1
Cyber Forensics
Student Name
Professor
Unit Code
Date
2
Cyber Forensics
Cyber forensics is also called computer forensics and mainly involves collecting ng,
preserving, analyzing, and presenting digital evidence. Cyber forensics has played an essential
role in solving cases involving digital devices and the internet (Drobotov et al., 2023). Currently,
many crimes that happen online are due to digital devices. Some cases witnessed online include
hacking, social engineering, and phishing. This comprehensive overview will address the critical
aspects of cyber forensics through the lens of the 5 W's: What, Who, When, Where, and Why,
focusing primarily on the "What" to align with your inquiry.
WHAT
Cyber forensics includes several critical steps that ought to be followed to ensure that the
right insights are derived; the steps start from identifying potential digital evidence to presenting
the case in a court of law. Various principles in the cyber forensic investigation include
authenticity, adherence to the legal framework, confidentiality of other sensitive information, and
proper documentation (Castel o et al., 2023). The chain of custody can have both positive and
negative implications for cyber forensics. Chain of custody is a type of documentation that
identifies the changes in the control, handling, ownership, and possession of evidence. This
process is significant as it ensures that digital evidence is not altered and that high integrity is
maintained. A wide range of organizations seek to employ contract cyber security forensics
investigators. Various organizations have employed forensic investigators to help them monitor
digital devices in their organizations. Some include legal firms, government departments, private
corporations, and cyber security firms.
Essential skills are necessary for one to be a cyber forensic examiner. The essential skills
include proficiency in operating systems, cyber security principles, and networking principles.
3
The certifications that one needs to be a forensic examiner include Systems Security
Professional, Certified Computer Examiner, and Certified Forensic Computer Examiner. It is
approximated that the average salary for a cyber forensic investigator ranges from $50,000 to $
100,000.
WHO
Various sectors have decided to hire cyber forensic examiner to protect them from cyber
threats. Cyber forensics examiners are in high demand in sectors like a financial industries and
healthcare education facilities. Consulting firms, corporate sector and law enforcement team
have hired the cyber forensic examiners to protect and monitor their sensitive information form
intruders. Due to the rise in demand on cyber forensic experts, various institutions including
colleges and Universities and also online platforms like Udemy are providing this Course. The
people who apply for this position when it is advertised are mainly Forensic and Cyber security
related courses graduates.
WHEN
There are various conditions when cyber forensic investigations should be applied to
address cyber incidents and crimes. One of the circumstances includes after a cyber-attack or a
data breach, during an internal corporate investigation, and when responding to a suspicious
activity. It should also be performed as part of a legal investigation whereby illegal activities like
fraud, identity theft, and cyberstalking have happened. There are several circumstances when the
actions of the cyber forensic investigator might be called into question. The circumstances
include a breach of a chain of custody, a lack of proper documentation, and a violation of privacy
laws. When forensic investigators collect data without the user's authorization or exceeding the
4
consent scope, their actions can be challenged. Forensic investigators can also be challenged in
case they use unapproved tools, which, in most cases, compromises the evidence.
WHY
Cyber forensics plays a critical role within the broader domain of cybersecurity. Some of
the crucial aspects of cyber forensics include analysis and evidence identification. Cyber
forensics provides tools for identifying, collecting, and analyzing digital evidence from digital
devices and networks (Khan et al., 2023). Just like in any other technical field, cyber forensic
examiners should be certified for many reasons. One of the reasons for certifying a profession is
to validate their expertise and also maintain professional standards. A person who is certified has
more skills and expertise compared to a person who lacks certification. Daubert Standard is one
of the standards that is crucial in cyber forensics. The Daubert Standard plays a significant role
in the admissibility of evidence and enhancement of reliability and quality. In addition, the
Daubert standard also plays a vital role in building legal evidence.
WHERE
Cyber forensics is utilized across various organizations and industries to ensure that
digital evidence is identified and recovered. There are several places where cyber forensics is
applied. Some of them include law enforcement firms. Cyber forensics is integrated into digital
crimes like cyberstalking, cyber terrorism, and fraud to recover the evidence from web platforms
and digital evidence (OBAMANU, 2023). Cyber forensics is also applied in financial institutions
like banks to identify identity thefts, investigate fraud and data breaches of economic data, and
embezzlement. In addition, it is used in the healthcare sector in cases that involve data breaches
of patient data. One example where cyber forensics played an important role was during the
investigation of the 2014 cyber-attack on Sony Pictures Entertainment. In this case, a group
5
identified as Guardians of Peace got access to Sony's network, leading to the breaching of
employees' confidential data.
The cyber forensic investigation steps used in this case include malware identification.
The investigators analyzed the malware used to penetrate the Sony defense infrastructure. The
other step involved the recovery of digital evidence. Logs and malicious software were identified
as part of the digital footprints left during the attack. The other thing that was part of the forensic
investigation was attribution. Through forensic analysis, the U.S. Federal Bureau of Investigation
attributed the attack to North Korea. They cited the malware's similarities to other malware used
by North Korean hackers and the attack's motivations linked to a movie called The Interview.
The outcome of this investigative process was crucial in identifying the penetrators, the
tools used, and providing evidence of the penetrator, who was North Korean. The result of this
case also outlines the importance of cyber forensics in attributing cyber-attacks to specific actors.
In addition, it also illustrates the role of cyber forensics in modern digital investigation.
Reference
6
Castelo Gómez, J. M., Carrillo-Mondéjar, J., Roldán-Gómez, J., & Martínez Martínez, J. L.
(2023). A concept forensic methodology for the investigation of IoT cyber incidents.FThe
Computer Journal, bxad062.
Drobotov, S., Pertsev, R., Hrab, M., Fedytnyk, V., Moroz, S., & Kikalishvili, M. (2023).
Forensic Research of the Computer Tools and Systems in the Fight against
Cybercrime.FJournal of Information Technology Management,F15(1), 135-162.
Khan, A. A., Shaikh, A. A., & Laghari, A. A. (2023). IoT with multimedia investigation: A
secure process of digital forensics chain-of-custody using blockchain hyperledger
sawtooth.FArabian Journal for Science and Engineering,F48(8), 10173-10188
OBAMANU, G. (2023). LEGAL ISSUES AND CHALLENGES IN THE ADMISSIBILITY OF
DIGITAL FORENSIC EVIDENCE IN COURTS IN NIGERIA.FAJIEEL,F8(01), 96-109.
