IT Forensics
Forensic Hacking
When investigating crimes or other offenses, it is often necessary to access and analyze digital evidence. The scene of the crime may be a computer system or a communications network such as the Internet, or the crime may have taken place in the physical world; in either case, investigators need data to serve as clues, to reconstruct the crime, or as evidence.
Many systems, networks, and applications today offer IT security mechanisms that enable users to protect their data from hackers. However, perpetrators can also exploit these security mechanisms for anti-forensic purposes, making it difficult or even impossible for investigators to access existing digital traces.
Even when perpetrators employ IT security mechanisms or other forensic defense mechanisms, investigators can often still access the desired data. This is because, in practice, implementations of IT security mechanisms in systems, networks, or applications are often flawed. Investigators can exploit this to bypass forensic defenses and obtain relevant data. When taking such an approach, special care must always be taken to ensure that the evidential value of the data is preserved.
Anyone seeking to discover and exploit gaps in security mechanisms requires extensive expertise in IT security analysis—both at the conceptual and implementation levels. Fraunhofer SIT possesses extensive expertise in identifying and exploiting vulnerabilities in IT security mechanisms. In addition, Fraunhofer SIT has a large collection of tools that can be used for forensic purposes. Examples of security vulnerabilities discovered by Fraunhofer SIT during analysis work include:
