Introduction, Historical background of Cyber

Cyber forensics is a process of extracting data as proof for a crime (that involves electronic devices) while following proper investigation rules to nab the culprit by presenting the evidence to the court. Cyber forensics is also known as computer forensics. The main aim of cyber forensics is to maintain the thread of evidence and documentation to find out who did the crime digitally. Cyber forensics can do the following: It can recover deleted files, chat logs, emails, etc It can also get deleted SMS, Phone calls. It can get recorded audio of phone conversations. It can determine which user used which system and for how much time. It can identify which user ran which program. Cyber forensics helps in collecting important digital evidence to trace the criminal. Electronic equipment stores massive amounts of data that a normal person fails to see. For example: in a smart house, for every word we speak, actions performed by smart devices, collect huge data which is crucial in cyber forensics. It is also helpful for innocent people to prove their innocence via the evidence collected online. It is not only used to solve digital crimes but also used to solve real-world crimes like theft cases, murder, etc. Businesses are equally benefitted from cyber forensics in tracking system breaches and finding the attackers. Cyber forensics is a field that follows certain procedures to find the evidence to reach conclusions after proper investigation of matters. The procedures that cyber forensic experts follow are: Identification: The first step of cyber forensics experts are to identify what evidence is present, where it is stored, and in which format it is stored. Preservation: After identifying the data the next step is to safely preserve the data and not allow other people to use that device so that no one can tamper data. Analysis: After getting the data, the next step is to analyze the data or system. Here the expert recovers the deleted files and verifies the recovered data and finds the evidence that the criminal tried to erase by deleting secret files. This process might take several iterations to reach the final conclusion. Documentation: Now after analyzing data a record is created. This record contains all the recovered and available(not deleted) data which helps in recreating the crime scene and reviewing it. Presentation: This is the final step in which the analyzed data is presented in front of the court to solve cases.