3 Ways Cell Phone Forensics Analysts Preserve Digital Evidence
Picture a scene from a CSI episode or a similar spinoff
where you are at a crime scene. However, instead of dead things and dark
lighting, you see a cell phone, hard drive, and monitor, among other
unidentifiable objects. It looks like a rather innocent scene.
However, as the story unravels, forensics analysts inevitably find evidence of a possible crime. While most criminal investigations may not require computer forensics teams, they can be crucial in some cases.
Activities warranting forensics teams may include criminal
activities like hacks, spoofed emails, fraud, personal data theft, and
intellectual property destruction. Whatever the case, something as simple as a
cell phone can leave breadcrumbs only a professional forensics expert can find.
How? You might ask. Keep reading to find out:
Investigation Initiation
The software, hardware, and other tools used to perform
computer forensics analysis can be quite expensive but effective. For example,
acquiring the most efficient Cell Phone
Forensics Software for your company’s forensics team might not be very
cost-effective. In most situations, it’s better to contract out forensics work
to professionals.
In this post, we will share with you the top 3 ways
forensics analysts preserve digital evidence to build cases of criminal
activity:
·
Drive Imaging
Before a forensics team can start analyzing evidence, they
need to image it first. This is a forensic process used by forensic analysts to
create a bit-for-bit duplicate of damaged drives and phones. This forensic
image can help you retain evidence to present for investigations.
You must also remember that even wiped drives can sometimes
retain important recoverable data when analyzing a disk image. In the best
cases, analysts can recover all deleted data and catalog it using forensic
techniques.
Whenever your system is compromised, it is vital that you do
nothing to avoid damaging the data stored in it. Ideally, you could isolate it
from other systems to prevent connections into or out of it to mitigate the
damage spread.
·
Hash Values
When a forensic analyst images a machine for analysis, it
generates cryptographic
hash values, including MD5 and SHA-1. The hash value verifies the integrity
and authenticity of the disk image as an exact replica of the original media.
Therefore, hash values are vital, especially when admitting
critical digital evidence into court. That’s because altering even a small bit
of data could generate a different new hash value. This hash value and other
metadata aren’t always visible in normal file explorer windows, but analysts
can access them using special software. As such, if the hash values don’t
match, the court may assume that someone tampered with the evidence.
·
Chain of Custody
Forensics analysts are also required to document all
transfers of evidence and other media on Chain
of Custody (CoC) forms when transferring the collected data when needed.
They are also required to capture dates and signatures upon media handoff.
The CoC artifact demonstrates that the evidence has been
under known possession since the time of creation. Therefore, any lapse in the
CoC nullifies any legal value it may have, and thus the analysis. This includes
any time the image might have been in an unsecured location.
Investigators may still analyze the results, but they may
not hold up in court, especially when facing a reasonably tech-savvy attorney.
Comments
Post a Comment