Wiretapping Case Study

3.3.2.2 Wiretapping

A prevalent technique used to catch the data is to detect the network connections and traffic, which is called as wiretapping. Wiretapping is in different forms, which vary from the network habitat of the computer system which network traffic wants to be checked; common characteristics that regulates how wiretapping should be achieved are the type of connection of the computer system, the channel used for data transmissions, local network topology and the quality of the connection to be monitored, which could be encrypted or not. The objective of wiretapping is to study the incoming and outgoing data, which should be meaningful for investigation.
In each case the wiretapping requires a physical entry to the network media

An effective technique is to utilize software like spyware. A spyware is a utility which, once stored on a computer system, keeps a check on the online activities of the users of that computer, it captures the information such as password or e-mails, and then dispatches the collected information to the investigator.
In case of wiretapping the encrypted data is captured, which is very tedious to decrypt. In case of spyware the data prior encryption is captured by the investigators. The main hurdle is to install the spyware prior the data seizing starts. The complex procedure to install a spyware inside a computer system is to exploit browser susceptibilities to develop a web page which when inspected, which aggravate the spyware to be installed.
3.3.3 Data recovery

The meaningful data could be eliminated from the electronic gadgets thus the techniques for data recovery were formed. The points to be studied while performing data recovery: the physical status of the device, the scope of the device, the type of the device, data from a damaged device. The data may be concealed inside some other file ie., file inside a file should be

Digital evidence is checked by hashing the content of the data [61]. The hash value will assure the accuracy of digital evidence needed during later stages of the investigation and demonstration at trial [30].
The legal necessities for authenticity that must be fulfilled are the following [54]:
• The content of the data must be consistent.
• The data is a copy from an original source.
• The metadata displayed should be accurate.
The legal necessities can easily be obtained by using technological aspects given by digital forensics tools. MD5 or SHA-1 are normally used as technology to authenticate information within these tools. Pollitt puts down the following requirements to check the authenticity of the original image against a prepared image [33]:
1. The duplicate image must be a real and correct portrayal of the original. The person who seized or is available during the imaging activity must declare the original has been imaged.
2. The imaging activity of the original must be cited in a log.
3. The imaging activity must provide enough information for an equally capable investigator to regenerate the action and reach the same