7 - Digital Literacy - Digital Forensics

7 - Digital Literacy - Digital Forensics

Digital Forensics

KO: Introduce students to the concept of Digital Forensics.

All: Will be able to recall and understand the concept of digital forensics.

Most: Will be able to explain the importance of digital forensics in our digital age.

Some: Students will be able to use their knowledge of digital forensics to analyse case studies and identify how digital forensics could be used in different scenarios.

What is the main purpose of digital forensics?
Why is this important?

What situations can digital forensics be used as part of data recovery?

Uses for digital forensics

System Failures: Digital forensics can be used to recover lost data and determine the cause of the failure.

Accidental Deletion: Digital forensics techniques can often recover deleted files.

Cybercrime Investigations: In cases of hacking, malware, or other cybercrimes, digital forensics can help recover compromised data and provide evidence for the investigation.

Disaster Recovery: Digital forensics can be used to recover data from damaged devices.

Insider Threats: If an employee or insider is suspected of misusing data or violating policy, digital forensics can be used to recover data and investigate.

Legal Proceedings: Digital forensics can be used to recover and analyze data that may serve as evidence in court cases.

Case Study: The Stolen Painting

A valuable painting has been stolen

It was last seen on Friday afternoon.

On Monday morning, it was missing.

The museum has given you:

CCTV logs of the entrances and exits.

Employee digital records.

Keycard system logs.

Keycard System Log

| Timestamp                  | Door ID | Activity Type | User ID |

| 2024-04-19 09:00:00 | D1           | Entry                | U1          |

| 2024-04-19 09:05:00 | D2           | Entry               | U1           |

| 2024-04-19 09:30:00 | D1           | Entry                | U2          |

| 2024-04-19 10:00:00 | D2           | Entry               | U2           |

| 2024-04-19 13:00:00 | D2            | Exit                  | U1           |

| 2024-04-19 13:30:00 | D1             | Exit                  | U1           | 

| 2024-04-19 18:00:00 | D2           | Exit                  | U2           |

| 2024-04-19 18:30:00 | D1            | Exit                  | U2           |

Employee Digital Records

| Timestamp                  | Computer ID | Activity Type | User ID |

|----------------------------|-------------------|------------------|-----------|

| 2024-04-19 09:00:00 | PC1                    | Login              | U1           |

| 2024-04-19 09:30:00 | PC2                    | Login              | U2          |

| 2024-04-19 13:00:00 | PC1                      | Logout           | U1          |

| 2024-04-19 18:00:00 | PC2                     | Logout           | U2         |

CCTV Footage

| Timestamp                    | Camera ID | Activity Type | User ID |

|-----------------------------|----------------|------------------|-----------|

| 2024-04-19 09:00:00   | C1                  | Entry               | U1          |

| 2024-04-19 09:05:00   | C2                  | Entry               | U1         |

| 2024-04-19 09:30:00   | C1                   | Entry               | U2        |

| 2024-04-19 10:00:00   | C2                   | Entry               | U2        |

| 2024-04-19 13:00:00   | C2                   | Exit                   | U1        |

| 2024-04-19 13:30:00   | C1                    | Exit                   | U1        |

| 2024-04-19 18:00:00   | C2                   | Exit                   | U2       |

| 2024-04-19 18:30:00   | C1                    | Exit                   | U2       |

  

What information here might help solve the crime?

What can be learned from the sequence of events?

Who had access at the time of the crime?

Which user do you think stole the painting, if any?

What is the primary goal of digital forensics?

1. To prosecute cyber criminals
2. To recover lost data
3. To understand how and why a digital incident occurred
4. To repair damaged systems

Which of the following is a key aspect of digital forensics crime investigation?

1. Quickly making assumptions about the perpetrator
2. Ignoring the digital evidence if physical evidence is available
3. Following a systematic and documented approach to collect evidence
4. Focusing solely on high-tech crimes, like hacking or malware

Which of the following is a key aspect of data recovery using digital forensics?

1. Repairing broken systems.
2. Reading data from areas it usually can't be read from (RAM)
3. Following a systematic and documented approach to collect evidence.
4. Recovering stolen artworks.

One thing you've learned today that you found interesting