Digital Forensics Semester Exam Preparation - B.
Tech 8th Semester
1. Compare the different branches of Digital Forensics with examples (10 marks)
Introduction:
Digital forensics is a multidisciplinary field involving the recovery and investigation of data from
various digital sources. It branches out depending on the type of device or environment under
investigation.
1. Computer Forensics
- Focus: Extraction and analysis of data from personal computers and laptops.
- Tools: EnCase, FTK.
- Example: Recovering deleted documents from an employee's workstation.
2. Mobile Device Forensics
- Focus: Examination of mobile phones, tablets, and SIM cards.
- Tools: Cellebrite, XRY.
- Example: Retrieving WhatsApp messages from a suspect's smartphone.
3. Network Forensics
- Focus: Monitoring and analysis of network traffic and intrusions.
- Tools: Wireshark, NetworkMiner.
- Example: Tracing IP addresses involved in a DDoS attack.
4. Cloud Forensics
- Focus: Investigation of data stored or processed in cloud environments.
- Tools: Elcomsoft Cloud Explorer.
- Example: Investigating unauthorized access to Google Drive.
5. Database Forensics
- Focus: Analysis of structured data in databases like SQL.
- Tools: ApexSQL, DBF Recovery.
- Example: Detecting tampered entries in a financial transaction database.
6. IoT Forensics
- Focus: Examining data from IoT devices such as smart home appliances or wearables.
- Example: Using fitness tracker data to verify alibis.
Conclusion:
Each branch serves a unique role depending on the source of evidence. Collectively, they support a
holistic digital investigation approach.
2. What do you mean by Email Crime? Discuss some Email Forensic Investigation Techniques (10
marks)
Introduction:
Email crimes involve the misuse of email platforms for illegal or unethical activities such as fraud,
harassment, phishing, and corporate espionage.
1. Common Types of Email Crimes
- Phishing Attacks: Fraudulent emails to steal credentials.
- Email Spoofing: Faking sender identity.
- Cyberstalking/Harassment: Sending threatening or offensive emails.
- Business Email Compromise (BEC): Targeting businesses to extract money.
2. Email Forensic Investigation Techniques
i. Header Analysis
- Reveals routing details and originating IP address.
- Helps trace the sender's location.
ii. Keyword Search
- Forensics tools search specific terms across emails for leads.
iii. Hashing Attachments
- Attachments are hashed to check for tampering or comparison with known malware.
iv. Email Server Logs
- Investigators review logs for login attempts, sent/received timestamps.
v. Metadata Extraction
- Extracting details like creation time, sender/receiver info using tools like FTK.
vi. Email Recovery
- Use of forensic tools to recover deleted emails.
3. Tools Used
- FTK, X1 Social Discovery, Paraben Email Examiner.
Conclusion:
Email forensics is a crucial subfield in digital forensics, especially for investigating cybercrimes and
fraud. Accurate recovery and interpretation of email data can be decisive in court proceedings.
More answers are available as requested by the user for different marks criteria (2, 5, 10 marks).
Prepared for: 8th Semester [Link] Digital Forensics Exam
