Effective Management of Rapid Intervention, Investigation, Analysis And Reporting Processes on Crimes Committed By Computer With New Generation Forensic Informatics Methods

Abdulkerim Oğuzhan Alkan; İbrahim Dogru; İsmail Atacak

Article Details

Effective Management of Rapid Intervention, Investigation, Analysis And Reporting Processes on Crimes Committed By Computer With New Generation Forensic Informatics Methods

Authors:

Abdulkerim Oğuzhan Alkan | İbrahim Dogru | İsmail Atacak

Publisher:

Gazi University

Main Topics:

Mühendislik

Journal:

Politeknik Dergisi Vol.27 Issue 5, pp.1945-1954

Document Type:

Article

Publication Date:

2/2024

Document Language:

English

Document ID (Org No.):

2001331569

pISSN:

2147-9429

Keywords:

Abstract:

 Because of the exponential growth in the volume and speed of attack vectors, the rapid growth of computer crimes, the corporate attack surface and the enormous volumes of data, preventing the cyber-attacks has become very difficult. In terms of forensics, classical forensic methods in a traditional approach which include removing the disk, gettng its image and examining the image takes a lot of time with the increasing amount of data so that this situation leads to make quick intervention too difficult against cyber attack and it takes a lot of time. For example, on average, getting an image of harddisk which include 20 terabyte capacity takes 2 days of time. As a solution, with a special tool Binalyze AIR that collects only evidentiary documents getting hash of all evidences Disk Proof, Proof of Memory, Proof of Scanner, Proof of NTFS, Proof of Log, Proof of Network, Proof of Event Logs, Proof of WMI, Proof of Process Execution, etc. and collects only the documents that have the quality of evidence, thus this process can be completed in a very short time. It provides effective management of crime scene investigation and fast response to crimes committed by computer, investigation, analysis and reporting processes blocked with traditional forensic methods and offers an innovative solution to the scientific literature. In summary, in this study, the results obtained by using modern forensic techniques Binalyze AIR and Binalyze Tactical software are presented in comparison with classical forensic methods.

 Because of the exponential growth in the volume and speed of attack vectors, the rapid growth of computer crimes, the corporate attack surface and the enormous volumes of data, preventing the cyber-attacks has become very difficult. In terms of forensics, classical forensic methods in a traditional approach which include removing the disk, gettng its image and examining the image takes a lot of time with the increasing amount of data so that this situation leads to make quick intervention too difficult against cyber attack and it takes a lot of time. For example, on average, getting an image of harddisk which include 20 terabyte capacity takes 2 days of time. As a solution, with a special tool Binalyze AIR that collects only evidentiary documents getting hash of all evidences Disk Proof, Proof of Memory, Proof of Scanner, Proof of NTFS, Proof of Log, Proof of Network, Proof of Event Logs, Proof of WMI, Proof of Process Execution, etc. and collects only the documents that have the quality of evidence, thus this process can be completed in a very short time. It provides effective management of crime scene investigation and fast response to crimes committed by computer, investigation, analysis and reporting processes blocked with traditional forensic methods and offers an innovative solution to the scientific literature. In summary, in this study, the results obtained by using modern forensic techniques Binalyze AIR and Binalyze Tactical software are presented in comparison with classical forensic methods.

 Because of the exponential growth in the volume and speed of attack vectors, the rapid growth of computer crimes, the corporate attack surface and the enormous volumes of data, preventing the cyber-attacks has become very difficult. In terms of forensics, classical forensic methods in a traditional approach which include removing the disk, gettng its image and examining the image takes a lot of time with the increasing amount of data so that this situation leads to make quick intervention too difficult against cyber attack and it takes a lot of time. For example, on average, getting an image of harddisk which include 20 terabyte capacity takes 2 days of time. As a solution, with a special tool Binalyze AIR that collects only evidentiary documents getting hash of all evidences Disk Proof, Proof of Memory, Proof of Scanner, Proof of NTFS, Proof of Log, Proof of Network, Proof of Event Logs, Proof of WMI, Proof of Process Execution, etc. and collects only the documents that have the quality of evidence, thus this process can be completed in a very short time. It provides effective management of crime scene investigation and fast response to crimes committed by computer, investigation, analysis and reporting processes blocked with traditional forensic methods and offers an innovative solution to the scientific literature. In summary, in this study, the results obtained by using modern forensic techniques Binalyze AIR and Binalyze Tactical software are presented in comparison with classical forensic methods.

 Saldırı vektörlerinin hacmindeki ve hızındaki üstel büyüme, bilgisayarla işlenen suçların hızlı artışı, kurumsal saldırı yüzeyi ve yönetilecek veri miktarının çok büyük hacimlere ulaşması, bireysel ve kurumsal siber güvenlik içinde 100 ihlal önlemenin artık gerçekçi bir beklenti olmadığının kabul edilmesine yol açmıştır. Adli bilişim açısından klasik adli bilişim yöntemleri ile geleneksel yaklaşım; adli vakada diski sökmek, imajını almak ve incelemek artan veri miktarının büyüklüğüyle birlikte çok zaman almakta ve hızlı müdahaleyi zorlaştırmaktadır. Ortalama 20 terabaytlık bir diskin sadece imajını almak bir elektronik delilin kopyasının oluşturulması 2 gün sürmektedir. Olay yeri müdahalesinde sadece delil niteliği taşıyan belgeleri toplayan özel bir araçla Binalyze AIR bilgisayarı kapatmadan, tüm delillerin Disk Kanıtı, Hafıza Kanıtı, Tarayıcı Kanıtı, NTFS Kanıtı, Kayıt Kanıtı, Ağ Kanıtı, Olay Günlükleri Kanıtı, WMI Kanıtı, Süreç Yürütme Kanıtı vb. hashini alarak, kopyalayıp ön rapor oluşturulabilmekte ve bu süreci çok kısa bir sürede tamamlayabilmekte ve geleneksel adli bilişim yöntemleri ile tıkanan olay yeri inceleme ve bilgisayarla işlenen suçlara hızlı müdahale, inceleme, analiz ve raporlama süreçlerinin etkin yönetimini sağlamakta ve bilimsel literatüre yenilikçi bir çözüm sunmaktadır. Bu çalışmada Binalyze AIR ve Binalyze Tactical yazılımları kullanılarak çağdaş adli bilişim teknikleri ile çalışmalar yapılarak elde edilen sonuçlar karşılaştırmalı olarak ortaya konulmuştur.

Article Details

Effective Management of Rapid Intervention, Investigation, Analysis And Reporting Processes on Crimes Committed By Computer With New Generation Forensic Informatics Methods

Authors:

Abdulkerim Oğuzhan Alkan | İbrahim Dogru | İsmail Atacak

Publisher:

Gazi University

Main Topics:

Mühendislik

Journal:

Politeknik Dergisi Vol.27 Issue 5, pp.1945-1954

Document Type:

Article

Publication Date:

2/2024

Document Language:

English

Document ID (Org No.):

2001331569

pISSN:

2147-9429

Traditional forensics

contemporary forensics

binalyze air

binalyze tactical.Geleneksel adli bilişim

çağdaş adli bilişim

binalyze air

binalyze tactical.

Issues

Article Details

Authors: Abdulkerim Oğuzhan Alkan | İbrahim Dogru | İsmail Atacak

Publisher: Gazi University

Main Topics: Mühendislik

Journal: Politeknik Dergisi Vol.27 Issue 5, pp.1945-1954

Document Type: Article

Publication Date: 2/2024

Document Language: English

Document ID (Org No.): 2001331569

pISSN: 2147-9429

Issues

Authors:

Abdulkerim Oğuzhan Alkan | İbrahim Dogru | İsmail Atacak

Publisher:

Gazi University

Main Topics:

Mühendislik

Journal:

Politeknik Dergisi Vol.27 Issue 5, pp.1945-1954

Document Type:

Article

Publication Date:

2/2024

Document Language:

English

Document ID (Org No.):

2001331569

pISSN:

2147-9429