In terms of technology they use overlapping equipment but create totally different results. If your findings might be tested — in a tribunal, a court, a disciplinary hearing, or an insurance claim — that difference decides whether you have evidence or an assertion.
Although technically the two processes are virtually indistinguishable from one another, what creates separation is that no process may write to the original data, everything is hashed so alteration will demonstrate itself, and every step of the process will be documented sufficiently that you can perform the same actions months after they were first performed.
Technical basis for the statement that no alterations occurred.
Hardware that physically sits between the evidence drive and the workstation — passes read commands from the workstation through it and rejects all attempts to write to the evidence drive at the interface level. This is physical hardware as opposed to a software setting which could be misconfigured — and even accidentally, the evidence drive cannot be written to.
Hashes are generated using SHA-256 over the original data being captured and then again using SHA-256 over the resultant captured images. Identical hashes validate that the copies are identical to the original. If even one bit has been changed from its original state, the entire hash will be different therefore if any modifications occur after capture they can always be detected by comparing the current hash with the original hash.
Each time a previously validated copy of an image is utilised, a new hash is calculated. As long as the calculated hash continues to match the hash created upon initial validation of the image, it can be proven that no alterations have occurred to the copy since it was originally captured.
Documentation of tools, tool version numbers, all applicable parameters, date and time stamps, along with all conclusions reached throughout the course of creating/validating the copy — enabling an independent examiner to create the same results.
This portion of the process typically relates to the administrative side of things, and unfortunately it also accounts for where most failures typically occur.
Documentation of chain of custody is a continuous and detailed documentation of who has been in possession of the items from the time of seizure to the report. The documentation includes a signed copy of the exhibit log on receipt detailing what was received and in what condition. Also included are records documenting the secure storage of the exhibits and the access to them. In addition, each time the item is moved or handled, a new entry should be added to the log.
The reason that chain of custody is important is that while all of the technical work may have been done correctly and in a very professional manner, the lack of continuity in the chain of custody will provide the opposing party with the opportunity to argue as to whether or not the results obtained during the examination are valid based upon nothing but the documentation (i.e., paper work). As such, it provides the opposing side with an easy way to attack the validity of your findings.
In the UK this follows the same principles as those set by the Association of Chief Police Officers (ACPO) for digital evidence. In terms of practical application this means: do not alter the source data; if you have to, be competent to do so and explain why; keep an accurate log so someone else could follow your steps; and the person overseeing the work is responsible for compliance.
Most users would not expect the amount of detail available from their computers, especially Windows and macOS systems. Most operating systems now track user activity with great detail and even once the related files have been deleted there is still a lot of detail left behind.
What removable media were plugged into computers at what times? What items were copied from those media (these are often logged even if you can no longer see the file)? This is recorded in both the registry and system log entries.
Link files, jump lists, and shellbags, in other words, they indicate what was opened and which folders were browsed, including items since deleted.
Recovered deleted files in unallocated space were recovered as they existed prior to being deleted. The most important part is usually the date & time the file was created or modified; thus, these fields are preserved.
Combining timestamped data from the file system, registry and logs to create a timeline of events that occurred chronologically.
The most frequently violated rule. Usually done for good reasons.
Do not check it first. The act of booting your computer will alter timestamps on hundreds of files, possibly trigger updates and begin writing to disk prior to anybody viewing it. Opening a file in order to determine if you have opened the correct file will alter the last accessed date. Files copied using a file manager will create no documentation as to the contents of those files.
Should there be any chance the materials are used as evidence, preserve them precisely as they exist and say so at the first call — the nature of how they are handled is altered once received. Where a normal recovery later turns out to involve a dispute or a data breach, capturing images of them correctly at inception is free and allows all options available.
The fee for a forensic investigation is from £800 +VAT after scoping. In order to start an investigation, there is a 50% deposit required. An investigation will be charged regardless of whether anything improper is found; as finding nothing improper is a valid conclusion to reach during an investigation and requires the same level of analysis to conclude appropriately.
Recovery gets you back your files. Forensics can also prove that nothing has been done to them – write-blocked acquisition, SHA-256 hashing to prove that the image is identical to the original, and following the chain of custody as per ACPO principles.
Physical device that sits between the evidence disk and the workstation that will pass read requests through but will not allow any writes to occur at the interface layer. Due to its physical nature, accidental changes to the original cannot be made.
The SHA-256 hash will prove at both the time of forensic collection and again upon review of the working copy that the two are identical in every detail. Therefore, if a single bit on the drive is altered after collection, the entire hash will be completely different, so the alteration is detectable.
There must exist an unbroken paper trail detailing who had possession of the drive and for how long throughout its history, from receipt until reporting. No matter how good your analysis process, there can be no gaps in documentation regarding the storage of the drive.
Often. A forensic examiner can look at many different types of data left behind from USB devices. Link files, jump lists, shellbags and file system timestamps provide enough information to determine which USB devices were connected and accessed and when. Frequently, even after deletion of said items, these files remain accessible to investigators.
No. This is where most evidence is compromised. When you boot a computer, multiple hundred files get their timestamps changed, and it may trigger writes; opening a document alters its access time. So leave everything exactly as it is and say so when you call.