How Digital Forensics Operates

When Enron filed for bankruptcy in December 2001, numerous employees were left unemployed while some executives appeared to gain from the company's downfall. The U.S. Congress launched an investigation after receiving reports of corporate wrongdoing. A significant portion of this investigation relied on computer files as evidence. A specialized team of investigators began combing through the computers of Enron employees using digital forensics.

The goal of digital forensics is to examine, secure, and analyze data stored on computer systems to uncover potential trial evidence. While many traditional crime scene techniques have digital equivalents, there are also distinct factors involved in digital investigations.

For instance, simply accessing a computer file alters it—the system logs the exact time and date the file was accessed. If detectives seize a computer and begin opening files, it's impossible to confirm that nothing was altered in the process. Lawyers may challenge the integrity of the evidence when the case reaches court.

Some argue that relying on digital data as evidence is problematic. If computer information can be easily altered, how can it be trusted as solid proof? While many nations accept digital evidence in court, this could change if such evidence is found unreliable in future trials.

As computers continue to grow in power, the field of digital forensics must adapt. In the early days, a single investigator could sift through files due to limited storage capacity. Today, with hard drives storing gigabytes and even terabytes of data, the task has become overwhelming. Investigators must innovate to search for evidence efficiently without overextending resources.

What are the fundamental concepts of digital forensics? What should investigators search for, and where should they begin? Find out in the next section.

Introduction to Computer Forensics

The field of digital forensics is still relatively new. In the early stages of computing, courts treated evidence from computers just like any other form of evidence. However, as computers grew more advanced, courts began to realize that computer evidence could easily be altered, corrupted, or destroyed.

Investigators recognized the need to create specialized tools and methods to examine computers for evidence without tampering with the data. Detectives collaborated with computer scientists to determine the best procedures and tools for retrieving evidence from computers. Over time, these methods formed the foundation of the digital forensics field.

Typically, detectives must obtain a warrant to search a suspect's computer for evidence. The warrant must specify where the search is allowed to take place and what type of evidence the detectives are authorized to look for. In other words, a detective cannot simply execute a warrant and search any area or for anything suspicious. Furthermore, the warrant cannot be overly broad. Judges generally require that detectives be as specific as possible when requesting a warrant.

For this reason, it is crucial for detectives to conduct thorough research on a suspect before applying for a warrant. For example, if a detective obtains a warrant to search a suspect's laptop, but upon arriving at the suspect's residence discovers a desktop PC, the detective is not legally permitted to search the desktop since it was not included in the original warrant.

Every computer investigation is unique in its own way. Some may take just a week to complete, while others might span several months. Here are a few factors that can influence the duration of an investigation:

What are the steps involved in gathering evidence from a computer? Keep reading to find out.

Stages of a Digital Forensics Investigation

Judd Robbins, a renowned computer scientist and leading authority in the field of computer forensics, outlines the following steps investigators should take to recover computer evidence:

While each of these steps is critical, the first one is paramount. Without proof that the computer system was secured, any evidence found may be deemed inadmissible. Additionally, the job has grown more complex over time. In the past, an investigation might have involved a PC and a few floppy disks, but today’s systems may involve multiple computers, external drives, thumb drives, peripherals, and even Web servers.

Some criminals have devised methods to complicate the investigation process. They use programs called anti-forensics to make it more difficult for detectives to retrieve data from their systems. Investigators must be aware of these tools and know how to disable them to gain access to the information.

What exactly are anti-forensics, and how do they work? Stay tuned to learn more in the next section.

Anti-Forensics

Anti-forensics can pose a significant challenge for computer investigators. These tools are intentionally created by programmers to complicate or even prevent data retrieval during an investigation. Simply put, anti-forensics encompasses any method, device, or software that disrupts a computer forensics inquiry.

There are numerous techniques for concealing information. Some programs can manipulate file headers, which are usually invisible to users but crucial for identification by the system. A file's header indicates its type, even if the file's name is changed. For example, renaming an mp3 file to have a .gif extension doesn’t change its true format, as the header still shows it’s an mp3. Certain tools allow modifications to these headers, causing the computer to misidentify the file. Detectives searching for specific file formats could overlook critical evidence because it appears irrelevant due to the altered header information.

Some programs can fragment files into small sections and scatter them across different files. Files often contain unused spaces, known as slack space. With the appropriate software, it’s possible to hide files within this slack space. Recovering and reconstructing the hidden data is an exceptionally difficult task.

It’s also possible to embed one file within another. Executable files – files recognized by computers as programs – can be especially tricky. Tools known as packers are capable of embedding executable files into different file types, while binders can combine multiple executable files into one.

Encryption serves as another method of concealing data. This involves applying a set of complex rules, called an algorithm, to render the data unreadable. For example, an algorithm might transform a readable text file into an incomprehensible string of numbers and symbols. To access the original data, one would need an encryption key, which reverses the process and decodes the symbols into readable text. Without the key, investigators must rely on specialized software to break the encryption. The more advanced the encryption algorithm, the longer it will take to crack it.

Certain anti-forensic tools can manipulate the metadata attached to files. Metadata includes details such as when a file was created or last modified. Typically, this information is fixed, but some software allows users to modify metadata. For instance, a file’s metadata might falsely show that it will not exist for another few years, or that it was last accessed centuries ago. When metadata is tampered with, it complicates the ability to trust the evidence as reliable.

Some software programs are designed to wipe data if an unauthorized attempt is made to access the system. Developers have studied how computer forensics tools function and created applications aimed at blocking or sabotaging these programs. When forensics experts encounter such threats, they must apply creativity and caution to retrieve the data.

Some individuals utilize anti-forensics to highlight the inherent vulnerability and unreliability of digital evidence. If it's unclear when a file was created, accessed, or even if it ever existed, how can one trust computer evidence in court? While this is a legitimate concern, many countries do accept computer evidence in legal proceedings, though the specific criteria for admissibility differ from one country to the next.

So, what exactly defines the standards of evidence? We'll explore this in the following section.

Standards of Computer Evidence

In the United States, there are detailed guidelines governing the seizure and use of computer evidence. The U.S. Department of Justice publishes a manual titled "Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations." This document outlines the criteria for when investigators can include computers in a search, what types of information are admissible, how the rules of hearsay apply to digital data, and the procedures for conducting a search.

If investigators determine that the computer is merely functioning as a storage device, they are typically not permitted to seize the hardware itself. This restricts evidence collection to what is found in the field. However, if the investigators believe the hardware is itself evidence, they can seize the hardware and remove it for further investigation. For instance, if the computer is suspected to be stolen, the investigators can confiscate the hardware.

For computer evidence to be admissible in court, the prosecution must authenticate it. This means they need to prove that the data presented as evidence came from the defendant's computer and has not been tampered with.

Although it's widely recognized that altering computer data is both feasible and relatively simple, U.S. courts haven't outright rejected computer evidence. Instead, the courts demand proof or indications of tampering before dismissing such evidence.

Another key factor considered by the courts when dealing with computer evidence is hearsay. Hearsay refers to statements made outside of a courtroom, which are typically inadmissible. However, the courts have ruled that information found on a computer is generally not considered hearsay and can be used as evidence. If the computer records contain statements made by individuals, like those found in e-mail messages, the court must assess their reliability before allowing them to be used as evidence. This evaluation is done on a case-by-case basis.

Computer forensics specialists rely on a variety of fascinating tools and applications during their investigations. Discover more about them in the following section.

Computer Forensics Tools

Many developers have built a range of computer forensics tools. For most police departments, the selection of these tools largely depends on available funding and the technical proficiency of the staff.

Below are several computer forensics tools and programs that facilitate investigations into digital evidence:

These tools can only serve their purpose if investigators adhere to proper procedures. Otherwise, a skilled defense attorney could argue that any evidence obtained during a computer investigation lacks credibility. Some anti-forensics specialists even claim that no computer evidence can ever be fully reliable.

The future of computer evidence in the courts remains uncertain. Anti-forensics experts believe that it's only a matter of time before someone proves in court that it's possible and feasible to manipulate computer data without detection. If that happens, courts may face challenges in justifying the acceptance of computer evidence in legal proceedings.