Study Notes on Advanced Cyber Forensics - Cyber Forensics | Core Paper- X SEM 3

Advanced Cyber Forensics encompasses the structured identification, acquisition, extraction, analysis, and preservation of digital evidence across computing systems, volatile memory, file systems, and network endpoints. This curriculum guide covers core principles of live system forensics, artifact examination, and timeline reconstruction for legal proceedings.

Unit 1: Windows Forensics and Live System Acquisition

Windows operating systems represent the most prevalent environment in digital forensics investigations. When responding to a live security incident or executing a court-ordered search, forensic examiners must prioritize the collection of volatile digital artifacts before powering down the target host.

Volatile Data Collection Methodologies

Volatile data resides in temporary storage mechanisms such as Random Access Memory (RAM), CPU caches, and dynamic network sockets. Because this data is lost upon system shutdown or reboot, investigators must capture volatile evidence in strict accordance with the Order of Volatility defined in RFC 3227. Essential volatile data collection steps include:

• Physical Memory Capture: Acquiring full RAM dumps using trusted command-line utilities (such as WinPmem, DumpIt, or FTK Imager CLI) to capture encryption keys, injected malicious payloads, and unsaved documents.
• System Date and Time Verification: Recording local system time against an authoritative Network Time Protocol (NTP) source to establish accurate forensic timeline synchronization.
• Active Logged-On Users: Identifying active and remote interactive logon sessions using tools like PsLoggedOn or NetSession.
• Open Network Connections and Port Mapping: Capturing active TCP/UDP endpoints, listening sockets, and process-to-port bindings using Netstat and TCPView to detect command-and-control communication channels.
• Running Process Enumeration: Documenting process hierarchies, parent-child process relationships, executable image paths, and loaded DLL modules using Tasklist, Process Explorer, and WMIC.
• Clipboard Contents and Command History: Extracting text and graphic snippets cached in the system clipboard and recording console command history from PowerShell and cmd buffers.
• Mounted Network Shares and Mapped Drives: Documenting active NetBIOS connections, SMB sessions, and mapped shared directories.
• Service and Driver State: Extracting active Windows services, running drivers, and registered kernel hooks using Sc query and Driverquery commands.

Non-Volatile Data Collection Techniques

Non-volatile data collection involves extracting persistent information stored on secondary storage media such as magnetic hard drives, solid-state drives, optical media, and USB flash devices. Investigators create bit-stream forensic images using hardware or software write-blockers to prevent data modification during imaging.

• Disk Imaging: Generating exact bit-for-bit forensic duplicates of internal hard drives and external USB media using forensic acquisition engines.
• Registry Dump: Extracting active hive files, including SAM, SYSTEM, SECURITY, SOFTWARE, and NTUSER.DAT for offline parsing.
• Event Log Extraction: Exporting EVTX logs from System32/winevt/Logs to preserve Security, System, and Application event histories.
• Prefetch File Acquisition: Collecting Windows Prefetch files (.pf) from the Prefetch folder to establish evidence of program execution, execution frequency, and timestamps.
• Volume Shadow Copies: Extracting historical snapshot copies of volumes to recover previous file states and registry entries.
• Crash Dump and Hibernation File Acquisition: Capturing hiberfil.sys and memory.dmp files to extract compressed volatile memory states saved during hibernation or system crashes.

Unit 2: File System Forensics and Metadata Analysis

Understanding file system architecture is vital for discovering hidden, deleted, or obfuscated digital evidence. In Windows environments, the New Technology File System (NTFS) provides rich metadata structures that record user actions and system events.

NTFS Architecture and Master File Table Analysis

The Master File Table (MFT) serves as the primary database in an NTFS volume, allocating at least one 1024-byte record for every file and folder. Key MFT attributes analyzed during investigations include:

• $STANDARD_INFORMATION ($SIA): Contains fundamental file metadata, including read-only, hidden, and system flags, as well as MACB timestamps (Modified, Accessed, Created, and MFT Modified).
• $FILE_NAME ($FNA): Contains the file name, parent directory reference, and independent MACB timestamps updated only when the file is renamed or moved, providing a reliable check against timestomping anti-forensic techniques.
• $DATA: Stores the actual file contents. For small files (typically under 700 bytes), data is stored resident within the MFT record itself; for larger files, data runs point to non-resident clusters on the storage volume.
• Alternate Data Streams ($ADS): Allows multiple data streams to be attached to a single file name, frequently leveraged by malware to hide executables behind legitimate files.
• $LogFile and $UsnJrnl: Transaction logging mechanisms that record metadata changes and file modifications in real time, enabling forensic timeline reconstruction.
• $Bitmap and $BadClust: Allocation tracking records indicating active, unallocated, and marked bad sectors across the disk volume.

Windows Registry Artifact Examination

The Windows Registry is a hierarchical database that stores operating system configurations, software settings, and user activity traces. Forensic examiners analyze specific registry hives:

• NTUSER.DAT and UsrClass.dat: User-specific hives located in the user profile directory. They contain UserAssist keys (tracking executed GUI applications), Shellbags (recording folder browsing history and window coordinates even for deleted folders), and RecentDocs (listing recently opened documents).
• SYSTEM Hive: Contains the MountedDevices key, USBSTOR keys (cataloging every connected USB mass storage device by serial number and vendor ID), and CurrentControlSet service definitions.
• SOFTWARE Hive: Tracks installed software, autostart extension points (Run and RunOnce keys), and operating system build information.
• SAM Hive: Stores local user account definitions, group memberships, password policy parameters, and last login timestamps.
• Shimcache (AppCompatCache) and Amcache.hve: Execution artifacts recording binary file paths, file sizes, compile times, and execution indicators for malware persistence analysis.

Unit 3: Memory Forensics and Incident Reconstruction

Memory analysis has become indispensable for detecting sophisticated cyber attacks, rootkits, fileless malware, and in-memory credential harvesting. Using memory analysis frameworks such as Volatility and Rekall, analysts inspect physical RAM images to reconstruct runtime state.

Core Memory Analysis Procedures

• Process Memory Scanning: Identifying hidden or unlinked processes that have been removed from the ActiveProcessLinks doubly-linked list (Direct Kernel Object Manipulation).
• Code Injection Detection: Scanning memory sections for executable memory pages (PAGE_EXECUTE_READWRITE) lacking backing files on disk, characteristic of reflective DLL injection and shellcode execution.
• Network Socket Inspection: Reconstructing network connections that existed at the moment of memory capture, including closed or ephemeral connections.
• Kernel Module and Driver Verification: Checking loaded driver lists against verified cryptographic signatures to detect unauthorized kernel-level rootkits.
• Extracting Passwords and Cryptographic Keys: Recovering plaintext credentials, Kerberos tickets, and SSL/TLS session keys from LSASS memory dumps.
• Analyzing VAD Trees: Traversing Virtual Address Descriptor (VAD) binary trees to determine memory allocation protections, heap structures, and memory-mapped files.

Organizations undergoing incident response frequently collaborate with specialized legal advisors in digital forensics and incident investigation to ensure that technical findings meet evidentiary standards in court.

Unit 4: Virtual Machine Forensics

Virtualization technology separates operating systems and workloads from physical hardware, introducing unique challenges and opportunities for forensic investigators. Virtual machine (VM) environments must be preserved and analyzed using specialized virtualization forensic methodologies.

Types of Hypervisors and Architecture

• Type 1 Bare-Metal Hypervisors: Hypervisors running directly on host hardware without an underlying host operating system. Examples include VMware ESXi and Microsoft Hyper-V Server. Forensic examination requires accessing host management interfaces, datastores, and storage area networks (SAN).
• Type 2 Hosted Hypervisors: Hypervisors running on top of a standard host operating system such as Windows or Linux. Examples include VMware Workstation and Oracle VirtualBox. Examiners analyze both the guest virtual machine containers and the host operating system traces.

Hypervisor Disk Files and Formats

Virtual machines encapsulate their storage in structured container files. Forensic examiners inspect and mount various virtual disk formats:

• VMDK (Virtual Machine Disk): The standard container format used by VMware solutions. Monolithic and split VMDK descriptors contain geometric mapping parameters and differential snapshot pointers.
• VHD and VHDX: Microsoft virtual hard disk formats used in Hyper-V environments, supporting fixed, dynamic, and differencing disk structures.
• VDI (VirtualBox Disk Image): Oracle VirtualBox container format storing block allocation tables and virtual disk metadata.
• QCOW2 (QEMU Copy-On-Write): Flexible Linux virtualization format supporting AES encryption and differential overlays.

VM Snapshots, Memory States, and Live Migration Analysis

Virtual machine snapshots capture exact point-in-time states of virtual disks and running memory. Examining VMware snapshot files (.vmsn and .vmem) or Hyper-V save state files (.vsv and .bin) allows investigators to extract physical RAM dumps of guest machines at historical moments without disrupting production systems.

Unit 5: Cloud Forensics and Distributed Storage Analysis

Cloud computing transforms digital investigations by decentralizing evidence across multi-tenant, globally distributed infrastructure. Cloud forensics encompasses legal, organizational, and technical dimensions required to identify, preserve, collect, and analyze cloud artifacts.

NIST Cloud Forensic Science Framework

The National Institute of Standards and Technology (NIST) cloud forensic framework outlines systematic phases for cloud investigations:

• Evidence Source Identification: Pinpointing target data across SaaS, PaaS, and IaaS layers, including tenant logs, API activity records, and cloud storage buckets.
• Preservation and Chain of Custody: Implementing legal holds, snapshotting cloud volumes (such as AWS EBS snapshots), and locking immutable log buckets (such as AWS CloudTrail and S3 Object Lock).
• Collection and Extraction: Using cloud provider APIs and forensic command-line tools to extract object storage, database snapshots, and identity audit logs.
• Examination and Correlation: Parsing JSON log feeds, IP connection records, and IAM role assumptions to trace attacker movements across cloud assets.

Cloud Storage Forensics: Dropbox and Google Drive

Investigating cloud storage synchronization clients on endpoint machines reveals extensive data remnants:

• Dropbox Artifacts: Examiners inspect config.dbx and filecache.dbx SQLite databases on local user profiles to discover synchronized file lists, deleted cloud files, host IDs, and shared folder collaborations.
• Google Drive Artifacts: Investigating sync_log.log, snapshot.db, and cloud graph SQLite databases reveals local sync status, cloud document revisions, shared user emails, and download timestamps.
• Browser Cloud Remnants: Analyzing browser cache, IndexedDB records, and session storage to identify uploaded documents and web-based file preview activity.

Jurisdictional Challenges and Cross-Border Compliance

Cloud data frequently crosses international borders, creating complex jurisdictional hurdles for law enforcement and corporate investigators. Legal instruments such as Mutual Legal Assistance Treaties (MLAT), the US CLOUD Act, and European General Data Protection Regulation (GDPR) govern cross-border evidence acquisition. Engaging specialized legal expertise in cyber security and data protection legal consulting ensures that multi-jurisdictional evidence requests remain legally enforceable and compliant with privacy mandates.

Unit 6: Cross-Platform Forensics and Anti-Forensic Detection

Modern enterprise networks operate across heterogeneous operating environments, requiring forensic investigators to apply structured acquisition and analysis methodologies to Linux and Apple macOS platforms in addition to Windows endpoints.

Linux Forensic Investigation

Linux forensics centers on examining the Unix filesystem hierarchy, daemon configurations, user authentication logs, and kernel structures. Core investigation targets include:

• System Log Analysis: Parsing /var/log/auth.log or /var/log/secure for unauthorized SSH access, sudo privilege escalations, and failed authentication attempts.
• Ext4 Filesystem Examination: Analyzing inode structures, extended attributes, and ext4 journal records ($Journal) to recover deleted files and reconstruct timeline activity.
• Cron Job and Persistence Auditing: Inspecting /etc/cron*, /var/spool/cron/crontabs, and systemd service unit files (/etc/systemd/system) for malicious persistence mechanisms.
• Shell History and User Environments: Examining .bash_history, .zsh_history, and environment configuration scripts (.bashrc, .profile) across home directories.
• Network Socket Enumeration: Analyzing /proc/net/tcp, /proc/net/udp, and lsof output to detect active network sockets and hidden listener daemons.

macOS Forensic Artifacts

Forensic examination of Apple macOS systems requires navigating the Apple File System (APFS) and macOS-specific security architectures:

• APFS Snapshots and Container Metadata: Leveraging APFS snapshot capabilities to examine point-in-time filesystem states and clone structures.
• Unified Logging System: Querying macOS trace logs using the log show command to examine system events, daemon activity, and authorization decisions.
• FSEvents Database: Parsing the File System Events (.fseventsd) daemon records to track file creation, modification, deletion, and volume mounting activity across the storage volume.
• KnowledgeC and QuickLook Databases: Extracting application usage statistics, user focus states, web browsing habits, and cached document thumbnails.
• LaunchDaemons and LaunchAgents: Reviewing property list configuration files in /Library/LaunchDaemons and /Library/LaunchAgents for unauthorized autostart persistence.

Anti-Forensics Countermeasures

Anti-forensics techniques represent intentional attempts by adversaries to compromise the availability or integrity of digital evidence. Forensic specialists employ advanced detection and recovery strategies:

• Timestomping Detection: Comparing $STANDARD_INFORMATION timestamps against $FILE_NAME timestamps in NTFS MFT records to detect artificial timestamp alteration.
• Data Wiping and Secure Deletion Identification: Identifying patterns of continuous zeros, pseudorandom bytes, or uniform overwrites across unallocated clusters.
• Steganography Analysis: Examining image, audio, and video files for anomalous Least Significant Bit (LSB) distributions and unexpected entropy variations.
• Log Clearing and Tampering Recovery: Correlating event gaps in Event Viewer logs with VSS shadow copies, MFT transaction journals, and memory residency traces.
• Rootkit and Hooking Detection: Using System Service Descriptor Table (SSDT) validation and inline function hooking checks to discover kernel modifications.

Unit 7: Network Forensics, Log Analysis, and Timeline Creation

Network forensics analyzes network traffic, packet captures, and infrastructure logs to reconstruct lateral movement, data exfiltration, and attack vectors across distributed enterprise systems.

Packet Analysis and Protocol Decryption

Investigators capture and analyze packet captures (PCAP files) using tools like Wireshark and Zeek (formerly Bro). Key examination steps include:

• DNS Query Analysis: Identifying suspicious domain lookups, fast-flux DNS configurations, and DNS tunneling used for command and control or data leakage.
• HTTP/HTTPS Session Reconstruction: Inspecting HTTP headers, User-Agent strings, POST payloads, and SSL/TLS certificate handshakes to track web-based exploitation.
• Email Header and SMTP Tracking: Analyzing Internet message headers, Received fields, SPF/DKIM verification, and MIME attachments in phishing investigations.

Super Timeline Construction

Creating an integrated super timeline is essential for establishing the precise chronological sequence of attacker activity. Using log2timeline and Plaso frameworks, examiners aggregate timestamped events from multiple sources into a single structured master timeline:

• MFT and File System MACB Timestamps: Establishing exact file creation, access, modification, and deletion milestones.
• Event Logs (EVTX): Correlating user logons (Event ID 4624), process creations (Event ID 4688), and service installations (Event ID 7045).
• Web Browser History and Download Records: Mapping initial infection vectors, downloaded payloads, and accessed phishing URLs.
• Network Flow and Proxy Logs: Aligning external firewall connections with internal endpoint execution timestamps.

Unit 8: Mobile Device Forensics and Embedded Systems

Mobile devices introduce specialized acquisition techniques due to proprietary hardware architectures, sandboxed operating systems, and hardware-backed full-disk encryption (FDE).

Mobile Acquisition Levels

• Manual Acquisition: Direct interactive browsing and photographic capture of device screen contents, used when forensic software extraction is blocked by device security policies.
• Logical Extraction: Communicating with operating system APIs through backup protocols (such as iTunes Backup or Android Debug Bridge) to extract contacts, call logs, SMS databases, and application data.
• File System Extraction: Accessing the underlying SQLite databases, configuration plist files, and sandboxed directory trees through bootloader exploits or device jailbreaking/rooting.
• Physical Extraction: Performing raw bit-stream memory acquisitions of NAND flash memory chips via JTAG (Joint Test Action Group), Chip-Off desoldering, or emergency download (EDL) modes.

Mobile App Artifact Analysis

Examiners dissect SQLite databases, Write-Ahead Logs (WAL), and shared preferences across mobile apps to reconstruct instant messaging chats (WhatsApp, Telegram, Signal), geolocation history (frequent locations and cell tower records), and health tracker sensor logs.

Unit 9: Electronic Evidence Admissibility and Section 65B Certification

In Indian judicial proceedings, technical forensic evidence must satisfy strict statutory admissibility standards under the Indian Evidence Act, 1872 (now Bharatiya Sakshya Adhiniyam, 2023). Under Section 65B of the Evidence Act, secondary electronic records (such as printouts, CD copies, server exports, or USB drives) are inadmissible unless accompanied by a statutory Section 65B Certificate.

Mandatory Requirements for Section 65B Certificates

As established by the Supreme Court of India in the landmark judgment of Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal (2020), a Section 65B certificate must:

• Identify the electronic record containing the statement and describe the manner in which it was produced.
• Give particulars of any device involved in the production of the electronic record.
• Be signed by a person occupying a responsible official position in relation to the operation of the relevant device or the management of the relevant activities.
• Affirm that the computer system was operating properly during the relevant period and that data integrity remained uncompromised.

Unit 10: Static and Dynamic Malware Analysis in Digital Investigations

When investigative targets involve infected hosts or advanced persistent threats (APTs), forensic analysts execute structured malware triage to discover indicators of compromise (IOCs) and determine attacker intent.

Static Analysis Techniques

• File Fingerprinting and Cryptographic Hashing: Generating MD5, SHA-1, and SHA-256 hashes to query threat intelligence feeds and malware repositories.
• String and Symbol Extraction: Extracting ASCII and Unicode strings using strings utilities to discover hardcoded IP addresses, URLs, registry keys, and error messages.
• PE Header and Section Inspection: Analyzing Portable Executable (PE) headers, import address tables (IAT), export tables, and section entropy to identify packed, obfuscated, or encrypted payloads.
• Disassembly and Decompilation: Using disassemblers (such as IDA Pro, Ghidra, and Cutter) to examine assembly instructions, control flow graphs, and API invocation sequences.

Dynamic Analysis and Sandboxing

• Behavioral Monitoring: Executing malware within isolated, instrumented sandbox environments (such as Cuckoo Sandbox) to record real-time filesystem modifications, registry additions, and process injection events.
• Network Capture and Simulation: Intercepting command-and-control beaconing, DNS requests, and secondary payload downloads using INetSim, Wireshark, and FakeNet.
• Kernel Debugging: Setting breakpoints in debuggers (such as x64dbg and WinDbg) to analyze memory unpacking routines and bypass anti-debugging protections.
• Signature Generation: Creating standardized YARA rules and Snort signatures to detect malware variants across network traffic and endpoint storage.

Summary of Core Forensic Principles

Successful digital investigations require strict adherence to scientific rigor, verifiable procedures, and statutory compliance. From volatile RAM acquisition and MFT parsing to cryptographic verification and chain of custody documentation, forensic practitioners provide the objective factual foundation necessary for legal adjudication in modern courts.