UNIT 2
Types of Digital Evidence
•Volatile Evidence (disappears when power is off)
•RAM contents
•Running processes & open files
•Network connections & live traffic
•Logged-in users
•Encryption keys in memory
•Non-Volatile Evidence (persists after power off)
•Hard drives / SSDs
•USB drives, SD cards, CDs/DVDs
•Emails, chat logs, databases
•Browser history, cache, cookies
•System logs & registry
•Cloud storage data
•Computers & Servers – files, logs, backups, emails
•Mobile Devices – calls, SMS, chats, GPS, apps
•Removable Media – USBs, external HDDs, SD cards, CDs/DVDs
•Network Devices – routers, firewalls, IDS/IPS logs, PCAPs
•Cloud Services – Google Drive, Dropbox, OneDrive, email servers
•IoT & Smart Devices – CCTV/DVR, smart home devices, wearables
•Social Media & Web – Facebook, Instagram, Twitter/X, web server logs
•Financial/Transaction Records – online banking, cryptocurrency wallets
•Other Digital Sources – vehicles (black box), biometric devices, etc.
• A cognizable offence is an offence in which the police have the
authority to register a case (FIR), investigate, and arrest the accused
without prior approval or warrant from a magistrate.
Do’s at a Digital Crime Scene
Best Evidence Rule digital forensics
Forensic Readiness
• It is the ability of an organization to gather, preserve, and analyze
digital evidence in a way that is technically sound, legally admissible,
and operationally efficient. This preparation enables organizations to
respond rapidly to cybersecurity incidents and ensures that the digital
evidence collected can be used for legal, regulatory, or internal
investigations.
• Swift Incident Response: It facilitates quicker response times to security incidents. By
having the right tools and processes in place beforehand, organizations can immediately
begin collecting and analyzing evidence, reducing the time needed to detect and contain
threats.
• Regulatory Compliance: Many industries must comply with strict regulations concerning
data protection (e.g., GDPR, HIPAA). Forensic readiness ensures that data collection and
handling adhere to these regulations, minimizing the risk of non-compliance and
associated penalties.
• Cost Savings: By proactively preparing for incidents, organizations can reduce the costs
associated with data breaches and investigations. Proper forensic readiness can minimize
operational disruptions, data loss, and the financial impact of legal proceedings.
• Reputation Management: A well-prepared organization is better equipped to handle
security breaches, which can protect its reputation. Swift, effective incident response
demonstrates to customers and stakeholders that the organization is capable of managing
cybersecurity risks.
• Root Cause Analysis: It allows for thorough investigations to determine the cause of
security incidents. By analyzing evidence efficiently, organizations can identify
vulnerabilities, prevent future incidents, and strengthen their overall cybersecurity
posture.
Principles for Collection of Digital Evidence
• Integrity and Authenticity: Always use forensically sound tools and
processes. Maintain hashes for verification and a strict chain of
custody to secure credibility.
• Documentation: Every step, acquisition method, and handling record
must be comprehensively documented.
Importance of Evaluation in Investigation
• Investigating Officers (I0s) should conduct a pre-investigation assessment for each
reported cybercrime/incident.
• Complainant may have inadvertently destroyed crucial digital evidence before
reporting.
• The crime may be in progress, potentially causing further damage.
• Complainant may initially withhold information due to anxiety or ignorance.
• Pre investigating assessment involves collecting necessary information from
complainant/victim.
• This helps understand the incident’s scope and potential outcomes , informing the
investigation plan
• Digital evidence is critical and volatile, requiring immediate protection and
collection.
• The assessment should consider the crime's location and circumstances.
Ethics
• Integrity – Must be honest and truthful; never alter or falsify evidence.
• Confidentiality – Sensitive case data must be protected from unauthorized
access.
• Objectivity & Impartiality – Avoid personal or professional bias.
• Respect for Privacy – Investigate only within the legal scope, without violating
rights.
• Accountability – Take responsibility for methods and conclusions.
• Professional Conduct – Follow organizational and legal codes of ethics.
• Adherence to Law – Always follow proper procedures, warrants, and legal
guidelines.
• Avoid Conflict of Interest – Do not work on cases where personal
involvement may affect neutrality.
• Proper Chain of Custody – Ensure evidence is preserved and traceable.
• Duty to Report Accurately – Present facts as they are, even if they are
unfavorable to one side.
Qualities of a Good Forensic Investigator
• Technical Expertise – Strong knowledge of digital forensics, operating systems,
networks, and tools.
• Analytical Skills – Ability to think critically, connect small details, and reconstruct
events.
• Attention to Detail – Careful observation so no evidence is overlooked or mishandled.
• Patience & Perseverance – Forensic investigations can be slow and time-consuming.
• Objectivity – Must remain neutral, without bias, focusing only on facts.
• Problem-Solving Skills – Ability to trace evidence and find hidden or deleted
data.
• Good Communication – Clearly present findings in reports and court testimony.
• Continuous Learning – Stay updated with new cyber threats, tools, and laws.
• Teamwork – Work effectively with law enforcement, legal teams, and other
investigators.
• Documentation Skills – Properly maintain chain of custody and accurate logs.
Benefits in Digital Forensics
•Crime Investigation Support – Helps law enforcement trace cybercrimes, fraud, hacking, and
digital evidence.
•Evidence in Court – Digital evidence can be presented in court to support or defend a case.
•Data Recovery – Helps recover deleted, hidden, or encrypted files for investigations.
•Corporate Security – Organizations use it to investigate insider threats, data breaches, and policy
violations.
•Incident Response – Assists in identifying how a cyberattack happened and preventing future
incidents.
•Attribution – Helps identify suspects or threat actors behind cybercrimes.
•Chain of Custody – Maintains trust in evidence through proper handling and documentation.
•Proactive Prevention – Lessons learned from investigations help improve security measures.
Challenges in Digital Forensics
• Large Volume of Data – Devices store massive data, making analysis time-consuming.
• Encryption & Passwords – Strong encryption can block access to important evidence.
• Anti-Forensic Techniques – Criminals use tools to hide, delete, or modify digital evidence.
• Rapid Technology Changes – New devices, apps, and storage methods evolve faster than
forensic tools.
• Legal Issues – Different countries have different cyber laws, making cross-border cases
complex.
• Privacy Concerns – Investigators must balance evidence collection with individual privacy
rights.
• Cloud Forensics – Data stored across distributed servers is harder to
acquire and preserve.
• Volatile Data – Some evidence (like RAM, live network traffic) disappears
if not captured immediately.
• Cost & Resources – Requires advanced tools, labs, and trained
professionals.
• Admissibility in Court – Evidence must follow strict legal standards (Best
Evidence Rule, Chain of Custody) or it may be rejected.
Deleted Data Recovery:
• Deleted data recovery is the process of retrieving files, documents, or
information that a user has deleted from a digital device (computer,
mobile, USB, etc.).
• In most cases, when a file is “deleted,” it is not permanently removed
immediately — only its reference (pointer) in the file system is
deleted. The actual data remains on disk until overwritten.
Techniques Used
• File System Analysis – Checking file tables (like FAT, NTFS, EXT) to restore deleted entries.
• Unallocated Space Analysis – Searching disk areas marked as free but still containing data.
• Carving – Extracting files by identifying patterns (e.g., headers/footers of images,
documents).
• Memory Dump Analysis – Recovering temporary or deleted data from system RAM.
• Specialized Tools – Tools like EnCase, FTK, Autopsy, Sleuth Kit, R-Studio, etc.
Search, Seizure, Collection, and Preservation
IT ACT 2000 – ITAA 2008