Computer Forensics Fundamentals

Module 1 – Computer Forensics Fundamentals Computer Forensics is Procedures and techniques used to identify, gather, preserve, extract, interpret, document, and present digital evidence so that it can be accepted in legal or administrative proceedings. Objectives of Computer Forensics 1. Identify, gather & preserve evidence. 2. Gather evidence correctly. 3. Estimate impact (damage) & intent (why attackers did it). 4. Minimize tangible and intangible losses. . 5. Protect future incidents. . 6. Support prosecution. . Need for Computer Forensics 1. Ensure integrity & continued existence → keep systems safe and running. 2. Prove the attacker’s action in court → collect and understand evidence of what attacker did. 3. Track down perpetrators (criminals) → find the attackers from different parts of the world. 4. Protect the organization’s financial resources and time. When Do You Use Computer Forensics? • Prepare for incidents (strengthen security + fix weaknesses). • Identify actions (know what to do when incidents happen). • Act against copyright + intellectual property theft or misuse. • Estimate and minimize damage. • Set security rules to be ready for forensic investigation. Indicators of Compromise (IoCs) = signs or evidence that indicate a computer system or network may have been compromised or attacked. Examples of IoCs include: • Unusual network activity • Suspicious or unexpected system behavior • Unauthorized access • Unexpected changes to files or systems • Suspicious processes or activities Purpose: IoCs help investigators identify and investigate possible security incidents.