Computer Incidents Analysis based on Live Response Script

In the course of providing electronic evidence a number of commercial tools are used. The users of this tolls very often are not able to explain the way they are operating and the manner in which the report is generated. There is an increased need for developing and using of scripts and programs which can be used to provide information from information systems which are not switched off. At the same time the examiners must be able to explain the script functionality and generated result and information. In this paper we are presenting a developed script which can be used to perform a live forensics analysis used to analyze volatile data

Корпорациска истрага на компјутерски криминален инцидент

Во овој труд обработена е проблематиката на спроведување на истражни постапки во рамките на институцијата во која се случил компјутерскиот криминален инцидент, односно опишана е таканаречената корпорациска истрага, почнувајќи од првите информации за случување на криминалниот инцидент, преку составување на корпорациски тим за истрага, извршување на истражните активности, собирање на дигитални докази, нивната припрема за презентација пред врвните менаџери на институцијата, па се до донесувањето на одлука дали е потребно истрагата да се предаде во надлежност на званичните истражни органи или не. На крајот е даден пример за спроведување на една ваква истрага

Novel First Responder Script as a Tool for Computer Forensics

The computer forensics as a branch of digital forensic pertaining to legal evidence found in computers and digital storage media. In order forensic acquisition to be more reliable it must be performed on computers that have been powered off. This type of forensics is known as ‘traditional’ or 'dead' forensic acquisition. However, this type of forensic cannot be used to collect and analyze the information which is not on the hard disk, or encrypted data. The disadvantages of the dead forensics can be overcome handling a live forensics acquisition process. There are many commercial and freeware tools which can be used to provide information based on live forensics acquisition. The problem with this tools is that in many cases the examiner cannot explain the script functionality and generated results and information. Because of this reason there is a increased need for developing and using script which can be easy explained and adapted to any analysis which should be made by the examiners. The paper presents a developed First Responder script which can be used to perform a live forensics analysis

Novel First Responder Digital Forensics Tool as a Support to Law Enforcement

There are many freeware and commercial tools which can be used to provide forensics information based on dead and live forensics acquisition. The main problem with these tools is that in many cases the investigator cannot explain the script functionality and generated results and information during the trial. Because of this reason there is an increased need for developing and using script which can be easy explained and adapted to any analysis which should be made by the examiners. The chapter presents a novel developed First Responder script which can be used to perform a live and dead forensics analysis in support of Law Enforcement during the investigation process

Cyber security issues of telecommunication infrastructure

We live in a well connected and technology dependent world. People, institutions, companies have increasing need for communication in everyday life. Global and seamless connectivity today is enabled by complex telecommunications infrastructure consisted of a large variety of different technologies which are in a continuous process of development and innovations. But, the global connectivity and easy access to modern technology also enables malicious users and their activities. These activities might be of different nature: starting from passive monitoring to destructive attacks disabling the normal operation of ICT (information and communication technology) infrastructure. Therefore, security issues of telecommunication infrastructure must be thoroughly addressed by all relevant stakeholders. Although each technology includes certain security mechanisms, it is necessary to create well designed security concept for the infrastructure as a whole, taking into consideration not only the technical issues, but also policy framework and legal aspects. The concept must be a subject of constant revision in order to be up to date to current threats. Therefore, the network infrastructure must be always monitored and analyzed, in order to create efficient measures against the security threats. The telecommunication infrastructure in the Republic of Macedonia is owned and operated by state institutions, telecom operators and providers, other companies and universities etc. All of them are faced with number of malicious activities and attacks exploiting vulnerabilities of the systems, which are well monitored and statistically analyzed. Also, all of them has defined more or less effective security concept including proactive and reactive measures. However, a common practice of cooperation and exchange of information and experience among the subjects is missing. A national strategy and policy framework are also missing. Their creation and devoted implementation would be beneficial for all stakeholders resulting in more effective and less expensive solutions as a response to cyber attack