Introduction
Most of the information in the world today is collected, transferred, saved and processed
digitally. With digital information becoming ever-present in our daily lives, incidents of computer crime are
on the rise. Increasingly, criminals are adopting various technological means to enable their offending,
obfuscate evidence and avoid prosecution. Law enforcement has found itself in a continuous battle as new
methods are devised to commit crimes, in response new procedures must be
developed.
The field of digital forensics is still young and emerged in response to a growing amount of computer
related crimes. Its origins can be traced back to the FBI and similar agencies, when they began developing
programs in the late 1970s to examine digital evidence. There is no single answer to ‘what is
digital forensics’, however it can be broadly described as 'the process of identifying, preserving, analysing,
and presenting digital evidence in a manner that is legally accepted'. The investigative
approach is extremely important for a forensic examiner, they must ensure the absolute credibility of any
evidence obtained. Overlooking a step or mishandling information can lead to inconclusive or poor results
and a culprit may escape conviction, or an innocent suspect could be subject to negative consequences.
Technicals & Procedures
As opposed to simply examining devices or analysing data, the fundamental
goal of digital forensics is to offer legitimate and accurate digital evidence for
court cases. It does not solely focus on technical problems; it encompasses
both computing methods and legal issues. It is multidisciplinary in nature, dealing with arrests, seizures, preservation,
investigations and the storage of devices and objects. Digital evidence itself
comes in many different formats such as physical hardware, digital audio,
video and imagery, mobile devices, user logs, social media and other digital
communication platform history. Law enforcement has recognised that
modern day life cannot be adequately protected without considering the wide
variety of digital devices and systems that can be exploited. Unfortunately, due
to the overwhelming amount of digital information being collected, there is a
significant lack of resources to competently analyse all the evidence. As such,
there is a large backlog of pending criminal cases with thousands of devices
awaiting examination.
Our digital footprint is enormous and provides lots of information about the
webpages we visit, the actions we commit, when we were active on a system
and the type of device we were using. Following these footprints allows
investigators to retrieve data that is often crucial to criminal cases. Various
tools and software can be used to help experts when they are analysing
encrypted information and many different techniques can be deployed
depending on the type of crime being dealt with. Some of the tasks involved
with an investigators role include cracking passwords, recovering deleted data,
examining content on devices and determining the source of security breaches. Once all of the evidence has been collected, it will be stored and
made presentable for the police or courts to review.
The procedures for conducting an investigation should be flexible given the fast moving technological landscape. However, to limit
liability, ensure legitimacy, validity and reliability; some definition of a standard operating procedure is typically adopted. A number of
frameworks have been suggested, the DFRWS created a model in 2002 which consists of six phases and does well at providing general
guidance. Other institutions have also engineered models to approach the issue of a formal set of forensic
investigation rules, with some organisations distilling existing frameworks into their own policies.
Laid out below are the general procedures for a digital forensic investigation:
- Preparation
• Monitor, support and obtain authorisation to begin the investigation.
• Ensure that the infrastructure and resources are sufficient.
• Provide the mechanism to detect and confirm any incident.
• Identify the need for the investigation.
• Plan in detail the path to getting the required information.
• Identify and agree a strategy, policies and remit.
• Inform subjects involved that the investigation has begun.
- Acquisition & Preservation
• Establish what constitutes as evidence and identify potential sources of data.
• Determine the location of the evidence and details of incident.
• Translate any media into relevant data.
• Maintain integrity via write protection & hash checking.
• Package, transport and store the data.
• Ensure that the devices cannot be tampered with; maintain chain of custody.
• Record the details of any physical scene.
• Duplicate all digital evidence using accepted tools and methodology.
- Examination & Analysis
• Determine the author of the data and how and when it was produced.
• Record and highlight significant data points.
• Extract any hidden data or information stored within unconventional locations.
• Attempt to identify patterns in behaviour.
• Recognise clear digital evidence and assess the competence of the suspect.
• Transform the data where required into a more manageable format for analysis.
• Construct detailed documentation to assist analysis and form conclusions.
• Build a timeline of events and data.
• Create hypothesis of the event and document the findings.
- Examination & Analysis
• Prepare the results from the analysis.
• Determine the reliability and relevance of the information.
• Clarify evidence, statistics and provide an explanation of conclusions.
• Communicate the findings and prove the validity of the hypothesis.
- Resolution
• All physical and digital property is returned to its owner.
• Disseminate the data from the case.
• Determine which criminal evidence must be removed.
• Review the case to identify potential areas of improvement.
• Finalise the investigation and preserve the obtained knowledge.
Tools
A critical element of forensic analysis depends on practitioners knowledge of the limits, capabilities and restrictions of their tools. It is
not possible to calibrate and verify digital forensic tools in the same way as equipment used for analysing DNA or other scientific
evidence, there are simply too many variables. NIST has conducted thorough tests on the various features of leading forensic toolkits,
however there are more software applications and capabilities available than any one group can test, so forensic analysts are normally
recommended to perform some kind of validation themselves. Many organisations choose to develop their own test data incorporating
scenarios that they commonly encounter; this can allow them to test their tools and ensure that their interpretation of pertinent
information is correct. Even following validation of tools, experienced analysts will “trust but verify” any important findings. This could
include reviewing the data in a hex viewer, or repeating the analysis with a different forensic tool and confirming the same results are
achieved.
Some of the tools available and often used within the industry include:
FTK / Forensic Toolkit
This is an advanced password recovery and encryption breaking application that also offers full disk forensic imaging, registry parsing
with labelling and bookmarking and nice visualisation options all navigated with a modern and simple user interface.
EnCase
Securely analyse multiple machines simultaneously, triage and collect information from various locations. Unify evidence while
ensuring integrity, provides customed workflows and efficiently audit large groups of machines to identify fraud and security issues.
Sleuthkit
A collection of UNIX based command line file and system volume analysis tools. Inspects raw, EW and AFF file types and disk images. A
complete kit for investigating disk images and recovering files from them, review meta data, complete file structure analysis and
timeline generation.
Autopsy
Provides a graphical user interface for Sleuthkit. Complete offline or live analysis is done when used in combination with Sleuthkit.
CAINE
This is an open source Linux based distribution developed explicitly for digital forensic purposes. It provides a suite of existing security
tools all based around user friendly interfaces. It provides automatic extraction of timelines from RAM, and many tools such as
Autopsy, Wireshark and PhotoRec built in and ready to go.
SIFT
Another popular Linux distro focused on digital forensics and incident response. It automatically maintains the latest software with
tools and techniques for investigation.
Wireshark
This platform is one of the worlds most popular network analysers. It specialises in network monitoring and troubleshooting and
conducts deep packet browsing. It is multiplatform and has a substantial list of features.
Volatility
Tools within the Sleuthkit focus on hard drive discovery, however this is not the sole place where data could be stored. Important
forensic information is often found in RAM and this must be collected quickly and carefully. Volatility is the most widely recognised tool
for the analysis of volatile memory and is open source.
Registry Recon
A variety of data can be found stored in the system registry; malware is also regularly present within OS registries. Registry Recon is a
specialised tool that enables users to analyse and rebuild parts of the registry.
Cellebrite
This platform focuses on mobile digital forensics. It features a full investigative solution with a range of tools, the ability to check for
deleted data, breach encryption and the extraction of data from mobile devices make it a widely utilised application.
Evaluation & Importance of Documentation
There are still some drawbacks to the digital forensic techniques used today. To ensure compliance with traditional forensic
requirements, all data pertaining to an investigation must be collected and examined for evidence. Current computers could be holding
large volumes of data to be reviewed, which leads to lengthy timeframes gathering, storing and analysing data. Technology and the
crime it enables are rapidly changing, the systems under investigation are often evolving faster than the tools to examine them. Due to
electronic devices being so widespread, computer crimes are occurring across all jurisdictions and many areas lack the resources to
train and hire investigators.
Given that every investigation has its differences, it will remain difficult to fully determine a set of standard operating procedures.
Therefore, it is extremely important to deploy a methodical approach to organising and analysing the large data sets involved with
computer crime. Reconstruction of a scenario using forensic data allows investigators to gain a more complete understanding of the
situation, the acquired data lets us sequence events, determine locations and establish the time and duration of user actions.
Throughout an investigation it is imperative to maintain high levels of care and attention to documentation, the proper handling and
processing of evidence should mitigate any problems that could affect admissibility. The HTCIA adopted these guidelines to preserve
the admissibility of digital evidence:
1. Upon seizing digital evidence, action should not change that evidence.
2. When it is necessary for a person to access original digital evidence, that person must be forensically competent.
3. All activity relating to the seizure, access, storage or transfer of digital evidence must be fully documented, preserved and available for review.
4. An individual is responsible for all actions taken with respect to digital evidence while the digital evidence is in their possession.
5. Any agency that is responsible for seizing, accessing, storing or transferring digital evidence is responsible for compliance with these principles.
The absence of procedural standardisation further exacerbates the difficulties and effectiveness of current investigation techniques,
creating privacy concerns and hindering efficacy. Disparities in regional law enforcement operational requirements, training and
budgets results in different methods being used for preparing and presenting forensic reports. This can have a big impact on the end
quality of an investigators findings and there is a genuine need to develop a standardised set of procedures and specifications,
something that provides clear guidance to achieve a format that will be admissible across many jurisdictions. Generally speaking, the
methods used to collect evidence have been developed informally by investigators within the industry. The scope and legality of
digitally acquired evidence within criminal proceedings can sometimes be unclear and may not be rigorous enough for justice systems
standards.
Summary
The field of digital forensics has progressed with great speed, but more is needed as new interesting problems appear on the horizon.
With computers reaching ubiquity throughout modern society, they continuously change in shape, size, purpose and function. At one
point in time evidence could be gathered from large mainframes, however now we have personal computers, mobile devices, laptops,
cloud service providers and complex networks, all of which can offer digital evidence. Data located on a computer in the United
Kingdom could be readily available to another user across the world, spanning many legal jurisdictions.
It is crucial that this domain is given the attention and resources it needs to achieve fair and accurate outcomes. A poorly conducted
investigation, badly managed procedures and a lack of tools could have serious and far reaching consequences for all those involved.
Moving forward, challenges remain for investigators due to the sheer volume of data being captured. A single inquiry can contain many
terabytes of information, spanning across many device types and locations. Ensuring that this landscape is properly funded and
nurtured will have a profound impact on the future of the legal framework surrounding our digital lives.