Introduction to Digital Forensics

Digital Forensics

• Digital forensics involves investigating, recovering, and analyzing digital devices and data.
• The goal is to collect evidence for use in legal proceedings.
• It is an interdisciplinary field, working with various forensic and technical areas.
• Digital forensics adapts to technological advancements and changes in cyber threats.

Relationship with Other Forensic Disciplines

• Digital forensics enhances traditional forensic methods, like ballistics, DNA analysis, and fingerprinting.
• An example is using digital data to confirm or disprove physical evidence in criminal cases.
• Digital forensics overlaps with cybersecurity through investigations of data breaches, hacking, malware, and digital fraud.
• Digital forensic methods are used to find, study, and reduce security incidents.
• Network forensics focuses on monitoring and analyzing network traffic to find evidence of cyberattacks, unauthorized access, or malicious actions.
• It uses digital forensic instruments and techniques to analyze data packets and network logs.
• Mobile device forensics is vital due to the widespread use of smartphones and tablets.
• Mobile device forensics involves extracting and analyzing data such as call logs, text messages, location data, and app history.
• Cloud forensics investigates digital evidence stored on cloud platforms.

Forensic accounting

• Digital forensics assists forensic accounting by investigating digital evidence in financial crimes like embezzlement, money laundering, or corporate fraud.
• Examining financial transactions, emails, and digital documents gives insight into fraud.
• In audio and video forensics, digital forensic techniques improve, authenticate, and analyze multimedia to confirm authenticity and reliability for courts.
• Digital forensics integrates into the legal and criminal justice systems.
• Evidence is presented in court to support or challenge legal arguments and is critical in criminal prosecutions, civil litigation, and regulatory investigations.

Digital Forensics Investigation Process

• Seizure involves digital media collection before examination, often by law enforcement to maintain chain of custody.
• Acquisition is creating a forensic copy of data using a hard drive duplicator or software tool, then securing the original to prevent tampering.
• The copy is verified using SHA-1 or MD5 hash functions, and re-verified during analysis to ensure it remains unchanged.
• Analysis follows evidence acquisition, where files are analyzed to either support or contradict a hypothesis.
• Analysts recover from data storage, deleted space or cache information such as emails, chat logs, images, internet history, and documents.
• Reporting involves assembling the data into accessibility reports for non-technical people, including meta and audit information.

Rules of Evidence

• Rules of evidence offer instructions for presenting evidence in legal procedures.
• Following these guidelines ensures fairness, reliability, and effective presentation of digital evidence in courts.
• Relevance is a fundamental principle, ensuring digital evidence is directly related to the incident or crime being investigated.
• Authenticity is another principle, requiring accurate representation of digital evidence, along with a chain of custody and technical analysis.
• Reliability refers to the trustworthiness and accuracy of the proof.
• Demonstrating that the tools and methods employed to gather have been scientifically tested helps establish reliability.
• Hearsay evidence, which is an out-of-court statement presented to establish the truth, is often inadmissible.
• Exceptions exist for statements by a party-opponent or some business records.
• The best evidence rule prioritizes original digital files and data in court over summaries or copies.
• Certain protected communications, like those between a lawyer and client, are protected from court disclosure.
• The chain of custody includes chronological documentation, handling and transfer of evidence.
• Clear chain of custody helps prove reliability of digital evidence.
• Expert testimony is also used and relies on reliable methods relevant to the case.

Search and Seizure

• Search and seizure are legal ways for law enforcement to collect evidence that is governed by constitutional protections.
• Essential for law enforcement to detect and prosecute crimes, while upholding constitutional rights and freedoms.
• Search warrants need to be issued by a judge or magistrate before officers can search someones property; homes, vehicle, digital devices.
• Warrants describe the location and evidence to be taken, with exceptions for searches made with the person's consent or incident with lawful arrest.
• Probable cause, meaning more than suspicion but not absolute certainty.

Search Warrants

• Warrants must specifically describe the location and items to be taken to prevent overbroad or intrusive searches.
• Officers must minimize disruption and damage to property while entering the location described in the warrant looking for evidence.
• Illegally obtained data evidence under the Fourth Amendment is subject to suppression and serves as a deterrent to unconstitutional actions.
• Evidence of a crime can be collected without a warrant if the Law enforcement officer in plain sight during lawful procedure.
• The search and seizure of computers, phones, and tablets pose unique issues that are addressed through encryption and digital privacy.

Digital Evidence

• Digital Evidence is stored or sent electronically that is relevant to any probe in a court of law.
• Digital evidence is subject to admissibility, authenticity and the use of specialist equipment and expert staff.

Forms of Digital Evidence

• Electronic documents: Spreadsheets, emails, and other electronic files stored on digital devices.
• Databases: Customer records, financial data or logs.
• Images and Videos: Cameras, smartphones, and surveillance systems are sources of digital evidence.
• Digital Communications: Exchanged emails, messages, posts etc.
• Metadata: Information such as time, date and authorship.
• Internet Activity: Online activities used in forensic analysis.
• Network Logs: Identifying origin with IP and MAC addresses.
• GPS data: Tracking of locations based on device GPS tracking.
• Cloud Data: Documents, emails, photos are all stored on cloud based serves.

Media Analysis

• Media analysis is a way of examining content to derive insight, identify patterns, and understand trends, through print, broadcast, and digital.
• Serves brand management, market research, public analysis and social factors.
• Content Analysis: Categorizing, quantifying content and researchers can see frequency based on coverage.
• Qualitative Analysis: Narratives, ideologies, language, symbols and biases of cultural norms.
• Quantitative Analysis: Statistical methods to measure range, impact and visibility of coverage.
• Social Media Analysis: User generated content, tech and sentiment of social platforms.
• Media monitoring uses services to find topics, brands and organizations in real time.
• Competitive Analysis: Bench marking media output.
• Issue and Crisis Management: Gauging sentiment to effectively relay to media contacts.
• Audience Analysis: Tailoring content for specific target audiences.

Computer Forensics Process

• Identification: Determines potential digital evidence coming from computers, smartphones, hard drives, or cloud storage, that may contain data.
• Preservation: Securing digital evidence, via alteration prevention or chain of custody.
• Collection: Digital evidence will acquired and extracted from imaging, live data, or data nets.
• Analysis: Examines and interprets digital evidence, identifies user activity, and reconstructs events.
• Documentation: Investigators maintain transpency based on how the investigation was completed.
• Presentation: Evidence displayed in a legally permissible manner.

Terminologies

• Evidence Identification: Identify external drives.
• Data Aquistion: Examine smartphone data.
• Documentation: Expert report on procedure and findings.
• Presentation: Analyst testifies to court.
• Developing new encryption algorithms is not a primary goal of computer forensics.
• Windows Artifacts: Activity generated by Windows.
• Registry files: System configuration settings.
• Browser Artifacts: History that is providing insights.
• Recycle Bin: Deleted files temporarily saved for later.
• Autopsy: Analyze Evidence.
• EnCase: Comprehensive examination.
• Evidence Identification: Sources of data.
• Presentation: Explaining data to report.
• Browsing Hostory: Windows artifact for website searches.
• Analysis: Computer data being examined.
• Fragile: Damage done to vulnerable data.
• Reproducible: Precise replicate of origin.
• Evidence Labeling: Evidence tracking and identification.
• Live Data Acquisition: Ongoing network connections and RAM.
• Static Data Acquisition: Everything, everywhere.
• Computer Forensics: Specialization of digital device analysis.
• Hashing: Used to integrity of data.
• Chain of Custody: Following process after data collection.
• Data Acquisition: Copy of digital data.
• Digital Data: Data as use for legislation.
• File images: Digital storage copy.
• Data interception: Vulnerability for attackers.