• E4J University Module Series: Cybercrime

• Module 4: Introduction to Digital Forensics

• Introduction and learning outcomes

• Key issues

• • Digital evidence
  • Digital forensics
  • Standards and best practices for digital forensics
  • Conclusion
  • References

• Exercises

• Possible class structure

• Core reading

• Advanced reading

• Student assessment

• Additional teaching tools

•  

• First published in March 2019
  

•  

 

  This module is a resource for lecturers  

 

Standards and best practices for digital forensics

 

The International Organization for Standardization (ISO), an international non-governmental organization, and the International Electrotechnical Commission (IEC), an international not-for-profit organization, develop and publish international standards to harmonize practices between countries. In 2012, the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) published international standards for digital evidence handling (ISO/IEC 27037 Guidelines for Identification, Collection, Acquisition, and Preservation of Digital Evidence). These guidelines included only the initial handling of digital evidence. The proposed four phases for digital evidence handling are as follows:

Identification. This phase includes the search for and recognition of relevant evidence, as well as its documentation. In this phase, the priorities for evidence collection are identified based on the value and volatility of evidence (see Module 6 on Practical Aspects of Cybercrime Investigations and Digital Forensics for further information).

Collection. This phase involves the collection of all digital devices that could potentially contain data of evidentiary value. These devices are then transported back to a forensic laboratory or other facility for acquisition and analysis of digital evidence. This process is known as static acquisition. However, there are cases in which static acquisition is unfeasible. In such situations, live acquisition of data is conducted. Let us consider, for example, the systems of critical infrastructures (i.e., industrial control systems). These systems cannot be powered down as they provide critical services. For this reason, live acquisitions are conducted that collect volatile data and non-volatile data from live running systems. These live acquisitions, however, can interfere with the normal functions of the industrial control system (e.g., by slowing down services) (see Module 6 on Practical Aspects of Cybercrime Investigations and Digital Forensics for further information).

Acquisition. Digital evidence is obtained without compromising the integrity of the data. This was highlighted by the United Kingdom National Police Chiefs Council (NPCC), formerly known as the United Kingdom Association of Chief Police Officers, as an important principle of digital forensics practice (i.e., Principle 1: "No action taken by law enforcement agencies, persons employed within those agencies or their agents should change data which may subsequently be relied upon in court") (UK Association of Chief Police Officers, 2012, p. 6). This obtainment of data without altering it is accomplished by creating a duplicate copy of the content of the digital device (a process known as imaging) while using a device ( write blocker) that is designed to prevent the alteration of data during the copying process. To determine whether the duplicate is an exact copy of the original a hash value is calculated using mathematical computations; here, a cryptographic hash function is used to produce a hash value. If the hash values for the original and copy match, then the contents of the duplicate are the exact same as the original. Understanding that there are certain "circumstances where a person finds it necessary to access original data [i.e., during live acquisitions]," the United Kingdom National Police Chiefs Council notes that "the person [accessing this data] must be competent to do so and be able to give evidence explaining the relevance and the implications of their actions" (Principle 2) (UK Association of Chief Police Officers, 2012, p. 6) (see Module 6 on Practical Aspects of Cybercrime Investigations and Digital Forensics for further information).

Preservation. The integrity of digital devices and digital evidence can be established with a chain of custody (discussed in Module 3 on Legal Frameworks and Human Rights), which is defined as "the process by which investigators preserve the crime (or incident) scene and evidence throughout the life cycle of a case. It includes information about who collected the evidence, where and how the evidence was collected, which individuals took possession of the evidence, and when they took possession of it" (Maras, 2014, p. 377). Meticulous documentation at each stage of the digital forensics process is essential to ensuring that evidence is admissible in court (see Module 6 on Practical Aspects of Cybercrime Investigations and Digital Forensics for further information).

The remaining phases of the digital forensics process (analysis and reporting) are not included in the ISO/IEC 27037. The analysis (or examination) phase requires the use of appropriate digital forensic tools and methods to uncover digital data. There are numerous digital forensics tools on the market of varying qualities. Examples of digital forensics tools include Encase, FTK, and X-Ways Forensics. The type of digital forensics tools varies depending on the type of digital forensics investigation conducted (e.g., for mobile forensics and cloud services on mobile devices, one tool that can be used is the Oxygen Forensics Suite; for network forensics, which involves "the use of scientifically proven techniques to investigate [crimes committed against and via] computer networks" (Maras, 2014, p. 305), a tool that can be used is Wireshark). Existing digital forensics tools (e.g., EnCase, FTK, and NUIX) are designed to work with traditional computing environments. Specialized digital forensics tools are needed, for example, for the networks, interfaces, and operating systems of critical infrastructure (discussed in Module 2 on General Types of Cybercrime).

The United States National Institute of Standards and Technology has a searchable digital forensics tools database, which includes various functionalities (e.g., database, cloud, drone, and vehicle forensics tools, among others). National law enforcement agencies differ in their preference and use of digital forensics tools.

The tools used must be forensically sound. To be forensically sound, the "acquisition and subsequent analysis of …[digital] data" with these tools must be able to preserve "the data in the state in which it was first discovered" and "not in any way diminish the evidentiary value of the electronic data through technical, procedural or interpretive errors" (McKemmish, 2008, p. 6). Put simply, the data acquired must not be modified in any way - that is, its integrity must be maintained. The Computer Forensics Tool Testing Program of the United States National Institute of Standards and Technology has

establish[ed] a methodology for testing computer forensic[s] software tools by [the] development of general tool specifications, test procedures, test criteria, test sets, and test hardware. The results provide the information necessary for toolmakers to improve tools, for users to make informed choices about acquiring and using computer forensics tools, and for interested parties to understand the tool[']s capabilities.

The purpose of the analysis phase is to determine the significance and probative value of evidence. This determination is made by, for example, examining whether the evidence under examination "has the tendency to make the existence of any fact that is of consequence to the determination of the action more probable or less probable than it would be without the evidence" (Rule 401, U.S. Federal Rules of Evidence) (see Module 6 on Practical Aspects of Cybercrime Investigations and Digital Forensics for further information).

The reporting phase includes a detailed description of the steps taken throughout the digital forensics process, the digital evidence uncovered, and the conclusions reached based on the results of the digital forensics process and the evidence revealed (see Module 6 on Practical Aspects of Cybercrime Investigations and Digital Forensics for further information). Artificial intelligence (i.e., "computational models of human behaviour and thought processes that are designed to operate rationally and intelligently"; Maras, 2017, p. 7) can be used to produce reliable results. However, the use of artificial intelligence could pose problems in the analysis and presentation phases of the digital forensic process because experts may not be able to explain how these results were obtained (Maras and Alexandrou, 2018). 

The ISO/IEC have published other guidelines on the digital forensics process that cover: validity and reliability of digital forensic tools and methods ( ISO/IEC 27041:2015, Guidance on assuring suitability and adequacy of incident investigative methods), and the examination (or analysis) and interpretation phases of the digital forensics process ( ISO/IEC 27042:2015, Guidelines for the analysis and interpretation of digital evidence).

Best practice guides are available to identify and promote valid and reliable digital forensics processes and outcomes. Cases in point are the U.S. Scientific Working Group on Digital Evidence's  best practices for computer forensic examination, digital evidence collection, and computer forensic acquisitions, and the European Network of Forensic Science Institutes' best practice manual for the forensic examination of digital technology.

These standards and best practices seek to establish the validity and reliability of digital forensics results. First, to be admissible, the tools and techniques used in the digital forensics process must be "scientifically valid;" that is, proven to provide accurate results through empirical testing. Second, the digital forensics results must be reliable; that is, the same results must be obtained on different occasions using the same data, tools, and techniques (Maras, 2014; p. 48). Particularly, the results should be repeatable and reproducible. Results are repeatable when the same digital forensics results are obtained using the same test items, equipment, laboratory, and operator (Maras, 2014, p. 48). Results are reproducible when the same digital forensics results are obtained using the same test items, but different equipment, laboratories, and operators (Maras, 2014, p. 49). As the United Kingdom National Police Chiefs Council noted, an important principle of digital forensics practice is the ability of "[a]n independent third party…to examine those processes and achieve the same result" (Principle 3) (UK Association of Police Chiefs, 2012, p. 6).

 

Next: Conclusion

Back to top