Digital Evidence Forensics | T...

In today's society, digital devices allow people to easily interact locally and globally.

Most people assume that computers, cellphones, and the internet are the only places where digital evidence may be found, but every piece of technology that processes data can be utilized for illegal purposes.

Hand-held games, for example, can be used to send encrypted messages between thieves, and modern domestic goods, such as a refrigerator with a built-in TV, can be used to store, view, and distribute unlawful photographs.

The crucial thing to remember is that responders must be able to identify and seize any digital evidence.

Information and data of importance to an inquiry that is saved on received, or transferred by an electronic device are referred to as digital evidence. When electronic devices are seized and secured for examination, this evidence can be obtained.

Evidence in The Digital Age

• It is like fingerprints or DNA evidence, latent (hidden).
• It crosses jurisdictional boundaries fast and readily.
• It can be easily manipulated, damaged, or destroyed.
• It is time-sensitive.

There are several sources of digital evidence, however, for the sake of this blog, the subject is classified into key forensic categories that can yield evidence from internet-connected computers or gadgets, as well as mobile devices.

Different types of crimes lend themselves to different types of evidence-gathering techniques, tools, and concerns, similarly different types of crimes lend themselves to different types of devices. here we discuss computers, mobile devices,s, and cell phone

Computer

The Florida Computer Crimes Act, which made unauthorized use of computing facilities a criminal, was enacted as a result of this.

In 1984, federal legislation was enacted. In both the public and private sectors, computer crimes are becoming more prevalent.

Pornography, copyright infringement, extortion, counterfeiting, and other criminal activities can all be evidenced on a single computer, or the unlawful use can be contained in the machine itself.

Digital evidence is stored on the hard disc of the computer as well as peripheral equipment such as thumb drives and CD-ROM discs.

Mobile Devices

The first prototype of what we now term a mobile phone was not invented until the 1980s, despite the fact that handheld voice transmission devices using radio transmission had been in use since the 1940s (the Walkie-Talkie).

In the 1990s, global cell phone use exploded, reaching 4.6 billion subscriptions by the end of 2009. 

Cell phones are being used for many of the same duties as computers, including taking digital images and movies, sending instant messages, browsing the web, and doing many of the same tasks as a computer.

Criminals can engage in an ever-increasing array of activities using mobile devices, which follow their every step and message. In many circumstances, it is because of this tracking capability that mobile devices become crucial evidence.

Principles of Digital Evidence

The electronically stored information is referred to as "digital" because it has been broken down into digits, or binary unitsof ones (1) and zeros (0), which are saved and retrieved using software or code.

These instructions can be used to create and save any type of data, including images, words, and spreadsheets.

Finding and utilizing evidence recorded in this manner is a rapidly evolving field of forensics that is continually changing as technology advances.

 The internet, often known as the World Wide Web, was launched in the mid-1990s, ushering in the "era of access."

Individuals outside the academic world might use it for the first time to connect with others (and their computers) in a completely new way.

The Internet-enabled access to a vast amount of information and resources, but it also served as a conduit for the unlawful trafficking of photos, information, and espionage.

Criminals can exploit global access to information and other computers to hack into financial and communications systems, big corporations, and government networks to steal money, identities, and information, or sabotage systems, thanks to this access.

Understanding how the process works and staying connected with advances in software and tracking technology is one of the most difficult issues in Internet crime for detectives, laboratories, and technical professionals.

How Does it Work?

Any computer that connects to an Internet Service Provider (ISP), whether it is a single computer or part of a local area network (LAN) at a workplace, becomes part of the ISP's network.

Each ISP establishes a connection to a different network, and so on. In this sense, the Internet is a web of networks over which data can be delivered and received from any location on the web to any other point on the web.

Because there is no "owner" or overall governing network for this worldwide collection of networks, it functions as a community with all of the benefits and drawbacks that any other community would have.

Digital Evidence Examination

Any major criminal investigation, such as murder, rape, stalking, carjacking, burglary, child abuse or exploitation, counterfeiting, extortion, gambling, piracy, property crimes, and terrorism, may involve digital evidence.

For example, if a criminal used online programs like Google MapsTM or street view to case a property before committing a crime, or posted stolen items for sale on Craigslist or EBay®, or communicated with accomplices via text message to plan a crime or threaten a person, pre-and post-crime information is most relevant.

Computer hacking, commercial fraud, and identity theft are examples of crimes that can be done wholly through digital means.

In each of these scenarios, a trail of electronic data is left behind for a competent investigation team to spot, grab, and exploit.

Following correct protocols, like with any evidence-gathering, is critical and will generate the most meaningful data. Failure to follow correct processes might result in evidence being lost, damaged, or rendered inadmissible in court.

Evidence That Can be Gathered Through Digital Means

A few examples of information that can be obtained and utilized as evidence from electronic devices:

• Computer papers
• Emails
• Text
• Messages
• Transactions details
• Photographs
• Browsing history

Mobile devices, for example, rely on internet backup systems, sometimes known as the "cloud," to give forensic investigators access to text messages and photos taken from a specific phone.

The last 1,000–1,500 text messages sent to and received from that phone are kept on average by these systems.

Furthermore, many mobile devices save information on the places they visited and when they were there.

Examiners can get to a normal of the past 200 cell areas gotten to by a versatile gadget to pick up this data. Car fawning radios and fawning route frameworks can both give comparable data.

Indeed pictures shared on social media destinations like Facebook may incorporate area information.

Photos shot using a device that can use the Global Positioning System (GPS) contain file data that shows when and where the photo was taken.

Examiners can accumulate a parcel of data around a gadget and the individual who employs it by getting a subpoena for a particular portable gadget account.

Digital Evidence Forensic Analysis

In the lab, after the digital evidence is delivered to the laboratory, a trained analyst will retrieve and examine the data as follows:

Prevent Contamination: Cross-contamination in a DNA laboratory or at a crime scene is easy to understand, but digital evidence has comparable difficulties that the collecting officer must avoid.

An image or work copy of the original storage device is made before digital evidence is analyzed.

To keep the original immaculate, the copy of data collected from a questionable device must be kept on another form of media. To avoid contamination or the introduction of data from another source, analysts must employ a "clean" storage medium.

Isolate Wireless Devices: If one is available, cell phones and other wireless devices should be examined first in an isolation chamber.

This prohibits any network connections and preserves the integrity of the evidence.

The gadget, including phone information, Federal Communications Commission (FCC) information, SIM cards, and so on, can be exploited by opening the Faraday bag inside the chamber. From within the chamber, the gadget can be connected to analytic software.

Install Write-Blocking Software: To prevent any changes to the data on the device or media, the analyst will place a block on the working copy, allowing data to be viewed but no changes or additions to be made.

Choose Extraction Methods:  Once the working copy has been generated, the analyst will decide the device's make and model, as well as the extraction program that will best "digest the data," or display its contents.

Yield Gadget or Unique Media for Conventional Evidence Examination: The device is returned to evidence once the data has been erased. It's possible that DNA, traces, fingerprints, or other evidence can be extracted from it, and the digital analyst can now work without it.