1. Forensic Investigation Techniques Michael Jones

2. Overview Purpose People Processes Michael JonesDigital Forensic Investigations2

3. The (Digital) Forensic Process Photographs Faraday bags Photographs Faraday bags Imaging - forensically sound copying Analyse file system and analyse files Produce Report Scene Store Laboratory Chain of Custody Michael Jones3Digital Forensic Investigations

4. Review: Logical and Physical Views Logical view – As seen via the file manager Physical view – What is (physically) on the device Questions – What might these be different? – What is ‘striping’? – Is ‘physical’ really physical? Michael JonesDigital Forensic Investigations4

5. Imaging Low (device) level – Duplicating the bit sequence – Output is a file – Multiple copies may be taken Verification – Applying (hashing) algorithms to device and copy MD5, SHA1 If device and copy hashes match then copy is forensically sound Devices and copies returned to (case) store Michael JonesDigital Forensic Investigations5

6. Analysing the Image Before: apply hashing algorithms Processes: – Identify file system – Scan for known file types – Compare with logical view – Match logical and physical views and identify deleted files – Deeper analysis After: apply hashing algorithms Michael JonesDigital Forensic Investigations6

7. Digital Forensics Triage Triage – Quick analysis to identify priorities – why? Focus on logical view – Plus deleted files Ideal outcomes of triage Michael JonesDigital Forensic Investigations7

8. Main Analysis That which is actually there – File dates and times – File and directory (folder) names – Metadata That which might require interpretation – Examples encoding and encryption File manipulation (e.g., changing first byte of a jpeg) Michael JonesDigital Forensic Investigations8

9. Deeper Analysis Can be time consuming Secondary data – Additional processes needed Examples – Use of slack space, unused space – Encoding and encryption – Steganography E.g., Snow Michael JonesDigital Forensic Investigations9

10. Summary Rigorous processes need to be followed – E.g., ACPO guidelines All investigations produce documentation All documents and artefacts must be labelled and stored appropriately Chain of custody must be unbroken Michael JonesDigital Forensic Investigations10