High Level Overview of Digital Forensics and Forensics Sciences

Topics

• Job opportunities – why should you care?
• What is Forensic Science?
• Why Forensic Science now?
• What is Computer/Digital Forensics?
• Uses of Computer/Digital Forensics
• Role in the Judicial System

What’s NOT Forensics Science

• It certainly isn't Humvees, sunglasses, and expensive suits. It isn't done without lots of paperwork, and it's never wrapped up in sixty minutes (with or without commercials).

​

• Now that we know what it isn't, let's examine what it is.
• Simply put, forensics is the application of science to solve a legal problem.
• In forensics, the law and science are forever integrated.
• Neither can be applied without paying homage to the other.
• The best scientific evidence in the world is worthless if it's inadmissible in a court of law.

​

What is Digital Forensics?

Digital Footprint / Traces

• 1s and 0s capture our “footprints” as we go about our daily life.

​

• Cell phone records

​

• ATM transactions

​

• web searches

​

• e-mails

​

• and text messages are a few of the footprints we leave.

Volume of Data

• Heavy use of technology means that we are literally drowning in electronically stored information.
• Mountains of data keep increasing.

​

• Check out these numbers from the research company IDC: The digital universe (all the digital information in the world) will reach 1.2 million petabytes in 2010. That's up by 62% from 2009. If you can't get your head around a petabyte, maybe this will help: “One petabyte is equal to: 20 million, four-drawer filing cabinets filled with text or 13.3 years of HD-TV video.” (Mozy, 2009)

​

• IDC projects that by 2020 the digital universe will reach 40 zettabytes (ZB), which is 40 trillion GB of data, or 5,200 GB of data for every person on Earth. This amount exceeds previous forecasts by 5 ZBs, resulting in a 50-fold growth from the beginning of 2010.

​

​

Impact of data on forensics

• The impact of our growing digital dependence is being felt in many domains, not the least of which is the legal system.

​

• Everyday, digital evidence is finding its way into the world's courts.

​

• This is definitely not your father's litigation.

​

• Gone are the days when records were strictly paper.

• This new form of evidence presents some very significant challenges to our legal system.

​

​

Impact of data on forensics….cntd

• Digital evidence is considerably different from paper documents and can't be handled in the same way.

​

• Change, therefore, is inevitable.

​

• In fact, legal system about as nimble as the Titanic.

• It's struggling now to catch-up with the blinding speed of technology. 🡪 this means job opportunities for you

​

Forensic Job Opportunities

• Criminal, civil, and administrative proceedings often focus on digital evidence, which is foreign to many of the key players, including attorneys and judges.

​

• We all know folks who don't check their own e-mail or even know how to surf the Internet.

​

• Some lawyers, judges, businesspeople, and cops fit squarely into that category as well. Unfortunately for those people, this blissful ignorance is no longer an option.

​

• Where law-abiding society goes, the bad guys will be very close

​

Job opportunities…cntd

• Bad guys d have joined us on our laptops, cell phones, iPads, and the Internet.

​

• Criminals will always follow the money and leverage any tools, including technology, that can aid in the commission of their crimes.

​

• Although forensic science has been around for years, digital forensics is still in its infancy.

​

• It's still finding its place among the other more established forensic disciplines, such as DNA and toxicology.

​

• As a discipline, it is where DNA was many years ago. Standards and best practices are still being developed. 🡪 This is your chance to get in on the ground floor, before forensics takes off

.

​

Job opportunities…cntd

• Attorneys and judges often know little about digital evidence

​

• Digital forensic scientists must therefore be teachers as well as technical experts

What does it take?

• Digital forensics can't be done without getting under the hood and getting your hands dirty, so to speak.

​

• It all starts with the 1' s and 0' s. This binary language underpins not only the function of the computer but how it stores data as well.

​

• We need to understand how these 1' s and 0' s are converted into the text, images, and videos we routinely consume and produce on our computers.

​

Digital Evidence

• Computers record evidence of everything you do, and also
• Cell phones
• ATM machines
• Web servers
• Email servers
• SMS systems
• etc.

​

Forensic Science

• Forensics
• Application of science to solve a legal problem
• Digital Forensics
• Application of computer science and investigative procedures
• Analysis of digital evidence
• Chain of custody
• Validation with mathematics
• Use of validated tools
• Repeatability
• Reporting
• Expert presentation

Items to Examine

• Laptop and desktop computers

​

• Mobile devices

​

• Networks

​

• Cloud systems

​

• Video, audio, and images
• Authenticity, comparison, enhancement

Uses of Digital Forensics

• Criminal investigations
• Identity theft
• Homocide, robbery, burglary…
• Almost every criminal investigation

​

• Civil litigation

​

• Intelligence

​

• Administrative matters

Forensics Backlog

• "…there were massive backlogs within all police forces, to the point where it was six months to two years before some computers could be examined"

Law Enforcement Paradigm

• Police need to think of and seek out digital evidence

​

• Seize
• Computers, Tablets
• Cell phones
• Gaming consoles
• Cameras
• Etc.

​

Bind. Torture. Kill. (BTK)

• Dennis Rader
• Respected citizen
• Also a serial killer
• Murdered ten people in Kansas from 1974 to 1991

​

• He confessed in an anonymous letter to a newspaper

​

• He offered to send police a floppy disk
• Police said it couldn't be traced

Metadata (data about data)

• Metadata on the RTF (rich text file) file he sent contained
• Dates
• Title: "Christ Lutheran Church"
• "Last Saved By:" Dennis

​

• Christ Lutheran Church Wichita website showed Dennis Rader as President of Congregation Council

John Mcaffee

• Fugitive from Belize police

​

• Posed for a photo in Guatemala

​

• Published on the Internet with GPS location metadata

Civil Litigation

• eDiscovery is a $780 million business
• Hiring in San Francisco now
• eDiscovery definition
• "any process in which electronic data is sought, located, secured, and searched with the intent of using it as evidence in a civil or criminal legel case"
• Both parties are entitled to examine evidence
• This process is called "Discovery"

​

Google's Billion Dollar eDiscovery Error

• This email was marked "Confidential" on some copies but not on others
• Accidentally revealed as evidence
• (Google didn't actually lose the $1 billion)

Intelligence

• Terrorists and foreign governments use digital tools and the Internet

​

• US Military uses documents and media in the DOCEX and DOMEX processes

DOMEX

• DOCEX (Document Exploitation)
• "Procedures used by the United States Armed Forces to discover, categorize, and use documents seized in combat operations"
• "Documents" includes �digital media

​

• DOMEX (Document and

Media Exploitation)

• Use of documents by �various agencies after� collection

Real Aid to the Enemy

• "…a real-world example from 2007. When a new fleet of helicopters arrived … in Iraq, some Soldiers took pictures ... From the photos that were uploaded to the Internet, the enemy was able to determine the exact location of the helicopters inside the compound and conduct a mortar attack, destroying four of the AH-64 Apaches."

Administrative Matters

• Digital evidence is used to detect policy violations
• Accessing forbidden websites at work

​

• SEC Office of the Inspector General
• Firewall logs showed officials surfed porn at work

Locard's Exchange Principle

• When perps enter or leave a crime scene, they will leave something behind or take something with them
• Such as DNA, fingerprints, hair, fibers, etc.

​

• Also true of digital forensics
• Registry keys, log files, etc.

Scientific Method

• Forensic science is new and procedures are still being developed

​

• A scientist is normally regarded as objective, neutral, dealing only with facts

​

• BUT forensic experts are hired by both prosecution and defense, and state expert opinions as well as facts

Organizations of Note

• "brings together organizations actively engaged in the field of digital and multimedia evidence to foster communication and cooperation as well as to ensure quality and consistency within the forensic community"

​

• Premier forensic organization in the world

​

• Develops standards of practice

​

• 6000 members, including directors of most federal crime labs

American Society of Crime Laboratory Directors/�Laboratory Accreditation Board (ASCLD/LAB)

• ASCD/LAB accredited labs are the "gold standard" in forensics
• They set standards and requirements for accreditation

NIST�(National Institute of Standards and Technology)

• National Software Reference Library
• Known file signatures for operating system software and other items of no investigative value
• Computer Forensic Tool Testing

• Also develops standards for forensics

HTCIA�(not in textbook)

• High-Tech Crime�Investigation Association
• Organization of peace officers, investigators, prosecuting attorneys, and security professionals
• But NOT criminal defense experts

Defense Lawyers

• Understand their goals
• Hurting the expert & freeing the client is a win for them
• Image from http://www.zazzle.com/lawyer_shark_trust_me_bumper_sticker-128101885100809676

Role of the Forensic Examiner in the Judicial System

• Expert witness
• Qualified to render an opinion
• Must be effective communicators
• Must be teachers
• Must be without bias
• Follow the evidence wherever it leads