Module-3 Digital Forensic

1
Data Acquiring and duplication:

Acquisition of Evidence
Digital evidence is highly volatile and fragile—any mishandling can result in data corruption,
loss, or alteration. Because of this, investigators must follow strict procedures to ensure the
integrity and admissibility of the evidence in court.

Errors during acquisition can lead to:

 Loss of data (partially or completely).

 Altered timestamps or metadata that may weaken the case.
 Challenges to investigator credibility if the integrity of the evidence is questioned.

To avoid these risks, forensic investigators use a tool validation process and follow industry-
accepted best practices.

Exploring evidence:-
What is Evidence?

 Definition (dictionary): Facts or information indicating whether a belief or proposition

is true or valid.
 Legal Reality: Evidence is not just about facts—it must meet legal standards of
admissibility for a particular jurisdiction.
 Trier of Fact: (judge/jury) decides whether evidence is valid and admissible.

2. Challenges with Evidence

 Evidence may seem strong (e.g., blood, DNA, digital files), but if it cannot withstand
legal challenges, it may become a liability.
 Example: A strong murder case fell apart because defense lawyers successfully
challenged how evidence was handled.

3. How Evidence is Attacked

 Attacking the evidence itself: Questioning authenticity, accuracy, or relevance.

 Attacking the process/personnel: Highlighting mishandling, errors, or flawed
methodologies.

4. Case Examples

 Thumbnail Cache Misinterpretation

o Examiner misread URI metadata paths (bob vs. bobby accounts).
o Incorrect assumptions led to errors in the report.

2
 o Opposing counsel exposed the mistake, weakening the examiner’s credibility.
 Child Exploitation Case
o Despite strong evidence (confession, chats, images), government altered/deleted
digital evidence (text messages, video edits).
o Jury ruled not guilty because tampered evidence destroyed credibility.

5. Lessons Learned

 Errors (even honest mistakes) open doors for attacks.

 Tampering/manipulation (intentional or not) can make otherwise strong cases
collapse.
 If evidence isn’t presented, it doesn’t exist legally—unsubmitted evidence has no
weight in proceedings.

6. Best Practices to Protect Evidence

1. Follow proper handling procedures

o Don’t take shortcuts.
o Maintain strict chain of custody.
2. Use validated methodologies
o Validate tools and processes yourself, not just rely on third-party validation.
o Ensure methods are reproducible by others.
3. Control the forensic environment
o Prevent contamination.
o Use sterile media and tested tools.
4. Be prepared for challenges
o Assume every step will be questioned.
o Document everything thoroughly.
o Conduct your work as if you’ll need to defend it in court.

Understanding the forensic examination environment:-

A forensically sound examination environment refers to the controlled conditions under which
a digital forensic examiner conducts an investigation. It is not limited to a physical laboratory,
but applies to any location—lab, office, or field—where digital forensic tasks are performed.

The main principles of a sound forensic environment are:

1. Examiner control – The forensic examiner must have full control over the environment.
2. Intentional actions – No action should occur unless explicitly initiated by the examiner.
3. Predictable outcomes – The examiner should know the expected results of every action
taken.

3
This environment is more of a mindset than just a location, requiring the examiner to be
methodical and thorough, reducing mistakes that could compromise evidence integrity.

Example:
In one case, investigators imaged devices from a remote site. On later review, one examiner
realized that instead of imaging the suspect’s device, they had imaged their own forensic laptop.
This mistake occurred because they ignored details during the imaging process. Fortunately, a
backup image created by another examiner saved the investigation.

Lesson:
Such errors highlight the importance of strict adherence to forensic principles, tool validation,
and maintaining backups. Without them, evidence could be lost forever, and credibility damaged.

Tool validation

Tool validation is the process of ensuring that the forensic tools used in an investigation function
correctly and produce accurate results. Since digital evidence is often challenged in court, the
examiner must be able to defend the reliability of the tools and processes used.

If tools are not validated, the opposing counsel can question both the integrity of the evidence
and the competence of the examiner. For example, in the Casey Anthony trial, errors in forensic
tools led to challenges against the evidence, which weakened the prosecution’s case.

How to mitigate attacks on tools and processes:

1. Understand tool functionality – Know how the tool works and where it finds artifacts.
2. Document training and notes – Record your qualifications and steps taken during the
exam.
3. Personally validate tools – Use tools on known datasets (e.g., NIST Computer Forensic
Reference Dataset) and verify results match expected outputs.
4. Maintain reproducibility – Ensure that other examiners using the same tool and dataset
can replicate your results.

Example:
Using a NIST control dataset, both Autopsy (open source) and X-Ways (commercial) correctly
identified two logical files and their metadata, with MD5 hashes matching the control
documentation. This confirmed that the tools were functioning properly.

Conclusion:
Tool validation is essential for credibility in digital forensics. Without it, even strong evidence
can be discredited. Proper validation, documentation, and reproducibility strengthen the
examiner’s ability to defend their findings in court.

4
Creating sterile media

Sterile media refers to a storage device that has been completely wiped, with every byte
overwritten (commonly with hexadecimal 00), ensuring that no residual data from previous
investigations remains. The purpose is to prevent cross-contamination of evidence and maintain
the credibility of the forensic process.

In earlier forensic practices, investigators often made forensic copies instead of images. If the
destination device was not sterilized, leftover data in unallocated or slack space could mix with
the current case data, leading to credibility issues in court. Even newly purchased drives must be
sterilized before use to guarantee they are free of pre-existing data.

Reasons for using sterile media:

 Prevents contamination between past and current cases.

 Ensures integrity of the forensic copy or image.
 Protects investigators from challenges by opposing counsel regarding irrelevant or
foreign data.
 Secures old storage devices before disposal or recycling.

Verification Process:

1. Sterilization tools like PALADIN (Ubuntu-based forensic toolkit) can overwrite the
device with 00s and generate logs of the process.
2. Verification can be done using tools like X-Ways Forensics, applying a 64-bit
checksum. If the result is all zeros, it confirms successful sterilization.
3. MD5 or SHA-1 are not recommended for this task, as they don’t directly indicate
whether all data has been wiped.

Conclusion:
Sterile media is a foundational practice in digital forensics to safeguard evidence integrity.
Without it, investigators risk contamination, credibility loss, and legal challenges.

Understanding write blocking:-

Write blocking is a fundamental concept in digital forensics designed to protect the integrity of
digital evidence. Its purpose is to prevent any modifications to the source device during
acquisition or examination. Even simple actions, such as connecting a storage device to a
Windows system, can cause the operating system to automatically write to the device (e.g.,
updating metadata), thereby altering evidence.

To avoid this, forensic examiners use write blockers, which allow read-only access to the
source device. This ensures that the examiner can acquire or analyze data without making any
changes.

There are two main types of write blockers:

5
 1. Hardware Write Blocker – A physical device placed between the source drive and the
forensic workstation. It ensures no write commands reach the source device.
2. Software Write Blocker – A software-based solution that intercepts and blocks write
commands at the operating system level.

Importance:

 Maintains evidentiary integrity.

 Ensures compliance with forensic best practices.
 Protects against accidental or automatic system writes.
 Strengthens credibility in court by proving no alteration occurred.

Conclusion:
Write blocking is essential for a forensically sound examination. Without it, even unintentional
modifications could compromise the admissibility of evidence in legal proceedings.

Got it 👍 Here’s a mindmap of “Understanding Write Blocking” in a structured text format.

🧠 Mindmap: Write Blocking

🔹 Core Concept

 Prevents any modifications to the source device.

 Ensures evidence integrity.

🔹 Why Needed?

 OS (e.g., Windows) may automatically write data when a device is connected.

 Even a single bit change can compromise evidence.

🔹 Types of Write Blockers

1. Hardware Write Blocker

o Physical device.
o Placed between source drive & forensic workstation.
o Completely blocks write commands.
2. Software Write Blocker
o Software tool installed on the forensic system.
o Intercepts and blocks write commands at OS level.

🔹 Benefits

 Maintains forensically sound environment.

6
  Protects chain of custody.
 Increases admissibility of evidence in court.
 Prevents accidental alteration.

🔹 Risks Without Write Blocking

 Data corruption.
 Evidence inadmissibility.
 Loss of examiner credibility.

Hardware Write Blocker

✅ Definition

A hardware write blocker is a physical device that sits between the forensic workstation and
the source device, intercepting commands and preventing any write operations from reaching
the evidence media.

✅ Working Principle

 OS normally issues read/write commands to storage devices.

 The write blocker filters out write commands while allowing read commands.
 Ensures the source evidence remains unaltered during acquisition.

✅ Features

 Physically connected between the source drive and forensic computer.

 Supports different storage interfaces (e.g., SATA, IDE, USB, NVMe).
 Often provides logging features for examiner documentation.

✅ Example Device

 Tableau Forensic SATA/IDE Bridge (T35u)

o Tested by Department of Homeland Security (2018).
o Enables forensic acquisition of SATA/IDE drives via USB 3.0.

✅ Reliability & Standards

 Tested under the NIST Computer Forensics Tool Testing Program (CFTT).
 Validated results available: NIST Hardware Write Blocker Reports.

7
✅ Advantages

 Strong protection against accidental writes.

 Trusted and court-accepted method.
 Independent of OS/software settings.

✅ Limitation

 More expensive than software write blockers.

 Device-specific (must match drive type/interface).

Software Write Blocker

✅ Definition

A software write blocker prevents write operations by making changes at the operating system
level. It blocks or restricts write commands so that evidence remains read-only during forensic
analysis.

✅ Methods of Software Write Blocking

1. Registry Modification (Windows)

o Example: changing registry settings to prevent writes to attached USB devices.
2. Bootable Forensic Operating Systems
o PALADIN (Linux-based live OS)
o WinFE (Windows Forensic Environment)
o By default, they do not auto-mount storage devices, ensuring no accidental writes.

✅ Mounting Options

 Read-only Mode (Recommended)

o No changes made to the device.
o Suitable for forensic imaging and evidence preservation.
 Read/Write Mode
o Only used when intentional modifications are required (rare in forensic practice).

✅ Example (PALADIN Toolbox)

 Displays all drives in the system.

 Mode column indicates status:
o Green (Read-only) → Safe for forensic acquisition.
o Red (Read/Write) → Not recommended for evidence drives.

8
✅ Advantages

 Cost-effective (no extra hardware needed).

 Flexible and works across multiple devices.
 Useful for quick triage in the field.

✅ Limitations

 Relies on OS-level settings (less secure than hardware).

 May not fully prevent writes if misconfigured.
 Some courts view hardware blockers as more reliable.

✅ Conclusion:
Software write blockers are practical and efficient for many forensic tasks, but whenever
possible, investigators prefer hardware write blockers for stronger legal defensibility.

Rules of Forensic duplication:-

----------------------------------------------------------------------------------------------------
Defining forensic imaging:

Forensic imaging is the process of creating a bit-for-bit copy of a storage device in a

forensically sound manner.

 Rule: Never analyze the original device—only the forensic copy/image.

 Captures all data: allocated files, deleted files, slack space, unallocated and unpartitioned
space.

Types:

1. Forensic Copy – Exact clone (bit-for-bit) of source to destination.

2. Forensic Image (DD, E01, AFF) – Bit-for-bit copy stored in a forensic format with
protective wrapper.
3. Logical Image – Copies only selected files/folders (cannot recover deleted/slack data).

Importance:

 Preserves evidence integrity.

 Ensures admissibility in court.
 Allows recovery of hidden/deleted data.

9
 DD image

 DD command: Oldest forensic imaging tool, originally for UNIX, now on

Linux/Windows/Mac.
 Function: Creates a bit-for-bit copy of the source to the destination.
 Output: Flat file/RAW image, saved as .dd, .img, or .001.
 Capacity: No compression; destination must be equal to or larger than source.
 dcfldd (by DCFL): Adds features like on-the-fly hashing, progress output, wiping,
verification, multiple/split outputs, and logs. ⚠️Issue: Misaligns data on faulty drives.
 dc3dd (by DoD Cybercrime Center): Patch of DD; supports hashing, error logging,
wiping, verification, progress reports, and split outputs.

Encase evidence file:-

 The EnCase Evidence File, also called E01, EX01, or Expert Witness Format (EWF), is a
bit-for-bit forensic image.

It includes additional metadata such as case information, evidence number, acquisition
date/time, investigator notes, and tool details.

Created by Andy Rosen for Guidance Software (now OpenText), the current version is
EX01.

 EX01 supports AES256 encryption, LZ compression, and MD5/SHA-1 hashing.

It uses CRC checks every 64 sectors to verify the integrity of the image.

Compared to a DD image, it provides enhanced security, compression, and validation

features for forensic investigations.

SSD device:-

 Solid-State Drives (SSDs) are increasingly used in business and consumer markets due to
lower costs.

 SSDs have firmware-driven processes that the examiner cannot intercept or stop.

 Wear leveling redistributes data across storage blocks to prevent overuse, which can move
data unpredictably.

 Garbage collection and the TRIM command automatically erase deleted data, making
recovery difficult.

10
 Hash values of SSDs may change over time, even after creating a forensic image, due to
firmware activity.

 SSDs require special consideration during imaging and explanation in court to ensure forensic
validity.

----------------------------------------------------------------------------------------------------

Imaging tools:
1. FTK Imager:-

 Forensic imaging should always be done on a copy, not the original media, especially for
SSDs.

 FTK Imager is a free tool by AccessData for creating forensic images and verifying data
integrity with hash values.

 Steps in FTK Imager:

1. Attach source device via write blocker.

2. Obtain pre-hash value of the device.
3. Select source type: Physical Drive (full copy) or Logical Drive (partition data only).
4. Choose forensic image format: Raw (dd), E01, SMART, or AFF.
5. Enter evidence item information: Case number, evidence number, device description,
and notes.
6. Select destination and set optional fragmentation, compression, and encryption.
7. Create image and verify with post-hash value to ensure no alterations occurred.

2. PALADIN:-

 PALADIN is a Linux distribution based on Ubuntu, designed for forensically sound

evidence collection.

 It is a live OS, bootable from USB or CD/DVD, which prevents changes to the source device.
11
 Steps to create a forensic image in PALADIN:

1. Open the PALADIN toolbox and select Disk Manager to view attached devices.
2. Check device access mode: green = read-only, red = read/write.
3. Perform pre-hash on the source device to record the starting hash value.
4. Select the source device carefully to avoid errors.
5. Choose forensic image format: dd, E01, SMART, DMG, VMDK, or VHD.
6. Select destination device, ensuring it is mounted as read/write and has enough space.
7. Add filename/evidence label for identification.
8. Optionally, verify after creation or create segmented/second forensic image
simultaneously.

 PALADIN uses dc3dd for imaging, ensuring a complete and validated forensic copy.

12