Table of Contents for

System Forensics, Investigation, and Response, 3rd Edition

A forensic specialist should touch the original data as little as possible. Instead, information should be copied prior to examination. This means that the first step in any investigation is to make a copy of the suspected storage device. In the case of computer hard drives, you make a complete copy. That means a bit-level copy. Tools like EnCase, Forensic Toolkit, and OSForensics will do this for you; it is also possible to do this with basic Linux commands. In addition, it is a common practice to make two copies of the drive. This gives you one to work with and a backup in the event you need it.

The idea of handling original information as little as possible is a critical philosophy that should permeate your approach to forensics. But the real question is, why? Why is it so important that you not touch the actual original evidence any more than you have to? The first answer to that question is that each time you touch digital information, there is some chance of altering it. Even such a simple thing as changing the time/date stamp on a file is altering it. And if you alter the file, you cannot be certain that the evidence you find is valid.

Another reason is that there may be a need for another investigator to do his or her own examination. If you have worked with the original information, you may have altered it so that another person cannot now do a fresh analysis. There are many situations in which another examiner will need to review the original information. The most obvious situation is when the opposing counsel hires his or her own expert who wants to do his or her own examination.

This stems from a principle known in forensics as Locard’s principle of transference. Edmond Locard was a pioneer in forensics. Although he dealt with physical forensics (hair, blood, etc.) and lived long before the advent of the computer age, his concepts are still applicable. Essentially, he stated that you cannot interact in an environment without leaving some trace. This is true in computers. For example, the moment you log in to a Windows system, you have changed a few Windows Registry keys, added to the log, and changed a few temp files.

There are times when live forensics may be needed; however, that is always a secondary choice. The preference is to work with an image of a drive, rather than the actual drive.

During an investigation, a forensic specialist should keep in mind the relevant rules of evidence. The chain of custody and the Daubert standard, for instance, are just two of these that you must follow.

Rules of evidence govern whether, when, how, and why proof of a legal case can be placed before a judge or jury. A forensic specialist should have a good understanding of the rules of evidence in the given type of court and jurisdiction.

As one example, the Federal Rules of Evidence (FRE) is a code of evidence law. The FRE governs the admission of facts by which parties in the U.S. federal court system may prove their cases. The FRE provides guidelines for the authentication and identification of evidence for admissibility under rules 901 and 902. The following is an excerpt from rule 901 of the FRE from Cornell University Law School (2011), with the portions relevant to computer forensics shown:

1. In General. To satisfy the requirement of authenticating or identifying an item of evidence, the proponent must produce evidence sufficient to support a finding that the item is what the proponent claims it is.…

(1) Testimony of a Witness with Knowledge. Testimony that an item is what it is claimed to be.…

(3) Comparison by an Expert Witness or the Trier of Fact. A comparison with an authenticated specimen by an expert witness or the trier of fact.…

(9) Evidence About a Process or System. Evidence describing a process or system and showing that it produces an accurate result.

Item 1 refers to expert testimony. You, as a forensic examiner, may be called upon to authenticate evidence. Item 3 refers to a comparison between a given specimen and another item. This can be used to authenticate evidence. Item 9 is critical for computer forensics. Even if you use automated tools such as EnCase from Guidance Software or Forensic Toolkit from AccessData, you should understand how the tools work in detail so you can authenticate the process if need be.

Individual jurisdictions may have some additional rules particular to that jurisdiction. It is critical that you be aware of the rules in your jurisdiction as well as general rules of evidence.

A forensic specialist should not undertake an examination that is beyond his or her current level of knowledge and skill. This might seem obvious, but it is a problem that you can observe not just in forensics, but in the IT industry in general. Most other professions are more than happy to refer a client to a specialist. For example, if you see your family doctor and she discovers an anomaly regarding your heart, she will refer you to a cardiologist. Certainly she studied cardiology in medical school, but she will still send you to someone who specializes in cardiology. However, IT professionals all too often believe that if they have a little knowledge, that is enough to proceed.

This can be very problematic in forensics. Suppose you are a very skilled forensic examiner, and you have extensive experience with Microsoft Windows and Linux. But a computer is brought to you that runs Mac OS X. Now it is very likely that your skills would allow you to extract data. And it is true that OS X is based on a Linux-like system (FreeBSD). But is that enough? Very likely it is not. It is very likely that if you insist on doing the investigation yourself, you may miss key evidence or, at the very least, the opposition’s attorney can claim in court that you have.

These basic principles should guide your forensic investigation. These are not specific procedures, but rather general philosophical approaches to investigation.

Before you begin any forensic examination, you should have an analysis plan. This plan is a guide for your work. How will you gather evidence? Are there concerns about evidence being changed or destroyed? What tools are most appropriate for this specific investigation? Is this a federal or state case? Will this affect admissibility rules? You should address all of these issues in your data analysis plan. It is advisable to have a standard data analysis plan that you simply customize for specific situations.

System forensics specialists must keep in mind three main technical data collection considerations: understanding the life span of information, collecting information quickly, and collecting bit-level information.