Digital Evidence

Digital Data

challenging aspects of digital evidence
1.it is a chaotic form of evidence
2.it can be altered maliciously or unintentionally
3.it is circumstantial to be difficult to trace the system's activity
4.create data remnants

Locard's exchange principle:
當事人在crime scene中,一定會遺留一些東西(evidence),並且帶走一些東西(evidence)

characteristics digital evidence in court of law
admissible(可採證性) :admissible evidence in court of law
authentic(證據真偽) 
complete(採證過程是否完整)
reliable(可靠度)
believable/convincing(說服力)

...

fragility of digital evidence
digitial data is fragile in nature, it is easy to be destoryed
as below:
 data is lost permanently if computer is turned off
 evidence may be overwrited
 evidence may be deleted

ADF(Anti-digital forensics)
1.overwriting(wiping)
ex:repeat 35 overwriting to fully clean disk
2.bugs in forensic tools
3.obfuscation of data(混碼)
4.steganography(隱藏),cryptography(加密)


ps:
erasing data of Hard Disk: throw the hard disk into the fire

....

type of digital data
volatile data: can be modified ,ex: process memory, process-to-port mapping
non-volatile data: used for the secondary storage, ex:hard disk
transient data: if the machine is turned off ,all this information is lost, ex: cache data
fragile data: temporarily saved on the hard disk, ex: access date
residual data,檔案被殺掉時所殘留的部份資料
metadata,描述資料的資料
Digital photography: for chain of custody

 

...............................................................................................................................

Rules of Evidence

rule of evidence
用在法庭中,此證據的產生需符合的規則
a route that evidence takes from the found time until the case is closed or goes to court

best evidence rule
It states that the court only allows the original evidence of a document, photograph, or recording at the trial rather than a copy

common rule as below
federal rules of evidence
IOCE
SWGDE standards

IOCE
1.所有程序需要被遵守,all of the general forensic and procedural principles must be applied
2.扣押不可破壞證據, seizing digital evidence , actions taken should not change that evidence
3.搜證人員要受過訓練, person whould be trained for the purpose
4.符合chain of custody
5.保管人對證物有完全責任
6.保管單位對證物有完全責任

................................................................................................................................

Types and Collecting Potential Evidence

 

type of files for potential evidence
user-created files: User產生的檔案
user-protected files:User加密的檔案
computer-created files: 電腦建立的檔案

categories of evidence
computer-genrated(admissible highly): by computer,
ex: log
computer-stored(admissible low): by user,
ex: txt
computer-generated and computer-stored.
ex:
email(head=computer-genrated ,body=computer-store),
pdf,doc(metadata=computer-genrated, content=computer-store)
photo file

ps:
metadata is like created,modified,accessed

challenges to the authenticity of computer records(evidence)
were records altered,manipulated, or damaged ?
is reliability of the computer program ?
how to indentity of author ?


ps:
a evidence was found in unrelated crime
plain view doctrine(一眼看清原則)
按照此項原則,警方在有合法根據進入的場所,無意中發現有關犯罪的物件,並一眼認出與犯罪有關,可即時予以扣押,並可將此物件作為證據提出,但警方不得以此原則為借口擴大搜查範圍,以圖獲取犯罪證據。
refer
http://lawyer.get.com.tw/Dic/DictionaryDetail.aspx?iDT=69573

..................................................................................................................................

Digital Evidence Examination Process

 

digital evidence examination process
1.evidence assessment
2.evidence acquistion
3.evidence preservation(important)

4.evidence examination and analysis
5.evidence documentation and reporting

ps:
check datetime
ex: check the date and time in the system's CMOS with the hard drive removed from the suspect PC

...

Evidence acquistion

type of evidence acquistion
live collect, ex: memory dump on live computer
static collect, ex: disk dump on poweroff computer

ps:
the collection should proceed from the most volatile to the least volatile

searching list for live collect:
process register
virtual and physical memory
network state
running process

ps:
common evidence sources about RAM
memory
swapfile/pagefile
hibernate(休眠檔)

evidence acquisition checklist
1.don't use the computer for evidence search.
2.photograph all the devices connected to the computer.
3.don't turn on the system, if it is in off state.
4.if the computer is on, take a photograph of the screen.
5.if the computer is on and screen is blank, move the mouse slowly and take a photograph of the screen.

6. unplug all the cords and devices connected to the computer and label them for later identification.
7. if the computer is connected to the router and modem, unplug the power.

...

Evidence preservation

preserving evidence for cell phones
mkae sure that the device is charged if device is turned on
put on the special bag(訊號遮敝袋)

...

Digital examination and analysis

type of extraction for evidence examination:
physical extraction: ex: whole disk
logical extraction, ex: log or file on disk

ps:
using hash check before and after evidence examination

 

 

2015-10-19 14:28:19發表 2015-10-19 14:31:05修改   

數據分析
程式開發
計算機組織與結構
資料結構與演算法
Database and MySql
manage tool
windows
unix-like
linux service
network
network layer3
network layer2
network WAN
network service
作業系統
數位鑑識

資訊安全解決方案
資訊安全威脅
Cisco security
Cisco network
Cisco layer3
Cisco layer2



  登入      [牛的大腦] | [單字我朋友] Powered by systw.net