Conception et réalisation d’un système d'aide aux investigations numériques -application des techniques de computer forensics-

Abstract

The massive use of information technologies and the development of cybercrime in the field of computer science has led to the creation of a new branch: Digital forensics. The techniques and methods of investigation are evolving continually, the diversity of digital media requires strict rules, and procedures to be followed, which are needed to search, preserve and interpret the extracted data. This branch, which was first exercised by judicial experts from the national police or the gendarmerie for the purpose of digital searches, is now being extended and developed to the private sector as part of a security audit and incident response. Digital investigation is still relatively new in Algeria, and is increasingly being requested by private companies such as banks and multinationals.More recently, criminals are becoming more forensically aware and are now able to compromise computers without accessing the hard disk of the target computer. As such, many companies specialized in IT, security have developed this field to meet the growing demand of companies. The objective of this work is to guide the expert in charge of investigation by means of so-called "good practice" rules but also to introduce forensic methods to all persons wishing to develop their skills in this field. Finally, a system is developed and implemented to facilitate the digital investigation of physical memory on Windows systems.