Month: December 2015

Forensic means to use in court. Computer forensics is the collection, preservation, analysis, extraction, documentation and in some cases, the court presentation of computer-related evidence which has either been generated by a computer or has been stored on computer media.
Traditional Forensic v/s Computer Forensic
The difference between traditional forensics workers and the computer forensics folks is that the traditionalists tend to work in two locations only. The initial crime scene but the majority of the investigation goes on back at the lab. The computer forensics investigators may have to take on their analyses wherever the equipment is located or found rather than just in the pristine environment and the products that are used by investigators come from a market-driven private sector. Traditional forensics investigators are expected to interpret their findings and draw conclusions accordingly whereas computer forensics investigators must only produce direct information and data that will have significance in the case they are investigating.
Component steps for Computer Forensics:
Make a Forensic Image
• Requires Extensive Knowledge of Computer Hardware and Software, Especially File Systems and Operating Systems.
• Requires Special “Forensics” Hardware and Software
• Requires Knowledge of Proper Evidence Handling.

Create Indexes and setup “case”
Access Data Forensic Toolkit (FTK)
• Implements “Hashing” concept.
• Hashing is done using hash functions which is a well-defined procedure or mathematical function for turning some kind of data into a comparatively small integer.
• The values returned by hash function are called hash values

Look for evidence within the image
• View Emails, Documents, Graphics etc.
• Searching for Keywords
• Bookmark relevant material for inclusion into report
• Good investigation skills needed to interview the client to get background material needed to focus the CF investigation.

Generate CF Report
• Usually in HTML format
• Can be printed or on CD-ROM
• Basis for Investigation Report, Deposition, Affidavits, and Testimony.
• CF Report often supplemented with other investigation methods (Online Databases, Email / Phone Interviews)

Forensic Software:
Byte Back, Drive Spy, EnCase , Forensic Tool Kit (FTK), Hash Keeper, Ilook, Maresware, Password Recovery Toolkit (PRTK), Safeback, Thumbs Plus

Pros and cons of Computer Forensics
Pros:
• Searching and analyzing of a mountain of data quickly and efficiently.
• Valuable data which has been deleted and lost by offenders can be retrieved. It may become substantial evidence in court.
• Preservation of evidence.
• Ethical process
Cons:
• Retrieval of data is costly.
• Evidence on the other hand can only be captured once.
• Privacy concerns.
• Data corruption

With computers becoming more and more involved in our everyday lives, both socially and professionally, there is a need for computer forensics. This field will enable crucial electronic evidence to be found, whether it was deleted, lost, hidden, or damaged and used to prosecute individuals that believe they have successfully beaten the system.

Depth-first search (DFS) is an algorithm for traversing or searching tree or graph data structures. One starts at the root and explores as far as possible along each branch before backtracking.
A version of depth-first search was investigated in the 19th century by French mathematician Charles Pierre Trémaux as a strategy for solving mazes.

The order of Excution of nodes are as :1, 2, 3, 4, 5, 6, 7, 8, 9, 10.
Pseudo code:
Input: A graph G and a vertex v of G
Output: All vertices reachable from v labeled as discovered
A recursive implementation of DFS:
1 procedure DFS(G,v):
2 label v as discovered
3 for all edges from v to w in G.adjacentEdges(v) do
4 if vertex w is not labeled as discovered then
5 recursively call DFS(G,w)
A non-recursive implementation of DFS:
1 procedure DFS-iterative(G,v):
2 let S be a stack
3 S.push(v)
4 while S is not empty
5 v = S.pop()
6 if v is not labeled as discovered:
7 label v as discovered
8 for all edges from v to w in G.adjacentEdges(v) do
9 S.push(w)

Applications: There are various applications of DFS.
• Finding connected components.
• Detecting cycle in a graph.
• Finding connected components.
• Finding the bridges of a graph.
• Generating words in order to plot the Limit Set of a Group.
• Finding strongly connected components.
• Planarity testing.
• Solving puzzles with only one solution, such as mazes. (DFS can be adapted to find all solutions to a maze by only including nodes on the current path in the visited set.)
• Maze generation may use a randomized depth-first search.
• Finding biconnectivity in graphs.