Chapter 13 Digital Forensics

If the case comes to trial and the analyst is called he or she will have two duties

1. Analyst must testify to his/her direct experience. Analyst may testify about everything from receiving the initial evidence to the final report. 2. Analyst may play the role of a technical expert, qualified to give summaries and opinions as to the meaning of evidence.

Two imperatives of hard drive manufacturers:

1. Storage Density 2. Speed

Hash

A number generated by an algorithm from a text string. Also known as a message digest.

hex editor

A type of computer program that allows for manipulation of the fundamental binary data that constitutes a computer file.

L2 cache

A type of memory cache that is slightly slower than L1 cache, but has a much larger capacity, ranging from 64 KB to 16 MB. (SLOWER BUT HOLDS MORE INFO)

L1 Cache

Cache used by a CPU for short-term storage of data and instructions. It is the fastest and closest to the CPU.

The image produced should be written to a true, write once media such as a

DVD-R or CD-R

EFS

Encrypting File System.

True or False: Field Acquisition is the preferred method

False: Because failure to maintain control of the evidence device can also lead to problems in establishing the authenticity or chain of custody of the evidence in court (least preferred bc makes it easier for defense to undermine your testimony)

The forensic analyst's process must include a step to calculate an ___________ hash of the evidence device

MD5

Most important task for examiner

Maintaining the continuity of evidence from the source to the final anlysis product.

The examination of stored data is often referred to as _________ analysis

Post-Mortum

Write blocker

Prevents data writes to a hard disk. Usually used on the windows operating system to prevent the analysts lab computer from writing data to the HD.

True or False: Analysis creates investigation leads and summaries not evidence

True

True or False: Logical copies do not produce latent data

True

True or False: Rule of evidence: original evidence, not a copy be brought to court

True

True or false: Bulk of evidence is from active files

True

Lossless Compression

a data compression algorithm that allows the original data to be perfectly reconstructed from the compressed data.

Direct-access storage

a storage method that allows a data-retrieval mechanism to quickly find data

The Gold Standard

an analyst must be able to reliably reproduce any result from procedure notes and a copy of the original data seized.

Digital evidence is more easily ____________ than physical evidence

authenticated

Best method of imaging the evidence drive is to create a _______ copy

bit stream. (also called a mirror or image)

Botable CDS

create a RAM drive and can be used to load larger programs, thus they do not alter data on the hard drive.

One of the most important characteristics of FAT systems is

deleted files aren't wiped from the drive.

Most common source of latent files is __________

deletion

Two broad classes of removable storage media:

direct access and sequential access.

Disk drives allow

direct storage access, they do not have stored information in sequential order like a magnetic tape or other device.

Storage Forensics

examination of information stored on a physical medium

hex editor can be used to _______________

examine intact files (active data) or obscured/deleted data (latent)/ Can access active and latent files without interfering with hard disks

Latent files

files that are not recognized by the OS, therefore, do not show up on a list of files.

A hash value is essentially the _________ of the digital data set

fingerprint

Electronic Crime Scene Investigation: A Guide for First Responders

intended to assist state and local law enforcement w ho may be responsible for preserving an electronic crime scene for recognizing, collecting, and safeguarding digital evidence.

RAM

largest reserve of info that supplies the processor

computer forensic packages

make it easier to find elements and establish elements of a crime -Can bring all the info form the hard drive at once -All digital data are stored as a pattern of bits -Generally validated by an external expert and used in standard practice

Physical medium

real world object that may be inside or outside the computer.

A bit stream copy

reproduces every bit of info found on the evidence device, even unused storage space.

Sequential access storage

requires longer to fast forward through unneeded data to find requested data

The expert witness presents

simplified explanations and abbreviations to the fact finder.

When information is stored on a physical medium, it is said to be __________

static

Activity Log

steps of analysis that must be organized in a consistent and reproducible fashion.

Power of the search

the ability of a search to achieve results; like when you misspell something and it helps you find stuff easier

Time access of Direct access storage

the time required to access data is reduced, making retrieval faster

True or False: Digital evidence is easier to authenticate than physical evidence

true

True or False: The image of a device is considered to be "best evidence"

true; The Federal Rule of Evidence allows unaltered digital evidence to be presented as a copy. A comparison of MD5 hashes can verify that the data is unaltered.

Structures of digital storage can be divided into two parts

volatile and nonvolatile storage

Active Files

word processing docs, spreadsheets, text files, graphics, etc