Please enable JavaScript.

Coggle requires JavaScript to display documents.

Block 5 part 2 - Coggle Diagram

- - - - In order to be credible and assist in solving the problem in hand, an investigation needs to be reliable in its processes and conclusions. This is particularly important – in fact, essential – in digital forensic inquiries, where the credibility of any findings an analyst makes will stand or fall on the fine detail of evidence handling. We will examine what the word ‘evidence’ means in the next section.
        
        Section 4 of Block 5 Part 1 discussed the sequential steps that should be followed during the digital forensic process. The first two steps in the process are to identify potential sources of relevant information and to preserve that information (Figure 5.8). In the following sections, these two steps will be scrutinised more closely.
        
        Figure 5.8 The first two fundamental steps in the digital forensic process
        
        Description Diagram showing two right-pointing arrow shapes. The first arrow shape contains the word ‘Identify’; the second arrow shape contains the word ‘Preserve’.
  - - - Broadly speaking, evidence falls into two categories:
        
        Spoken evidence (sometimes called testimonial evidence) from
        
        eye witnesses who have, claim to have or are thought to have, direct knowledge or information relevant to an event
        
        experts whose knowledge can assist a court on specialist issues, such as medicine and forensic science.
        
        Opinion evidence
        Verbal or written testimony given by a professional e.g. a medical doctor, who is accepted by a court as being an expert in their field, based on their opinion.
        
        Spoken evidence
        Evidence given verbally, usually in a courtroom setting, by witnesses of an event. Sometimes also called testimonial evidence.
        
        Testimonial evidence
        Evidence given verbally, usually in a courtroom setting, by witnesses of an event.
        
        Study note – Opinion evidence
        Expert testimony is also called opinion evidence. In English law, a judge can agree to accept opinion evidence from a professional person whose training and experience supports the claim to be an expert. For the duration of the case concerned, that professional is then called an expert witness. Unlike other types of witness, an expert witness is allowed to express opinions as well as discuss facts. For instance, a medical expert might state in testimony that a murder victim died as the result of loss of blood from a wound which, in their opinion, was inflicted by the forceful use of a knife. A digital forensics expert might state that certain, seemingly incriminating, artefacts found on a computer or mobile phone were created by automatic operating system activity rather than by any user.
        
        Physical evidence (sometimes called real evidence); for example, case-relevant documents or other tangible evidence that can be observed and measured. Usually, physical evidence has to be formally produced by a live witness giving testimony as to how and where the physical object was obtained. In many cases, particularly those involving a forensic inquiry, a record of how the evidence has been looked after between its initial discovery and subsequent analysis is required. This record is called the continuity of evidence or chain of custody (CoC). You will look at record keeping more closely in Section 2.
        
        Physical evidence
        Case-relevant documents or other tangible evidence that can be observed and measured. Sometimes also called
        
        Real evidence
        Case-relevant documents or other tangible evidence that can be observed and measured.
        
        Continuity of evidence
        A written record of how evidence has been handled and by whom between its initial discovery and subsequent analysis.
        
        Chain of custody (CoC)
        A written record of how evidence has been handled and by whom between its initial discovery and subsequent analysis.
        
        Table 5.1 lists a number of common types of physical evidence samples that may be collected at the scene of an incident.
        
        Biological Blood, body fluids, hair
        
        Latent Fingerprints, footprints
        
        Pattern Footwear and tyre track prints
        
        Trace Fibres, soil, glass fragments
        
        Tool and tool mark Tools, traces left by tool use
        
        Firearm Weapons, firearm discharge residue
        
        Drug Solids (e.g. powder cocaine), paraphernalia (e.g. pipe, syringe)
        
        Accelerants Petrol, turpentine, other flammable solvents
        
        Go to module website Activity 5.6 Types of evidence
        
        1 more item...
    - - The terms electronic evidence and digital evidence can be, and often are, used interchangeably. In recent years, ‘digital evidence’ has become more commonly used and it will be adopted in this module from the next section onwards.
        
        Retaining the term ‘electronic evidence’ until now has been a deliberate choice because it helps to keep the focus on what is actually being talked about: evidence that has been obtained from some electronic system, device or file. You may be wondering why this point is being stressed. Things will become clearer during the next activity.
        
        Activity 5.7 Definitions of ‘digital’
        
        Access the internet via your usual browser and look up the term ‘digital’. Find two or three definitions that refer to data and make some brief notes in your learning journal.Of the definitions that you have found, which did you find the easiest to understand? Would you be able to explain what ‘digital data’ is to a non-technical friend now, or would you have to get more clarification from online sources?
        
        The next activity looks at what can and cannot be categorised as digital evidence.
        
        Go to module website Activity 5.8 Categorising digital evidence
      - 1.1.2 A bit on bytes
        
        As you should remember from previous studies, digital information is usually held in units of eight bits. Each unit of eight bits is known as a byte (Figure 5.9).
        
        Figure 5.9 Binary numbers
        
        Description This diagram shows a sequence of eight digits that are either zero or one. A title above the sequence reads ‘Binary numbers’. To the left of the sequence is the text ‘Bit’; a line runs from this text to the first digit in the sequence, which is coloured red. A bracket is placed underneath the sequence with the text ‘8 Bits = 1 Byte’.
        
        When we speak of computer storage capacity and quantities of digital data today, frequently used measures are the megabyte (MB), gigabyte (GB) and terabyte (TB). As the terms suggest, a megabyte of data represents about a million bytes, a gigabyte of data represents about a billion bytes, and a terabyte of data, about 1 trillion bytes. Table 5.2 shows another way of representing this mathematically.
        
        Table 5.2 ^ = power of
        
        5 more items...
        
        1.1.3 Digital storage capacity in human terms
        
        Non-technical people will tend to be easily overwhelmed by lots of large figures and terms that seem familiar but turn out to be rather more complicated once explained. As an investigator it is useful, therefore, to develop a method of describing just how big a quantity of data is in ways that the regular user can relate to. In other words, what that much stuff would look like in the real world.
        
        A stack of A4 paper one inch high contains about 250 sheets, for instance. Representing this in digital terms is subject to a lot of caveats, which you will look at in the study note below. In very general terms, though, data representing a single page of text can be expected to occupy around 4 kB. So our one inch of A4 paper might occupy approximately 4 x 250 = 1000 kB = 1MB of space. In terms of today’s technology, 1MB of storage is next to nothing.
        
        Figure 5.11 Visualisation of paper to data capacity
        
        Description This graphic shows a stack of paper labelled as being one inch high, containing 250 sheets – the equivalent of 1 megabyte of digital data – and a person thinking ‘One megabyte? One gigabyte equals one thousand megabytes!’
        
        What should become clear from this is that present-day data storage solutions can contain huge volumes of information. Even legacy digital storage (e.g. an old 3.5 inch floppy disk) could retain about 1.44 MB of data. We live in an age in which a portable hard drive that fits into the palm of the hand commonly offers 1–2 TB of storage. This is a significant problem for digital forensic investigators, in both the corporate environment and law enforcement, since they are frequently called to analyse multiple devices and numerous sources of data, which will ultimately mean having to review mountains of data. This is one of the major challenges facing anyone involved in digital forensics at the current time.
        
        Study note – Paper vs digital documents Making comparisons between how much space paper documents take up and how much space digital files take up is useful in helping people to get an idea of the size of a given problem or workload, but it should be stressed that such comparisons are based on guesswork because every document will be formatted in a different way. For example, some text documents will be single spaced, some double spaced, and different fonts may be used in various sizes. The number of actual characters on a printed page can therefore vary a great deal.
        
        1 more item...
- - - - Figure 5.7 Computer magic
        
        Description Cartoon illustration of a hand holding a magic wand waving over a computer. A trophy appears above the computer screen in a puff of smoke.
        
        As with any inquiry, the fact is that digital forensic investigations are made up of many components. From this point forward, week by week, you are going to take a more detailed look at these components, examining the various aspects, getting to know what’s involved, and understanding where each piece fits within the larger picture.
        
        After studying Block 5 Part 2, you will be able to:
        
        :check: discuss what evidence is and what the broad categories and types of evidence are.
        :check:explain what can and cannot be categorised as digital evidence.
        :check:identify potential sources of inquiry-relevant digital evidence. :check:explain how data is stored on electronic devices.
        :check:understand the importance of continuity (chain of custody). :check:create correct and detailed records during a digital forensic inquiry.