Unit 1: Computer Forensics and Investigation Process

1. Governing Principles of Digital Forensics

Digital forensics is the application of computer science investigation and analysis techniques to discover and preserve potential legal evidence within computing devices, embedded hardware, networks, and cloud environments.

CODECopy Code
+-------------------------------------------------------------------------+
|                  CORE PROCESS PILLARS OF DIGITAL FORENSICS              |
+-------------------------------------------------------------------------+
|  1. ACQUIRE      : Bit-stream physical imaging using write-blockers     |
|  2. AUTHENTICATE : Mathematical proof of integrity via SHA-256 hashing |
|  3. ANALYZE      : Conduct all investigative tests on working copies     |
|  4. REPORT       : Document clear, objective, legally defensible facts  |
|  * GOLDEN RULE   : NEVER perform analysis directly on the original media|
+-------------------------------------------------------------------------+

1.1 Locard's Exchange Principle (Digital Adaptation)

In classical forensic science, Edmond Locard posited that "every contact leaves a trace." In digital systems, any interaction between a user, software process, or network packet and a computer inevitably leaves digital footprints:

• Modified file access timestamps ($MACB$ — Modified, Accessed, Created, Born).
• Log generation in operating system event managers.
• Registry value changes and temporary swap or pagefile residue.
• Network connection states in ARP caches, routing tables, and socket pools.

1.2 Core Investigation Axioms

1. Integrity via Cryptographic Hashing: Digital evidence is authenticated by calculating cryptographic checksums (SHA-256). If the hash of the forensic image matches the hash of the source media, mathematical identity is established.
2. Analysis on Clones Only: Forensic analysts must never power on, mount, or execute programs directly on the suspect physical drive. All triage, carving, and parsing must take place on verified duplicate forensic images.
3. Repeatability and Reproducibility: Any competent, independent forensic scientist utilizing the same toolsets, methods, and forensic image must arrive at identical conclusions.
4. Order of Volatility (RFC 3227): Evidence collection must proceed from the most perishable data states (CPU registers, cache, RAM) to the least perishable (magnetic tape, optical disks).

2. Cybercrime Classifications, Digital Evidence, and Forensic Readiness

2.1 Taxonomy of Cybercrime

Cybercrimes are systematically classified according to the targeted entity:

2.2 Digital Evidence Characteristics and Types

Digital evidence consists of information of probative value stored or transmitted in binary format.

• Defining Characteristics:
  • Latent: Invisible to the naked eye; requires software tools to parse.
  • Fragile: Extremely susceptible to accidental alteration, overwrite, or deletion through standard operating system routines.
  • Transboundary: Often distributed across global cloud providers spanning multiple foreign jurisdictions.
• Evidence Classifications:
  • Volatile Evidence: Data resident in system memory, registers, or network sockets that disappears instantly when power is severed.
  • Non-Volatile Evidence: Data persisted on non-volatile physical storage media (hard drives, SSDs, flash cards, unallocated disk clusters, system logs).
• The Best Evidence Rule: A fundamental legal doctrine (Federal Rule of Evidence 1002) requiring the introduction of the original evidence in court, or an authenticated mechanical/electronic duplicate (such as a validated forensic bit-stream image) shown to be an exact equivalent.

2.3 Organizational Forensic Readiness (The Rowlingson Framework)

Forensic Readiness is the systematic ability of an enterprise to maximize its potential to collect valid digital evidence while minimizing the financial and operational costs of an investigation.

CODECopy Code
Ten-Step Forensic Readiness Lifecycle (Robert Rowlingson):
1. Define business scenarios requiring digital evidence (fraud, breach, IP theft).
2. Identify all potential evidence sources (firewalls, EDR, cloud audit trails).
3. Determine evidence collection requirements and retention mandates.
4. Establish legal authorization and capabilities for collection.
5. Secure storage for retrieved evidence (WORM storage, encrypted vaults).
6. Train staff in incident identification and initial response handling.
7. Ensure standard operational procedures (SOPs) preserve evidence integrity.
8. Establish secure incident communication and escalation channels.
9. Formalize case documentation and chain of custody workflows.
10. Conduct recurring reviews, tabletop exercises, and legal policy audits.

3. Incident Response Intersections, Investigator Roles, and Legal Compliance

3.1 Tension Between Incident Response and Digital Forensics

While Incident Response (IR) and Digital Forensics (DF) operate closely, they maintain inherently divergent primary objectives:

CODECopy Code
+-------------------------------------------------------------------------+
|                  OPERATIONAL TENSION: IR vs. FORENSICS                  |
+-------------------------------------------------------------------------+
|  Incident Response Priority:                                            |
|  - Business Continuity and Service Restoration                          |
|  - Rapid containment, re-imaging, and patching                         |
|  - "Get production back online immediately!"                            |
|-------------------------------------------------------------------------|
|  Digital Forensics Priority:                                            |
|  - Evidence Preservation and Legal Defensibility                        |
|  - Painstaking bit-level extraction, memory dumping, timeline analysis  |
|  - "Freeze the scene; do not alter a single bit!"                       |
+-------------------------------------------------------------------------+

A mature Security Operations Center (SOC) balances these priorities by capturing volatile memory and network captures before executing remediation or rebooting hosts.

3.2 Investigator Roles and Ethical Responsibilities

A digital forensics investigator must operate with strict neutrality:

• Fact Finder, Not Prosecutor: The investigator's role is strictly objective—uncovering facts, validating timelines, and reporting findings regardless of whether they incriminate or exonerate the suspect.
• Documentation Discipline: Every command entered, tool version utilized, error code observed, and hash calculated must be contemporaneously recorded in laboratory bench notes.
• Technical Competence: Maintaining mastery over file systems (NTFS, ext4, APFS), operating system artifacts, memory structures, and legal standards.

3.3 Legal Standards and Evidentiary Admissibility

To be admitted into criminal or civil legal proceedings, digital evidence and scientific expert methodologies must satisfy strict legal tests:

• Search Warrants and Consent: Evidence collected by law enforcement without a valid judicial warrant, probable cause, or documented consent violates the Fourth Amendment (in the US) and is subject to the Exclusionary Rule ("Fruit of the Poisonous Tree").
• The Daubert Standard: Evaluates whether a scientific technique or software tool:
  1. Has been empirically tested and validated.
  2. Has been subjected to peer review and publication.
  3. Maintains a known or potential error rate.
  4. Maintains operational standards controlling its execution.
  5. Has gained general acceptance within the relevant scientific community.
• The Frye Standard: A traditional standard requiring that scientific evidence must be based on principles that have attained "general acceptance" within the relevant discipline.

4. The Three-Phase Forensic Investigation Process

A structured investigation consists of three macro-phases: Pre-Investigation, Investigation, and Post-Investigation.

CODECopy Code
+--------------------+       +--------------------+       +--------------------+
| Pre-Investigation  | ----> |   Investigation    | ----> | Post-Investigation |
| - Authority/Warrant|       | - First Response   |       | - Expert Report    |
| - Team & Toolkit   |       | - Bit-Stream Image |       | - Court Testimony  |
| - Secure Lab Prep  |       | - Carving/Timeline |       | - Evidence Retain  |
+--------------------+       +--------------------+       +--------------------+

4.1 Phase 1: Pre-Investigation

1. Legal Authorization: Confirming explicit jurisdiction, formal corporate authorization, or judicial search warrants detailing the specific physical locations and devices subject to seizure.
2. Toolkit Readiness: Assembling calibrated forensic field kits: hardware write-blockers (SATA, NVMe, USB), sterile target storage drives, forensic bootable media (Caine, Kali), anti-static bags, tamper-evident evidence tape, and chain of custody ledgers.
3. Forensic Workstation Preparation: Ensuring forensic workstations operate in isolated network segments with wiped, cryptographically sanitized analysis volumes.

4.2 Phase 2: First Response and On-Scene Triage

When arriving at a physical crime scene:

1. Secure the Physical Perimeter: Remove unauthorized personnel, isolate the room, and disconnect external network cables to stop incoming commands or active data exfiltration.
2. Photographic Documentation: Photograph the complete scene before touching equipment: monitor displays, cable connections, device serial numbers, and surrounding physical desk artifacts.
3. The Live System Decision Matrix:
   • If the computer is ON:
     • Capture volatile RAM using live extraction tools (e.g., WinPmem, LiME) to preserve active encryption keys, network sockets, and unencrypted documents.
     • Document running processes, active network connections, and command prompts.
     • Never perform a graceful OS shutdown (which executes shutdown scripts and overwrites temporary files). Pull the power cable directly from the rear of the power supply unit (PSU) on desktop computers, or remove the battery on laptops.
   • If the computer is OFF:
     • Leave it OFF. Powering on a machine loads the operating system, altering thousands of registry keys, timestamps, and log files.

4.3 Phase 3: Forensic Acquisition and Analysis

CODECopy Code
Source Drive (Suspect) ---> [ Hardware Write-Blocker ] ---> Forensic Acquisition Tool
                                                                    |
                                                                    +---> Bit-Stream Image (.E01 / .raw)
                                                                    +---> Verification Hash (SHA-256)

1. Hardware-Blocked Acquisition: The suspect storage media is connected to the acquisition machine through an approved hardware write-blocker.
2. Bit-Stream Physical Imaging: Creating a raw bit-for-bit physical copy (or Expert Witness Format .E01 image). Logical file backups are unacceptable because they fail to capture unallocated space, file slack, and deleted records.
3. Cryptographic Authentication: Calculating the pre-acquisition hash of the physical drive and comparing it to the hash of the generated image:

$\text{Admissible} \iff \text{SHA-256}(\text{Physical Media}) = \text{SHA-256}(\text{Forensic Image})$

4. Forensic Examination and Carving:
   • File Carving: Reconstructing deleted files from unallocated clusters based on file header/footer magic bytes (e.g., JPEG headers \xFF\xD8\xFF).
   • Timeline Analysis (Super Timelines): Correlating $MACB$ timestamps across file system artifacts, event logs, shell histories, and browser cache to reconstruct exact adversarial actions.

4.4 Phase 4: Post-Investigation and Reporting

1. Forensic Reporting: Generating a clear, objective, and legally binding written report detailing scope, methodologies, tool versions, chain of custody, factual findings, and conclusions. Jargon must be translated into plain language for judges and juries.
2. Expert Witness Testimony: Presenting findings under oath, defending methodologies under cross-examination, and adhering to strict ethical codes.
3. Evidence Archival & Disposition: Securing physical evidence in climate-controlled, tamper-evident lockers adhering to legal hold retention schedules until all appeals are exhausted.

5. Summary Review and Exam Takeaways

1. Four Pillars: Acquire (bit-stream), Authenticate (hashing), Analyze (on clone), Report (objective facts). Never analyze live suspect media.
2. Locard's Exchange Principle: Contact leaves a trace; every digital interaction alters timestamps, creates event logs, or leaves memory residue.
3. Best Evidence Rule: Courts require original media or an authenticated, identical bit-stream duplicate.
4. Order of Volatility (RFC 3227): CPU registers -> RAM / network state -> Swap/temp space -> Local storage -> Remote logs -> Archival media.
5. Live Triage Decision: If ON, dump volatile RAM first, then pull the power plug (never perform graceful shutdown). If OFF, leave it OFF.
6. Integrity Proof: Pre-acquisition SHA-256 hash must equal post-acquisition image hash.
7. Legal Admissibility: Daubert standard evaluates empirical testing, peer review, error rates, and scientific consensus; Frye evaluates general acceptance.
8. Forensic Readiness: Establishing proactive logging, time synchronization, and incident plans to maximize evidence collection capability while minimizing cost.