tracking someone credentials.
 To find out the spy
 To identify the specific methods or the software used for facilitating.
 To find out the reason for spying
 To find out whether any other person is involved in it and to finally characterize them.
2. Digital Forensics Tools
OSForensics , FTK , SleuthKit , autopsy , ProDiscover Basic , Volatility are usual and famous
tools for forensic investigation.
2.1 FTK
DESCRIPTION
The abbreviation of FTK is "Forensic Toolkit" which is used for investigation purposes is
a simple and faster tool. It does scans the hard drive and gives the variety of information. It is a
software made by AccessData which is easy to use and reduces case backlog. FTK has the
feature to get the lost personal passwords and locate the deleted emails. It is easy to analyze and
makes the evidence effectively. FTK is database driven with stability and ease of use. Once the
case investigation is completed a report can be created regarding the evidence collected from the
case.
3

HOW TO USE
4

5

6

7

2.2 Sluethkit
DESCRIPTION
The collection of Linux tool is the Sleuth Kit. Which perform diverse aspects. The investigations
are made and found that Sleuth Kit and the Autopsy Forensic Browser helps in providing a real
file system toolset analysis. The suppleness of tool kits covered in The Sleuth Kit frequently lead
to difficult command line series, the difficulty is overcome by computerization which is provided
by the Autopsy Forensic Browser. Digital Forensics is the part of growing through an expanding
field of coverage demanding many dissimilar tools to achieve varying functions. Both Sleuth Kit
and Autopsy deliver an actual file system analysis toolset.
HOW TO USE:
Download sleuth kit software
8

By using previous command extract the sleuthkit-4.1.3.tar.gz
Enter into the extracted directory
9

10

11

12