Computer Forensics: Terminology and Practices

Computer Forensics: Terminology and Requirements

• Computer forensics is the practice of collecting, analyzing, and reporting digital data in a legally sound manner.
• It is used for detecting and preventing crime, and resolving disputes where digital evidence exists.
• The goal of computer forensics is to examine digital media, identify pertinent information, preserve and recover digital evidence, analyze the information, and present the facts and opinions.

Computer Forensics – An Emerging Discipline

• Computer forensics is an emerging discipline because of new technologies, criminal behaviors, and police techniques.
• Maintaining the integrity of evidence is crucial to computer forensics.
• A chain of custody (CoC) documents the seizure, custody, control, transfer, analysis, and disposition of physical or electronic evidence.
• Maintaining a chain of custody is imperative to maintaining the integrity of evidence.
• Viruses must not be introduced to the suspect machine during analysis.
• The evidence must remain in its unaltered state throughout the process.

Traditional Problems in Computer Investigations

• Local law enforcement agencies often face inadequate resources, dwindling budgets, and increased responsibilities.
• Lack of communication and cooperation among agencies can hinder successful investigations.
• Over-reliance on automated programs and self-proclaimed experts may not be sufficient.
• The perception of incompetence can lead to victims not reporting the crime.
• Victims (and corporations) are sometimes discouraged from reporting due to their advisors' self-serving opinions.
• Lack of sufficient resources at law enforcement agencies can be a problem.

Evidence Corruption – Cardinal Rules of Computer Investigations

• Always work from an image of the original hard drive to avoid altering the original data.
• Thoroughly document each step of the investigation.
• Maintaining a chain of custody is essential.

Disk Structure and Digital Evidence: Terms to Know

• Non-volatile storage: Computer storage that retains data even after the power is off.
• Computer storage: Refers to the entire storage system, not individual pieces of hardware.
• Primary storage: RAM.
• Secondary storage: Drives like hard drives, etc.
• Floppy disks, CD-ROMs, CD-RWs, hard/fixed disks are examples of secondary storage.
• Operating Systems: software that manages the computer's hardware and software resources.
• Hardware: The physical components of a computer.
• Software: Programs that instruct the computer.
• Firmware: Instructions embedded in hardware that control specific hardware functions.
• Computer: The overall device.
• Static memory: Retains data even without power.
• Volatile memory: (RAM) Data is lost without power.

Disk Structure and Data Storage

• Drives: Physical devices for storing data.
• Physical file size: The actual space a file takes up on a hard drive.
• Logical file size: The size of a file in bytes as represented in the file system.
• Logical partitions: Independent units of a physical drive important for computer forensics.

Disk Structure and Data Storage Terms

• Bits are the smallest unit of digital data.
• Tracks are concentric circles on a hard drive.
• Cylinders are a group of tracks in a hard drive
• Sectors are subdivisions of tracks.
• Shaft
• Head
• Actuator arm
• Platters
• Spindle
• ASCII (American Standard Code for Information Interchange) is a character encoding standard.
• Binary system (base-2).
• Hexadecimal system (base-16)
• Clusters (aka file allocation units): One or more sectors that collectively represent the basic allocation units of magnetic disk storage.

Data Storage Scheme

• Sectors: Fixed units where data is stored. The smallest physical unit on a hard drive.
• Clusters: One or more adjacent sectors that the computer allocates to a file/data.
• Logical file size: The size of the file as recorded by the computer's OS.
• Physical file size: The actual amount of space the file takes up on the drive.
• File slack: Unused space between the logical and physical end of a file within a cluster.
• Partitions: Portions of a disk that are identified as independently managed units by the operating system. The maximum is four partitions on a disk (with one considered "bootable").
• Master boot record and partition table: Created during partitioning to manage the hard drive.

Data Storage Scheme: File Systems

• File system (FFS) is the structure used to manage the data on the disk. DOS, FAT16, FAT32, and NTFS are examples of FFS used in Windows operating systems.
• FAT (File Allocation Table): Contains the location of each piece of a file, and details its size and the starting location of the file's data in the drive's sector regions. Deleted files remain until the drive is reformatted.
• NTFS (New Technology File System) was developed by Microsoft in the 1990s for security, performance, and support of larger file sizes. Contains a Master File Table that describes each file by recording information like size and the starting location or cluster. More efficient than older file systems, especially for storage efficiency.

Disk Structure and Digital Evidence: Firmware

• Firmware controls certain hardware functions.
• BIOS (Basic Input/Output System) contains the initial commands used to load the operating system.
• POST (Power-on self-test) checks that the computer and its hardware components are working correctly.

Disk Structure and Digital Evidence: Data Integrity

• Data integrity refers to how correctly data is recorded on the disk, and how easily errors might occur during transmission.
• CRC (Cyclical Redundancy Checksum) a checksum algorithm to validate data integrity.

Developing Computer Forensic Science Capabilities

• SOP (Standard Operating Procedures) are constantly updated. Should be readily available and contain the process, appropriate software and hardware, and details of special procedures. SOPs should be reviewed annually.

Minimum Software Requirements

• Five kinds of software tools are needed and grouped broadly.
  • Data preservation, duplication, and verification tools: create image copies or bitstream copies of disks without alteration.
  • Data recovery/extraction tools: recover data from a drive.
  • Data analysis tools: review and analyze digital exhibits.
  • Data reporting tools: to present information and details.
  • Network utilities: to manage data communications across network devices.

Conclusions

• Computer forensics investigations need proper resources, training, and appropriate SOPs to be successful. Collaborative efforts with civilian and corporate entities may be needed. Investigative team should meet minimum equipment standards.

Explore the essential concepts and requirements of computer forensics in this quiz. Test your knowledge on digital evidence collection, analysis, and the importance of maintaining the integrity of information. Understand the emerging trends and techniques that shape this critical field today.