NPA Cyber Security: Digital Forensics Levels 4-6

Applying computer scientific tests and techniques to solve a crime, involving recovering and interpreting electronic data while preserving evidence in its original form.

An event that might trigger an investigation into a suspected crime.

Systematic process to collect, identify, and validate digital data to recreate past events.

A crime for which there's a reasonable cause to believe it occurred.

A government organization responsible for upholding the law.

Maintaining digital data in its original state to avoid altering any information.

The process of reporting a suspected crime event.

Electronic devices like smartphones, computers, and tablets used to store data.

Information about network activity, typically stored in pcap files, collected by network analysis software.

Detailed call history, location data, and timestamps from mobile devices maintained by phone service providers.

Previously deleted files on mobile devices that can be retrieved and looked at by investigators.

Records of a phone's location and times when it was turned on, even if not used for calls.

Data protected by encryption on modern devices (smartphones, tablets, laptops), potentially making examination harder.

An online network that hides user identities and makes tracing communications difficult for investigators.

A network that conceals sender and receiver identities and encrypts communications, making them challenging to decrypt and trace.

A Digital Forensic Examiner interprets technical information and explains it in court, remaining neutral and gathering evidence, not proving guilt or innocence.

A chronological record of digital activity reconstructed by the examiner to help determine a suspect's actions.

The Digital Forensic Examiner's report, along with the lead investigator's report, is submitted to the Procurator Fiscal in Scotland.

The Procurator Fiscal, in Scotland, reviews the evidence and decides if there's enough to proceed to a trial.

The documented and unbroken trail of evidence, showing its origin, handling, and storage, ensuring its integrity.

Digital forensic evidence should be interpreted without bias, showing what happened, not drawing conclusions about guilt.

If evidence points to someone's innocence, the lead investigator should consider it and possibly re-evaluate the investigation.

If evidence suggests innocence, the lead investigator should consider whether the real perpetrator is still at large.

A secure, tamper-proof copy of digital evidence kept for reference, typically stored in a locked safe.

A copy of digital evidence used for examination and analysis, allowing the original to remain untouched.

A device that prevents any new data from being written to a storage device while making a copy, ensuring a perfect replica.

A perfect copy of every single bit of data on a storage device, ensuring no information is lost or altered.

Write Blockers are used to prevent alteration of evidence by stopping any new data from being written to the original storage device while making a copy.

Having a prime copy (the original) and a working copy (for analysis) ensures that the original evidence remains untouched and unaltered throughout the investigation.

A software application used to create exact images of the contents of a storage medium when the device cannot be easily removed.

Documenting all changes to the working copy ensures the integrity of the evidence and allows for a clear audit trail of any actions taken on the data.

A method used to generate a unique 'fingerprint' (Hash Code) for digital data, ensuring that any copy can be verified as identical to the original.

A long string of letters and digits produced by applying a mathematical process (Hashing) to data. It uniquely identifies the data and verifies its integrity.

Common hashing techniques used in digital forensics to verify the integrity of data copies. MD5 (Message Digest 5) and SHA1 (Secure Hashing Algorithm 1) are often used together for double-checking.

In legal cases, this refers to the original or most reliable source of evidence. In digital forensics, verified copies of data obtained through hashing are considered 'Best Evidence'.

It ensures that any investigation findings based on the copy are admissible in court. If the copy is not identical to the original, the evidence might be considered unreliable.

It means the copy is not an exact replica of the original data. This could indicate tampering, corruption, or accidental changes. The copy cannot be used as evidence.

A website that allows you to see Hashing Codes being created. It provides a tool for understanding how hashing works and generating hash codes for different data.

To ensure the admissibility of digital evidence in court by verifying that copies of data are identical to the originals, preserving the integrity of the evidence.

A Scottish legal professional who investigates and prosecutes crimes in Sheriff Court, representing 'The Crown'.

The court in Scotland where the most serious crimes are tried, cases reaching it are handled by the Office of the Lord Advocate.

The term used in Scotland to refer to the prosecution side in a criminal trial, represented by Procurator Fiscal or Lord Advocate.

A reason why the Procurator Fiscal may decide not to prosecute a crime, even if there is enough evidence, if they believe it wouldn't benefit society.

A principle in Scots Law where both the prosecution (Crown) and defense have to share evidence with each other before a trial.

The Digital Forensic Examiner may be called to court to explain their findings. They must present their evidence using clear and unbiased language.

The examiner must explain the how they conducted their investigation using clear, unambiguous, and unbiased language, ready for questioning.

Both the defense and Crown lawyers can question the Digital Forensic Examiner's findings and testimony.