Fundamentals
The process of collecting, examining and preserving evidence related to a digital crime so it is admissible in court.
What is Computer Forensics?
Temporary data needing constant power, lost when power is cut — system time, logged-on users, open files, network & process info, clipboard.
What is Volatile Data?
Actions against societal norms; law enforcement collects evidence under a warrant; a high standard of proof; harsh penalties.
What is Criminal Investigation?
The legal document showing the progression of evidence from its original location to the lab — who collected, handled, stored and analyzed it, and when.
What is Chain of Custody?
High-performance, self-repairing; file-level security, compression, auditing, encryption; uses the Master File Table (MFT).
What is NTFS?
Any illegal act that involves a computer, its systems, or its applications.
What is Cyber Crime?
Permanent data on secondary storage — hidden files, slack space, swap file, unallocated clusters, registry, event logs.
What is Non-volatile Data?
Disputes between two parties (e.g., contracts, lawsuits); a guilty verdict usually results in monetary damages.
What is Civil Investigations?
A written order issued by a judge directing an officer to search for a particular piece of evidence at a particular location.
What is a search warrant?
Concentric rings on a platter
What are Tracks?
An internal attack — a primary threat — by a disgruntled individual within the same firm or household (espionage, IP theft, record manipulation, Trojans).
What is an insider threat (Attack)?
Prevents alteration of evidence; a duplicate suffices only if the original is destroyed by fire/flood, lost in normal business, or held by a third party.
What is Best Evidence Rule?
Internal org investigation of policy violations: non-criminal misconduct such as resource misuse, harassment, or bribery.
What is Administrative Investigation?
1. Set up the forensics lab, toolkit and workstation; assemble the team; get authorization; plan and secure the scene.
2. The main phase — acquire, preserve, examine and analyze data to identify the source of the crime and the culprit.
3. Reporting and documentation — clear, legally sound, and admissible in court.
What are Three Investigation Phases: Pre-investigation, Investigation, Post-investigation?
Smallest physical storage unit, traditionally 512 bytes (newer drives use 4 KB).
What are sectors?
Always work on duplicate copies of the original evidence, and authenticate those copies to protect integrity. Never proceed beyond your own skill level.
What are the rules of Forensic Investigation?
Admissible · Authentic · Complete · Reliable · Believable
What is Sound evidence?
Organization’s ability to make optimal use of digital evidence quickly and at minimal cost.
What is Forensic Readiness?
Attorney - Gives legal advice about the investigation and legal issues involved.
Incident Responder - Takes first measures when an incident occurs — secures the area and collects evidence.
Decision Maker - Authorizes policies/procedures during the investigation.
Evidence Examiner - Examines acquired evidence and sorts what is useful.
Expert Witness - Offers a formal opinion as testimony in a court of law.
What is a Forensic Investigation Team?
Smallest logical/allocation unit
What are Clusters?
A methodology that treats criminal activity holistically as an ongoing operation rather than a single isolated act.
What is Enterprise Theory of Investigation (ETI)?
Anyone or anything entering a crime scene takes something of the scene away and leaves something of themselves behind.
What is Locard’s Exchange Principle?
Ensures evidence is collected, preserved, examined and transferred with quality control that safeguards accuracy and reliability
What is SWGDE (Scientific Working Group on Digital Evidence)?
Investigations/studies of compromising emanations — unintentional signals that can disclose classified information if intercepted.
What is TEMPEST?
Disk striping — best performance, no redundancy (min 2 drives).
Mirroring — duplicates data across two drives (min 2 drives).
Byte-level striping with distributed parity (min 3 drives).
1+0 — mirrored pairs then striped (min 4 drives).
What are Redundant Array of Independent Disks (RAID)?