Digital Forensics for Infected Computer Disk and Memory: Acquire, Analyse, and Report

Cyber-crime is becoming more widespread every day, and hackers are hitting organizations' IT infrastructures with sophisticated malware. However, the victims of this malware are not only organizations; end users' IT can also become infected due to the worldwide spread of this malware. Today, major security consultancy companies clearly state the deficiency of tools, methods and experts to combat this new evolving plague. In this paper, we will discuss how special tools can be used to create images from an infected disk and memory, access and analyse them and recover data from an infected machine. Every crime leaves some evidence of the criminal, which can be in digital format or in physical appearance. In most cases of cyber-crime, evidence can be found in digital format, and the process of analysing the computer crimes with tools and techniques is known as forensic analysis, which is performed by IT security professionals. In this scenario, where a number of computers have been infected by ransomware, two solutions are available: (1) we pay the ransom to the hackers; (2) we use forensic tools to recover data and find the vulnerability exploited by the hackers in order to secure and patch other computers inside the organisation. In this paper, we will use the disk image created from an infected machine and analyse it with forensic tools to investigate what happened and why. The next step will be to recover as much data as possible from the infected disk image