Digital Evidence Acquisition
Some important things to consider
- Chain of custody
- Document - screenshots, etc
- Permission - warrant, etc
The ultimate goal of a digital forensics investigation is to preserve, identify, acquire and document digital evidence to be used in the court of law
The most important step in digital forensics. A single-shot chance. No mistakes allowed!
Looking through the files or booting up the computer will destroy the evidence
No matter the type of data, you should always keep in mind that digital evidence is fragile and volatile
Hence methodological procedures should be followed to ensure the integrity of the data during the acquisition process
Things to consider
- Order of volatility
- Imaging methods
- Forensic image files formats
- Capabilities of imaging tools
- Keep continuity in mind
- Write-blockers
- Image validation
- Last but most important documentation, aka CoC
The first two rows of evidence types can only be captures in case the investigated machine was running
Go in order, start at the top and make your way down to make sure you get stuff in the order of what is most fragile
During a forensic investigation, we cannot perform tasks directly on the original evidence, since it will be considered contaminated!
If I cannot work on the original evidence, I should create an image (sort of copy) of the evidence
A copy provides the actual data of a file without any extra information, such as the file's metadata
Due to the importance of metadata and other information on the drive, digital forensic investigators capture an image of the drive
Imaging an evidence drive allows capturing the entire drive bit-by-bit, including actual files, data in slack space, swap files, and unallocated space (which may contain deleted files)
In most images of file systems, (like NTFS) the metadata is kept separate from the file data
- In a copy, the only thing that would be grabbed is the file data and not the metadata (ie the time is changed to when the file was copied)
- In an image, the metadata is maintained (the time stays the same as the original)
If a drive failed, you can replace it with it's clone, not it's image
Since the forensic image is stored as a file!
However, you can compress and fragment an image
Create two images from the evidence drive, in case one gets corrupted, the second one can be used for further analysis
Use two different tools for image acquisition
Photos can be attached to the CoC to show the evidence state at the collection time. This is very important in case of acquiring a powered-on machine, which has running applications on its screen
You can also include a photo of the disk label for example
The acquisition validation is used to ensure that the forensic image is identical to the source
The validation of digital evidence involves using a hashing algorithm to generate a hash value (aka a fingerprint) which is a unique binary or hexadecimal number
Identical files will always have the saqme fingerprint even if their names differ
Integrity check gaurantees that the data has bit been corrupted or altered during the acquisition process
The data integrity should be verifies using verification algorithms