Cyber Forensics in C-DAC

Jul 31, 2013

Resource Centre for Cyber Forensics

Technical Resource Centre

Establishment of Technical Resource Centre (TRCCF) to follow up the implementation of IT ACT 2000 of Government of India Indigenous development of Disk and Network Forensics Tools Expert Technical Services to Law Enforcement Agencies such as Forensic Analysis, Authentication and Evidence presentation Training to personnel of Judiciary, Police and other Law Enforcement Agencies & Public and Private Corporates on Cyber Forensics
Jul 31, 2013 Resource Centre for Cyber Forensics 2

TRCCF Achievements
Successfully developed the countrys first set of indigenous Cyber Forensics Tools CyberCheck Suite comprising of TrueBack, CyberCheck and Email Tracer Over 50 licenses of the product supplied to several Law Enforcement Agencies in the country (CBI, DFSL, ACSE) Conducted a number of training programs to LEA (Police, Judiciary) Assisted LEA in analyzing over 20 Cyber Crime cases
Jul 31, 2013 Resource Centre for Cyber Forensics 3

Resource Centre
The success of the TRCCF project and the request for new features and facilities from end users prompted DIT to setup a Resource Centre for Cyber Forensics at CDAC, Thiruvananthapuram. Objectives To establish Resource Centre for Cyber Forensics (RCCF) for enhancing cyber forensics tools already developed as well as carrying out new developments, while meeting the requirements of the Law enforcement agency.

Jul 31, 2013

Resource Centre for Cyber Forensics

RCCF Achievements
DeviceAnalyst Suite Device Forensics Tools PDA Imager & Analyzer Tool for imaging and analyzing PDA contents SIM Card Imager & Analyzer Tool for imaging and analyzing GSM SIM Card contents CDR Analyzer Tool for analyzing Call Data Records Cyber Forensics Hardware Tools TrueImager High speed H/W based Disk Imaging Tool TrueLock H/W based drive lock for write protecting IDE/SATA disks RCCF and E-learning Portal : www.cyberforensics.in
Jul 31, 2013 Resource Centre for Cyber Forensics 5

RCCF Achievements
Training Conducted 18 training programmes to leading Law Enforcement Agencies and Judiciary Technical Services Received material objects involved in more than 150 cyber crime cases and submitted reports on 93 cases after analysis.

Jul 31, 2013

Resource Centre for Cyber Forensics

RCCF Other Achievements

Expertise has been built up to tackle new development challenges in Cyber Forensics and Cyber Crime Analysis. Well equipped lab setup with facilities for analyzing most types of cyber crimes. About 75 copies of CyberCheck Suite have been supplied to different Law Enforcement Agencies of the country during the period of the RCCF project. Enrolled as an Associate Member of National White Collar Crime Centre (NW3C), USA.

Jul 31, 2013

Resource Centre for Cyber Forensics

RCCF Outcome
Development of Cyber Forensics tools comparable to international tools like ENCASE. Deployment and usage of these tools by leading Law Enforcement Agencies like CBI, IB, State Police Departments and Forensic Science Labs. CBI is using our tools extensively for training. Analysis of very important cyber crime cases using the developed tools.

Jul 31, 2013

Resource Centre for Cyber Forensics

Enterprise Forensics
Objectives Design and development of Enterprise Forensics System Development of Advanced Cyber Forensics Hardware and Software Tools Setting up Virtual Training Environment

Jul 31, 2013

Resource Centre for Cyber Forensics

Enterprise ForensicsAchievements Cyber Forensics Software Tools

a. b. c. d. e. f. g. CyberCheck Ver 4.1 MobileCheck Ver 1.0 Forensic Data Carver (F-DaC) Forensic Registry Analyzer (F-RAN) Forensic Thumb Nail Extractor (F-TEx) TrueBack Forensic Edition (Windows and Linux) Windows Live System Imager and Analyzer (WinLift)

Jul 31, 2013

Resource Centre for Cyber Forensics

10

Enterprise ForensicsAchievements Cyber Forensics Hardware Tools

a. TrueImager Ver 2.0 (Handheld Imaging tool)

b.

TrueBackBridge (for Imaging computers without physically opening them)

c.

TrueTraveller (portable forensic toolkit)

Jul 31, 2013

Resource Centre for Cyber Forensics

11

Enterprise ForensicsAchievements Enterprise Forensics System

Designed and developed an Enterprise Forensics tool for carrying out forensics on remote systems in a network

Jul 31, 2013

Resource Centre for Cyber Forensics

12

Enterprise ForensicsAchievements Virtual Training Environment

Setup a Virtual training environment and developed modules (including practical sessions) for carrying out training in Basic and Advanced Cyber Forensics using this environment. The system has been successfully used in various training programmes.

Jul 31, 2013

Resource Centre for Cyber Forensics

13

Enterprise ForensicsAchievements 42 Copies of Cyber Forensics Tools developed at RCCF supplied to IT Centre, Damascus, Syria setup by Ministry of External Affairs, India. Order value is Rs. 46.2 lakhs. MCTE, MHOW placed an order worth Rs 22 lakhs for Cyber Forensics tools and training. RCCF participated in the Cyber Forensics Challenge organized by the Cyber Crime (DC3) cell of the US Department of Defence and was ranked 12 among non US participants.

Jul 31, 2013

Resource Centre for Cyber Forensics

14

Current Activities
Design and Development of BitLocker Decryption tool Design and development of ISCSI based forensic tool Design and development of Photo Forensics tool Design and development of Language Identification tool Design and development of Virtual forensics tool Design and development of Mobile Phone Hardware tool Porting of existing tools to 64 bit environment
Jul 31, 2013 Resource Centre for Cyber Forensics 15

Main Objectives of RCCF

1. Design and development of cyber forensics tools 2. Technical Support Consultancy and Analysis of cyber crimes 3. Training on Cyber Forensics

Forensic Tools developed by C-DAC

Disk Forensics Tools TrueBack Disk Imaging Tool CyberCheck Data Recovery and Analysis Tool Network Forensics Tools CyberInvestigator Forensic Log Analyzer NeSA on Linux Network Session Analyzer EmailTracer Tool for tracing sender of email Live Forensics Tools WinLift - Examining and analyzing live systems Enterprise Forensics EFS - Enterprise Forensic System Tool

Jul 31, 2013

Resource Centre for Cyber Forensics

17

Forensic Tools developed by C-DAC

Free Forensics Tools F-RAN Forensic Registry analyzer F- DAC Forensic Data Carver F-TEx - Forensic Thumb Nail viewer Device Forensics Tools PDA Imager & Analyzer Tool for imaging and analyzing PDA contents SIM Card Imager & Analyzer Tool for imaging and analyzing GSM SIM Card contents MobileCheck Software for forensics of mobile phones
Jul 31, 2013 Resource Centre for Cyber Forensics

18

Forensic Tools developed by C-DAC

Cyber Forensics Hardware Tools
TrueImager High speed H/W based Disk Imaging Tool TrueLock H/W based drive lock for write protecting IDE/SATA disks TrueTraveller Portable Forensics kit TrueBackBridge Device to seize/image computers without physically removing the hard disk.

Jul 31, 2013

Resource Centre for Cyber Forensics

19

Main Achievements

Within a very short period, the Resource Centre for Cyber Forensics (RCCF) has established itself as a Centre of Excellence in Cyber Forensics. RCCF was dedicated to the nation on Aug 23rd, 2008 by the Honble Union Minister of Communications and Information Technology. Designed and developed the first indigenous suite of products for carrying out cyber forensics investigation. The Centre has generated over Rs. 300 lakhs through commercialization of its products. More than 1500 Law Enforcement Officers have been trained through various training programmes. The Centre has conducted over forty training progarmmes and generated a revenue of Rs. 85 lakhs. Technical support in cyber crime analysis of over 400 cases, some of paramount importance,has been provided.
Jul 31, 2013 Resource Centre for Cyber Forensics 20

Organizations that use CyberCheck Suite

National Investigation Agency Army Cyber Security Establishment, New Delhi Intelligence Bureau, New Delhi Delhi Police, New Delhi CBI and CBI Academy, Ghaziabad GEQDs of Hyderabad and Shimla CFSL, Hyderabad FSLs of Chandigarh, Chennai, Thiruvananthapuram and Haryana DFSL, Gujarat Cyber Crime Investigation Cell, Thane, Maharashtra Cyber Cells of Bangalore and Arunachal Pradesh SCRB, Thiruvananthapuram National Academy of Taxes, Nagpur National Police Academy, Hyderabad Cabinet Secretariat, New Delhi Kerala IT Mission, Thiruvananthapuram Hitech Cyber Cell, Thiruvananthapuram

Training on Cyber Forensics

Conducted more than 40 training programmes to leading Law Enforcement Agencies and Judiciary. Over 1500 Law Enforcement officers have been trained

Technical Support
Nature of Crime Hacking Document Forgery Financial Frauds Software Piracy Pornography Mobile Phone Crime Email Crimes Total Number 31 142 59 10 24 104 57 427

Technical Support
Agency RAW CBI Bangalore Police CCPS Bangalore Chennai Police BPCL CDAC Crime Branch, Kerala Vigilance, Kerala Kerala Police Total Reported Cases 1 32 29 39 7 1 1 36 49 232 427 Analysis Completed 1 28 25 36 6 1 1 29 41 188 356

Technical Support

Agency CDAC Central Govt Agencies Kerala Police Others Total

Submitted Media 74 11 35 29 149

Recovery Completed 69 9 31 26 135

Other Activities
Setup Cyber forensics labs for Department of Income Tax and Department of Revenue Intelligence Setup Digital Training and Analysis Centre for Kerala Police and Cyber Forensics lab for National Investigation Agency Currently setting up a state of the art Cyber Forensics lab for Madhya Pradesh Police

Advantages of C-DAC Solutions

Completely indigenous development Self-reliance in technology Cost-effective solution Developed for Law Enforcement Agencies and Corporate houses Total technical support
Jul 31, 2013 Resource Centre for Cyber Forensics 27

What C-DAC can offer

Provide a well tested and certified cyber forensics suite of products (CyberCheck Suite) for acquisition and analysis on portable lab as well as forensic workstation Cost effective solution Software for Network Forensics, Live Forensics and Device Forensics Hardware tools for disk forensics Introductory and advanced training in cyber forensics
Jul 31, 2013 Resource Centre for Cyber Forensics 28

THANK YOU

Jul 31, 2013

Resource Centre for Cyber Forensics

29