Digital Forensics Investigation Types and Roles

Digital Forensics Investigation Types

• The term "court" is used broadly in digital forensics to refer to any entity that requests the investigation or receives its outcome
• Investigations can change types as they progress. For example, an internal investigation into data exfiltration may change to a criminal investigation.

Forensic Roles

• Case Technician: Manages digital evidence, creates forensic images, prepares cases for investigation, and handles the chain of custody.
• Examiner: Initiates the investigation, bookmarks and categorizes evidence.
• Analyst: Conducts the final investigation and creates the report. LEAs might combine the roles of examiner and analyst.
• Forensic investigators require a mix of skills – technical knowledge of computers, legal understanding, and communication skills, as reports are presented to audiences who might not understand IT.

Burden of Proof

• Criminal cases are handled by a law enforcement authority (LEA).
• Inculpatory evidence: Supports a given theory. It might include emails, texts, or social media posts that show planning or involvement in a crime.
• Exculpatory evidence: Contradicts a theory and introduces reasonable doubt, like a suspect claiming they were on leave when emails were sent.
• Direct evidence: Directly supports a truth without inference, like a witness claiming they saw a crime.
• Circumstantial evidence: Provides circumstances that lead to a conclusion but requires an inference to connect it to a fact. It's often used to build a case and can corroborate other evidence.

Law Enforcement Process

• LEAs gather intelligence about suspects' activities.
• When enough intelligence is gathered, LEAs seek warrants to make arrests, seize property, and search locations.
• Case managers must convince magistrates to grant warrants based on intelligence.
• LEAs plan raids, mobilizing firearms officers, fingerprint specialists, and crime scene investigators.
• Digital investigators rarely attend raids. They rely on crime scene investigators to seize equipment and case technicians to create forensic images.

Data Seizure

• Artefacts refers to devices like laptops, PCs, iPads, mobile phones, SD cards, USB sticks, external hard drives, IoT devices, and dashcams.
• ACPO principle 1 emphasizes that no action taken by law enforcement should change data that could be used in court.

Forensic Considerations on Social Media Accounts

• Investigators should be cautious with social media accounts.
• Browsing accounts from third-party machines provides limited information - only what the suspect has chosen to share.
• Using the suspect's machine (through a virtual machine) to investigate social media requires documentation using body cams or screenshots because reading messages changes their status.

Case Preparation

• Ingest modules: Pre-process data within storage systems to make it accessible and categorize evidence.
• They identify file patterns, hash matches, mismatched extensions, URLs, email addresses, web bookmarks, and USBs attached to a computer.
• Results are displayed for examiners.
• More research is needed to develop more ingest modules.

Forensic Hygiene

• Investigators should report the software and version used, the machine used for the investigation, and document hash values.
• Some tools only store MD5 hashes, while others provide users with the option to store both MD5 and SHA1 hashes.
• DFI (Digital Forensic Image) verification: FTK Imager recalculates hashes from DFI data blocks and compares them to stored verification hashes.
• DFI creation tools often create a text report of the DFI creation process.

This quiz covers various types of digital forensics investigations and the roles involved in the process. It details the responsibilities of case technicians, examiners, and analysts, as well as the significance of adapting investigation types based on circumstances. Enhance your understanding of digital forensics with this informative quiz.