Digital Forensic Investigations

Digital forensics has always been known across technologists and law enforcement as the art of hacking into a computer and retrieving important information. Information that holds the key to important crimes and issues surrounding criminal activity. More importantly, digital forensics has the ability to make the non-believer surrounding a criminal case into a swift prosecutor ready to use his or her fullest extent of the law; regarding the sensitive data that comes out of that powerful piece of machinery as we know today as technology. Digital forensic scientists have begun to venture into the world of cloud computing and its familiar components. Components such as remote servers, web browsers, and web based media devices that are connected to the cloud.

Data is crucial to the success of any company and they are now increasing their efforts in soliciting and retrieving customer data to learn more about their client's preferences, likes, and dislikes. This, among other factors has attributed to a growing field of data science where data scientists learn to collect crucial data. While there are many types of data, this paper will primarily focus on digital data and how digital scientists can retrieve these data to support provide information for the crown or for the defense. This area has received more attention because criminals such as terrorists have realized the effectiveness of using digital devices to aid in their criminal endeavors (Reith, Carr & Gunsch, 2002, p.2). To combat this, law enforcement agencies are now relying on digital scientists to preserve, collect, analysis and interpret "digital evidence derived from digital sources" (Vincze, 2016, p.184) to help prevent cybercrime and prosecute (or exonerate) suspects. The purpose of this paper is then to illustrate why digital forensic is crucial to addressing the new dangers presented in our society by analyzing the strengths and demonstrating why the weaknesses of the field

Mobile device forensics is the newest branch of digital forensics relating to the recovery of digital evidence or data from a mobile device under forensically sound conditions. The use of phones in crime was widely recognized for some years, but the forensic study

Moreover higher official instruct first responder to leave the discovered mobile device to be powered on at the crime scene. However forensics equipment such as Faraday bag are reliable but cannot be fully guaranteed the signal will not reach the phone, in order to block the phone from receiving data. Lastly, criminal investigation can be preceded by suppression hearing where the judge look at the evidence and determines if an unreasonable search violated a defendant’s constitutional right In this case, the forensic investigator has to follow the laws that deal with evidences. In overall, obtaining legal evidence from a mobile device is vital. David W (Bennett , August 20, 2011). Even though, electronic evidence poses special challenges, following proper forensic procedures as listed above will meet these challenges (Technical Working Group, july 2001). There are eight sections in this paper, first section is the introduction about digital evidence examination process and its challenges, second section is about describing digital evidence, third section is explanation about principles of cyber forensics, fourth section is about examination process, section 5 will discuss about Process model for Inculpatory and Exculpatory cases. Sixth section will discuss about crime reconstruction hypotheses. Seventh section discuss about alternative hypotheses and their importance, and finally, Last section concludes the paper.

The appropriate use of evidence plays a vital role in case’s hearings. Digital Forensic analyst accumulates all the evidences from the crime scene and then evaluates the evidences and analyze the result before presenting it in the case hearing. Digital Evidence Analysis can be done with the use of data that is extracted from any type of digital electronic device. In any of the cases, where a guilty person is involved in illegal activity, such evidences and devices are used can be used to find the actual guilty person.

Computers have become a new weapon in committing crime, and to the burgeoning science of digital evidence, law enforcement now uses computers to fight crime. Digital evidence is information stored, transmitted, and received in binary form that can potentially be relied on as evidence in court. Notwithstanding, digital evidence is commonly associated with crimes that involve such devices, such as a computer hard drives, external storage devices, mobile phones, among others, and are often referred to as e-crimes. However, to fight e-crime, law enforcement must collect relevant digital evidence for such crimes, law enforcement agencies are incorporating the collection and analysis of digital evidence, also referred to as computer forensics, into many of their infrastructures.

A live acquisition of data occurs in the field or remotely and can yield potential vital evidence in the RAM if the forensic examiner is quick to identify the IoT devices on the scene (Ali, Othman, Mohammad, & Saeed, 2017). Jusas, Birvinskas, & Gahramanov (2017) gave a thorough and comprehensive review of models and methods of live triage ranging from theoretical framework to current processes in use by law enforcement. Many of the models and methods mention aspects that may apply to part of live triage for IoT devices, but IoT live acquisitions are not specific to one method or model (Jusas et al., 2017). In 2006, Adelstein’s approach to digital forensics expresses the importance of utilizing live digital forensic techniques to perform a “snapshot” of the system’s state (p.64). This concept recognizes the challenge regarding the need to gather potential data in an efficient manner to evade the loss of time to gather potential evidence (Adelstein, 2006). As a technology develops, a recognition of current techniques and plan to scale that method to encompass the new technology is a smooth transition but not always possible (Oriwoh, Jazani, Epiphaniou, & Sant, 2013). When a developing technology cross clearly defined areas, challenges are bound to arise (Lillis et al., 2016).

Forensics is the use of examination and investigation procedures to accumulate and save prove from a computing device in a way that is appropriate for presentation in a courtroom. The objective of computer

We are now in the process of purchasing computer forensics tools and resources for HJC Corporation. There are many programs, utilities, etc. available on the market that provide computer forensic data retrieval capabilities, however, we are only required to provide information on just two of these tools in our research. The purpose of computer forensics, as it is related to digital data, is to perform computer crime related investigations to discover who committed the crime and provide investigators, police and prosecutors with evidence that will be admissible in a court of law.

Computer crimes present exorbitant issues in today's society. With computer security crimes on the rise, it is becoming e crucial for law enforcement officers and digital forensic examiners to understand computer forensic efficiently and effectively. It has become critical for law enforcement and digital forensic analysts to comprehend computer frameworks productively and adequately as cybercrimes continue to rise as society relies upon the usage of technology. Assessments of information system incidents can be reviewed and evaluated through forensic methodologies. The essential the methodologies presented in digital forensic process model will ensure my forensic team identify potential digital evidence on any type of electrical gadget.

The branch of Network forensics is relatively a newer branch of digital forensics, and it involves carefully analyzing the data that is flowing in a network to find any possible evidences of intrusion or theft. The information flow in a network is always dynamic in nature, and thus this branch of digital forensics needs to be proactive in its approach. One of the usage of this branch lies in the investigation of network data for any traffic that might seem anomalous in nature, for the purpose of detecting intrusions. The second usage lies in the area of law enforcement, where the evidence gathered by Network Forensics can be used as evidence in case of a crime. Mobile Device Forensics relates to data and evidence recovery from a mobile device, be it a mobile phone, PDA, tablet, GPS device, and so on. This area of forensics is a bit challenging due to the reason that exact pin pointing of location where from communication was initiated is not accurately possible. Other factors adding to the challenge are the diversity of manufacturers and models, multiple hardware and software specifications, and data recovery tools that may not bring the desired results on all platforms. Database Forensics specifically on the analysis of databases, using relevant tools for analysis and manipulation of data. Analysis of database meta-data is also undertaken, along with studying the

This paper conducts a forensic investigation for locating and documenting the evidences by analyzing the attached Android client devices. This paper utilizes CDH Cloud for conducting forensic analysis of client devices to investigate the

Digital Forensic methods have to be continuously updated in order to effectively combat trends that enable users with intentions of destroying, concealing, altering and deleting digital evidence that can either link them to serious felonies or various computer crimes. Means for tampering with evidence involve the use of techniques that are classified as anti-forensics. Anti-forensics presents digital forensic investigators with several challenges, the greatest being connecting the perpetrator to a crime by identifying evidence of their use of it. If a perpetrator can properly conceal his/her tracks using anti-forensics then even if a digital forensic investigator can identify the use of anti-forensic tools on a system, they’d still have a daunting task ahead of them; proving what user used the tools and how it can be admissible as evidence in the court of law. These challenges have existed in the past, and exist even today as the field of digital forensics has to constantly evolve to keep up with its enemy, anti-forensics. However, experts are currently researching future ways to identify the presence of anti-forensics and some of the perpetrators are getting caught.

There is a guideline proposed by the UK Association of Chief Police Officers (ACPO) that defines some rules for the handling of digital evidence [10]. The device must be kept separate from the network, and the investigation process should be properly planned. The functionality of the tool or software must be known also for having a secure wireless connection with device in order not to delete any information while running it [4]. A “dummyrun” approach can be used with same type of device under investigation. The device must be seized and analyzed by well-trained persons. In Subscriber Identity Module Analysis law enforcement collects the network and user data through various types of SIM. Integrated Circuit Card ID (ICCID, International Mobile Subscriber Identity (IMSI), Mobile Country Code (MCC), Mobile Network Code (MNC), Mobile Station International Subscriber Directory Number (MSISDN) and Abbreviated Dialing Numbers (ADN) analysis is performed on SIM. Using forensics software and sophisticated tools which can retrieve data logically or directly from a mobile device can result in valuable evidence. The growing industry of mobile phones is creating a challenge for forensics investigators to be able to extract evidence at all even when using different tools. Forensics tools should be developed with advancement in technology.

Digital Forensics is a field of computer science that aids in determining what may or may not have occurred during some computer task. The bit-by-bit concept satisfies computer media, it does not apply to smartphones. Two experiments were designed using three devices; Android HTC Aria, Apple iPhone 3G, and Windows Mobile HTC TouchPro 6850. These experiments will compare and contrast the device by carrier, manufacturer, file size by category, file size by test, and folder size. These types of experiments will create a baseline for change in specific model smartphones depending on the specific user function performed. If such a baseline is determined, one may be able to prove that a set of tasks occurred given the current state of the device.