Digital Evidence Acquisition
Some important things to consider
- Chain of custody
- Document - screenshots, etc
- Permission - warrant, etc
The ultimate goal of a digital forensics investigation is to preserve, identify, acquire and document digital evidence to be used in the court of law
The most important step in digital forensics. A single-shot chance. No mistakes allowed!
Looking through the files or booting up the computer will destroy the evidence
No matter the type of data, you should always keep in mind that digital evidence is fragile and volatile
Hence methodological procedures should be followed to ensure the integrity of the data during the acquisition process
Things to consider
- Order of volatility
- Imaging methods
- Forensic image files formats
- Capabilities of imaging tools
- Keep continuity in mind
- Write-blockers
- Image validation
- Last but most important documentation, aka CoC
The first two rows of evidence types can only be captures in case the investigated machine was running
Go in order, start at the top and make your way down to make sure you get stuff in the order of what is most fragile
During a forensic investigation, we cannot perform tasks directly on the original evidence, since it will be considered contaminated!
If I cannot work on the original evidence, I should create an image (sort of copy) of the evidence
A copy provides the actual data of a file without any extra information, such as the file's metadata
Due to the importance of metadata and other information on the drive, digital forensic investigators capture an image of the drive
Imaging an evidence drive allows capturing the entire drive bit-by-bit, including actual files, data in slack space, swap files, and unallocated space (which may contain deleted files)
In most images of file systems, (like NTFS) the metadata is kept separate from the file data
- In a copy, the only thing that would be grabbed is the file data and not the metadata (ie the time is changed to when the file was copied)
- In an image, the metadata is maintained (the time stays the same as the original)
If a drive failed, you can replace it with it's clone, not it's image
Since the forensic image is stored as a file!
However, you can compress and fragment an image
Create two images from the evidence drive, in case one gets corrupted, the second one can be used for further analysis
Use two different tools for image acquisition
Photos can be attached to the CoC to show the evidence state at the collection time. This is very important in case of acquiring a powered-on machine, which has running applications on its screen
You can also include a photo of the disk label for example
The acquisition validation is used to ensure that the forensic image is identical to the source
The validation of digital evidence involves using a hashing algorithm to generate a hash value (aka a fingerprint) which is a unique binary or hexadecimal number
Identical files will always have the same fingerprint even if their names differ
Integrity check guarantees that the data has not been corrupted or altered during the acquisition process
The data integrity should be verified using verification algorithms, such as:
- Message Digest (MD5) Hash
- Secure Hash Algorithm 1 (SHA-1)
- SHA-2
The physical image is the entire hard drive; it copies all the zeroes and ones on the drive
hence a physical image of a 1TB drive will generate an image file of size 1 TB
This is the most common in digital forensic and it is important in case you suspect that the evidence has been deleted or modified
The logical image is part of the hard drive, a certain volume(s) of the drive
For example, if a hard drive contains two partitions, D and E, the logical image would be data from E: Drive or D: Drive
This is very useful in case you are interested only in the information contained in the drive
In some cases, you know what files you need for the investigation
If the target machine is powered on and running, the acquisition is called live acquisition (aka Online Acquisition), The live acquisition helped to collect important information such as memory content, unencrypted data, passwords, and open network connections
In live Acquisition, it will be difficult to avoid contamination, since the tools and commands you will use will change the time and date of file access, use DLLs, or shared libraries, trigger malware, or even reboot the device
In some cases, the investigated device cannot be brought down
The static acquisition (aka dead) is when the target machine is powered off
In such cases, you could remove the hard drive and connect it to a hardware write-blocker or boot it from a live forensic OS
The write blocker will prevent the modification of the hard drive since the device allows read only from the evidence drive
Examples of static data are emails, images, word documents web activity, spreadsheet, slack space, swap files, unallocated drive space, and deleted files
Local is when you have physical access to the investigated system
While in remote acquisition, you will need network tools to create connections for evidence acquisition