Digital Forensics Concepts

• Digital Forensics Concepts
  • What Is Digital Forensics?
    • Subdisciplines
    • Professions That Use Digital Forensics
  • The Scientific Method
    • Selecting a Good Hypothesis
    • Designing Good Tests
    • Refutation and Confirmation Bias
  • Reporting and Testimony
  • Evidence Principles
    • Circumstantial vs. Direct Evidence
    • Forensic Soundness
    • Evidence Integrity
      • Cryptographic Hash Functions
    • Chain of Custody
  • Further Viewing

What Is Digital Forensics?

• Forensics: The application of science to legal problems and investigations.
• Digital forensics: A branch of forensics involving the recovery and investigation of digital evidence.
• Digital evidence: Data stored or transmitted using a digital device that are relevant to a legal investigation.

Subdisciplines

• Computer forensics: forensics related to individual computers
• Network forensics: forensics related to network components
• Mobile device forensics: forensics related to cell phones, tablets, GPS devices, etc.

Professions That Use Digital Forensics

• Digital forensics examiners
• Lawyers
• Network security analysts
• Military intelligence
• Data recovery specialists
• Software engineers (writing digital forensics tools)
• Librarians and archivists

The Scientific Method

The scientific method provides the framework for rigorous, defensible forensic analysis:

1. Make observations and learn background
2. Form a hypothesis
3. Experiment
4. Analyze results
5. Draw conclusions and report findings

Selecting a Good Hypothesis

A scientific hypothesis should be:

• Falsifiable: It must be possible to show the hypothesis to be false by some feasible test.
• Consistent: The hypothesis must be consistent with all previous observations.
• Simple: Other considerations being equal, a simpler hypothesis should be preferred (Occam’s razor).

Designing Good Tests

Tests in digital forensics should:

• Have a high chance of refuting or confirming the hypothesis
• Be tractable (feasible with available tools and time)
• Use sound techniques
• May be passive examination or active experimentation (live or online forensics)

Refutation and Confirmation Bias

Refutation: Tests designed to confirm a hypothesis should also include tests that attempt to refute it. We naturally tend toward confirmation bias — designing tests more likely to confirm our assumptions. A conclusion of guilt should not be drawn unless all other viable explanations have been refuted.

Example: Suppose the hypothesis is “Adam downloaded illegal content from website X.”

• Evidence of guilt: network analysis shows him downloading data from site X.
• Refutation evidence: further examination shows the data were served through a banner ad while Adam was shopping for yarn for his kitten orphanage.

The refutation evidence does not prove innocence, but it demonstrates that an alternative explanation exists and must be accounted for.

Reporting and Testimony

Digital forensics reports should:

• Target a general lay audience — assume no technical background
• Never explicitly assert that a party is guilty or innocent
• Present and explain evidence only; deciding guilt is up to judges and juries
• Tell a story, but leave the conclusion blank

Evidence Principles

Circumstantial vs. Direct Evidence

• Direct evidence shows that an event occurred.
• Circumstantial evidence implies that an event occurred, but other explanations remain possible.
• Multiple pieces of circumstantial evidence must be corroborated to form a direct link.

Digital evidence is usually circumstantial. It links computers to events, but linking a person to an event requires additional evidence. For example, digital evidence may directly link a computer to an event, but only circumstantially link the computer’s owner to that event.

Forensic Soundness

Forensically sound is roughly equivalent to “best practice.” It requires:

• Documenting all steps in handling and analyzing evidence
• Ensuring evidence is not damaged or altered
• Keeping analysis objective and unbiased

Forensic soundness is distinct from the question of whether evidence is circumstantial or direct — it describes how evidence was handled, not what it proves.

Evidence Integrity

• Ensure evidence is not damaged or altered during collection or analysis
• Any alteration must be precisely documented
• Avoid loss of evidence
• Avoid introducing artifacts that may confuse the investigation

Cryptographic Hash Functions

Hash functions take arbitrary input and produce a fixed-size hash value. Properties relevant to forensics:

• Collision resistance: infeasible to find two inputs with the same hash
• Pre-image resistance: infeasible to recover the input from the hash
• Second pre-image resistance: infeasible to find a second input with the same hash as a known input

Evidence integrity is verified by computing a cryptographic hash at the time of collection and recomputing it later. If the hashes match, the evidence has not been altered. Common algorithms used in forensics: MD5 (legacy, fast), SHA-256, SHA-512.

Why MD5 is insufficient on its own: Researchers demonstrated practical MD5 collision attacks in 2004 (Wang et al.). An adversary who can produce two files with the same MD5 hash could, in theory, swap evidence and maintain hash consistency. SHA-256 has no known collision weaknesses and is the current standard for forensic integrity; many labs compute both MD5 (for compatibility with legacy tools and databases) and SHA-256 (for cryptographic strength).

Chain of Custody

Chain of custody is the documentation of every person who handles the evidence. Several people will likely handle evidence before it reaches the digital forensics examiner. Incomplete documentation can result in evidence being ruled inadmissible.

Further Viewing

• A Geek’s Guide to Digital Forensics — Google TechTalk (56 min)
• Fighting Viruses, Defending the Net — Mikko Hypponen TED talk on the state of cybercrime (18 min)