Cyber Security and Digital Forensics (4361601) - Summer 2025 Solution

Question 1(a) [3 marks]

#

Give comparison between Public key and Private Key cryptography.

Answer:

Mnemonic: “Private Personal, Public Pair”

Question 1(b) [4 marks]

#

Explain CIA Triad in detail.

Answer:

CIA Triad is the foundation of information security with three core principles:

Diagram:

graph TD
    A[CIA Triad] --> B[Confidentiality]
    A --> C[Integrity]
    A --> D[Availability]
    B --> E[Data Privacy]
    C --> F[Data Accuracy]
    D --> G[System Access]

• Confidentiality: Ensures data is accessible only to authorized users
• Integrity: Maintains accuracy and completeness of data
• Availability: Ensures systems are accessible when needed

Mnemonic: “Can I Access” (Confidentiality, Integrity, Availability)

Question 1(c) [7 marks]

#

Explain Md5 algorithm steps.

Answer:

MD5 (Message Digest 5) is a cryptographic hash function producing 128-bit hash value.

Algorithm Steps:

Code Block:

# MD5 Processing Steps
def md5_process():
    # Step 1: Padding
    padded_message = original + padding_bits
    # Step 2: Process in 512-bit chunks  
    for chunk in chunks:
        # Step 3: Apply round functions
        result = round_functions(chunk)
    return final_hash

• Round 1: F(X,Y,Z) = (X∧Y) ∨ (¬X∧Z)
• Round 2: G(X,Y,Z) = (X∧Z) ∨ (Y∧¬Z)
• Round 3: H(X,Y,Z) = X⊕Y⊕Z
• Round 4: I(X,Y,Z) = Y⊕(X∨¬Z)

Mnemonic: “My Data Needs Proper Processing” (Message, Digest, Needs, Proper, Processing)

Question 1(c OR) [7 marks]

#

List inventors of RSA. Write steps of RSA algorithm.

Answer:

RSA Inventors:

• Ron Rivest (MIT)
• Adi Shamir (MIT)
• Leonard Adleman (MIT)

RSA Algorithm Steps:

Key Pairs:

• Public Key: (n, e)
• Private Key: (n, d)

Mnemonic: “RSA: Rivest Shamir Adleman”

Question 2(a) [3 marks]

#

Define: Firewall. List limitations of firewall.

Answer:

Definition: Firewall is a network security device that monitors and controls incoming/outgoing network traffic based on predetermined security rules.

Limitations:

Mnemonic: “Fire Walls Limit Internal Protection”

Question 2(b) [4 marks]

#

Sketch IPsec Tunnel Mode and Transport mode.

Answer:

IPsec Modes Comparison:

Key Differences:

Mnemonic: “Transport Travels, Tunnel Total”

Question 2(c) [7 marks]

#

Explain various types of Active & Passive attacks in detail.

Answer:

Attack Classification:

graph TD
    A[Network Attacks] --> B[Active Attacks]
    A --> C[Passive Attacks]
    B --> D[Modification]
    B --> E[Fabrication]
    B --> F[Interruption]
    C --> G[Eavesdropping]
    C --> H[Traffic Analysis]

Active Attacks:

Passive Attacks:

• Active attacks modify system resources or data
• Passive attacks observe and collect information
• Detection: Active attacks easier to detect than passive

Mnemonic: “Active Acts, Passive Peeks”

Question 2(a OR) [3 marks]

#

Define: Digital Signature. Also discuss various application areas of Digital Signature.

Answer:

Definition: Digital Signature is a cryptographic technique that validates authenticity and integrity of digital messages or documents using public key cryptography.

Application Areas:

Mnemonic: “Digital Documents Demand Authentic Approval”

Question 2(b OR) [4 marks]

#

Differentiate HTTP & HTTPS.

Answer:

Diagram:

Mnemonic: “HTTPS Has Security”

Question 2(c OR) [7 marks]

#

Define: Malicious software. Explain Virus, Worm, Keylogger, Trojans in detail.

Answer:

Definition: Malicious software (Malware) is any software designed to harm, exploit, or gain unauthorized access to computer systems.

Types of Malware:

Detailed Explanation:

Virus:

• Requires host program to execute
• Spreads through infected files
• Can corrupt or delete data

Worm:

• Self-propagating malware
• Exploits network vulnerabilities
• Consumes network bandwidth

Keylogger:

• Records user keystrokes
• Captures login credentials
• Can be hardware or software-based

Trojan:

• Appears as legitimate software
• Creates backdoor for remote access
• Does not self-replicate

Mnemonic: “Viruses Visit, Worms Wander, Keys Captured, Trojans Trick”

Question 3(a) [3 marks]

#

Define: Cybercrime. Also discuss needs of Cyber Law.

Answer:

Definition: Cybercrime refers to criminal activities carried out using computers, networks, or digital devices as tools or targets.

Needs of Cyber Law:

Mnemonic: “Cyber Laws Create Legal Protection”

Question 3(b) [4 marks]

#

Explain Cyber spying and Cyber theft.

Answer:

Cyber Spying:

• Definition: Unauthorized surveillance of digital communications and activities
• Methods: Malware, phishing, social engineering
• Targets: Government, corporate secrets, personal data
• Impact: National security threats, competitive disadvantage

Cyber Theft:

• Definition: Unauthorized taking of digital assets or information
• Types: Identity theft, financial fraud, intellectual property theft
• Methods: Hacking, social engineering, insider threats
• Consequences: Financial loss, reputation damage

Comparison Table:

Mnemonic: “Spies Spy, Thieves Take”

Question 3(c) [7 marks]

#

Explain article section 66 of cyber law.

Answer:

Section 66 - Computer Related Offences (IT Act 2008):

Key Provisions:

Detailed Coverage:

Section 66 Main Offenses:

• Hacking: Unauthorized access to computer systems
• Data Theft: Stealing or copying data without permission
• System Damage: Destroying or altering computer data
• Virus Introduction: Introducing malicious code

Elements Required:

• Intent: Dishonest or fraudulent intention
• Access: Without permission of owner
• Damage: Causing harm to system or data
• Knowledge: Awareness of unauthorized access

Legal Framework:

• Cognizable: Police can arrest without warrant
• Non-bailable: Bail at court’s discretion
• Evidence: Digital evidence admissible in court

Mnemonic: “Section 66 Stops Cyber Sins”

Question 3(a OR) [3 marks]

#

Explain Cyber terrorism.

Answer:

Definition: Cyber terrorism involves the use of digital technologies to create fear, disruption, or harm for political, religious, or ideological purposes.

Characteristics:

Examples:

• Power grid attacks
• Transportation system disruption
• Financial system targeting

Mnemonic: “Terror Through Technology”

Question 3(b OR) [4 marks]

#

Explain Cyber bullying & Cyber stalking.

Answer:

Cyber Bullying:

• Definition: Using digital platforms to harass, intimidate, or harm others
• Platforms: Social media, messaging apps, online forums
• Characteristics: Repetitive, intentional harm, power imbalance
• Impact: Psychological trauma, depression, social isolation

Cyber Stalking:

• Definition: Persistent online harassment causing fear or emotional distress
• Methods: Unwanted messages, tracking, identity theft
• Duration: Long-term, continuous behavior
• Legal: Criminal offense in many jurisdictions

Comparison:

Mnemonic: “Bullies Bother, Stalkers Stalk”

Question 3(c OR) [7 marks]

#

Explain article section 67 of cyber law.

Answer:

Section 67 - Publishing Obscene Information (IT Act 2008):

Main Provisions:

Key Elements:

Section 67 - Obscenity:

• Publishing: Making available in electronic form
• Content: Lascivious, sexually explicit material
• Medium: Website, email, social media
• Intent: Corrupt or deprave viewers

Section 67A - Sexually Explicit:

• Enhanced punishment for explicit sexual content
• Broader scope than general obscenity
• Commercial purpose considered aggravating factor

Section 67B - Child Protection:

• Zero tolerance for child exploitation
• Strict liability for possession and distribution
• Higher penalties reflecting seriousness
• Age verification requirements for platforms

Defenses Available:

• Scientific/educational purpose
• Artistic merit consideration
• Private viewing in some cases
• Lack of knowledge about content nature

Digital Evidence Requirements:

• Chain of custody maintenance
• Technical authenticity proof
• Source identification methods
• Preservation of electronic evidence

Mnemonic: “Section 67 Stops Shameful Sharing”

Question 4(a) [3 marks]

#

Discuss types of Hackers.

Answer:

Hacker Classification:

Detailed Types:

• White Hat: Ethical hackers, security professionals
• Black Hat: Cybercriminals seeking profit or damage
• Gray Hat: Between ethical and malicious

Mnemonic: “Hats Have Hacker Hierarchy”

Question 4(b) [4 marks]

#

Explain RAT.

Answer:

RAT (Remote Administration Tool):

Definition: Software that allows remote control of a computer system, often used maliciously for unauthorized access.

Characteristics:

Common RATs:

• BackOrifice
• NetBus
• DarkComet
• Poison Ivy

Detection Methods:

• Antivirus software
• Network monitoring
• Process analysis
• Behavioral detection

Mnemonic: “RATs Run Remote Access Tactics”

Question 4(c) [7 marks]

#

Explain Five Steps of Hacking.

Answer:

The Five-Phase Hacking Methodology:

graph LR
    A[1. Reconnaissance] --> B[2. Scanning]
    B --> C[3. Gaining Access]
    C --> D[4. Maintaining Access]
    D --> E[5. Covering Tracks]

Detailed Steps:

Phase 1 - Reconnaissance:

• Passive: Public information gathering
• Active: Direct target interaction
• Goal: Map target infrastructure

Phase 2 - Scanning:

• Network scanning: Live system identification
• Port scanning: Service discovery
• Vulnerability scanning: Weakness identification

Phase 3 - Gaining Access:

• Exploitation: Vulnerability utilization
• Authentication attacks: Password cracking
• Privilege escalation: Higher access levels

Phase 4 - Maintaining Access:

• Backdoor installation: Future access
• System modification: Persistence mechanisms
• Data collection: Information harvesting

Phase 5 - Covering Tracks:

• Log manipulation: Evidence removal
• File deletion: Trace elimination
• Timeline modification: Activity concealment

Mnemonic: “Real Smart Guys Make Choices” (Reconnaissance, Scanning, Gaining, Maintaining, Covering)

Question 4(a OR) [3 marks]

#

Explain Brute force attack.

Answer:

Definition: Brute force attack is a trial-and-error method used to decode encrypted data by systematically trying all possible combinations.

Characteristics:

Types:

• Simple Brute Force: All possible combinations
• Dictionary Attack: Common passwords
• Hybrid Attack: Dictionary + variations

Mnemonic: “Brute Force Breaks By Trying”

Question 4(b OR) [4 marks]

#

Define: Vulnerability, Threat, Exploit

Answer:

Security Terminology:

Relationship:

Examples:

• Vulnerability: SQL injection flaw
• Threat: Cybercriminal
• Exploit: SQL injection payload

Risk Formula: Risk = Threat × Vulnerability × Asset Value

Mnemonic: “Threats Target Vulnerable Exploits”

Question 4(c OR) [7 marks]

#

Explain any three basic commands of kali Linux with suitable example.

Answer:

Essential Kali Linux Commands:

1. NMAP (Network Mapper):

# Port scanning
nmap -sS target_ip
nmap -A -T4 192.168.1.1

2. Metasploit:

# Start Metasploit
msfconsole
# Search exploits
search apache
# Use exploit
use exploit/windows/smb/ms17_010_eternalblue

Commands:

• search: Find exploits/payloads
• use: Select module
• set: Configure options
• exploit: Launch attack

3. Wireshark:

# Command line version
tshark -i eth0
# Filter traffic
tshark -i eth0 -f "port 80"

Features:

• Packet capture: Real-time network monitoring
• Protocol analysis: Deep packet inspection
• Filter options: Targeted traffic analysis
• GUI interface: User-friendly analysis

Additional Commands:

4. Hydra (Password Cracking):

hydra -l admin -P passwords.txt ssh://192.168.1.1

5. John the Ripper:

john --wordlist=rockyou.txt hashes.txt

6. Aircrack-ng (WiFi Security):

airmon-ng start wlan0
airodump-ng wlan0mon

Command Categories:

Mnemonic: “Network Maps Make Security”

Question 5(a) [3 marks]

#

List the branches of Digital Forensics.

Answer:

Digital Forensics Branches:

Specialized Areas:

• Cloud Forensics
• IoT Forensics
• Blockchain Forensics

Mnemonic: “Digital Detectives Discover Many Clues”

Question 5(b) [4 marks]

#

Discuss Locard’s Principle of Exchange in Digital Forensics.

Answer:

Locard’s Exchange Principle:

Original Principle: “Every contact leaves a trace”

Digital Application:

Digital Evidence Traces:

System Level:

• Registry entries: System changes
• Log files: Activity records
• Temporary files: Process artifacts
• Metadata: File information

Network Level:

• Router logs: Traffic records
• Firewall logs: Connection attempts
• DNS queries: Website visits
• Packet captures: Communication content

Application Level:

• Browser artifacts: Web activity
• Application logs: Software usage
• Database changes: Data modifications
• Cache files: Temporary storage

Forensic Implications:

• No perfect crime: Digital traces always exist
• Evidence location: Multiple sources available
• Corroboration: Multiple trace validation
• Timeline reconstruction: Activity sequencing

Mnemonic: “Every Exchange Exists Electronically”

Question 5(c) [7 marks]

#

List the critical steps in preserving Digital Evidence.

Answer:

Digital Evidence Preservation Process:

graph TD
    A[Digital Evidence] --> B[Identification]
    B --> C[Collection]
    C --> D[Preservation]
    D --> E[Analysis]
    E --> F[Presentation]

Critical Preservation Steps:

Detailed Preservation Methods:

Physical Preservation:

• Power management: Proper shutdown procedures
• Hardware protection: Anti-static measures
• Environmental control: Temperature/humidity
• Access restriction: Authorized personnel only

Logical Preservation:

• Bit-stream imaging: Exact disk copies
• Hash verification: Integrity confirmation
• Write blocking: Prevent modifications
• Metadata preservation: Timestamp protection

Legal Preservation:

• Documentation standards: Detailed records
• Chain of custody: Handling log
• Authentication: Evidence verification
• Admissibility: Court requirements

Best Practices:

Do’s:

• Create multiple copies of evidence
• Use forensically sound tools
• Document every action
• Maintain chain of custody
• Verify integrity with hashes

Don’ts:

• Never work on original evidence
• Avoid contamination of scene
• Don’t power on suspect systems
• Never modify evidence
• Don’t break chain of custody

Quality Assurance:

Legal Considerations:

• Admissibility requirements: Court standards
• Expert testimony: Technical explanation
• Cross-examination: Process validation
• Standard compliance: Industry best practices

Mnemonic: “Proper Preservation Prevents Problems” (Plan, Preserve, Protect, Prove)

Question 5(a OR) [3 marks]

#

Explain Malware forensics.

Answer:

Definition: Malware forensics involves the analysis of malicious software to understand its behavior, origin, and impact on infected systems.

Key Components:

Process:

• Sample collection: Malware acquisition
• Isolation: Sandbox environment
• Analysis: Behavior observation
• Reporting: Findings documentation

Mnemonic: “Malware Makes Mysteries”

Question 5(b OR) [4 marks]

#

Explain why CCTV plays an important role as evidence in digital forensics investigations.

Answer:

CCTV in Digital Forensics:

Importance of CCTV Evidence:

Digital Evidence Properties:

Technical Aspects:

• Metadata preservation: Timestamp, camera ID, settings
• Chain of custody: Secure handling procedures
• Format integrity: Original file structure maintenance
• Authentication: Digital signatures, hash values

Forensic Value:

• Real-time documentation: Live incident recording
• Unbiased testimony: Mechanical witness
• High resolution: Clear image quality
• Audio capture: Additional sensory evidence

Analysis Methods:

• Frame-by-frame examination: Detailed scrutiny
• Enhancement techniques: Image improvement
• Comparison analysis: Multiple angle correlation
• Motion tracking: Subject movement patterns

Legal Admissibility:

• Authenticity verification: Chain of custody
• Technical validation: Equipment calibration
• Expert testimony: Forensic analysis explanation
• Standard compliance: Industry best practices

Mnemonic: “CCTV Captures Criminal Conduct Clearly”

Question 5(c OR) [7 marks]

#

Explain phases of Digital forensic investigation.

Answer:

Digital Forensic Investigation Process:

graph TD
    A[Incident Response] --> B[Evidence Identification]
    B --> C[Evidence Collection]
    C --> D[Evidence Preservation]
    D --> E[Evidence Analysis]
    E --> F[Documentation]
    F --> G[Presentation]

Phase-wise Breakdown:

Detailed Phase Analysis:

Phase 1 - Preparation:

• Tool readiness: Forensic software installation
• Hardware setup: Write blockers, imaging devices
• Documentation templates: Chain of custody forms
• Team preparation: Role assignments, training
• Legal preparation: Warrant requirements, permissions

Phase 2 - Identification:

• Scene survey: Evidence location mapping
• Device inventory: System identification
• Volatile evidence: Memory, network connections
• Priority assessment: Critical evidence first
• Photography: Scene documentation

Phase 3 - Collection:

• Live system analysis: Memory acquisition
• Disk imaging: Bit-for-bit copies
• Network evidence: Log files, packet captures
• Mobile devices: Physical/logical extraction
• Cloud evidence: Remote data acquisition

Phase 4 - Preservation:

• Hash generation: MD5, SHA-256 checksums
• Write protection: Hardware/software blocking
• Storage security: Tamper-evident containers
• Chain of custody: Handling documentation
• Backup creation: Multiple evidence copies

Phase 5 - Analysis:

• File system examination: Directory structure analysis
• Deleted data recovery: Unallocated space searching
• Timeline creation: Event chronology
• Keyword searching: Relevant content identification
• Pattern recognition: Behavioral analysis

Phase 6 - Presentation:

• Report writing: Findings documentation
• Visual aids: Charts, diagrams, screenshots
• Expert testimony: Court presentation
• Peer review: Quality assurance
• Archive maintenance: Case file storage

Best Practices:

Technical Standards:

• Tool validation: Regular calibration
• Methodology consistency: Standard procedures
• Quality control: Verification checks
• Documentation completeness: Detailed records

Legal Requirements:

• Admissibility standards: Court requirements
• Chain of custody: Unbroken documentation
• Expert qualifications: Professional certification
• Cross-examination preparation: Defense against challenges

Quality Assurance:

Common Challenges:

• Encryption: Data protection barriers
• Anti-forensics: Evidence hiding techniques
• Volume: Large data sets
• Volatility: Temporary evidence
• Legal complexity: Jurisdiction issues

Success Factors:

• Systematic approach: Methodical investigation
• Technical expertise: Skilled personnel
• Proper tools: Adequate resources
• Legal knowledge: Compliance understanding
• Documentation discipline: Thorough records

Mnemonic: “Proper Planning Prevents Poor Performance” (Preparation, Preservation, Processing, Presentation, Proof)