(2 ½ Hours) [Total Marks: 75]

N.B. 1) All questions are compulsory.

2) Figures to the right indicate marks.
3) Illustrations, in-depth answers and diagrams will be appreciated.
4) Mixing of sub-questions is not allowed.

Q. 1 Attempt All (Each of 5Marks) (15)

(a) Multiple Choice Questions
i) ____ is a Sysinternals command that shows all Registry data in real time on a Windows
computer.
a. PsReg b. RegMon
c. RegExplorer d. RegHandle
ii) _____ unique number is referred to as a “digital fingerprint.”
a. commingled data b. hash values
c. acquired data d. file header
iii) Corporations often follow the ____ doctrine, which is what happens when a civilian
or corporate investigative agent delivers evidence to a law enforcement officer.
a. silver-tree b. silver-platter
c. gold-tree d. gold-platter
iv) E-mail messages are distributed from one central server to many connected client
computers, a configuration called ____.
a. client/server architecture b. client architecture
c. central distribution architecture d. peer-to-peer architecture
v) When you give ____ testimony, you present this evidence and explain what it is and
how it was obtained.
a. technical/scientific b. lay witness
c. expert d. deposition

(b) Fill in the blanks

(3, voir dire, 4, image, motion in limine, linear, picture, key escrow, hierarchical, key
splitting)
i) _____ is designed to recover encrypted data if users forget their passphrases or if the
user key is corrupted after a system data failure.
ii) Most SIM cards allow _____ access attempts before locking you out.
iii) _____ is the process of qualifying a witness as an expert.
iv) The file where the bit-stream copy is stored; usually referred to as an/a ____
v) The file system for a SIM card is a ____ structure.

(c) Answer in 1 – 2 sentences

i) State two types of deposition
ii) What is meant by Chain of Custody?
iii) List two hashing algorithms commonly used for forensic purposes.
iv) Define Plain view doctrine
v) What is TOR?

67110 Page 1 of 2
Q. 2 Attempt the following (Any THREE) (15)
(a) Define Data Acquisition. State its types and goals
What guidelines an investigator has to keep in mind while seizing digital evidence at
(b)
the scene?
List standard systems analysis steps to be applied when preparing a for forensic
(c)
investigation case
(d) What is the standard procedure used for network forensics?
(e) State and explain various sub functions of extractions
(f) What is an Investigation triad? State and Explain its parts

Q. 3 Attempt the following (Any THREE) (15)

(a) State and explain any two ways to trace information on the internet
What are the two most common caveats an Internet Forensics investigator will
(b)
encounter? Explain any one in brief
(c) List the different fields of Web Server logs
What are the different types of Personal Information that can be found on Social
(d)
Media?
Explain the following terms:
(e)
i) Web Cache ii) Geotagging iii) Web Shells iv) SMTP v) Traceroute
(f) Describe tasks in investigating e-mail crimes and violations

Q. 4 Attempt the following (Any THREE) (15)

Explain the legal process to conduct computer investigation for potential criminal
(a)
violations of law.
(b) What are the steps to create image files of digital evidence?
What is an Expert Witness? State the four criteria based on which the quality of a
(c)
report is judged?
(d) Briefly outline the steps of trial process
(e) Explain Digital Signature and Electronic Signature w.r.t to the IT Act
(f) Write a Short note on Electronic Governance

Q. 5 Attempt the following (Any THREE) (15)

(a) Write a short note on SIM & its structure
(b) State and explain various Cyber Forensic tools
(c) What are privacy controls? Explain its importance
(d) List various guidelines for writing reports
(e) Explain the following terms:
i) Affidavit ii) limiting phrase iii) deposition banks
iv)hearsay v) spoliation

*******************************************

67110 Page 2 of 2
Q. 1 Attempt ~ 1 (Each
1 of 5Marks)
(a) Multiple Choice Questions
i) b. RegMon
ii) b. hash values
iii) b. silver platter
iv) a. client/server architecture
v) a. technical/ scientific

(b) Fill in the blanks

(3, voir dire, 4, image, motion in limine, linear, picture, key escrow, hierarchical,
key splitting)
i) Key escrow
ii) 3
iii) Motion in limine
iv) Image
v) hierarchical

(c) Answer in 1- 2 sentences

i) There are two types of depositions: discovery and testimony preservation.
ii) The route evidence takes from the time the investigator obtains it until the case is
closed or goes to court.
iii) MD5, SHA-1, SHA-256, SHA-384, and SHA-512
iv) The plain view doctrine states that objects falling in the direct sight of an officer
who nas the right to be'in a location are subject to seizure without a warrant and
can be introduced into evidence.
For the plain view doctrine to apply, three criteria must be met:
The officer is where he or she has a legal right to be.
Ordinary senses must not be enhanced by advanced technology.
Any discovery must be by chance.

v) A technique for sending requests through a set of intermediate end points is called
onion routing.
Since this process wraps your message under layers of encryption which have to
be peeled off at each different hop just like an onion that's why its called an onion
router.(TOR)

Q. 2 Attempt the following (Any THREE) (15)

(a) Data acquisition is the process of copying data. For computer forensics, it's the
task of collecting digital evidence from electronic media.
There are two types of data acquisition: static acquisitions and live
acquisitions.

(b) With proper search warrants, law enforcement can seize all computing
systems and peripherals.
Depending on company policies, corporate investigators rarely have the
authority to seize all computers and peripherals.
When seizing computer evidence in criminal investigations, follow the U.S.
DO] standards for seizing digital data.
For civil investigations, follow the same rules of evidence as for criminal
.investigation.

1.Preparing to Acquire Digital Evidence:

 2. Processing an Incident or Crime Scene:
3. Processing Data Center with RAID Systems:
4. LTsing a Technical Advisor:
5. Documenting Evidence in the Lab:
6. Processing and Handling Digital Evidence:

(4
When preparing a case, you can apply standard systems analysis steps, explained
in the following list, to problem solving.
Make an initial assessment about the type of case you're investigating
Determine a preliminary design or approach to the.case
Create a detailed checklist
Determine the resources you need
Obtain and copy an evidence drive
Identify the risks
Mitigate or mir.Lz-iZe &2 risks.
Test the design
Analyze and recover the 'digital evidence
Investigate the data you recover
Complete the case report
Critique the case

(d) A standard procedure often used &I network forensics is as follows:

1.Always use a standard installation image for systems on a network. This image
isn't a bit-stream image but an image containing all the standard applications used.
You should also have the MD5 and SHA-1 hash values of all application and OS
files.
2. When an intrusion incident happens, make sure the.vulnerability has been fixed
to prevent other attacks fr0.mtaking advantage of the opening.
3. Attempt to retrieve all volatile data, such as RAM and running processes, by
doing a live acquisition before turning the system off.
4. Acquire the compromised drive and make a forensic image of it.
5. Compare files on the forensic image to the original installation image. Compare
hash values of common files, such as Win.exe and standard DLLs, and ascertain
whether they have changed.

(e) The extraction function is the recovery task in a computing investigation and
is the most challenging of ali tasks to master.
Recovering data is the first step in analysing an investigation's data.
The following sub-functions of extraction are 'used in investigations:
Dataviewing
Keyword searching
Decompressing
Carving
Decrypting
Bookmarking

(f) Investigators often work as a team to make computers and networks secure in an
organization.
The computer investigations function is one of three in ,a triad that makes up
computing security. In a i enterprise
~ network environment, the triad consists of
the following parts
Vulnerability assessment and risk management
Network intrusion detection and incident response
 Computer investigations

lnt~slcnResponse

Q. 3 Attempt the following (Any THREE)

(a) Gathering of information is divided into two parts:
~ c ~ u i s i t i oCollection
n: of information from the endpoints
Tracing: Collection of information about endpoints connected to the Internet
Tracing often makes use of information publicly available on the Internet, like
databases of domain or IP address ownership
Different ways to trace information on the internet are: (Explanation of any two)
1. DNS & Reverse DI4S
2. Whois & Reverse Whois
3. Ping & Port Scan
4. Traceroute
5. IP Geolocation
(b)
When you encounter an IPaddress that appears to be of interest in some digital
evidence, there may be several reasons why that address maybe misleading or
inaccurate. Two common scenarios are that the discovered address maybe shared
among multiple endpoints (e.g.,in a school) or that the address is a proxy for the
real address.
Two common caveats an Internet Forensics Investigator will encounter are:
network address translation
onion routing
Explanation of either(4 marks)

(c) Field Description Example

Identity Idcn~ityo l t h e client o n i ~ machiric

s jirnrny (though most often "-")
: Timestamp T i ~ n c\\,hen the rcqilest was rcccivcd 1O/Scp/2015:16:33:01 +0200
Bytes Size of' thc rcsponse i11 bytcs 137
Request A string ciultainiug hat resource was reqi~estcd C;ET/honlc.php HTTPll.1
, Auth Thc idcnLity of thc clicnt on the scnrer jimmy
Agcnt Thc hl-owser the client says is being used Mozilla5.0; Wi~lrlowsN T 6.1; 1 . . . ]
Rcfcrrcr From whcrc thc browser says it came frorn php
ht~p://son~eothcraite.con~/p~~ge
Client IP The publlc IP address of the client 128.39.41.45

(d) Different types of Personal information shared on social media are:

I) BASIC DEMOGRAPHICS
11) SOCIAL CONNECTIONS AND ASSOCIATES
111) LOCATION DATA
IV) BEHAVIOR PATTERNS
V) POSTED CONTENT

(e) i) Web Cache

9 Web cache is one way that the browser makers shave some time off the
download times.
9 Cache speeds things along by reusing web page components like images,
saving time from having to download objects more than once.
 ii) Geotagging
Geotagging refers to the process of adding a location (or "geolocation") to a post,
photo, or status update. This is typically determined via GPS coordinates,
indicating a precise location of the post
iii) Web Shells
A web-shell is a malicious script used by an attacker with the intent to escalate and
maintain persistent access on an already compromised web application
A web shell is a script that can be uploaded to a web server to enable remote
administration of the machine
iv) SMTP
Simple Mail Transfer Protocol (SMTP)-Used by e-mail clients to send e-mail
and by servers to both send and receive.
v) Traceroute
Traceroute, also called tracepath or tracert, is a network tool used to determine the
path packets take from one IP address to another
Traceroute is a network diagnostic tool that displays the route taken by packets
zcrossa net-~orkand measures any transit delays.

(f) The tasks in investigating e-mail and violations are:

I) Examining E-mail Messages
11) Copying an E-mail Message
111) Viewing E-mail Headers
IV) Examining E-mail Headers
V) Examining Additional E-mail Files
VI) Tracing an E-mail Message
VII) Using Network E-mail Logs

Q. 4 Attempt the following (Any THREE) (15)

(a) When conducting a computer investigation for potential criminal violations of
the law, the legal processes we follow depend on local custom, legislative
standards, and rules of evidence.
In general, however, a criminal case follows three stages: the complaint, the
investigation, and the prosecution.
Someone files a complaint; a specialist investigates the complaint and, with
the help of a prosecutor, collects evidence and builds a case. If a crime has been
committed, the case is tried in court.
-.

To differentiate the training and experience officers have, CTIN has established
three levels of law enforcement expertise:
Level 1- Acquiring and seizing digital evidence, normally performed by a
police officer on the scene.
Level 2- Managing high-tech investigations, teaching investigators what to ask
for, and understanding computer terminology and what can and can't be
retrieved from digital evidence. The assigned detectives usually handle the
case.
 Level 3- Specialist training in retrieving digital evidence, normally conducted
by a data recovery or computer forensics expert, network forensics expert, or
Internet fraud investigator. This person might also be qualified to manage a
case, depending on his or her background.
In a criminal or public case, if we have enough information to support a search
warrant, the prosecuting attorney might direct to submit an affidavit.
We must then have theaffidavit notarized under sworn oath to verlfy that the
information in the affidavit is true.
After a judge approves and signs a search warrant, it's ready to be executed,
meaning we can collect evidence as defined by the warrant.
After we collect the evidence, we process and analyse it to determine whether
a crime actually occurred. The evidence can then be presented in court in a
hearing or trial.
(b) Following are steps to create image files:
1. Copy all image files to a large drive.
2. Start your forensics tool to analyse the evidence.
3. Run an MD5 or SHA-1 hashing algorithm-onthe image files to get a digital
hash.
4. When we finish copying image files to a larger drive, secure the original
media in an evidence locker. Don't work with the original media; it should
be stored in a locker that has an et.idence custody form. Be sure to fill out
the form and date it.

(c) Expert Witness:

An expert witness, can have opinions about what they have found or observed.
These opinions form from experience and deductive reasoning based on facts
found during an investigation. In fact, these opinions are that make an expert
witness
Writing Reports Clearly
To produce clear, concise reports, we should assess the quality of the writing,
using the following criteria:
1. Communicative quality
2. Ideas and organization:
3. Grammar and vocabulary.
4. Punctuation and spelling

(d) The typical order of trial proceedings, whether civil or criminal, is as follows:
Motion in limine
Empaneling the jury
Opening statements
Plaintiff
Defendant
Rebuttal
Closing arguments
Jury instructions

(e) Authentication of Electronic Records

(1)Subject to the provisions of .this section any subscriber may authenticate an
electronic record by affixing his Digital Signature.
(2) The authentication of the electronic record shall be effected by the use of
asymmetric crypto system and hash function which envelop and transform the
initial electronic record into another electronic record.
(f) 4 Legal Recognition of Electronic Records
5 Legal recognition of Electronic Signature
6 Use of Electronic Records and Electronic Signature in Govenunent and its
agencies
6A Delivery of Services by Service Provider (Inserted vide ITAA-2008)
7 Retention of Electronic Records
7A Audit of Documents etc in Electronic form
8 Publication of rules, regulation, etc, in Electronic Gazette
9 Sections 6,7 and 8 Not to Confer Right to insist document should be accepted
in electronic form
10 Power to Make Rules by Central Government in respect of Electronic
Signature (Modified Vide ITAA 2008)

Q. 5 Attempt the following (Any THREE) (15)

(a) Subscriber identity module (SIM) cards are found most commonly in GSM
devices and consist of a microprocessor and 16 KB to 4 MB EEPROM.
. .

Figure 12-1. SIM filestructure

(b) The following sections explore some options for command-line and GUI tools in
both Windows and UNIX/Linux:
Command-Line Forensics Tools:-
UNXX/Linux Forensics Tools:-
SMART:
Helix:
BackTrack:
Autopsy and Sleuth Kit:
Knoppix-STD:
Other GUI Forensics Tools:-

* Privacy controls allow social media users to control who can see their content.
(c)
These can be simple settings that toggle an account between public and
restricted to an appl.oved group, or they can be sophisticated that give users
control over every person who can see each individual.post.
While privacy controls are important for users, especially when they are
sharing sensitive personal information, people often do not fully understand
how public their data is nor how to use all the controls at their disposal.

(d) The guidelines for writing reports are as follows:

Use of supporting matcl-ial:
Importance of Consistcl~cy:
Investigate report for~nat:
Attachments and appendices:
Include metadata:
(e) i) Affidavit
The document, given under penalty of pejury, that jnvestigators create to detail
their findings. This document is often used to justdy issuing a warrant or to deal
with abuse in a corporation.
ii) limiting phrase
Wording in a search warrant that limits the scope of a search for evidence.
When you find commingled evidence, judges often issue a limiting phrase to the
warrant, which allows thc police to separate innocent information from evidence.
iii) deposition banks
~ibrariesof previously given testimony that law firms can access.
iv)hearsay
Hearsay is any out-of-court statement presented in court to prove the truth of an
assertion. In other wortls, hearsay is evidence of a statement made other than by a
witness wlule testifying at the hearing and is offered to prove the truth of a
statement.
v) spoliation
Destroying or concealit~gevidence; this action is subject to sanctions.