Please enable JavaScript.

Coggle requires JavaScript to display documents.

Block 5 - Coggle Diagram

- - - - There are a few other examples of a forensic process being applied in order to ascertain the root cause of some alarming event from ancient times, but forensic science as we know it today really started evolving in the eighteenth and nineteenth centuries. Toxicology, the study of poisons, was one of the new forensic disciplines being introduced by the Spanish chemist Mathieu Orfila in 1840. Orfila had published the first scientific treatise on poisons, as early as 1814, but the first time toxicology was used in a forensic sense was when a court asked Orfila to investigate a murder where a wife was accused of poisoning her husband...
        
        Later in the nineteenth century, French policeman Alphonse Bertillon invented a cataloguing system for criminals and suspects that was based on physical appearance. The process of identification, Bertillon claimed, could be accelerated and improved by noting numerous statistics, including the lengths of a person’s arms and legs, and the circumference of their head. This approach to classification turned out to be too cumbersome, though, and was later supplanted by fingerprint analysis. Nevertheless, Bertillon made another contribution that has lasted to the present day – taking photographs or ‘mugshots’ of anyone arrested for questioning to aid recognition by police in the future.
        
        Figure 5.2 The ‘mugshot’ side and front facial view A pair of ‘mugshot’ photographs of a woman; one showing a side view, the other showing the front view of her face. She is holding a board showing her prisoner number in the second photograph.
        
        A more controversial and, from a modern perspective, offensive method of classification was proposed by Cesare Lombroso, an Italian criminologist, who theorised that criminality was inherited; and that a person’s facial features – for instance, a large jaw, hooked nose or protruding ears – would give their malicious nature away. Indeed, in his book Criminal Man, first published in 1876, Lombroso (2006) suggested that certain features were typical of certain types of criminal. He went on to develop this idea in other works, notably Criminal Woman, The Prostitute and The Normal Woman. Titles such as these would be unlikely to make it onto bookshelves today, but Lombroso’s theory of the ‘born’ criminal dominated thinking about the causes of criminal behaviour in Europe and America through to the twentieth century, and fed into then popular notions such as ‘degeneracy’ and the rise of the eugenics movement.
        
        Fingerprint analysis is probably the forensic process that is best known to the general public, thanks to endless detective novels, films and TV police dramas. While fingerprints were used as a method of signing official documents in many ancient cultures from around 1000 BC, it took until 1788 for a scientist, J.C.A. Mayers, to notice that no two people have the same fingerprints. The observation remained in relative obscurity until the nineteenth century when Sir William Herschel, a British civil servant in India, suggested that fingerprints might potentially be used as a means of identification
        
        A Scottish physician named Henry Faulds is said to have carried out the first investigation to establish this theory as fact in 1880. Nevertheless, it took some time for police groups around the world to start using fingerprints to help solve crimes. By 1901, though, the Scotland Yard Fingerprint Bureau had been set up in the UK; soon afterwards, in 1903, the New York Police Department began using fingerprints to identify people; and in 1905, America’s National Bureau of Criminal Investigation began cataloguing fingerprints that were held on file nationwide.
        
        1 more item...
  - - - the notion that forensic science might contribute to miscarriages of justice is often treated as ironic because of the popular association of science with notions of ‘truth’ and ‘certainty.’ Of course, any sober assessment should clearly understand that forensic techniques, like any other detection system, should be expected to yield errors
        (Cole and Thompson, 2013, p.112)
        
        Study note – Presumption of innocence
        The presumption of innocence is a fundamental legal principle that underpins the of delivery of criminal justice in the UK and many other countries. It means that any person brought to trial must be considered innocent until proven guilty. The onus is therefore on the prosecution to put enough evidence before a court to convince the judge and jury that the accused person is guilty. In the UK, the court must be persuaded ‘beyond reasonable doubt’. If there is any doubt, the accused must be acquitted.
        
        Criminal justice
        Criminal justice is a general term that refers to the laws, procedures, institutions and policies that exist within a particular jurisdiction and that aim to both control crime and enforce the imposition of penalties for crime.
        
        The presumption of innocence is an international human right under Article 11 of the United Nations’ Universal Declaration of Human Rights
        
        Note that in cases of civil justice judges decide for either the plaintiff or defendant on a completely different basis. The criterion used is the ‘balance of probabilities’, meaning that the court must be satisfied, based on the evidence put before it, that a contested event actually happened; or, as Lord Nicholls put it during a case that went to the House of Lords on appeal, the court must be convinced that ‘the occurrence of the event was more likely than not’ (House of Lords, 1995)..
        
        Civil justice
        Civil justice is a system of law used to resolve disputes between individuals and organisations.
        
        Activity 5.2 Forensic science and ‘certainty’
        
        Read the boxed text ‘Profiling Failure – Colin Stagg’ (p. 5) in Chapter 1 ‘Criminal profiling: evidence, experts and miscarriages of justice’ (Koen, 2018) in Koen, W.J. and Bowers, C.M. (eds) The Psychology and Sociology of Wrongful Convictions: Forensic Science Reform. Make some notes and, from these, post a short message encapsulating your thoughts in the tutor group forum. Make constructive comments on two posts from other
        
        As you have seen from Activity 5.2, circumstantial evidence – that is, information that infers that a suspect was involved in some critical event – can look very persuasive. An investigator should therefore be careful not to present any findings they might make during an inquiry as facts, in either any verbal report or any written report. You will take a closer look at report writing in Block 5 Part 5, but for now you could work through the following activity to explore the difference between findings and facts
        
        Activity 5.3 Findings vs facts
        
        1 more item...
- - - - Figure 5.1 The art of investigation – then and now
        
        Description A three-frame cartoon to illustrate how the art of investigation has been depicted over time. The first frame shows a ‘Sherlock Holmes’ figure, sporting a deerstalker hat, with a pipe in his mouth and magnifying glass in his hand; the second frame shows a 1940s-style detective in signature fedora hat and scruffy raincoat; and the third frame shows a modern-day analyst sitting at a desk, concentrating on a laptop in front of them.
        
        This part of TM256 – the final block – aims to provide the essential knowledge you will need to understand the meaning of the term ‘digital forensics’, the types of work it encompasses, and the processes and procedures that are involved. The aim is to give you a good grounding in what digital forensics is, what the processes associated with it are and how a digital investigation should be approached and carried out. There will be hands-on activities for you to try that will enhance your understanding of how operating systems work and what sorts of traces of activity can and should be looked for when examining digital data. You will also gain knowledge that will give you the confidence and ability to make effective case management choices when computer-related incidents arise.
        
        The study notes provided throughout this block contain snippets of useful information for you to file away for further use. You may wish to copy them into your learning journal.
        
        During this week you will learn how to:discuss the development of forensic science with reference to specific disciplines.discuss the development of forensic science with reference to specific disciplines.identify the role of digital forensics within cyber security.explain the aims and stages of a digital forensic inquiry.describe the difference between findings and facts.
        
        What’s it all about?
        
        1 more item...
  - - - Well, has it or hasn’t it? The answer is that you don’t know yet. First, you have to see what you can find that will help to build up a picture of what occurred, when and how. After that, you can think about what or who might have caused the problem under review; and after that, you might consider whether a relevant authority needs to be informed that a crime may have taken place.
        
        In common with other forensic disciplines – a few of which are looked at briefly in the next section – digital forensics is a science. Being scientific means applying a recognised methodology to problem solving. Certain steps have to be followed and the available data has to be thoroughly sifted through before any kind of reasoning can be applied to the findings.
        
        So, let’s start again. What is digital forensics? Put simply, it is an exciting and quickly expanding area of investigative enquiry and one of the newest to become recognised as a formal discipline within the range of specialisms that are termed forensic science. As the name implies, it involves obtaining and analysing data gathered from a wide range of digital devices and storage areas, such as company servers or the cloud, in order to provide intelligence that can be brought before and scrutinised by a court of law. You will look more closely at the formal process in Section 4.
        
        Digital forensics terminology
        A branch of forensic science that centres on the recovery, investigation, examination and analysis of digital data. Digital forensics may be used following unauthorised access to a system, network or data to support reporting of evidence that may be reliably used in legal proceedings.
        
        Forensic science terminology
        The application of scientific methods and techniques to matters under investigation in criminal or civil proceedings
        
        Study note – Is it a crime?
        It is never the job of a person involved in carrying out an enquiry into any given incident to determine whether a crime has been committed. That is for a judge and jury to decide. The police may bring a charge against a person if it is suspected that a crime may have been committed, but that is not proof that a crime actually has been committed.In this block, we will be following the law as it is applied in England and Wales. Other countries may have different rules. It is always advisable to familiarise yourself with the laws that apply in the jurisdiction in which you are working or, in the case of a digital investigation, the jurisdiction in which any device or data is located, before taking any action.
        
        SAQ 5.1 Definitions
        
        Compare the following three quotes, which each provide a definition of digital forensics. What are the similarities and differences? Jot down two or three short answers in your learning journal before looking at the discussion below.
        
        1 more item...
- - - - Description A photograph of a laptop, tablet and mobile phone placed on an office desk.
      - When approaching a digital forensic investigation, it’s important to remember that it is exceptionally difficult to confirm that a particular person was the individual sitting at the computer keyboard when some incident or other happened. There are many reasons why - for example:
        
        it is unlikely that corroborative CCTV footage of the scene will exist
        
        people share passwords
        
        people often keep notes of their passwords in obvious places (e.g. a sticker on or behind the computer screen)
        
        people can guess the passwords of others well known to them
        
        people log into a computer and then wander away, leaving the system open to compromise
        
        people lend each other devices (e.g. laptop, phone, tablet)
        
        people share devices with family members when homeworking.
        
        So, whatever findings are made during a digital forensic investigation, these should be reported in a rational way and in a logical order, starting from low-level observations – for instance, that a particular user was logged in to a computer under review at a certain time – and gradually building to higher level observations – for example, that a file shredding application was used on the machine during that log-in period. Each piece of information should reinforce the last. In this way, a clearer picture of what occurred should emerge.
        
        A way of visualising this idea is to imagine a cartwheel: there is a central hub and many spokes that radiate out from that hub to the outer rim of the wheel. If we think of the suggested suspect in a case as being at the hub of the wheel and each item of data that signifies a particular observed activity as sitting on the outer rim of the wheel, then the spokes become ‘threads’ of association between the suspect and the observed actions (Figure 5.4). The more ‘threads’ that lead back to the suspect, the more the association is intensified. Of course, a proper analysis of the data obtained may show that the suggested suspect had nothing to do with the problem under review.
        
        Yet, even where a compelling amount of intelligence to implicate the suspect exists, the point is that the intelligence only implicates, it does not prove. This brings us back to the central issue mentioned earlier: whose hands were on the keyboard? As digital forensic investigators, it is not our job to say. Our job is to dispassionately analyse and report observations and then let the data do the talking. Others, further up the decision-making hierarchy, can draw whatever conclusions they choose
        
        Figure 5.4 Associating observed data with a suggested suspect – a ‘cartwheel’ visualisation
        
        Description This diagram shows a ‘cartwheel’ visualisation. The circular diagram has a central circle labelled ‘Suspect’. The central circle is surrounded by eight smaller circles, each labelled ‘Data’. Arrows point from each of the ‘Data’ circles to the central ‘Suspect’ circle.
        
        Activity 5.4 Findings vs facts revisited
        
        Go to module website Reconsider the scenario from Activity 5.3. Further analysis of the USB stick found in the suspect employee’s desk drawer has shown that some photographs of their partner and child were stored on it in a folder that was afterwards deleted.
        
        1 more item...
- - - - Step 1 – Identify: Identify potential sources of inquiry-relevant information (devices and data) and the location of the same.
      - Step 2 – Preserve: Preserve relevant electronically stored information by protecting the incident scene, capturing visual images of the scene and documenting all relevant information about any action taken.
      - Step 3 – Recover: Recovering relevant data may involve making a ‘forensically sound copy’ (image) of data stored on particular digital devices at the scene of the incident, or removing such devices – and imaging data on them – off-site, under controlled conditions.
      - Step 4 – Analyse: Analysis involves a systematic search for information relating to the incident under investigation, within any data acquired. Outputs may include artefacts generated by a device’s operating system as well as artefacts generated by a device user. Analysis aims to recover enough information to underpin any opinions formed about actions or activities that occurred on the device under review.
      - Step 5 – Present: Findings made during a digital forensic investigation will be presented in either a formal or informal report. Whichever of these it is, an essential factor is that the report must explain any methods or procedures undertaken by the initial analyst or examiner to the extent that a second examiner could repeat them and obtain the same results. If a report is required for court, it must be presented in a particular format and written to a particular standard. You will look into reports further in Block 5 Part 5.
- - - - The relationship between digital forensic professionals and cyber security professionals, when they work together, might be compared to the way in which detectives and patrol officers work together in a modern police force. Where a patrol officer’s role is to either prevent offences from happening or intervene and take appropriate mitigating action when they do, a detective comes to the scene after an event, investigates the circumstances surrounding it, finds out what happened and attempts to identify what or who was responsible.
        
        Figure 5.6 Analogical visualisation: the role of cyber security professionals and digital forensics professionals within cyber security
        
        Description A two-frame graphic showing a uniformed female police patrol officer in the first frame and a male detective in plain clothes in the second frame.
        
        Summary
        
        Block 5 Part 1 gave a broad overview of the world of digital forensics: what it is, how it can be defined, and how the discipline fits within cyber security. A brief history of forensic science was given, with reference to medical examination, toxicology, facial recognition and fingerprint analysis, as well as some of the main thought and practice influencers in the field over time.The nature and aims of a digital investigation were discussed, together with the standard process model that is generally adopted during an inquiry. The difference between fact and certainty when forming opinions on findings was also explored, and the importance of not jumping to conclusions was stressed.