ASSDF Module 6: Digital Forensics

1. Lecture #32: Digital Forensics : Evidence
Handling, Validation and Reporting
Dr.Ramchandra Mangrulkar
October 7, 2020
Dr.Ramchandra Mangrulkar Lecture #32: Digital Forensics : Evidence Handling, Validation and ReportingOctober 7, 2020 1 / 18

2. The principles of digital evidence
1 No action taken by law enforcement agencies, persons employed
within those agencies or their agents should change data which
may subsequently be relied upon in court.
2 In circumstances where a person finds it necessary to access
original data, that person must be competent to do so and be
able to give evidence explaining the relevance and the
implications of their actions.
3 An audit trail or other record of all processes applied to digital
evidence should be created and preserved. An independent third
party should be able to examine those processes and achieve the
same result.
4 The person in charge of the investigation has overall
responsibility for ensuring that the law and these principles are
adhered to.
Dr.Ramchandra Mangrulkar Lecture #32: Digital Forensics : Evidence Handling, Validation and ReportingOctober 7, 2020 2 / 18

3. The principles of digital evidence
1 No action taken by law enforcement agencies, persons employed
within those agencies or their agents should change data which
may subsequently be relied upon in court.
2 In circumstances where a person finds it necessary to access
original data, that person must be competent to do so and be
able to give evidence explaining the relevance and the
implications of their actions.
3 An audit trail or other record of all processes applied to digital
evidence should be created and preserved. An independent third
party should be able to examine those processes and achieve the
same result.
4 The person in charge of the investigation has overall
responsibility for ensuring that the law and these principles are
adhered to.
Dr.Ramchandra Mangrulkar Lecture #32: Digital Forensics : Evidence Handling, Validation and ReportingOctober 7, 2020 2 / 18

4. The principles of digital evidence
1 No action taken by law enforcement agencies, persons employed
within those agencies or their agents should change data which
may subsequently be relied upon in court.
2 In circumstances where a person finds it necessary to access
original data, that person must be competent to do so and be
able to give evidence explaining the relevance and the
implications of their actions.
3 An audit trail or other record of all processes applied to digital
evidence should be created and preserved. An independent third
party should be able to examine those processes and achieve the
same result.
4 The person in charge of the investigation has overall
responsibility for ensuring that the law and these principles are
adhered to.
Dr.Ramchandra Mangrulkar Lecture #32: Digital Forensics : Evidence Handling, Validation and ReportingOctober 7, 2020 2 / 18

5. The principles of digital evidence
1 No action taken by law enforcement agencies, persons employed
within those agencies or their agents should change data which
may subsequently be relied upon in court.
2 In circumstances where a person finds it necessary to access
original data, that person must be competent to do so and be
able to give evidence explaining the relevance and the
implications of their actions.
3 An audit trail or other record of all processes applied to digital
evidence should be created and preserved. An independent third
party should be able to examine those processes and achieve the
same result.
4 The person in charge of the investigation has overall
responsibility for ensuring that the law and these principles are
adhered to.
Dr.Ramchandra Mangrulkar Lecture #32: Digital Forensics : Evidence Handling, Validation and ReportingOctober 7, 2020 2 / 18

6. Evidence Collections
After securing the evidence, a survey of the scene will give
investigators an accurate sense of what’s ahead. Several questions
need to be answered
What kinds of devices are present?
How many devices are we dealing with?
Are any of the devices running?
What tools will be needed?
Do we have the necessary expertise on hand?
Dr.Ramchandra Mangrulkar Lecture #32: Digital Forensics : Evidence Handling, Validation and ReportingOctober 7, 2020 3 / 18

7. Evidence Collections
After securing the evidence, a survey of the scene will give
investigators an accurate sense of what’s ahead. Several questions
need to be answered
What kinds of devices are present?
How many devices are we dealing with?
Are any of the devices running?
What tools will be needed?
Do we have the necessary expertise on hand?
Dr.Ramchandra Mangrulkar Lecture #32: Digital Forensics : Evidence Handling, Validation and ReportingOctober 7, 2020 3 / 18

8. Evidence Collections
After securing the evidence, a survey of the scene will give
investigators an accurate sense of what’s ahead. Several questions
need to be answered
What kinds of devices are present?
How many devices are we dealing with?
Are any of the devices running?
What tools will be needed?
Do we have the necessary expertise on hand?
Dr.Ramchandra Mangrulkar Lecture #32: Digital Forensics : Evidence Handling, Validation and ReportingOctober 7, 2020 3 / 18

9. Evidence Collections
After securing the evidence, a survey of the scene will give
investigators an accurate sense of what’s ahead. Several questions
need to be answered
What kinds of devices are present?
How many devices are we dealing with?
Are any of the devices running?
What tools will be needed?
Do we have the necessary expertise on hand?
Dr.Ramchandra Mangrulkar Lecture #32: Digital Forensics : Evidence Handling, Validation and ReportingOctober 7, 2020 3 / 18

10. Evidence Collections
After securing the evidence, a survey of the scene will give
investigators an accurate sense of what’s ahead. Several questions
need to be answered
What kinds of devices are present?
How many devices are we dealing with?
Are any of the devices running?
What tools will be needed?
Do we have the necessary expertise on hand?
Dr.Ramchandra Mangrulkar Lecture #32: Digital Forensics : Evidence Handling, Validation and ReportingOctober 7, 2020 3 / 18

11. What to take along
1. Evidence Tape
2. Chain of custody form
3. Inventory forms
4. Digital camera
5. Toolkit ( Screw driver set with pentalobe Screwdriver for removing
HDDs from Mac laptops)
6. Adhesive tape, Sticky note
7. New/ wiped pen drives, hard drives
8. Gloves, static wrist band
9. Write blockers (e.g. ATA, SATA, SCSI, firewire, USB, e-sata,
SSD) with cables.
10. Hardware for Imaging (TD2U, Falcon, TrueImager) if available
11. Laptop with FTK (Crossover Tested)
12. Card readers
13. Magnifying glass, Flash Light
14. Faraday bag/Aluminium foil, Bubble wraps
Dr.Ramchandra Mangrulkar Lecture #32: Digital Forensics : Evidence Handling, Validation and ReportingOctober 7, 2020 4 / 18

12. Order of Volatility
CPU, cache, and register content
Routing table, ARP cache, process table, kernel statistics
Memory
Temporary file system/swap space
Data on hard disk
Remotely logged data
Data contained on archival media
Dr.Ramchandra Mangrulkar Lecture #32: Digital Forensics : Evidence Handling, Validation and ReportingOctober 7, 2020 5 / 18

13. Order of Volatility
CPU, cache, and register content
Routing table, ARP cache, process table, kernel statistics
Memory
Temporary file system/swap space
Data on hard disk
Remotely logged data
Data contained on archival media
Dr.Ramchandra Mangrulkar Lecture #32: Digital Forensics : Evidence Handling, Validation and ReportingOctober 7, 2020 5 / 18

14. Order of Volatility
CPU, cache, and register content
Routing table, ARP cache, process table, kernel statistics
Memory
Temporary file system/swap space
Data on hard disk
Remotely logged data
Data contained on archival media
Dr.Ramchandra Mangrulkar Lecture #32: Digital Forensics : Evidence Handling, Validation and ReportingOctober 7, 2020 5 / 18

15. Order of Volatility
CPU, cache, and register content
Routing table, ARP cache, process table, kernel statistics
Memory
Temporary file system/swap space
Data on hard disk
Remotely logged data
Data contained on archival media
Dr.Ramchandra Mangrulkar Lecture #32: Digital Forensics : Evidence Handling, Validation and ReportingOctober 7, 2020 5 / 18

16. Order of Volatility
CPU, cache, and register content
Routing table, ARP cache, process table, kernel statistics
Memory
Temporary file system/swap space
Data on hard disk
Remotely logged data
Data contained on archival media
Dr.Ramchandra Mangrulkar Lecture #32: Digital Forensics : Evidence Handling, Validation and ReportingOctober 7, 2020 5 / 18

17. Order of Volatility
CPU, cache, and register content
Routing table, ARP cache, process table, kernel statistics
Memory
Temporary file system/swap space
Data on hard disk
Remotely logged data
Data contained on archival media
Dr.Ramchandra Mangrulkar Lecture #32: Digital Forensics : Evidence Handling, Validation and ReportingOctober 7, 2020 5 / 18

18. Order of Volatility
CPU, cache, and register content
Routing table, ARP cache, process table, kernel statistics
Memory
Temporary file system/swap space
Data on hard disk
Remotely logged data
Data contained on archival media
Dr.Ramchandra Mangrulkar Lecture #32: Digital Forensics : Evidence Handling, Validation and ReportingOctober 7, 2020 5 / 18

19. Documenting the Scene
There is an old tried and true saying in law enforcement: “If you don’t
write it down, it didn’t happen.” These are words of wisdom indeed.
photographs
written notes
video
process begins the moment investigators arrive at the scene
noting the date and time
all the people at the scene
detailed descriptions of the evidence we collect
its location, the names of who discovered and collected it
item’s condition, especially if there is visible damage.
digital evidence is described by type, make, model, serial
number, or other similar descriptors.
device is on or off or if it’s connected to other devices (such as
printers) or a network (like the Internet).
Virtually everything we see, find, and do should be documented.
Dr.Ramchandra Mangrulkar Lecture #32: Digital Forensics : Evidence Handling, Validation and ReportingOctober 7, 2020 6 / 18

20. Evidence into Custody
Place the phone in special containers that shield the phone from
wireless signals. Empty paint cans and Faraday bags are two of the
more typical choices.
Dr.Ramchandra Mangrulkar Lecture #32: Digital Forensics : Evidence Handling, Validation and ReportingOctober 7, 2020 7 / 18

21. Protecting Cell Phones from Network Signals
It’s essential to isolate a live cell phone from the network. If not, it
can receive calls, text messages, or even commands to delete all the
data. A Faraday bag is one way to prevent a network signal from
reaching the phone. A Faraday bag is made of “some type of
conducting material or mesh” that repels these signals. 1
.
1
The function of the bag is based on the work of Michael Faraday, an English
scientist who specialized in electromagnetism (Microsoft Corporation)
Dr.Ramchandra Mangrulkar Lecture #32: Digital Forensics : Evidence Handling, Validation and ReportingOctober 7, 2020 8 / 18

22. Evidence Label Format
Dr.Ramchandra Mangrulkar Lecture #32: Digital Forensics : Evidence Handling, Validation and ReportingOctober 7, 2020 9 / 18

23. Evidence Labelling
The Basics of Digital Forensics: The Primer for Getting Started in
Digital Forensics
Dr.Ramchandra Mangrulkar Lecture #32: Digital Forensics : Evidence Handling, Validation and ReportingOctober 7, 2020 10 / 18

24. Chain of Custody
Before a piece of evidence gets in front of a jury, it must first meet a
series of strict legal requirements, well-documented called chain of
custody.
evidence makes many stops on its road to trial.
Each of these stops must be noted, tracking each and every time
the evidence item changes hands or locations
Without this detailed accounting, the evidence will be deemed
untrustworthy and inadmissible.
Dr.Ramchandra Mangrulkar Lecture #32: Digital Forensics : Evidence Handling, Validation and ReportingOctober 7, 2020 11 / 18

25. Chain of Custody
Dr.Ramchandra Mangrulkar Lecture #32: Digital Forensics : Evidence Handling, Validation and ReportingOctober 7, 2020 12 / 18

26. Chain of Custody : Marking Evidence
Dr.Ramchandra Mangrulkar Lecture #32: Digital Forensics : Evidence Handling, Validation and ReportingOctober 7, 2020 13 / 18

27. Chain of Custody :Cloning Evidence
A forensic clone is an exact, bit for bit copy of a hard drive. It’s
also known as a bit stream image. In other words, every bit (1 or
0) is duplicated on a separate, forensically clean piece of media,
such as a hard drive.
Hard drives are susceptible to failure. Having two clones gives
you one to examine and one to fall back on.
Forensically Clean Media : Drives can be cleaned with the same
devices used to make the clones. The cleaning process
overwrites the entire hard drive with a particular pattern of data
such as 1111111111111
Forensic Image Formats : The end result of the cloning process
is a forensic image of the source hard drive : EnCase (Extension
.E01) Raw dd (Extension .001) AccessData Custom Content
Image (Extension .AD1)
Dr.Ramchandra Mangrulkar Lecture #32: Digital Forensics : Evidence Handling, Validation and ReportingOctober 7, 2020 14 / 18

28. Evidence Validation: Hashing
How do we know our clone is an exact duplicate of the evidence
drive?
Dr.Ramchandra Mangrulkar Lecture #32: Digital Forensics : Evidence Handling, Validation and ReportingOctober 7, 2020 15 / 18

29. Evidence Validation: Hashing Example
How do we know our clone is an exact duplicate of the evidence
drive?
Dr.Ramchandra Mangrulkar Lecture #32: Digital Forensics : Evidence Handling, Validation and ReportingOctober 7, 2020 16 / 18

30. Final Report
Conclusion of the analysis, the examiner will generate a final
report detailing what was done, what was found, and their
findings.
Ideally, final reports need to be crafted with the intended
audience in mind.
Must be addressed wrt nontechnical reader’s such as judges,
attorneys and juries.
major forensic tools, such as EnCase and FTK
Final report should include a detailed narrative of all the actions
taken by the examiner, starting at the scene if they were present.
The examination should be documented with sufficient detail so
that the procedure can be duplicated by another examiner
Dr.Ramchandra Mangrulkar Lecture #32: Digital Forensics : Evidence Handling, Validation and ReportingOctober 7, 2020 17 / 18

31. Home work
https://www.forensic.co.in
http://www.forensicsciencesimplified.org/digital/
how.html
https://nij.ojp.gov/topics/articles/
new-approaches-digital-evidence-acquisition-and-analy
https://www.ncjrs.gov/pdffiles1/nij/250700.pdf
Dr.Ramchandra Mangrulkar Lecture #32: Digital Forensics : Evidence Handling, Validation and ReportingOctober 7, 2020 18 / 18