Week 2

Question 1

What is ACPO principles?

Answer 1

1 = “No action taken by law enforcement
agencies, persons employed within those
agencies or their agents should change
data which may subsequently be relied
upon in court.”
2 = “In circumstances where a person
finds it necessary to access original data,
that person must be competent to do so
and be able to give evidence explaining
the relevance and the implications of their
actions.”
3 = “An audit trail or other record of all
processes applied to digital evidence
should be created and preserved.
An independent third party should be
able to examine those processes and
achieve the same result.“
4= “The person in charge of the
investigation has overall responsibility for
ensuring that the law and these principles
are adhered to.”

Question 2

What are the important ISOs?

Answer 2

27000 is the cover standard and some important ones are:
* ISO/IEC 27041 offers guidance on the assurance aspects of digital forensics e.g. ensuring that the appropriate methods and tools are used properly.
* ISO/IEC 27042 covers what happens after digital evidence has been collected i.e. its analysis and interpretation.
* ISO/IEC 27043 covers the broader incident investigation activities, within which forensics usually occur.
* ISO/IEC 27050 (in 4 parts) concerns electronic discovery which is pretty much what the other standards cover.
* British Standard BS 10008:2008 “Evidential weight and legal admissibility of electronic information.
Specification.” may also be of interest.
* ISO/IEC 17025 enables laboratories to demonstrate that they operate competently and generate valid results, thereby promoting confidence in their work both nationally and around the world

Question 3

What are the basic 5 stages of an investigation?

Answer 3

. Identification
* Preservation
* Extraction
* Interpretation
* Presentation

Question 4

What is a devices IMEI?

Answer 4

International mobile equipment identifier. dial *#06#. Connected to the hanset.

Question 5

What is a devices ICCID?

Answer 5

Integrated circuit card ID. On the physical sim card.

Question 6

What is a devices IMSI?

Answer 6

International mobile subscriber identity. Connected to sim card.

Question 7

What is a devices MSISDN?

Answer 7

Mobile station integrated services digital network. A phone number. Connected to sim card.

Question 8

What are some examples of forensic software?

Answer 8

Cellebrite UFED
MSAB XRY
Oxygen
FTK
Magnet Axiom

All require a licence

Question 9

What are the different levels of electronically stored data?

Answer 9

Bit 1
Crumb 2
Nibble 4
Byte 8
Word 16
Double word 32