Digital Forensics and Cyber-Crime Investigation

Learn to maintain registry integrity during forensics by using the Red Shock tool to take registry snapshots, compare first and second shots, and document changes for court.

Learn how to maintain chain of custody for digital evidence by documenting handling, case details, items, and signatures to ensure integrity and admissibility.

Protect evidence integrity and preserve chain of custody by using hardware and software write blockers to prevent unauthorized writes to storage devices.

Acquire digital evidence via local, remote, online, and offline methods, employing cold imaging with a write blocker, live imaging for active systems, and remote tools for data capture.

Install FTK Imager by downloading the latest version from the official site, completing the form, and running the installer as administrator to image a storage device for forensic work.

Demonstrates practical data acquisition and imaging of a storage device, selecting source drives, performing a bit-for-bit copy, and verifying hash integrity for case evidence.

Learn to search a disk image for deleted files after acquisition and recover both word and media files from unallocated space, using metadata and file system insights.

OS forensics on Windows to acquire, extract, and analyze artifacts such as browser history, downloads, recycle bin, and user activity, linking digital evidence to crime cases.

Explore evidence volatility by prioritizing data collection using the forensic order of volatility. Capture volatile data from RAM first, then use FTK Imager for non-volatile analysis.

Learn how to perform a ram dump to preserve volatile evidence, uncover running processes, network connections, usernames and passwords, open windows content, and cryptographic keys for cyber-crime investigations.

Analyze Windows RAM dumps with Volatility, using command-line or GUI, to extract processes from a memory image and detect malware while preserving evidence integrity.

Explore steganography by concealing secret messages in images, audio, video, or files and extracting the hidden data. See a practical tool-based demonstration of creating and detecting hidden messages.

Demonstrate the procedure of creating and detecting steganography without external tools, using command prompt to embed a secret text message into an image and retrieve it.

Learn to extract image metadata to determine when and where a photo was taken, identify the device and editing history, and map exact locations for forensic investigations.

Explore how forensics collects digital evidence and how anti-forensic techniques hide footprints and disrupt investigations. Identify methods investigators use to counter such tactics with authentic techniques.

Explore how to investigate website crimes by tracing links through domain and IP lookups, collecting screenshots and other evidence, and coordinating with authorities to identify domain owners and hosting.

The lecture outlines guidelines for collecting electronic evidence from a crime scene, focusing on PC and laptop hard drives, photography and radiography, power cable disconnection, and documenting hardware details.

Forward the case using the case forwarding performa for forensic examination, detailing case number, police station, district/state, crime type, chain of custody, and forwarding authority to Central Forensic Science Laboratory.

Explore the scope of forensic science in India, including expert witnesses, licensing gaps, government vs private roles, and career paths from junior officer to private labs, with admissibility considerations.

Explore how to generate a forensic expert report for audio forensics, covering case context, chain of custody, technical details, audio analysis, and authenticity assessment using spectrograms and standard software.