Chapter 3 L1: 1.
Types of Digital Evidence
Digital evidence exists in two primary forms:
1. Volatile Evidence
o Definition: Data lost when the device is powered off or if a process is interrupted.
o Examples:
▪ Process information / Process-to-port mapping
▪ Logged-on user sessions
▪ Network connections / Ports in use
▪ Clipboard contents
▪ Command history
▪ Data stored in RAM (dynamic and easily overwritten)
2. Non-Volatile Evidence
o Definition: Data retained even when a system is powered down.
o Examples:
▪ Stored on hard disks, memory cards, USB drives
▪ Hidden files, slack space, swap files, unused/hidden partitions
▪ Registry settings, event logs
Key Point: Investigators typically collect volatile data first (RAM, running processes) because it
disappears quickly if the system shuts down.
2. Potential Sources of Evidence
Digital evidence isn’t limited to computers alone. Investigators should consider a variety of files
and devices that may contain critical clues.
A. Files
• User-Created Files: Documents, spreadsheets, images, database files,
bookmarks/favorites.
• User-Protected Files:
o Misnamed or hidden to evade detection.
o Encrypted (password-protected) or obfuscated using steganography.
• Computer-Created Files:
o Log files, backup files, config files, system or event logs, printer spool files,
temporary files, swap files.
B. Devices
• Hard Drive: Active/latent data, operating system files.
• RAM: Live processes, running applications, open ports (volatile).
• Network Devices (NIC, router, hub, switch): MAC addresses, logs, routing tables.
• Peripheral Devices
o Printers, Copiers: Usage logs, date/time stamps, possibly cached documents.
o GPS units: Previous locations, routes, timestamps.
o Credit Card Skimmers: Captured credit card data, user info.
o Biometric Scanners: Stored authentication/authorization details.
o Answering Machines: Voice recordings, last-called numbers.
Tip: Even seemingly mundane equipment (like a printer or phone) may store logs or cached data
that serve as key evidence.
3. Evidence Collection Order
Guidelines from the Internet Engineering Task Force (IETF, RFC 3227) emphasize:
• Collect data by volatility—the most volatile first, the least volatile last.
• Example Order:
1. CPU registers & caches
2. Routing/ARP cache, process tables, RAM
3. Temporary file systems
4. Non-volatile media (hard disks, removable drives)
5. Remote logging & monitoring data
6. Physical interconnections
7. Archival/backups
Other Considerations:
• Know which systems the data is from.
• Identify who has access, permission levels, and relevant configurations.
4. Data Integrity & Preservation
1. Avoid altering original evidence
o Accessing files directly from the original disk can change timestamps or
metadata.
o Solution: Work on copies made via bit-level imaging (forensic clone).
2. Forensic Clone (Bit-stream image)
o Captures every bit on the disk, including deleted but not-yet-overwritten data.
o Contrasts with simple “copy-and-paste,” which ignores latent space and hidden
partitions.
3. Documentation
o Record how the copy was created and any tools used.
o Preserve the original disk in its untouched condition (archive).
Goal: Any changes to the evidence must be detectable and the process must be repeatable and
verifiable.
5. Chain of Custody
Maintains the credibility of evidence by documenting:
1. Who discovered and collected the evidence.
2. When, where, and how it was collected.
3. Who took responsibility for it at each stage (transfers, storage).
4. Ensuring restricted access—only authorized personnel handle the evidence.