An Ontology for Digital Forensics in IT Security Incidents - OPUS

Chapter 4
Forensics
This chapter will explain what data is needed for the forensic analysis and
introduce tools and techniques for retrieving, storing and accessing the data.
4.1 Forensics Basics
Forensics, short for forensic science, means the systematic application of
scientic methods for answering questions. The majority of the questions
belong to the solution of criminal acts or are otherwise connected to them.
Forensic methods are used in order to provide reasonable reproducible facts
for the solution. As forensic methods are successfully applied on cases in
various domains for a long time, they were adapted to the needs of cases
that involve computers.[Kruse and Heiser, 2001]
The term malware is used as a general label for all kinds of malicious
software. Among other things this includes viruses, rootkits, trojan horses,
worms, and dialers.
4.1.1 Real Case
In the United States of America the famous case of the BTK-killer was solved
by the help of computational forensics after several decades. The perpetrator
killed ten people and sent letters to the police in the years of 1974 to 1991.
In 2004 he sent a oppy disk with his last message. Forensic examiners
found the decisive information in the metadata of the document le.[The
Associated Press, 2012, IADT Chicago, 2011]
4.1.2 Cyber Forensics
In this document forensics specically means computational forensics, also
called IT-forensics or cyber forensics. This "involves preservation, identication,
extraction, documentation, and interpretation of computer media for
evidentiary and/or root cause analysis"[Kruse and Heiser, 2001].
15