Coding - Digital forensics: an integrated approach for the investigation of cyber/computer rela

172

Landing Page

<!DOCTYPE html> <html>

<body>

<h1 style="margin-bottom:0;">The 2IR Methdology</h1></div> <div id="header" style="background-color:#FFFF00;">

<h3 style="margin-bottom:0;">Facets: Technical(T) Legal(L) Education (E)Ethical (E1)</h3></div>

<div id="menu" style="background-

color:#FFFF00;height:200px;width:100px;float:left;"> <b>Phases</b><br>

Initiation (I1)<br> Investigative (I2)<br> Reporting (R)</div>

<div id="content" style="background-

color:#00FF00;height:200px;width:400px;float:left;">

The 2IR methodology has three major phases ( described in the framework) that will be further broken down in to more specific steps. It is designed to be prescriptive and rigorous while ensuring speed and accuracy. It is prescriptive because it will include recommendations of the use of particular tools at different stages in the process and is guided by standards. It is rigorous because it is expected that no phase will be excluded. This measure ensures the model is accurate and reliable. Educational training and qualification along with legal and ethical principles encompass the methodology.</div> <div id="footer" style="background-color:#0000ff;clear:both;text-align:center;"> Copyright © Moniphia Hewling (eMRockOnline.com)</div>

</div> </body> </html>

173 Idle page

<h1>2IR Digital Forensics </h1>

Practitioner Name: <input type="text" name="firstname"><input type="text" name="lastname"><br>

PractitionerNumber<input type="number" number="PractitionerNumber"> <br>

</form>

Date (date and time): <input type="datetime" name="daytime">

</form>

<form name="input" action="html_form_action.asp" method="get"> UserID: <input type="text" name="user">

Password: <input type="password" name="pwd"> <input type="submit" value="Submit">

</form> <br> <br> <br>

174

</div> </body> </html>

Case detail Page (Page 3Coding)

<div id="header" style="background-color:#FFFF00;"> <h2><center>2IR Digital Forensics</center></h2> <p><b>Practitioner Name: </b></p>

<p>Practitioner Number: </p> <form>

Requesting Organisation: <input type="text" Requester="Requester"><br> Contact Name: <input type ="text" ContactName="ContactName"><br>

Type of Organisation: <input type="text" requester="requestingOrganisation"><br> Location/s: <input type ="text" Location="Location"><br>

Date of Request: <input type= "date" Date of Request="date"><br> <h4>Nature of investigation Requested</h4>

Criminal <input type="text" name="Criminal"><br>

Routine/Civil/eDiscovery: <input type="text" name="non criminal"> <h4>Investigation required</h4> <br>

<input type="checkbox" name="Yes" value="Yes">Investigation required<br> <input type="checkbox" name="No" value="No">No Investigation Required </form>

175 <h4>Legal Authorisation needed</h4>

<input type="radio" name="internal" value="internal">internal<br> <input type="radio" name="External" value="external">external <form/>

</body> <body>

<input type="button" onclick="myFunction()" value="Continue to phase one (I1)" /> <div id="footer" style="background-color:#0000ff;clear:both;text-align:center;"> Copyright © Moniphia Hewling (eMRockOnline.com)</div>

</div> </body> </htm2>

Phase 1 The Initiation Phase

<htm5>

<body style="background-color: yellow;"> <h1>2IR Digital Forensics</h1>

<p>Practitioner Name: </p> <p>Practitioner Number: </p> <p>Case Number: </p>

<form>

<h3>Phase 1 - Investigative (I1) </h3> <h4> Assessments complete?</h4> <p>Data Assessment</p>

<input type="checkbox" name="answer" value="Yes">Yes <input type="checkbox" name="answer" value="no">No <p>Pesonnel Assessment</p>

<input type="checkbox" name="answer" value="Yes">Yes <input type="checkbox" name="answer" value="no">No <p>Device Assessment</p>

176 <h4> Risk analysis complete?</h4>

<p>General Risk Analysis</p>

<input type="checkbox" name="answer" value="Yes">Yes <input type="checkbox" name="answer" value="no">No <p>Personal/Practitioner Risk Analysis</p>

<input type="checkbox" name="answer" value="Yes">Yes <input type="checkbox" name="answer" value="no">No <p>Requester/Company Risk Analysis</p>

<input type="checkbox" name="answer" value="Yes">Yes <input type="checkbox" name="answer" value="no">No<br> <h4> Legal permission been acquired?</h4>

<p>legal Authorisation</p>

<input type="checkbox" name="answer" value="Yes">Warrant

<input type="checkbox" name="answer" value="no">Permission<br>

<p><b> NB. all analysis and assessments must be complete before the investigation continues. It is recommended that legal advice and authorisation be received before any further are steps taken. </b> <br><br>

<h2>Phase 1 (I1) Complete?</h2>

<input type="checkbox" name="answer" value="Yes">Yes, Continue to phase 2 <br> <input type="checkbox" name="answer" value="no">No Revisit(enter missing task): <input type="text" name="user">

function myFunction() {

alert("Do you want to continue!"); }

177 </head>

<body>

<input type="button" onclick="myFunction()" value="Continue to phase two (I2)" /> <div id="footer" style="background-color:#0000ff;clear:both;text-align:center;"> Copyright © Moniphia Hewling (eMRockOnline.com)</div>

</div> </body> </htm5>

Phase 2 Investigative phase

<!DOCTYPE html>

<div id="header" style="background-color:#FFFF00;"> <h2>2IR Digital Forensics</h2>

<p>Practitioner Name: </p> <p>Practitioner Number: </p> <p>Case Number: </p>

</form>

<h3>Phase 2 (Investigative) </h2>

<h4>Crime Scene Captured (Photo,drawing, etc)</h4> <input type="checkbox" name="answer" value="Yes">Yes <input type="checkbox" name="answer" value="no">No <br>

<h4>Methods used</h4> <form>

<input type="checkbox" name="capture" value="Drawing">Drawing<br>

<input type="checkbox" name="capture" value="Digital Camera">Digital Camera<br> <input type="checkbox" name="capture" value="Notes">Notes<br>

<input type="checkbox" name="capture" value="Other">Other </form>

<h4>Number of Suspect devices </h4> <form>

Suspect devices: <input type="number" name="suspectdevice/s"><br> <h4>Live Data captured</h4>

178

<input type="checkbox" name="answer" value="no">No<br> <h4> Devices removed to control area </h4>

<input type="checkbox" name="answer" value="Yes">Yes <input type="checkbox" name="answer" value="no">No<br> <h4> Static Data Captured </h4>

<input type="checkbox" name="answer" value="Yes">Yes <input type="checkbox" name="answer" value="no">No<br> <h4> Data Mined </h4>

<input type="checkbox" name="answer" value="Yes">Yes <input type="checkbox" name="answer" value="no">No<br> <h4> Live data preserved </h4>

<input type="checkbox" name="answer" value="Yes">Yes <input type="checkbox" name="answer" value="no">No<br> <h4> Static data preserved </h4>

<input type="checkbox" name="answer" value="Yes">Yes <input type="checkbox" name="answer" value="no">No<br> <h4> Data Analysed </h4>

<input type="checkbox" name="answer" value="Yes">Yes <input type="checkbox" name="answer" value="no">No<br> <h4>Tools used </h4>

<form>

Software Tools: <input type="text" name="firstname"> <input type="text" name="firstname"><br>

Hardware Tools: <input type="text" name="lastname"> <input type="text" name="firstname"><br>

</form>

<h3> Phase 2 (I2) Complete? </h3>

179 {

alert("Do you want to continue!"); }

</script> </head> <body>

</div>

Phase 3 Reporting

<!DOCTYPE html>

<div id="header" style="background-color:#FFFF00;"> <h2><center>2IR Digital Forensics</center></h2> <p>Practitioner Name: </p>

<p>Practitioner Number: </p> <p>Practitioner Number: </p> <p>Case Number: </p>

<h3>Phase 3 (Report Creation) </h3> <form>

<h4>Inventory Created</h4> <p>Hardware devices</p>

<input type="checkbox" name="answer" value="Yes">Yes <input type="checkbox" name="answer" value="no">No <p>Software</p>

<input type="checkbox" name="answer" value="Yes">Yes <input type="checkbox" name="answer" value="no">No <p>Additional Items</p>

<input type="checkbox" name="answer" value="Yes">Yes <input type="checkbox" name="answer" value="no">No <h4>Reconstruction of Crime Scene done</h4>

180

<input type="checkbox" name="answer" value="Yes">Yes <input type="checkbox" name="answer" value="no">No <h4>Intrusion Profile created</h4>

<input type="checkbox" name="answer" value="Yes">Yes <input type="checkbox" name="answer" value="no">No <h4>Archive done</h4>

<input type="checkbox" name="answer" value="Yes">Yes <input type="checkbox" name="answer" value="no">No <h4>Report Completed</h4>

<input type="checkbox" name="answer" value="Yes">Yes <input type="checkbox" name="answer" value="no">No <h4>Report Checked</h4>

<input type="checkbox" name="answer" value="Yes">Yes <input type="checkbox" name="answer" value="no">No <h4>Report Submitted</h4>

<h2>Phase 3 (R) Complete?</h2>

<input type="checkbox" name="answer" value="Yes">Yes, End of Investigation <br> <input type="checkbox" name="answer" value="no">No Revisit(enter missing task): <input type="text" name="user">

<input type="submit" value="Submit"> </form> <head> <script> <head> <script> function myFunction() {

181 }

</script> </head> <body>

<input type="button" onclick="myFunction()" value="End of Investigation (R)" /> <h4>Generate Investigation report</h4>

End of investigation <!DOCTYPE html> <html>

<body>

<h1><center>2IR <center>Digital Forensics </center></h1> <p>Thank You

<p>Practitioner Name: </p> <p>Practitioner Number: </p>

<p>Based on your input to the 2IR Forensics Application the investigation is complete. </p>

<h2><center>Thank you for using the 2IR App!!!</center></h2> </body>

</html>

182

In document Digital forensics: an integrated approach for the investigation of cyber/computer related crimes (Page 183-194)