Forensic Investigation Techniques Michael Jones

Overview Purpose People Processes Michael JonesDigital Forensic Investigations2

The (Digital) Forensic Process Photographs Faraday bags Photographs Faraday bags Imaging - forensically sound copying Analyse file system and analyse files Produce Report Scene Store Laboratory Chain of Custody Michael Jones3Digital Forensic Investigations

Review: Logical and Physical Views Logical view – As seen via the file manager Physical view – What is (physically) on the device Questions – What might these be different? – What is ‘striping’? – Is ‘physical’ really physical? Michael JonesDigital Forensic Investigations4

Imaging Low (device) level – Duplicating the bit sequence – Output is a file – Multiple copies may be taken Verification – Applying (hashing) algorithms to device and copy MD5, SHA1 If device and copy hashes match then copy is forensically sound Devices and copies returned to (case) store Michael JonesDigital Forensic Investigations5

Analysing the Image Before: apply hashing algorithms Processes: – Identify file system – Scan for known file types – Compare with logical view – Match logical and physical views and identify deleted files – Deeper analysis After: apply hashing algorithms Michael JonesDigital Forensic Investigations6

Digital Forensics Triage Triage – Quick analysis to identify priorities – why? Focus on logical view – Plus deleted files Ideal outcomes of triage Michael JonesDigital Forensic Investigations7

Main Analysis That which is actually there – File dates and times – File and directory (folder) names – Metadata That which might require interpretation – Examples encoding and encryption File manipulation (e.g., changing first byte of a jpeg) Michael JonesDigital Forensic Investigations8

Deeper Analysis Can be time consuming Secondary data – Additional processes needed Examples – Use of slack space, unused space – Encoding and encryption – Steganography E.g., Snow Michael JonesDigital Forensic Investigations9

Summary Rigorous processes need to be followed – E.g., ACPO guidelines All investigations produce documentation All documents and artefacts must be labelled and stored appropriately Chain of custody must be unbroken Michael JonesDigital Forensic Investigations10