Digital Forensic Fundamentals Flashcards
What is digital forensics?
Digital forensics is the process of identifying, preserving, analysing, and presenting digital evidence from electronic devices and data storage systems. It is used in investigations to uncover and interpret information related to cybercrimes, security breaches, or other incidents involving digital data. The goal of digital forensics is to recover and examine digital information in a way that maintains its integrity, ensuring it can be used as evidence in legal proceedings or internal investigations.
What is Locard’s principle?
Locard’s Principle, also known as Locard’s Exchange Principle, is a fundamental concept in forensic science. It states that whenever two objects come into contact with each other, there is always an exchange of materials between them. In other words, a person will both bring something into an environment and leave something behind when interacting with it.
In the context of digital forensics, Locard’s Principle suggests that whenever someone interacts with a digital system, they leave traces of their activity (named artefacts), such as logs, files, or data remnants. These traces can be collected and analysed to reconstruct actions, identify perpetrators, and understand the sequence of events during a security incident or cybercrime.
What are the two fundamental questions that should always be asked in digital forensics?
- Who was operating the device when the artefacts were created?
- Did the user initiate the observed activity, or was it the result of an automatic function of the computer system or device?
What is the difference between digital evidence implying guilt as opposed to proving guilt?
The difference between digital evidence implying guilt and proving guilt lies in the strength and conclusiveness of the evidence:
- Implying Guilt: Digital evidence that implies guilt suggests a possible connection between the suspect and the crime, but it does not definitively establish that the suspect committed the offence. This type of evidence might raise suspicions or point towards involvement, but it may require additional context or corroboration to support a conclusion.
- Proving Guilt: Digital evidence that proves guilt provides a clear and definitive link between the suspect and the crime, leaving little or no doubt about their involvement. This evidence is strong enough to meet the legal standard required to establish guilt beyond a reasonable doubt in a court of law.
In summary, implying guilt indicates a potential connection, while proving guilt confirms that connection with a high degree of certainty.
What are the five fundamental steps in a digital forensics investigation?
Steps in a Digital Forensics Investigation:
- Identify: Determine potential sources of inquiry-relevant information (devices and data) and pinpoint their location.
- Preserve: Securely preserve electronic evidence by protecting the scene, capturing visual images, and documenting all actions taken to ensure data integrity.
- Recover: Recover relevant data by creating a forensically sound copy (image) of data on digital devices, either on-site or in a controlled off-site environment.
- Analyse: Conduct a systematic search for incident-related information within the acquired data. Analyse both system and user-generated artefacts to support conclusions about the actions or activities on the device.
- Present: Compile findings into a formal or informal report, clearly detailing the methods used so that another examiner could replicate the results. Reports for court must meet specific standards and formats.
What is the difference between cyber security and digital forensics?
The difference between cybersecurity and digital forensics can be summarised as follows:
- Cybersecurity is a preventative and detective practice focused on safeguarding information systems from intrusion, attacks, and other threats. It involves implementing measures to protect networks, devices, and data, as well as detecting and responding to potential security incidents.
- Digital forensics is an investigatory practice aimed at collecting, analysing, and preserving artefacts and digital evidence to prove or imply guilt related to an intrusion event or digital crime. It focuses on uncovering what happened after a security breach or cybercrime has occurred.
In essence, cybersecurity seeks to prevent and detect threats, while digital forensics is concerned with investigating and understanding incidents after they happen.
What is evidence, and what are the two types?
Evidence is any information or material that is presented to support or refute a fact or claim in a legal or investigative context.
The two types of evidence are:
- Spoken Evidence (Testimonial Evidence): This type of evidence includes testimony from a witness who directly observed the event or incident. It can also include verbal statements, confessions, or other oral accounts that directly prove a fact without the need for inference. Spoken evidence can also involve experts or specialists who assist the court by providing context and explanations for specialised issues, such as medicine, digital forensics, or engineering.
- Physical Evidence: This type of evidence consists of tangible objects or materials that can be linked to the crime or incident. It includes items like fingerprints, DNA, digital logs, video recordings, or objects found at the crime scene. Physical evidence may directly or indirectly suggest a fact or occurrence.
These categories help distinguish between what is observed and reported verbally (spoken/testimonial evidence) and what is physically present and can be examined (physical evidence), with spoken evidence often supported by expert testimony for specialised matters.
What is the definition of the word ‘digital’?
The word digital refers to the representation, processing, or transmission of information in binary form, where data is encoded as a series of discrete values, typically 0s and 1s. Digital systems are used to manage, store, and communicate data in formats that can be easily processed by computers and other electronic devices. This allows for precise, efficient, and often automated handling of data in various applications, from computing and communications to media and technology.
What is forensic readiness?
Forensic readiness refers to the proactive preparation and planning to ensure that an organisation can efficiently collect, preserve, and analyse digital evidence in the event of a cyber security incident, such as a hack or data breach. This involves knowing where data is stored, how long it will remain there, and how it can be accessed. By implementing forensic readiness, an organisation ensures that its systems are ready to respond to incidents while maintaining functionality and meeting legal requirements. Forensic readiness planning, as detailed in ISO/IEC 27043:2015, involves preparing for cyber security attacks and breaches before they occur, ensuring that an organisation can quickly and effectively manage and investigate such events.
What is meant by the term forensically sound?
The term forensically sound refers to the integrity and reliability of digital evidence throughout the forensic process. It means that the evidence has been collected, handled, preserved, and analysed in a manner that ensures it has not been altered or tampered with at any stage. Maintaining a forensically sound approach is crucial, as any doubt about the integrity of the evidence could lead to its rejection in a court of law. Detailed and meticulous record-keeping is essential to demonstrate that the evidence remains unchanged from its original state, making it reliable and admissible in legal proceedings.
What information would be typically required on a computer equipment form during a digital forensics investigation?
During a digital forensics investigation, a computer equipment form typically requires detailed information to document the devices being collected and preserved as evidence. The form helps ensure that all relevant details are recorded, maintaining the chain of custody and the integrity of the evidence. The following information is usually included:
-
Identification Information:
- Make and Model: The manufacturer and model number of the computer or device.
- Serial Number: The unique serial number of the device.
- Asset Tag Number: Any asset identification number used by the organisation.
- Device Type: Whether the device is a desktop, laptop, server, or other type of computing equipment.
-
Ownership Details:
- Owner/User: Name of the individual or department to which the device is assigned.
- Organisation Details: The name of the organisation owning the device.
-
Physical Description:
- Condition of Device: Note the physical condition of the device at the time of collection, including any visible damage.
- Accessories: List any accessories collected with the device, such as power cables, external drives, or peripherals.
-
Location Details:
- Location of Seizure: The specific location (e.g., office, home) where the device was collected.
- Date and Time of Collection: The date and exact time when the device was collected.
-
Collection Details:
- Collected By: Name and signature of the person collecting the device.
- Witnesses: Names and signatures of any witnesses to the collection.
- Chain of Custody: Documentation of the transfer of the device, including names, dates, and times each time custody changes hands.
-
Device Status:
- Power Status: Whether the device was on, off, or in sleep mode when collected.
- Connected Devices: Any devices connected to the computer at the time of collection, such as USB drives or network cables.
-
Storage Information:
- Storage Location: Where the device will be stored during the investigation.
- Environmental Conditions: Description of the storage conditions to ensure the device is preserved correctly.
-
Digital Evidence Details:
- Data Acquisition: If applicable, note whether a forensic image was created at the scene, including details of the tools and methods used.
- Hash Values: Record the cryptographic hash values of the data to verify its integrity.
This information ensures that the digital evidence is properly documented, preserved, and handled throughout the investigation, maintaining its integrity for use in legal proceedings.
How should exhibits be properly packaged and labelled during a digital forensics investigation?
Proper packaging and labelling of exhibits are crucial to maintaining the integrity of evidence. Ideally, exhibits should be placed in a tamper-proof evidence bag with a unique seal number, which must also be documented in the investigator’s contemporaneous notes. As a minimum, the following details should be recorded on the front of the evidence bag:
- A brief description of the evidential item.
- The name of the person or location from which the evidence was obtained.
- The name of the person taking custody of the evidence.
- The signature of the person taking custody of the evidence.
- The time and date when the evidence was placed in the bag.
For large or bulky items, sealed boxes with tamper-evident tape can be used for transportation. The tape should be signed by the person seizing the items, with the signature crossing the seal. Additionally, sticky labels should be attached to the box, noting at a minimum:
- The time of the seizure.
- The date of the seizure.
- The location of the seizure.
- The identity of the person seizing the items.
- A reference number for the exhibit.
These steps help ensure that evidence remains secure, properly documented, and intact throughout the investigative process.
What is the convention for allocating exhibit numbers?
Investigators will usually use their initials followed by incremental numbers.
for example: JL/01
Cross-referencing Exhibits:
Exhibits often need to be cross-referenced, especially when parts are removed from a larger item, such as a hard disk taken out of a computer housing. It’s important to clearly establish the connection between the items. One method to achieve this is by appending an additional number to the original exhibit reference. For instance, if the computer is recorded as Exhibit JL/01, the associated hard disk could be labelled as Exhibit JL/01/01. A second hard disk found in the same computer casing could then be recorded as Exhibit JL/01/02. This approach ensures a clear and organised reference system for related items.
What is the chain of custody (CoC)?
CoC stands for Chain of Custody. In the context of digital forensics and legal investigations, it refers to the documented process that tracks the movement, handling, and storage of evidence from the time it is collected until it is presented in court or archived. The Chain of Custody ensures that the evidence remains untampered and is handled by authorised individuals only, maintaining its integrity and admissibility in legal proceedings.
Key components of the Chain of Custody include:
- Detailed Records: Every person who handles the evidence must be documented, including their name, the time and date they took custody, and the purpose of the transfer.
- Secure Storage: Evidence must be stored in a secure environment to prevent unauthorised access or tampering.
- Preservation of Evidence: The condition and integrity of the evidence must be preserved throughout the process, with any changes or observations carefully recorded.
Maintaining a proper Chain of Custody is crucial to ensure that the evidence is reliable and can be used effectively in court.
What is a write blocker?
A write blocker is a tool used in digital forensics to prevent any data from being modified or written to a storage device, such as a hard drive, during the process of accessing or copying data from it.
Key Functions of a Write Blocker:
- Protects Evidence Integrity: By blocking any write commands, a write blocker ensures that the original data on the device remains unchanged. This is crucial for maintaining the integrity of the evidence, as any modification could compromise its admissibility in court.
- Allows Read-Only Access: It allows forensic investigators to read and copy data from the device without risking any accidental or intentional alteration of the original content.
- Supports Forensic Analysis: Write blockers are essential when creating forensic images (exact copies) of storage devices, ensuring that the original evidence is preserved in its pristine state.
In summary, a write blocker is a critical tool in digital forensics that ensures data integrity by preventing any changes to the original evidence during analysis or investigation.
