GLOBAL GUIDELINES FOR DIGITAL FORENSICS LABORATORIES
May 2019 INTERPOL For official use only INTERPOL Global guidelines for digital forensics laboratories
These Guidelines were prepared by the Digital Forensics Laboratory at the INTERPOL Global Complex for Innovation.
Any inquiries can be directed to:
INTERPOL Global Complex for Innovation 18 Napier Road Singapore 258510
E-mail: [email protected] Tel: +6565503462
© INTERPOL Global Complex for Innovation, 2019
Page 2/78
INTERPOL Global guidelines for digital forensics laboratories
FOREWORD BY THE SECRETARY GENERAL INTERPOL GLOBAL GUIDELINES FOR DIGITAL FORENSICS LABORATORIES
In today’s complex international security environment, investigations more often require highly specialized and technical expertise.
To better address these challenges, one of the policing capabilities that INTERPOL focuses on is digital forensics, a rapidly changing discipline which requires robust policies and procedures.
An increasing number of connected devices – smartphones, watches, GPS – can store meaningful information which could potentially become pieces of digital evidence.
To meet this growing challenge, through our Innovation Centre’s Digital Forensics Lab (DFL), INTERPOL is assisting member countries build national digital forensic capacity and develop e- evidence management processes to better support investigations and prosecutions.
As a neutral, global platform for law enforcement cooperation, INTERPOL continues its work to encourage and enhance communication and best practice development among our member countries.
This was one of the driving forces behind the creation of the INTERPOL Global Guidelines for Digital Forensics Laboratories which outlines the key principles and processes which are essential for practitioners.
These guidelines are also part of our ongoing commitment to make both the physical and virtual worlds, a safer place and I would like to thank everyone who contributed towards their development.
Jürgen Stock
INTERPOL Secretary General
Page 3/78
I T L lobal guidelines for digital forensics laboratories
A LETTER FROM THE DIRECTOR OF THE INTERPOL INNOVATION CENTRE
The dynamic history of digital forensics shows its strong interconnectivity with innovation The rapidly evolving nature of digital space and technologies means that an enormous amount of digital traces and data can be produced in the blin of an eye Continuous innovation in the field of digital forensics is a necessity, if not an obligation, for law enforcement
n a global level, many pre existing crimes are developing into a significant global threat by ta ing advantage of advances in technology and the borderless nature of our interconnected world Further to this, we are witnessing unprecedented types of criminal activities suddenly appearing on the radar of law enforcement These developments are adding another layer of complexity to the challenge
gainst this bac drop, I T L created its Innovation Centre in ingapore in with a view to fostering innovation in global law enforcement The Digital Forensics Lab (DFL) within the Innovation Centre has been leading the effort to enhance digital forensics capabilities in the member countries I truly believe that the wor of digital forensics laboratories is a crucial part of policing, particularly in combating digital crimes Indeed, digital forensics specialists are obliged to constantly learn and to develop their expertise especially in the context of the emergence of mart Cities homes, connected cars, drones, mobile networ s and cloud platforms
To this end, the DFL has been organi ing Digital Forensics xpert roup eetings annually in recent years, bringing together forensics experts in law enforcement, industry and academia to share information, nowledge and best practices aintaining this global networ of experts in digital forensics has been tremendously rewarding and useful in serving our member countries more effectively uilding on the active exchanges at the xpert roup meetings, I am pleased to present the I T L lobal uidelines for Digital Forensics Laboratories
The uidelines aim to provide a universal framewor for establishing and managing a digital forensics laboratory that is applicable anywhere in the world It will also hopefully contribute to closing the gap between member countries in terms of their digital forensics practices and capacity In the hope of creating momentum for the digital forensics field to become a very solid and important area of policing, the I T L Innovation Centre will be at the forefront of instilling innovative spirit in the activities of digital forensics laboratories in the member countries with the aim of contributing to overcoming the complex global security challenges
nita a enberg
Director, I T L Innovation Centre
age
I T L lobal guidelines for digital forensics laboratories
ACKNOWLEDGMENT
any parties have been involved in constructing the I T L uidelines for Digital Forensics
First and foremost, I T L would li e to than the Council of Europe for sharing the ‘Basic Guide for the Management and Procedures of a Digital Forensics Laboratory’ document. The Council of Europe’s guide provided a strong foundation and has been used as a model for developing this document
In addition, I T L would li e to express sincere gratitude to Cyber ecurity alaysia as the partner in ma ing these guidelines a reality Cyber ecurity Malaysia’s expertise and experience in an accredited digital forensics laboratory has been invaluable in completing this document
Finally we want to than our colleagues from I Cybercrime Department, Digital Forensics nit – IT Forensi , Federal Criminal olice ( ) IT Digital Forensic Department eneral Department of Criminal vidence of uwait, I Technology Crime Forensics ranch Criminal Investigation Department ingapore olice Force ( F) I Computer Forensic ection, eneral Commissary of cientific olice (C C) of panish ational olice (C ) T IT D T T F IC Department of omeland ecurity, omeland ecurity Investigations whose valuable input has helped to improve the quality of this document and ma e it a common effort to serve as a global reference for Law nforcement gencies worldwide
age
E P L Global guidelines for digital forensics laboratories
Title of Document: E P L Global guidelines for digital forensics laboratories Date of publication: May Original: English Available in: English
CONTENTS Page
1. INTRODUCTION ...... 11 1.1 Document purpose ...... 11 1.2 Intended audience ...... 11 1.3 Applying the document ...... 11 2. INTRODUCTION TO DIGITAL FORENSICS ...... 12 2.1 Digital forensics ...... 12 2.2 Understanding electronic evidence ...... 13 2.3 Principle of electronic evidence ...... 13 3. MANAGEMENT OF A DIGITAL FORENSICS LABORATORY ...... 14 3.1 Conducting a plan ...... 14 3.2 Premises ...... 15 3.2.1 Location ...... 15 3.2.2 Physical Security ...... 16 3.2.3 Size and Layout ...... 17 3.2.4 Facility ...... 19 3.2.5 Visitors ...... 20 3.3 Staff ...... 20 3.3.1 Recruitment ...... 21 3.3.2 Security Clearance ...... 21 3.3.3 Job Description ...... 21 3.3.4 Staff Development ...... 23 3.3.5 Mentoring ...... 24
Page
E P L Global guidelines for digital forensics laboratories
3.3.6 Health and Safety ...... 24 3.4 Equipment ...... 25 3.4.1 Software...... 25 3.4.2 Hardware ...... 26 3.4.3 Tools and accessories ...... 26 4. MANAGEMENT OF DIGITAL FORENSIC CASE ...... 27 4.1 Receiving a request ...... 27 4.2 Registering a case ...... 27 4.3 Registering an exhibit ...... 28 4.4 Photographing an exhibit ...... 28 4.5 Conducting analysis ...... 29 4.6 Returning the exhibit ...... 29 4.7 Closing the case ...... 29 5. LABORATORY ANALYSIS PROCEDURE ...... 29 5.1 Acquisition ...... 30 5.1.1 Overview ...... 30 5.1.2 Computer ...... 31 5.1.2.1 Types of Data Acquisition ...... 31 5.1.2.2 Write Blocker ...... 33 5.1.2.3 Imaging Tools ...... 33 5.1.2.4 Imaging Format ...... 33 5.1.2.5 Process Flow ...... 34 5.1.3 Mobile Devices ...... 34 5.1.3.1 Types of Data Extraction ...... 34 5.1.3.2 Extraction Tool ...... 36 5.1.3.3 Extraction File Format ...... 36 5.1.3.4 Process Flow ...... 37 5.2 Examination ...... 39 5.2.1 General ...... 39 5.2.2 Triage ...... 39 5.2.3 Methods for Computer Examination ...... 40 5.2.3.1 Examination on “Dead System” ...... 40 5.2.3.2 Examination on “Live System” ...... 41 5.2.3.3 Automated Processing ...... 41 5.2.3.4 Data Recovery ...... 42 5.2.3.5 Filtering ...... 42 5.2.4 Methods for Mobile Device Examination ...... 42 5.2.4.1 Automated Processing ...... 42 5.2.4.2 Filtering ...... 43
Page
E P L Global guidelines for digital forensics laboratories
5.3 Analysis ...... 43 5.3.1 Analysing Computer ...... 43 ate o ies o di ita t a es o ed es o di e ent t a es i t a i ation o ess o and in mass data is a i ation aids 5.3.2 Analysing Mobile Devices ...... 49 ate o ies o di ita t a es o ed es o di e ent t a es 5.4 Presentation ...... 52 5.4.1 Admissibility of Electronic Evidence ...... 52 5.4.2 Report Writing ...... 53 5.4.3 Expert Witness ...... 53 6. QUALITY ASSURANCE ...... 54 6.1 Quality assurance component ...... 54 6.2 DFL Accreditation ...... 56 7. SUMMARY ...... 57 APPENDIX A: DFL SKILLSET CHECKLIST ...... 58 APPENDIX B: CHECKLIST OF BASIC DFL EQUIPMENT ...... 60 APPENDIX ...... 61 APPENDIX D: SAMPLE OF EXHIBIT REGISTRATION FORM ...... 62 APPENDIX E: SAMPLE OF EXHIBIT SEALING ...... 63 APPENDIX F: DATA ACQUISITION WORKSHEET ...... 64 APPENDIX G: ACQUISITION PROCESS FLOW CHART ...... 68 APPENDIX H: COMPUTER EXAMINATION FLOW CHART ...... 69 APPENDIX I: PROCESS OF ANALYSING EXHIBIT’S ARTEFACTS ...... 70 APPENDIX J: COMMON REQUIREMENTS FOR FORENSIC REPORT ...... 71 APPENDIX K: ELECTRONIC EVIDENCE HANDLING ...... 72 APPENDIX L: INTERPOL DFL SERVICE REQUEST FORM ...... 73
List of Figures
Figure 1. Basic Floor Plan for DFL etup 18 Figure 2. Moderate i e Floor Plan for DFL etup 18 Figure 3. rgani ation Chart for Basic etup of Digital Forensic Laboratory 21 Figure 4. Case Management Procedure 27 Figure 5. Digital Forensics Laboratory nalysis Model 30 Figure 6. Data c uisition Process on Computer 34 Figure 7. Data Extraction Process on Mobile Devices 37
Page
E P L Global guidelines for digital forensics laboratories
L T
T Consideration for electing DFL Location T Chec list for Physical ecurity T Common Facility in a DFL T Chec list for isitors T Description of oles and esponsibilities T Method for conducting ac uisition Dead c uisition and Live c uisition T Method to solate et or T Mobile Device torage Media T Discoverable and undiscoverable traces from a computer T Method for isual ids T General Criteria for the dmissibility of Electronic Evidence T uality ssurance Components Chec list T Benefits of Lab ccreditation
Page
E P L Global guidelines for digital forensics laboratories
DEFINITIONS AND ABBRE IATIONS
AFF dvanced Forensic Format DCO Device Configuration verlay DF Digital Forensic DFL Digital Forensics Laboratory E F Expert itness Format HPA ost Protected rea IDEN ntegrated Digital Enhanced et or I EI nternational Mobile E uipment dentity umber EID Mobile E uipment dentity umber PDP Personal Development Portfolio PDP RA andom ccess Memory SI ubscriber dentity Module S GDE cientific or ing Group on Electronic evidence
REFERENCES
. Basic Guide for the Management and Procedures of a Digital Forensics Laboratory Council of Europe C E ersion . une
. cientific or ing Group on Digital Evidence GDE https .s gde.org
. CP Good Practice Guide for Digital Evidence ssociation of Chief Police fficers version https .digital detective.net digital forensics documents CP Good Practice Guide for Digital Evidence v .pdf
Page
E P L Global guidelines for digital forensics laboratories
INTROD CTION
D
E P L Guidelines for Digital Forensics Laboratories outline the procedures for establishing and managing a Digital Forensics Laboratory DFL and provide technical guidelines for managing and processing electronic evidence.
hese Guidelines should be seen as a template document that can be used by countries hen considering developing their digital forensics capability. he advice given is intended to be used at both the strategic and tactical levels in accordance ith national legislation practice and procedures.
I
he document is intended for use by E P L member countries. he ob ective of these Guidelines is to ensure that electronic evidence produced by the DFL is admissible in member countries’ courts of la as ell as in the international criminal ustice systems.
he Guidelines focus mainly on t o distinct groups the first is the digital forensics strategists and managers ho ma e decisions for the DFL the second group includes the technical staff ho deal ith electronic evidence on a day to day basis.
n addition prosecutors udges and la yers ill also benefit from this document in understanding the digital forensics process hich may be vital for their cases.
A
he Guidelines are not intended to impose limits on the DFLs hich have to follo the re uirements of their national legal frame or . he advice given in these Guidelines is not intended to contradict ith any national legislation in any member country.
Page
o ui e ines or i it orensics or tories
INTROD CTION TO DIGITAL FORENSICS
D
i it orensics is r nc o orensic science t t ocuses on i enti in c uirin rocessin n sin n re ortin on t store on co uter i it e ices or ot er i it stor e e i
e co uter i it e ice or ot er i it stor e s ste ic o s u e t or in esti tion is no n s e ectronic e i ence uc e es re to s s rt ones ser ers i it i eo recor ers s ste s rones s ste s n e conso es
e in o o i it orensics is to e tr ct t ro t e e ectronic e i ence rocess t e t into use u in or tion n resent t e in in s or rosecution rocesses in o e t ere ore s ou uti i e soun orensic tec ni ues to ensure t t t e in in s re issi e in court
e n ture o t e c ses in ic i it e i ence is in o e is ener or er ess n t e o ence ens in s it secon t e in in s eri e ro e ectronic e i ence ust t ere ore o o st n r set o ui e ines to ensure t t it is issi e not on in a specific country’s court o ut so in t e intern tion cri in ustice s ste e ui e ines or i it orensics ro i e se ine n re erence or t e n e ent o i it orensics
e
o a ui e ines for i ita forensics a oratories
ectronic e i ence un i e any ot er e i ence suc as fi re air an uns ot resi ue is c a en in to process ue to t e fact t at a e ata can e scattere in se era p ysica ocations so eti es across countries e ata can e transferre across uris ictiona or ers effort ess y an in a atter of secon s c e ata are i y o ati e – easi y a tere o er ritten a a e or estroye y t e sin e stro e of a ey e ata can e copie it out e ra ation e e ifespan of e ectronic e i ence un i e any ot er iscip ine of forensic e i ence is s ort efore it is ren ere use ess n e a p e of t is is a s artp one after fi e years it ay not e a e to s itc on or function proper y
ase on t ese facts t erefore e ectronic e i ence ust e processe an an e it ue care
P
en ea in it e ectronic e i ence t e fo o in princip es ust e a ere to
a ectronic e i ence ust e o taine in a e a anner
e taff in o e ust co p ete t e appropriate trainin pro ra e prior to an in e ectronic e i ence
c ny actions ta en on t e e ectronic e i ence ust not c an e its ata f it is necessary to access t e ori ina ata or c an e t e syste settin it is reco en e t at on y co petent staff e a e to o so an t at staff ust e a e to ustify t ose actions
ny action t at re uires t e ori ina ata to e accesse or c an e s ou e recor e an itnesse y a fe o practitioner if possi e
e recor of a actions ta en en an in e ectronic e i ence ust e create an preser e so t at t ey can e au ite n in epen ent t ir party s ou e a e to repeat t ose actions an ac ie e t e sa e resu ts
a e
ANAGE ENT OF A DIGITAL FORENSICS LABORATORY
–
C
DFL within its country’s criminal justice system.
. These are the “ ” costs
T L lo al ui elines or i ital orensics la oratories
ees sta salaries sta trainin orensic e ui ment maintenance an the re lacement o o ice e ui ment.
nce this initial research has een con ucte ecision ma ers shoul ha e a etter i ea a out the role an the si e o the DFL as well as the num er o sta re uire to ro i e an e ecti e resource or all sta ehol ers. P hen selectin the remises to uil the DFL se eral actors nee to e consi ere to ensure its success. The ollowin sections e lain in etail the ossi le success actors when choosin an e elo in a DFL. L e eral actors nee to e consi ere when selectin the location o the DFL. ome concerns that nee to e a resse are
C S DFL L s there su icient electrical ower to run the re uire e ui ment oes a itional e ui ment nee to su lement the ower acilities installe ac u enerators the la is a o e the roun loor is there a li t a aila le to trans ort lar e uantities o electronic e i ence
s the uil in or o ice ro ust enou h to ensure the security o the ata an rotect the eo le within re the walls loors an ceilin s stron enou h to withstan hysical or en ironmental ama e hat is the ris rom loo ire natural isasters an ci il unrest s ue care ein ta en to minimi e the ris s o incursion y a terrorist or criminal or ani ation see in to ama e in esti ations s the uil in suita le to ro i e the coolin re uire or the amount o e ui ment to e house within the uil in or can coolin acilities e retro itte T onsi erations or electin DFL Location
a e
T L lo al ui elines or i ital orensics la oratories
P S The DFL nee s not only to secure electronic e i ence ut also to ensure the security o the sta alua le so tware an har ware. The chec list or hysical security is as ollows
C P S S The sur eillance system is use to monitor the remises or unauthori e access an rea ins. nstallation ro essionals shoul consi er the est strate ic lace as well as the est resolution to ensure ma imum security. A
ccess control can e in the orm o hysical loc s an eys electronic ey a s swi e car s an or iometrics e en in on the u et. F DFL must ha e a ire etection system an ire su ression system installe on the remises. The material use or the ire su ression system must not cause ama e to the e hi its e ui ment or ersonnel. hen re uire win ows shoul e rein orce with ars an loc s to re ent rea ins. the DFL has lass win ows an walls care shoul e ta en that sensiti e ata are rotecte rom iew. onsi er usin a ire roo oor in a location such as a stairwell or corri ors to rotect the remises rom ire. S u icient ower soc ets uses an rea ers must e installe in the DFL to ensure smooth o eration an re ent ower o erloa s lea in to ire ha ar s an osin ris s to the sa ety o the sta . A nti static loorin hel s to re uce ossi le electrostatic ischar e D that may cause harm to em loyees e ui ment an e i ence.
R t is recommen e that the DFL install a system to loc networ si nals or e am le usin a Fara ay ca e or a jammin e ice. a io jammin system will loc any networ si nals an re ent any intrusion into the e hi it. ith current wireless technolo y the ossi ility e ists or owere on smart hones or la to s to automatically attem t to connect to e istin wireless networ s hence mo i yin their ata. ational le islation must e chec e to eri y that the use o such systems is allowe an they o not inter ere with other systems. C S
t is common or a DFL to ha e com uters to con uct wor eneratin a consi era le amount o heat within the la . erheatin can lea to loss o ata an ama e to har ware. The DFL shoul install a coolin system to control its room tem erature inclu in the e i ence stora e room an ser er room.
a e
T L lo al ui elines or i ital orensics la oratories
O D S B
lar e amount o ata is store y the DFL once it is ully o erational an it can e sensiti e in nature. The ata are usually store in a ser er. t is est ractice or the ata to e ac e u to an o site ser er away rom the DFL. n the e ent o a isaster where the DFL is a ecte the o site stora e can e use to ain access to im ortant ata. a in an o site ata stora e ac u is art o a isaster reco ery lan which ensures o erations can e u an runnin in minimal time. A D S L T D S ter analysis ata shoul e store such that they can e retrie e at a later ate or the ur ose o urther ju icial rocess or in li ht o new e i ence or in in s ertainin to the case. tora e time shoul e a a te to national le al re uirements.
T hec list or hysical ecurity
S L t a minimum a DFL must consist o es to ta les or aminers to con uct analysis a lar e ta le or e i ence re istration la ellin ima in an sealin a ire roo ca inet or electronic e i ence stora e an a ilin ca inet. This minimum setu is su icient or a small scale DFL where small uantities o electronic e i ence are su mitte .
owe er or an a ency that eals with a lar e num er o electronic e i ence this minimum setu may e insu icient. t is recommen e that the DFL se re ate the s eci ic ty es o acti ities to re ent cross contamination an loss o e hi its.
For e am le there must e an area or recei in e i ence. This can e one in the rece tion where an aminer will iscuss case re uests an the e uester an Technician will re ister the su mitte e i ence.
The la oratory mo ile hone la or com uter la or e am le must e restricte to the DFL sta only. ach aminer will re uire a lar e es or T e ui ment ilin ca inets to hol their case iles an com orta le chairs. n a ition er onomic ey oar s an a e mats can also ro i e more com ort or e aminers.
the DFL re uires a ser er – this may e store securely within the la oratory an i ossi le in a se arate room.
t is recommen e to ha e a esi nate area or ima in an rocessin . t shoul e se arate rom the Examiner’s wor stations an shoul i eally e close to the e i ence stora e room to re uce the amount o manual han lin .
The DFL may also consi er ha in a s ace to con uct rie in s or meetin s as well as an a itional o ice or the la oratory mana er.
n a ition to the a o e areas e icate to the stora e o non e i ential e ui ment such as me ia co iers me ia ro uction e ui ment rinters scanners iles ro erty a s ta s e i ence la els stora e me ia o ice e ui ment an ersonal elon in s o sta shoul e consi ere when selectin the most a ro riate lace to locate a i ital orensics la oratory.
a e
E a i e ines r i i a rensi s a ra ries
e i in r i e s e ar e en ex an i ere is an an i i a e in rease in eman r r an exis in s a e n i ne essar re a e r ex an in a s r ime e ex nen ia in reases in r a is nsi era m re ex ensi e re a e r ex an s i ma e ene i ia r i e r m r ex ansi n in e ini ia siness an e in is a s es i n r a asi r an r a
F asi r an r e an a en e i es e e a m era e si e e in is a s es i n r e r an
F r an r a m era e si e se
a e
E a i e ines r i i a rensi s a ra ries
F n e e remises a e een se e e an se ri ea res a e een ins a e e a ra r ana er nee s in e a i i ies e ins a e i in e
mm n a i i ies ins a e in a are as s
C F DFL R e area r e i erin an e in e e r ni e i en e is es se ara e is area r m e a s i an a ess r is is re en na ri e a ess e a s E e r m is e i a e s rin e e r ni e i en e n s me s is r m is a s se s re e ser er ess e r m m s e res ri e er ain s a n erna i e i ere are n a e ex i i s en a s e e i e s i n is a e a sa e x r ire r a ine s re a e e e r ni e i en e ins ea a in a e i a e s ra e r m E esi na e area issem e assem e a e an ima e e e e r ni e i en e This area should be separated from the Examiner’s workstations and should e se e e i en e s ra e r m re e e am n man a an in L e en in n e es ases re ei e a an a e se era a s se re a e r ase n es e i en e Exam es in e a m er rensi s a i e ne a i r i e a P n s me s s a s a e eir n es n a minis ra i e as s ri e re r s an rea e resen a i n s i es a s are se s e r ana sis r ereas is ers na s a e is se e s a r er ne essar r r s B rie in s a e is ere Examiners an is ss a ase an ere e mana er ire r an a rie in sessi n a a ase e r m an e ei er an en r se s a e is e i e r m i a is a s reen an a i e ar a i i a e is ssi n r resen a i ns I I a ra ries in e mm n a e eir n is a e ne r r m e organization’s network. This is to prevent malware and viruses from enterin e res e ne r
r erm re e m s a e n imi e an n i ere n erne a ess me ases re ire Examiners a ess r e e si es s e nee a e n erne a ess i a s r is is ne r s e r i e i se ri an a minim m a asi in r si n e e i n an in s s em i s e m ni re an main aine eri i a T mm n a i i ies in a
a e
TE lobal guidelines for digital forensi s laboratories
isitor a ess to the must be restri ted to prevent data leakage or an possible damage to the ele troni eviden e. isitors an in lude maintenan e workers staff from other agen ies onsultants or people delivering the ele troni eviden e.
The following table gives the basi he klist when re eiving visitors.
C R isitors must be registered using a form or via an online s stem before entering the premises. or a large group of visitors the a ompan ing staff must organize appropriate registration pro esses noting the agen size of the group and purpose of the visit. ID P temporar pass ma be issued to the visitor espe iall for long visits. The pass must learl distinguish the visitor from the staff.
E isitors must be a ompanied b staff at all times when on the premises. P lear signs or a poster on isitor oli must be displa ed in the ommon area for visitors to read. ules su h as photographing eating and drinking tou hing forensi e uipment and ele troni eviden e et . must be learl stated to visitors. nstru tions must be simple and eas to read for non English speakers. C lear signs should indi ate that potentiall illegal and inappropriate images are being anal sed and viewed within the . T he klist for isitor
S epending on the size of the laborator and the number of staff re uired the different fun tions that are re uired must be onsidered. taff roles and responsibilities will need to be do umented. etailed ob des riptions should be prepared so that ea h member of the team has a lear
age
TE lobal guidelines for digital forensi s laboratories
understanding of his her ob profile. here possible the stru ture of a should allow for staff areer advan ement within the organization.
Experien e shows that highl ualified staff spend mu h of their time undertaking mundane tasks below their level of expertise. ob profile and a learl set out areer path at the earl stage of the development will provide dire tion for the organization’s planning and budget fore asting.
R taff emplo ed b the organization for work often depends on the t pe of ases and the total amount of ele troni eviden e submitted to the . These staff ma ome from an edu ational ba kground but must have strong fundamentals and a high interest in the omputing field and urrent advan es in te hnolog .
t pi all onsists at a minimum of a ab anager and two Examiners. The Examiner works at the anal sing the ele troni eviden e and sometimes ma be re uired to go to the field site to ondu t eviden e preservation. f there is an in rease in ases and more forensi e uipment is obtained it is often best for the to emplo a Te hni ian. n dministrator ma also be emplo ed if the deals with numerous administrative tasks su h as managing various do uments training visits and talks.
suggested organization hart at minimum level is as follows
F rganization hart for basi setup of igital orensi aborator
S C efore staff are hired it is advisable for andidates to undergo a ba kground he k or se urit vetting. t a minimum the or the uman esour es epartment must ensure that a andidate has no riminal re ord and has satisfa toril passed learan e b the authorities. hile these learan es ma not alwa s be ideal the at least provide an indi ation of an serious riminal offen es in the past. t is ommon pra ti e for the uman esour es epartment or the manager to have a ess to the vetting and the candidate’s personal re ords prior to the interview pro ess or at least during the interview session. D ll staff must have a lear ob es ription on e the are emplo ed b the . Each individual’s roles and responsibilities in the must be explained in the ob es ription. t a minimum the roles and responsibilities of ea h staff member in the should be explained as follows
age
E l al uidelines di ital ensics la at ies
D R R L he a at ana e ust have technical n led e and a st n unde standin le islative e ui e ents elect nic evidence cedu es and cesses a at ana e ust unde stand the ve a chin inci les desc i ed in this uideline
e he ust have c nt l ve the i inal set u and uildin ve si ht c nce nin the u chase ha d a e and s t a e the cedu es and uncti ns
e she is es nsi le leadin the ec uit ent t ainin ent in c unselin and uidance eve d e l ed ithin the unit he a at ana e is als es nsi le decisi n a in elated t individual cases includin hethe t acce t e ect a case as ell as the i it
E he E a ine ust have the elevant technical n led e and a iate uali icati ns deall he she sh uld have s e t ainin in the use s t a e
n ein hi ed the E a ine ill e e ui ed t attend s eci ic t ainin t tain a ini u set s ills he E a ine ust have n led e le islati n and e a a e the ele ents each ence in de t a ticulate th se acts hen investi atin di e ent t es c i es hese les e ui e an anal tical and investi ative ind set he E a ine ust als e a le t delive his he indin s in a clea and unde standa le anne the e e havin d al and itten c unicati n s ills is essential
T he echnician c nducts evidence cessin such as e ist ati n ac uisiti n and st a e e endin n the si e the la at seve al technicians a e e ui ed he echnician ust have st n technical s ills in the c utin ield and technical n led e the va i us eth ds ensicall ac ui in di ital data e s ill e ui e ent is attenti n t detail and the a ilit t clea l d cu ent all acti ns c nducted n each ite evidence
he echnician is als es nsi le aintainin ensic e ui ent e she needs t ensu e that the ha d a e i a e is u dated and s t a e atches and u dates a e installed hen eleased
he echnician is als es nsi le handlin the evidence in the Evidence t a e e she needs t aintain ec ds evidence as ell as chec in and chec ut e hi its in the t a e
A a als e l an d inist at t c nduct the laboratory’s ad inist ative tas s e she is es nsi le ana e ent d cu ents t ainin and tal s e she can als act as a liais n ice inte nal as ell as e te nal sta eh lde s he d inist at can als e es nsi le handlin the u chase e ui ent the la at
T esc i ti n les and es nsi ilities
a e
lobal l s or tal or s s laborator s
S D a a t st s r t at sta ol t tas s ar a at ly a a t r t s lls
r aso or t s s t at ata o ta l tro a b as ly alt r a a or stroy by a s l stro o a y so t sta st o o to a l t ata t o t a a t ot r r aso s t at t o l ty o r to ay a a t lt to s o r t r t ata t r or t sta st o o to a tra t t
A T sta a b r r t t s orta t to o t ally lo t r ab l t s to ot at a r ta t a stabl s a a abl sta lo t ro ra a s ort t s s s o l b t a t o to t r or la ob s r t o st l arly at t r rol a r s o s b l t s a t r r ort a a r a a r st t y a la or sta tra s a a t a ro r at arra ts ay oos to s sta o tra o rs s or t a arra a s ss o or sta to s a o a l ar ro oll a s a or to a la t l or a l all a rs ll r r t r ally rt tra to ro t t t o to s t or s s tools a t r b l ty to l r r l abl o rt s st s lls t t at ay b l l t r t tra s s a a labl at A: DFL S C
B P a ts t olo y r r t sta to b r larly at t t r t o l a s lls a t o to t tra ro ra t s o l o s r a a ro y a t a ro ra as art o sta o l b r r to att s ars o t olo y at s att t al r lat t s o t o sly o t l tro a alys s att ro t o strat o s or att r tra ro ra s ro ra s orta t to s r t at a rs’ skills ar to at t t rr t t olo y a t at t y ar al ays abl to r or tas s
C P D P PDP o t ly a a sta lo t t ay o s r ss a b r o sta t a rso al lo t ort ol o s ort ol o s o l o ta a tra la tra rt at att a r or as ll as r or s o l sto s a t or la a a rs ay s s to s t tar ts or als a o tor t r r or a ro t to t
D R D A art ro t tra a ro y a t a a a t st also s t as so t or sta to rta r s ar a lo t a t t s sta s o l al at tools a a l at o s o o to t ar t a t r t r s a or t to s t
E S R s o l ta ot t at t t s tra ro ra a s sta ly al abl or ot r or a at o s to r t t r o r rat t r at al o t a o y ll b s t o sta tra a t s tal t y ar r ta s ally o t y b o or r o t r s o los sta t r a at o s o l a a oo sta r t t o ro ra la a rob st rso al lo t la s or
a
l l i li s i i l si s l i s
s ill i i s l i s s i i s ll s i i s i i i i s i s l l l s li i s l l ki i is i i
l i s i is i s ssi i i i i i is ss i s i s l i s ’s work l is i s s ll s s i i i i l i i i s ssi s l i s ill i i is s s l i i l s i s ll k s l l si is l ss ss i l i i i
H S is s si l s i l s ll s isi s isk ss ss s i i i i s i is s l i ll l s s i l s l i is i s i i k l s s is i is s si ili l l l s i s
s s s k s isi s s s s s ill l is ssi i ls i is ssi ili i i ll i s s i s i sl i i s s
l s s i i l l
● i s i s is s s – isk s i i i i s ● ss – s l l s l i s i k li ll l s s s s i l l s s l s i s s s ● li li i – s s li i s i i
o s or or s s or or s
● r s o r r sk o r s o k ● r r k rs o r r sk o r s o k or o
E
s ss o or s s r r o ro orr or s r s s r w r or so w r or o so r or o r oo s r or o s s s r o s r s o ro orr r s s
r o s or s B: C B DFL E
S k so w r r s s o s r r r s s r s
os o s s r or s k oro s s o or s s r s s s r so w r o orr s r r s
o o so r so w r o rs s r s s rs s so w r k s or r o or s
o jurisdictions and standards require ‘dual tool verification’ ss r o r s o so w r or r o o r s o r so r o
s so o s r s s or s o r o s s s w o s o s s s r’s name or s r s s r s or s s r s o ows
● rso r r o ● r r r ● s r r r ● Requester’s o s ● o r r ● s o s o w s ● rr or s r s ● ors – s s r s o r s ● s s ro ss – o r o s s ● o s s o s w s Examiner’s name ● s o ss r o s rs ● s o s s ● or o o o w s r s or o s or o s ow o r r o o o s r s s r r s o s so o or r ro r r o o s s
ER lo al uidelines for di ital forensics la oratories
H ard are must also e ro erl maintained eriodicall for ic it is recommended to ave a sc eduled lan and an equi ment list
n im ortant element for t e to consider a art from t e stora e and ac u of o erational data is t e stora e of t e electronic evidence e t ree t es of data t at t e ma need to deal it are t e ori inal evidence t e forensic co ies and t e data enerated durin t e anal sis t is essential for t e to ave a lar e o erful and s eed server due to t e volume of data and electronic evidence onsideration must e iven to o t is is to e stored arc ived and ac ed u strin ent ac u and arc ive re imen s ould e im lemented to offer resilience
list of asic equi ment is availa le at A B: C B DFL E
T ools and accessories suc as ca les scre drivers and o er extensions are just as im ortant as t e soft are and ard are in a ome or requires electronic devices to e disassem led and reassem led so t e needs to ave access to ood qualit tools and accessories e follo in is a list of ossi le items t at a ma need to erform da to da tas s o er extension eads and ada tors cre drivers ool it amera video recorder a netic ta es ommunication devices tora e ox or container for carr in equi ment orc a nif in lass Evidence sealin or evidence a s am er roof stic ers ermanent mar ers arada a
a e
ER lo al uidelines for di ital forensics la oratories
ANAGE ENT OF DIGITAL FORENSIC CASE
e must esta lis a case mana ement rocedure efore startin to receive cases enerall t ere are seven ste s in mana in a case as illustrated in t e follo in fi ure and furt er ex lained in t e su sequent sections rior to conductin a case t e must ensure t at it is follo in and com l in it relevant le islation e ana er or Examiner must ensure t at le al ermission for rocessin t e evidence exists t rou arrants or official documents e aim of conductin or is to use evidence to rove or dis rove dis uted facts ence electronic evidence must e o tained in com liance it t e le islation t t e end of t e or it must e ensured t at t e electronic evidence is admissi le and t e forensic re ort is acce ta le in court
Receive Register Photograph Return Register case Conduct analysis Close case request exhibit exhibit exhibit
F ase ana ement rocedure
R
e or starts on recei t of a formal request from a Requester is formal request can e in t e form of a letter e mail or fax e information su lied in t e formal request s ould include a descri tion of t e crime involved t e related act electronic evidence details t e case o jective and ossi l t e arrant
e la mana er or a ointed staff ill t en revie t e request and determine et er t e case is feasi le ased on t e follo in criteria a e case is it in t e sco e of di ital forensics i e t e evidence is electronic and not ot er ise suc as or fin er rints et ods and tools t at are availa le c taff is availa le to conduct t e case d e le al requirement is fulfilled
e ill t en formall res ond to t e request as to et er or not it can acce t t e case f t e decision is to acce t t e ill rovide a date for deliver of t e electronic evidence from t e Requester
R
nce t e decides t at t e case is feasi le t e Requester ill come to t e it t e electronic evidence e creates a unique runnin case num er for t at case and fills out a case re istration form sam le of t e case re istration form is availa le at endix C: S C R F
n order to effectivel examine electronic evidence Examiners need to e su lied it a clear and s ecific case request t e Requester ue to lar e amount and various t es of data in a device suc as documents videos communications ealt monitorin data locations etc it is im ossi le for an Examiner to examine t e data it out a clear and s ecific request
a e
ER lo al uidelines for di ital forensics la oratories
ased on t at information t e Examiner can lan t e met ods and tools to e used to rocess t e evidence
ot arties t e Requester and t e staff must si n t e form e or as no officiall e un e ill t en create a folder in a stora e medium to store all lo ical data related to t e case
R
en electronic evidence ex i its is received it is im ortant for t e ex i it to e sealed efore custod can e transferred to t e o eliminate an reasona le dou t a out t e inte rit of t e evidence ot t e Requester and t e Examiner must e a le to demonstrate t at no one else as ained access to t e evidence durin t e transfer rocess from one art to t e ot er is ractice is ne and costl for some a encies t e ill nevert eless rovide constant a areness and rovide a firm timeline to start ractisin t is rocedure it t e a encies
Eac iece of electronic evidence t at is su mitted must e re istered and assi ned a unique ex i it la el ic is documented it the exhibit’s details in t e re istration form sam le of t e ex i it re istration form is availa le at endix D: S E R F
is re istration includes eac exhibit’s sub items suc as sim cards and memor cards e la els must e a le to trac t e su items to t e arent item or exam le if a mo ile one is la elled as t en t e sim card ma e la elled as
t is im ortant to note t at an defects on t e ex i it must e documented in t e ex i it re istration form is is to rotect t e from an ne ative claims in t e future n forms of softco documents related to t e ex i it must e u loaded to t e case folder
o t e c ain of custod of t e ex i its as started and t e form must e filled in t e staff receivin t e ex i it ile t e ex i it is not in use it must e stored in an Evidence stora e room as ex lained in section
P
oto ra of t e ex i it is ta en for t e follo in reasons to record t e state of t e ex i it and to effectivel identif t e ex i it in t e future oto ra t e overall vie of t e ex i it as ell as t e close u vie f t e screen is active oto ra its screen dis la also e ictures s ould t en e u loaded to t e case folder t is advisa le to oto ra t e ex i it efore returnin it to t e Requester for future reference as to its condition
a e
l bal uideli es di ital e si s lab at ies
C
he a al sis ust be du ted i a da e ith the al sis del e e t e ti details h t du t the a al sis u i the ess xa i e s ust ai tai u i ati ith the e ueste a d u i ate a de iati s li itati s that a a ise du i the exa i ati e xa i e s ha e ea s led e i di ital e si s a d s the a e able t all ate the e t data he the e a e e e ti e u i ati s bet ee xa i e s a d e ueste
R
e the a al sis has bee leted the ta ts the e ueste t i u the e ide e a ti e i the is t etu the exhibit al ith the e si e t t the e ueste t sa e t a elli ti e e e etu i the exhibit the ust seal it he seal ust ha e the staff’s initial, the exhibit’s label and the date and time it as sealed exa le exhibit seali is a ailable at e dix E: S E S
C
he ess is the lete a d the a l se the ase l se the ase b th a ties ust a ee that the is lete a d the e t has bee deli e ed t the e ueste his a be d e b si i a exa le is a ailable at e dix D: S E R F he e b si i the exhibit etu se ti b th a ties a ee that the is lete
te leti the ase the a a d i l es the xa i e a ea i i u t t ide ex e t testi the e si esults the ase i e ui ed he e ueste i s the xa i e he he she is eeded i u t
LABORATORY ANALYSIS PROCED RE
his ha te e s the edu e du ti a al sis ele t i e ide e at the e all h l i al ess del is ese ted t ide a bette e ie the ai esses
he e a e t i all u hases i l ed i the a al sis ele t i e ide e i the a uisiti exa i ati a al sis a d ese tati h u h ut the ess the hai ust d the e ide e ust al a s be u dated he e e it ha es ha ds a d its i te it ust be se u ed at all ti es xa i ati a d a al sis hases a be e eated u til the satis ies the ase e uest
t is l u de st d that du ti i the e ui es these u hases h e e t all ases ill e ui e all the hases e tai ases the a uisiti hase a be s i ed t du t t ia e st ai hta a du i the exa i ati hase exa le su h a ase
a e
l bal idelines f di ital f ensi s lab at ies
is hen the e a e la e sets f data, he e nd tin a isiti n n ea h e iden e item ma be n t feasible
he f ll in fi e sh s the lab at anal sis m del
F i ital ensi s ab at nal sis del
he next se ti n in this d ment ex lains in detail ea h hase in l ed in the nal sis del
A
O isiti n , as it is bette n n, data a isiti n, is the ess f eatin a f ensi f the ele t ni e iden e exhibit s h as ha d dis , th mb d i e se e in the f m f an ima e file files he ima e file files ill then be sed f the next sta e f the ess in anal sin the e iden e he a isiti n is made in de t ese e the inte it f the ele t ni e iden e t is t d e an identi al f the data ith t han in the ntent f the ele t ni e iden e in an a
le t ni e iden e needs t be a i ed in a f ensi all s nd manne ata is t i all a i ed b lle tin latile data f m a nnin m te d in a sea h, b a i in a st a e medi m f m a sei ed m te at an the sta e d in an in esti ati n he intan ible nat e f data and inf mati n st ed in ele t ni f m ma es it eas t mani late and m e ne t alte ati n than t aditi nal f ms f e iden e t is the ef e im tant t ha e a defined and tested a isiti n ed e
n e an ima e file has been eated, b th the hash al e f the exhibit and the ima e file m st be e ded ashin is sed t e that the ima e file is exa tl the same as the ntent f the exhibit he e a e a l t f hashin al ithms sed in , s h as ha st f ensi s ft a e and ha d a e ffe the hash ene atin feat e
xaminati n and anal sis m st nl be d ne n a f ensi f the i inal e iden e, nless i mstan es e ent examine s f m d in s his is im tant in de t ese e the inte it f the e iden e he f ensi f the ele t ni e iden e m st be st ed n the st a e media, ne e nt the e iden e itself he f ensi m st be lea l labelled t
a e
l bal idelines f di ital f ensi s lab at ies
ens e it is n t mixed ith the i inal e iden e ith f ensi ies f m the ases he m st the ef e e a e s me st a e media bef e e ei in ases
his d ment ex lains the ess f nd tin examinati n and anal sis n t t es f de i e m te s bile e i es
C isiti n f m te s is as f ll s
y es o Data isition
he e a e t le els f data a isiti n h si al data a isiti n and l i al data a isiti n hile h si al data a isiti n in l des all a data, a l i al t i all nl in l des an all ated s bset f th se data
h si al data a isiti n, at h le dis le el, ies all data ntained n the dis , in l din the a titi n s heme, “There are two levels of a titi ned a ea, and n a titi ned a ea i al data a isiti n n dis le el ies nl a l i al a titi ned data a isiti n h si al a ea data a isiti n and l i al data a isiti n he xamine mm nl h ses h si al data a isiti n f a h le dis be a se it in l des deleted files and hile h si al data nall ated l ste s hen dealin ith en ti n, a isiti n in l des all h e e , a l i al data a isiti n f nl ed data is a data, a l i al efe ed t a h si al a isiti n f the en ted data n t i all nl in l des an this ases h si al a isiti n is still e mmended if the f ensi s ft a e s t the m ntin f the en ted all ated s bset f all ima ed th se data.”
eate a , the xamine fi st needs t h se the state f the exhibit f the s stem is and nnin , the xamine ma need t h se li e a isiti n
e e , if the s stem is e ed ff, the xamine ma then h se t nd t dead a isiti n he diffe en e bet een these meth ds f a isiti ns is des ibed in the f ll in table
a e
T lo al del es for d tal fore s s la orator es
D A L A hat ead a s t o s o d ted o a ve a s t o s o d ted o a l ve dead s ste . dead s ste s a s ste . l ve s ste s a s ste that s s ste that s ot r t r ed a d r where for at o a off w th o ower. e altered as data s o t o sl e ro essed. he the s ste s dead volat le data te orar stora e areas e a se of the r h ev de t ar val e s h as e or r that o ld e d s overed a l ve s ste ro esses a he or a t ve sw t h t off a a se loss of volat le a l at o d alo es o a data s h as data stored o the lo d o ter w ll o lo er e e r ted data r ro ess ava la le. etwor o e ted a d o ted f le s ste . ow The ro ess of o d t dead ata o a s ste have d ffere t levels of a s t o s stra htforward as t s volat l t . These data w ll e lost f the or all do e a to at all s s ste s sw t hed off or re ooted. fore s e e t. he ever the a er a res l ve data t s se s le to olle t fro the The hard d s st f rst e ta e ost volat le data to the least volat le. o t of the o ter efore o e t t to the e e t f The t al level of volat l t fro the oss le. ost to least volat le s as follows e or so e ases et oo o ters wa le or dev es w th soldered sol d state etwor ro esses dr ve stora e a ot e e tra ted ste ro esses dead a s t o . le ste for at o ther ethods to erfor e tra t o s h ases l e oot the s ste w th a l ve sho ld e o s dered.
he ead a s t o s o d ted ve a s t o s o d ted whe whe The s ste s s ess r t al a d ste s sw t hed off a ot e sh t dow eleted data s ore orta t olat le data are ore orta t tha tha volat le data deleted data
T ethod for o d t a s t o ead s t o a d ve s t o
The a er the eeds to hoose whether to lo e the e h t or to reate a a e. The lo e o es the data t t fro o e stora e ed to a other. The a e o the other ha d o es the data t t fro o e stora e ed to a a e f le. Th s f le a the e stored o a other ed . The latter te h e s the ore o o l sed as the a e f le a s se e tl e read ost fore s software for fore s a al s s ro ess . lo s o o l sed for s lat o r oses. efore that a e do e the a er st e s re that the e h t s wr te lo ed a ethod wh h e a les o l read a d reve ts a wr t o the e h t.
a e
T lo al del es for d tal fore s s la orator es
ite o e
wr te lo er s a dev e that e a les data to e a red fro a hard d s w tho t od f the disk’s data. The device allows a read o a d t does ot allow wr te o a ds to e e e ted o the hard d s . ost a tools have a lt wr te lo er that the a er a t l e wh le a a hard d s . h le wr te lo a also ee a h eved software tools or ha es the dows re str hardware sol t o s w ll e referred s.
ma in oo s
The a of a stora e ed a e erfor ed s fore s software or hardware. There are free as well as o er al rod ts ava la le wh h a a d the ro ess. he r has a tool the ost orta t r ter a to loo for are the s eed of o d t the a e a d the rel a l t . The a software a l de feat res s h as ● re o t o of h dde areas ● a lt le dev es s lta eo sl ● a to lt le dest at o s o rre tl ● a e es ● hash ver f at o w th o o hash al or th s ● hash ver f at o at d ffere t sta es of the a ro ess ● s ort the ost o o fore s a e for ats ● rod e r ted a d o ressed a es ● res a terr ted a s t o ro ess ● tolera e of hardware errors
The a er st alwa s e alert to the oss l t of a t fore s te h es. dde areas l e host rote ted areas s or dev e o f rat o overla wh h are o l addressa le v a s e al T o a ds a o l e dete ted so e ava la le a software sol t o s.
ma in o mat
There are several o o a e f le for ats a el raw or dd. These for ats store all data fro the or al ed a raw f le. ther for ats l de ert t ess or at a d dva ed ore s or at . The o ta feat res s h as ● o ress o of data ● r t o of data ● rror he s ● ase etadata ● ash s s ● l tt the a e h s
rther ore d ffere t fore s software sol t o s o e w th the r ow ro r etar a e for ats w th s lar feat res. he hoos a a e for at alwa s o t for o e that s s orted ost fore s software sol t o s. o e s se d ffere t fore s software a d as a res lt there s the oss l t that the a e f le a ot e o e ed f the a er hooses a e a e f le for at.
a e
T lo al ideli es o di ital o e sics la o ato ies
o ess o
The co o ocess o co d cti data ac isitio is ill st ated i the ollowi i e
Identify Image Verify Document storage media the exhibit exhibit and image file all actions
F ata c isitio ocess o o te
The ethod o co d cti data ac isitio is desc i ed i the ollowi sectio . detailed ocess low is availa le at e di G: A P F C .
A I S The a i e st e a e a co ati le sto a e edia with s icie t data si e e o e ha dove . the e hi it is la e the a i e a eed to e a e seve al sto a e edia to sto e the i a e ile.
B I E To i a e the e hi it i st co ect it to a w ite locke to e s e the e hi it is ot w ita le th s otecti its i te it . ost o e sic tools o e this eat e.
The i a e ile is the sto ed i the e a ed sto a e edia. To otect the sto a e edia a d the i a e ile se a sta da d la elli o at hashi all the evide ce ac i ed with .
The a i e eeds to ote that si a availa le w ite locki tech i e does ot eve t cha es to data o a solid state d ive o lash edia which i cl des a co t olle chi . s soo as the co t olle is attached to a owe s l it will sta t to eo a i e data o the lash chi s. Tasks like wea levelli w ite a li icatio a d a a e collectio a e ca ied o t the co t olle eve whe it is attached to a w ite locki device. t this oi t i ti e the e is o l a eso ce i te sive wa to c eate a t e o e sic co o the lash edia. This is do e solde i the chi s o the ci c it oa d a d the easse li the data i the co ect wa whe e ossi le.
C E I F te the i a e ile has ee c eated the a i e eeds to check that it is a le to si o e sic so twa e a d that the hash val es o oth the e hi it a d the i a e ile a e atched.
D D A A The last ste i e a i i a d a al si the co te is to doc e t the ocess the tools sed the hash val es date a d ti e as well as the Examiner’s initials i the case otes. sa le o case otes o wo ksheets is availa le at e di F: D A
D The ollowi ives details o data e t actio o o ile devices.
y es o Data Ext a tion
e o e sta ti the wo k the a i e st eview the case a e wo k o tai ed o the e este i o de to asce tai the t es o data e i ed o the e hi it. This ca assist the
a e
E a i e ines r i ita rensi s a rat ries
Examiner in e i in t e est extra ti n met r t e ase n attem t s e ma e t at er a ass es ass r s r atterns t e ex i it ri r t n tin t e r sin t e man a met r exam e re ires t e ne t e n e m st a extra ti n met s re ire nes t e n e t is t ere re a a s a ra ti e t tr t tain t e n e at t e time sei re
ere are i e i erent e e s ata extra ti n r m i e e i es i are es ri e r m t e e e ere m st ata an e extra te t t e e e ere t e east an e extra te e ar ess t e met se a ter t e in rmati n as een extra te r m t e e i e it t e an i r inserte t e ar an i r m st e ana se se arate
A P E si a extra ti n is t e a isiti n ra inar ata r m t e me ia st ra e t e e i e ese ra ata t en nee t e ana se an r esse at a ater sta e rensi s t are is met t i a a s t e Examiner t a ess i e an e ete ata eratin s stem i es an areas t e e i e t at are n t n rma a essi e t t e ser
B F S D FSD e i e stem m is a ri si a Extra ti n an i a Extra ti n retrie es t e e i e’s i e s stem an inter rets t e ata rin t e r essin sta e is a s t e Examiner t retrie e r exam e ata ases in e ete messa es t at ma n t e a ai a e at a i a extra ti n an ma n t e a essi e rin a si a extra ti n e er a imitati n is t at it es n t retrie e a e ete ata t e a a si a extra ti n is a e t
C L E i a extra ti n in es re ei in in rmati n r m t e m i e e i e an a in t e e i e t resent t e ata r ana sis is is ten t e e i a ent a essin t e ata n t e e i e itse is met ma es n i e ata a ai a e t t e Examiner st m i e e i e rensi s t are ers t is t e eat re
D imitati n rensi s t are is t at s metimes it es n t s rt t e m e ertain ni e m i e e i es r re ent a n e m e s n t is ase it is mm n a e ta e r t e Examiner t se t e man a met is met a esses t e e i e an re r s t e ata is a e n t e s reen it t ra s r i e r trans ri in its ata r
a e
E TAG C O R B
device’s requires the permanent removal of the device’s memory chip from the memory board. “Rooting” or “Jail Breaking”. This process involves leveraging fe of the running user (similar to the process of gaining “Root” T
Ext a tion oo
ing equipment and specialist jigs to read raw data from the device’s memory
Ext a tion i e o mat
T R lobal guidelines for digital forensics laboratories
o ess o
Identify Verify Isolate Extract Document exhibit and exhibit and exhibit from network relevant data all actions storage media extracted data
ig re ata traction rocess on obile evices
enti t e i it an torage e ia The aminer observes the e hibit at hand before proceeding to the ne t process. The exhibit’s label should be affi ed on the inside of the mobile device or printed on the bac of it. The label must include nternational obile quipment dentity umber ( a obile quipment dentifier ( or erial umber. These data uniquely identify the device and are used to submit the request for billing records or to conduct cell site analysis in the later stages of the investigation. The ma e model and can also be used to determine the level of support from the forensic software.
e t a storage media should be prepared to store the e tracted data. f a cloned card is required a clean empty card should be prepared.
B olate i it ro et ork hen conducting mobile device e traction the device needs to be switched on. To prevent any attempt to connect to a networ and subsequently ris changes to any data the e hibit needs to be isolated from a networ . n some countries some public networ s are available everywhere and evidence must be configured to connect them by default.
epending on budget isolation can be achieved through different forms such
et o to i olate net ork lone card appears in the e hibit as the original card but ar lac s the capability to connect to the mobile networ . card identifies the subscriber and ma es a connection to the networ . ome forensic tools offer the function of cloning the card. atest mobile phones could be powered without card and there is no impact on the store data within the phone et ork laboratory installed with araday shielding to prevent networ iel e roo signals. owever this is a very e pensive solution and the use of smaller araday bo es can be considered as an effective alternative. f this is not available proper containers such as araday bags or bo es can be used. irele This equipment bloc s incoming networ signals. n some a ing jurisdictions it is illegal to use this as stated in ection . . e i ent an al et o This is the cheapest easily configured method. owever it needs the aminer to access the e hibit. This poses some ris of changing the data. t is conducted by setting the mobile device to ‘Flight Mode’ and disabling the i i luetooth and any other networ connections. a le ethod to isolate networ s
age
lobal g idelines o digital o ensi s labo ato ies
tra t Rele ant ata e to so e s e i i ext a tion te hni es s h as i oot loade ext a tions and ooting o nd oid de i es it is not al a s ossible to i le ent ite blo ing to a obile de i e he e ossible ite blo ing sho ld be i le ented o exa le on e o a ds o e e it is idel a no ledged that the ite blo ing ethod is not al a s ossible o a ti al o obile de i es Fo this eason it is i e ati e that the exa ine is ll a a e o the onse en es o thei a tions hen handling obile de i es and is able to ex lain and sti these a tions
Mobile de i es a e esented ith th ee distin t edia that e i e se a ate handling te hni es as in the ollo ing table
e ia e ri tion ar e i es obile de i e o ensi tools Method to ext a t data is logi al ext a tion h si al ext a tion is not ossible o this de i e t is best that the M a d be e o ed o the exhibit d ing the F o o e e so e de i es e i e the a d to be inside the de i es hen the a e s it hed on he xa ine a od e a loned M a d to o e o e this e or ar hese an be exa ined as a o te ha d dis oth logi al and h si al ext a tion an be ond ted on these a ds as long as the o ensi tools s o t this eat e he xa ine has to the a d ext a t the data and then t it ba into the de i e be o e s it hing it on o e de i es sto e data in the e o a d and i it dete ts that the a d is not a ailable it o ld a se data loss o the obile de i e ti e and eso es allo a bit to bit lone o the e o a d sho ld be eated and that lone inse ted into the handset nternal e or his e i es obile de i e o ensi tools o e de i es a e s o ted b o ensi tools o a boot loade h si al ext a tion his an o ten be a ied o t itho t a M a d he o ensi tools ill boot the de i e in a a ti la a and ond t h si al ext a tion itho t a ing an hanges o alte ations to the se data on the de i e his ethod an otentiall e o e de i e lo odes hi h allo the xa ine to gain ll a ess to the exhibit on e it is s it hed on a le Mobile e i e to age Media
he ext a tion o ess ill a de ending on the ext a tion tool hosen Most o ensi tools ha e a g ide ex laining the o ed e that st be ollo ed o a s ess l ext a tion n so e ases exa ining and anal sing the obile de i e e i es odi i ation to the s ste iles o the o e ating s ste in o de to ext a t the data o so e extent it is ne essa to load o install a li ations to the obile de i e his o ess an a se so e data to be i e o e abl lost ho e e it a e ts onl the s ste iles ith little e idential al e no ledge o hat is alte ed b an o these o esses an be gained b holding a o iate t aining e ti i ations s h as t aining o ided b the an a t e s o obile o ensi s so t a e o a ti al ex e ien e in ol ing the testing o obile de i e ext a tion
age
lobal g idelines o digital o ensi s labo ato ies
nothe good so e o o ensi e iden e is the mobile device’s ba ile o e se s and de i es ill eate ba s on othe de i es s h as in the o te o in the lo d hese ba s an assist in b ilding a ti eline o e iden e and an also be sed to gain a ess to a ass ode lo ed de i e t is also ossible to anal se so e ba s as i the e e a h si al de i e
eri t e i it an t e tra te ata n e the data ha e been ext a ted the xa ine st e i the data against the dis la ed data on the exhibit n o ation s h as date and ti e st be oss he ed b the xa ine as so eti es it is on e ted to anothe date ti e o at d ing the ext a tion o ess
o ent ll tion he last ste in exa ining and anal sing a obile de i e is to do ent the o ess the tools sed date and ti e and the Examiner’s initials in the ase notes
a ination
eneral xa ination o o iginal e iden e sho ld be a oided he e ossible he xa ine st al a s o on the o ensi o i age ile o the e iden e this is ine itable a ess to the data st be ote ted sing a ite blo e
n e tain ases xa ine s need to se an isolated en i on ent o e set en i on ent to ond t the exa ination Fo exa le ond ting the si lation on a database s ste o ga ing so t a e o a hie e this xa ine s a se i t ali ation te hnolog and en a s late the ase in a o ing ontaine hen the exa ination is o lete the xa ine a e e t the o station to its e io s state sing a no n i age o sing a eat e o e ed b the o e ating s ste
riage iage is the o ess o io iti ing ases exhibits o data o anal sis o esses a o ding to thei ele an e to the ase ased on the es lt o t iage ases exhibits o data ill be anal sed de ending on thei io it se en e o the ost i o tant to the least i o tant t is ossible that so e a not be anal sed at all d e to i ele an e to the ase being in estigated
iage is ond ted in o de to add ess sit ations s h as
• h ge a o nt o exhibits o ass data needs to be anal sed in a sho t ti e a e • xhibits annot be sto ed an longe d e to legal iss es • t is a high io it ase and es lts need to be od ed i ediatel i e in a ase in hi h bodil ha o death is ossible
hile t iaging o e s so e ad antages the e a e also disad antages that need to be add essed t iage annot e la e a ll exa ination iage is ond ted sing a to ated o essing this is o e ed b o ensi so t a e o b nning sel itten odes to the exhibits o data he e is a is that this a to ated o essing onl exa ines s bsets o data and so e i o tant data ight be le t o t his is needs to be ex lained to the in estigato ose to o dge and based on that in o ation the a need to de ide in a o o o against the t iaging o ess o that a ti la
age
E lobal idelines or di ital orensics laboratories
case o ever tria e remains a valid method to co e ith a sit ation that co ld not be solved in an other a
here is lots o so t are on the mar et that o ers tria e nctions some are commercial and some are o en so rce ria e can be cond cted b r nnin the so t are hile the exhibit is still live or b bootin the exhibit sin orensic bootable media he Examiner then in ts e ords and lets the s stem r n be ore selectin relevant iles and storin them in removable stora e media doin this m lti le exhibits can be rocessed at the same time even overni ht or d rin ee ends
ter tria e has been cond cted and the Examiner decides that the exhibit is relevant to the investi ation the Examiner can then roceed to the next rocess described in this doc ment and se more so histicated methods to ather more data rom the com ter
et o or o ter a ination here are man methods and techni es to examine a com ter ome re ire in de th s ill hile others re ire minimal s ill s ch as cond ctin an a tomated rocess n mber o orensic so t ares can be sed b the Examiner e endin on so t are ca abilit some are able to recover ass ords correlate data bet een electronic evidence and cond ct e ord searches
he rocess lo or cond ctin an examination on a com ter is available at endix o ter a ination lo art he lo chart is ex lained in the ollo in section
Examination on “Dead System”
“dead s stem” is a s stem that is not r nnin t rned o ith no o er hen the s stem is “dead” volatile data in tem orar stora e areas s ch as memor r nnin rocesses cache or active a lication dialo es on a com ter ill no lon er be available
Examination o a “dead s stem” m st consider the ollo in data
a e
–
“ ”
A “ ”
● ● ● ● ● ●
A
et o or o ile e i e a ination
A
often necessary. A number of available tools use a form of “fuzzy processing”, that is to
nal i
nal ing o ter “ leave traces at a “digital crime scene”. and download history”
ra e t at are i o era le ra e on ig re to e n i o era le A A
lobal guidelines for digital forensics laboratories
ome of the discoverable traces ome of the undiscoverable traces
lac space humb caches nallocated space ost recently used lists entries og files A rowser histories rowser caches ost used programs orm data agefile.sys iberfil.sys olume shadow copies ownload history a le iscoverable and undiscoverable traces from a computer
ata and information that need to be e tracted from a computer depends on the type of case. or e ample in a fraud related case, data information typically e tracted from the computer is in the form of spreadsheets, e mails and office documents. n a child abuse case, the possible related data information may be pictures, videos and communication messages.
he process of analysing various inds of artefacts is illustrated at en i ro e o nal ing Exhibit’s rte a t he following sections e plain in detail the types of data that can be e tracted from a computer.
ail Analysis of e mails, which typically involve the mail clients such as utloo , hunderbird, and ail as well as webmail accounts. ifferent mail clients will produce different types of artefacts. utloo , for e ample, stores evidential data in personal folder files such as , , and A files. hunderbird stores messages in inbo files. sually, forensic software is capable of parsing these files, however they do not necessarily e tract all messages. ome forensic software cannot retrieve deleted messages from personal folder files, so the data recovery method may be needed in this case.
B i e o ent or ro e or rea eet re entation Analysis of office documents typically starts with file signature analysis and is followed by filtering the files of interest. ile signature analysis compares the file header with its e tension to ensure it is matched. f it does not match, there may be a possibility that the document header or e tension is being modified to hide the content. iltering files involves using a eyword search. ost forensic software is able to perform both tas s automatically.
nce the aminer has discovered related documents, it is good to refer to the e uester for content analysis. his is to ensure that the e tracted document is indeed related to the case being investigated. hen the e uester has confirmed the documents, the aminer can conduct further analysis on the document, document metadata, document ma er, and identify whether it has been sent or received on the computer.
i t re an i eo o conduct analysis on pictures and videos, the aminer first needs to have a clear idea from the e uester of what to loo for. f it involves searching for identical photos, then the
age
lobal guidelines for digital forensics laboratories
e uester needs to supply the aminer with the necessary photos. f it involves files with nown hashes, then the e uester may need to supply the aminer with the hashes, or the aminer can use a list of hashes from nown databases. f it involves a certain portion of a video, then the e uester needs to state its uni ue features. or e ample, to e tract all pictures from the video that has a motorcycle.
Analysis of pictures typically starts with signature analysis. e t, the aminer may sift through pictures in the gallery by using the thumbnail view.
f the case re uires searching for a set of nown pictures for e ample in a child abuse case or stolen blueprints a hash comparison can be used to accomplish this tas . ome forensic software offers a feature of similar picture detection, he aminer can use this feature by supplying the necessary picture to the software.
or video analysis, some software offers the feature of e tracting still pictures from the videos. or e ample pictures, in every second minute. hese e tracted pictures can then also be viewed in a gallery view. his allows for the much more efficient previewing of video files.
n cases where location or production details of pictures and video files are important, the aminer should consider e tracting the metadata of those files. etadata are sets of data that describe and give information about other data, for e ample coordinates where the picture was ta en, creation date and time as well as the device used to capture the picture.
ome e hibits may have thousands of photos and videos, and it is impossible for the aminer to sift through and locate one specific video or pictures files. he best way of doing this is by e tracting all pictures and then passing them to the e uester.
he simple tas of viewing the contents of the pictures videos does not re uire any digital forensic e pertise and could therefore be carried out by the e uester. hen the relevant photos videos have been identified, further analysis can be conducted by the aminer to e tract more meaningful data, such as coordinates and creation or modification data.
t t s nternet browsers are of evidential value in many cases. hey typically contain the following artefacts
● ebsite visit history ● ocal cache temporary internet files ● oo mar s favourites ● essions information ● oo ies ● aved usernames and passwords ● ntries from form fields ● nternet eyword searches
Analysing browser artefacts can be important for suggesting purpose or intent, an e ample is the eywords used in search engines which could prove intent.
opular browsers include oogle hrome, icrosoft nternet plorer dge, ozilla irefo and Apple afari. All of them store data within the user’s home directory. ith the e ception
age
s s s s
s s s s s s s s s s
s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s
s s s s s s ss s s s s s s s
E t s s s s s s s s s s s s s s s ss s s ss s s s s
s s s s s s s s s s s s s s
s ti it s s s s s s
● s s ● s s s ● s s s s s ● s ● s s ● s ● s ● s s ● ss s
s s s s s s ’s s s s s s s s s s s s s s s s s
s s s s s s s s s s s s s
i s s s s ss s s s s s s s s s s s s s s s s s s s s s s
s s s s
s s s s s s
E ti s s s s s s s s s s s s ss s s s s s s s
s ss s s ss s s ss s ss s s s s s ss s
s s s s ss s s s s s s ss s
t s s s s s s s s s s s s s s s s s s s ss s s s s
t t s s s s s
s s s s
s s s s s s s s s s s s s
s s s a company’s computers because the s s s s s
s s s s s s s s s s s ss s s s s
s s s ss s s s s
oba u e nes or ta orens cs aborator es
he poss b ty o ac u r n an ana ys n remote y store ata s epen ent on the e s at on an ur s ct on n some ur s ct ons or e amp e un er certa n c rcumstances the am ner s a o e to connect to the remote stora e us n the suspect s cre ent a s rom the computer n or er to ac u re the ata ther ur s ct ons may not accept such an ac u s t on n these cases o c a channe s can be use to re uest preser at on an access to the ata rom the pro er
t hen the computer memory has been ac u re h e the se e computer as st runn n the memory ump can be ana yse n the
n erstan n memory structures o erent operat n systems n or er to ana yse the memory ump re u res ery h h an techn ca s s so on y a ua e am ner shou o the or pec a so t are s re u re to ana yse the memory ump amp es o th s are o at ty an e a h ch are pub c y a a ab e on the nternet or ree
yp ca arte acts that can be e tracte rom memory umps nc u e
● unn n processes nc u n the r memory ● rocess n ormat on e han es ● ncrypt on eys ● pene es ● sernames pass or s ● nsa e ocuments
p cture s orth a thousan or s th s s part cu ar y true or rtua at on s n rtua at on the am ner can e the operat n system en ronment o an e h b t the same ay as the suspect has seen t n n e ence rom th n a rtua mach ne can somet mes be aster an more e press e than reassemb n traces o ata rom the ma e e n e amp e s e n counter e t am n so t are
hen mount n an ma e t shou be mounte th r te protecte or rea on y parameters th a r te cache a o n the rtua operat n system to r te o es thout a ect n the nte r ty o the ma e e
ome operat n systems re use to start n rtua en ronments h s can typ ca y be so e by rep ac n some r ers an by con ur n the system sett n s us n so t are e pen ates an pen obs the rtua operat n system starts th a pass or prompt the am ner nee s to e ther crac the pass or or remo e t
ome cases n o e ots o computers th masses o ata o e ecute the orens c tas a strate y nee s to be mp emente n or er to e pe te the or ne ay to o th s s to separate the orens c ana ys s tas rom the content ana ys s tas he am ners concentrate on the orens c ana ys s tas s such as reco er n pars n mount n an process n o e h b ts h e the n est ators th case spec c no e e o the content ana ys s
a e
oba u e nes or ta orens cs aborator es
he proper processes or han n an e n e tracte es may nee to be e e ope an mp emente bet een the am ners an the n est ators to ensure smooth operat on
nother metho or process n mass ata s by con uct n tr a e r a e s e p a ne n sect on n th s ocument
o a the un erstan n o comp e ata an o s sua at on a s can be use u ome e amp es o such a s are
th s is i s i i s hese can be use to sp ay user beha our hen the suspect o e n hen he connecte to a certa n me um hen he connecte to a certa n re ess router an hen he e e a part cu ar ebs te ti shi hese can e ans ers to uest ons such as ho has met th i s hom at h ch po nt n t me us n h ch me um hat n ormat on as sent rece e ho no s hom ho s the ma n suspect that coor nate others hese can he p to un erstan at h ch po nt n t me an amount o i s money has been sent o er h ch channe an by h ch n ua s
i ti m ar to a re at onsh p a ram but these o not necessar y i s n o e persons hey cou sho ho o ten certa n a resses attac certa n ser ers rom erent countr es b etho or sua s
raph ca representat ons ma e t eas er to un erstan the corre at on bet een the ata hey can a so enab e the n est ator to n ne re at onsh ps not pre ous y note yp ca y the bas s or such a rams s ra ata store n a structure ay or e amp e n or ormat hese es are oa e nto ana yt ca so t are
n nu or e amp e s mp e comman s e a sort an un use n con unct on th raph or ot can he p to ra raph ca representat ons
si bi i s ob e e ces conta n recor s an o s o commun cat ons a on th t mes an ates o part cu ar commun cat ons n a t on to th s mob e e ces may a so conta n me a es an ocat ons
ta traces oun on mob e e ces can be sp t nto three st nct e roups commun cat on ata me a es an other ata ommun cat on ata can nc u e ca recor s messa es an other messa n ser ce messa es e a es as th computers can conta n n ormat on beyon hat s ep cte by the e eta ata on me a es capture n a mob e phone or e amp e are e y to conta n eo ta s or other use u ocat on an ent cat on ata embe e th n the e tse
a e
oba u e nes or ta orens cs aborator es
he o o n sect ons e p a n the types o ata that can be e tracte rom a mob e e ce
hist he ca h story pro es ns ht nto the ca act ty o the o ner be ore the ac u s t on o the martphone e ce he n est ator can see ncom n out o n an m sse ca s nc u n the t me an urat on h s can he p the orens cs n est ator to ra an n rect conc us on about the suspecte act t es there ore ass st the n spee n up the ana ys s process by pro n a conc se an c ear case re uest
t t ist he contact st not on y pro es contact names but potent a y a so the home number mob e number an or number ther types o n ormat on such as contact t t e company a ress an assoc ate e ma s can a so be e tracte rom the contact st ome smartphone e ces store a p cture o the contact n the contact st h ch can ass st n ent y n a certa n n ua he n ormat on store n the contact st pro es the n est ator th the soc a an or re at ons o the o ner o the martphone e ce es es th s many peop e store erent types o account n ormat on an the pass or s n the contact st
xt ss s E i s n e the ca h story an contact st h ch pro e n rect n ormat on te t messa es an e ma s e e p c t n ormat on that can be use as e ence n court h s s because they conta n the e act te t nten e sent an rece e by the user o the e ce
i i i t s i s i e a es such as p ctures eos an au o es can be use as potent a ta e ence n court any smartphone e ces such as hones embe coor nates o the ocat on nto the meta ata ca e chan eab e e ormat o the p ctures ther n ormat on embe e n the ata can nc u e the bran o smartphone ate an t me n h ch p ctures ere ta en as e as the so t are that s use to mo y the p cture any h s pro es the n est ator th more ns ht nto the act t es o the o ner o the smartphone
E t t b si hist s h he nternet bro s n h story an ey or searches ma e n the smartphone e ce pro e the n est ator th a enera un erstan n o the nternet act t es o the o ner he n est ator sco er the types o ebs tes that the o ner has s te an to some e tent the user’s a our te s tes
h t s ss i s here are se era a a ab e chat app cat ons an messa n apps amp e nc u e hatsapp e e ram ype ne eebo e hat n o s e essen er oo e a an ac erry essen er sers o these app cat ons usua y choose to sa e the chat o s he chat o s can be use as ta e ence n court as to hat the o ner commun cate to others ome chat o s are bac e up n the c ou or oca stora e such as a computer so ana ys n the computer may be use u to a n more ata
essa n apps can a so o er o o ce o er ser ce h s enab es the o ner o the smartphone to commun cate th many peop e us n the protoco thout ea n a recor n the ca h story o the e ce he suspect may use th s so t are to commun cate
a e
u e es r t re s s r t r es
th r r t r e e h use ses the r u te th the h us these ess s
i t ts et r u ts su h s st r e tter u r st re user re e t s the e e tse st r the re e t s users t h e t e h t e the t t s t these s tes hese re e t s re u e t the er s the can be used to gain access to suspect’s social media account e t t e e tr te r the e e
t t s st re s e u ts t t sts ess es et ee u s r u s tures e s user t t – the st s e ess he er ee s t e su e th e r se re uest r er t e tr t the rre t t rese t s s resu ts ete se re s s re rts
t s he e r es ture the re us urre t uture e t t es the er the s rt h e he e r e use t ss te the er the s rt h e th s e t s t es r er t r ss e t esses he er the rt h e s h e s e tes th t h e u e r t th t e rese te s e e e urt
ti s bi t i i t th hese e the est t r er e the et r t t es th t ere er r e by the owner’s s rt h e e e he e et r e ture h h u tr r re the er h s r e e ture h h re et r the s rt h e h s e te t uet th e t s e the est t r r t ut the es the e es th t ere e te th the er the s rt h e
s ti s i ti s h it s h s r e the nvestigator with a geographical view of the owner’s movements h h e use s te t e e e urt GPS coordinates of the user’s movements can also e ture se su h s the se here t s th t r e re t s re use hese u e e s s s e s
t t ssi t st s rt h es er the e ture re t e t u e ts u e t r ess s t re su h s r heet t te t e e e re te t the se
e
P Global guidelines for digital forensics laboratories
s t ti
he Presentation phase re uires putting together findings in a presentable and understandable way for sta eholders hen the analysis phase is completed the aminer needs to put the findings and results in a forensic report he aminer should illustrate and translate complicated technical conte ts into facts that udges prosecutors and other parties involved can easily understand hey may also be e pected to interpret those facts and to e press an opinion on their meaning n some cases when a large number of e hibits are analysed it will be difficult for the e aminer to present the outcome to the investigation team t is recommended to adopt an analytic software to facilitate matching digital evidence with other data from the investigations his ind of tools can also be used to inde and search all the e hibits providing the investigation team with a global overview of the case
issibi it E t i E i he criteria for the admissibility of electronic evidence may differ from urisdiction to urisdiction Generally the aminer should consider the following criteria when evaluating electronic evidence for trial
it i th issibi it E t i E i th ti it he evidence must establish facts in a way that cannot be disputed and be representative of its original state t ss he analysis of or any opinion based on the evidence must tell the whole story and not be tailored to match a more favourable or desired perspective i bi it here must be nothing about the way in which the evidence was collected and subse uently handled that may cast doubt on its authenticity or veracity i i he evidence must be persuasive as to the facts it represents and must be able to convince the sta eholder of the truth in court ti it he methods used to gather the evidence must be fair and proportionate to the interests of ustice the pre udice i e the level of intrusion or coercion caused to the rights of any party should not outweigh the probative value of the evidence i e its value as proof b General riteria for the dmissibility of lectronic vidence
Page
P Global guidelines for digital forensics laboratories
t iti forensic report must be written in clear and understandable language he result must be properly summari ed and it must also provide a concise answer to the case re uest supplied by the e uester
t is recommended that all technical details be listed in the appendi section rather than put in with the main content his is to facilitate the layman’s understanding in reading the report
he aminer must also refrain from providing a statement that cannot be proven or e ample "The suspect has altered File A”. n appropriate sentence would be “File A found in Computer B has been altered”.
common re uirement for a forensic report is available at ppendi i t si t of this document
ue to the comple ity of the case sometimes it is difficult for the aminer to e press the findings in the report he use of visual aids and visual representation such as animation slides pictures and live demonstrations are good methods of facilitating understanding
Ex t it ss n some urisdictions a submitted forensic report is sufficient in court in lieu of the aminer attending the court session owever in other urisdictions the aminer is re uired to attend a court session and present his her e pert testimony related to the case
n e pert witness is a person who by virtue of education training s ill or e perience has an e pertise and speciali ed nowledge beyond that of the average person he witness’s nowledge is sufficient that others may officially and legally rely upon his her speciali ed scientific technical or other opinion about evidence or a fact within the scope of his her e pertise referred to as the e pert opinion
n some urisdictions e pert status is decided on each and every case by the trial udge and the person is only an e pert in that case n other urisdictions e pert status is appointed by the legal institution and the person is responsible for any case within his her e pertise
he rights and duties of an e pert witness differ from country to country t is important for aminers to familiari e themselves with their legislation their court procedures their role and their rights and duties in that role
Page
T lobal guidelines for digital forensics laboratories
E hen presenting the forensic report in court e aminers may not only be re uired to e plain the analysis process. They will also be re uired to e plain their proficiency the e uipment they used the method they chose the e idence handling method and much more. t is important that procedures to address the abo e matters are established and implemented in the F .
The following section e plains in further detail the components as well as the accreditation which should be obtained.
it ss t The basic uality assurance that can be implemented in a F includes but is not limited to
it ss ts h ist b t a. Create an rgani ation Chart at F le el and at the organi ation le el. b. Conduct an internal audit annually. c. stablish a procedure to address internal and e ternal complaints. d. stablish a procedure to control documentation. i it a. stablish lab premises – access and e its. E i t b. Create an access list and limit access by using eys indi idually iti assigned identification cards or biometric de ices. c. onitor the lab en ironment regularly – temperature humidity cleanliness. d. stablish a ealth and afety programme. e. stablish isitor policy. f. Conduct regular house eeping. E i t a. stablish a procedure for handling transport storage use repair disposal and planned maintenance for e uipment. b. Before putting into use ensure that the e uipment is wor ing according to specifications. c. mplement the maintenance programme. d. pdate the firmware according to re uirements. e. aintain e uipment documentation manuals and warranties.
age
t
Evaluate staff’s competency by conducting Competency Test Evaluate existing staff’s proficiency by conducting
si th i st
–
ix E i st
TE lobal guidelines for digital forensics laboratories
E i Establis and implement a policy and procedures on evidence i andling T is s ould contain a Evidence preservation b Evidence labelling c Evidence sealing d tems to document including t e c ain of custody e Evidence t at is left unattended f recautions for securing and andling t e evidence g torage and retention
ee ppendix E t i E i i for details on evidence andling
si s t a eep tec nical records to support t e forensic result T e records must indicate t e Examiners conducting t e process and t e date mendments to previous records must be trac ed b Conduct tec nical and administrative revie of t e forensic results c ut ori e t e forensic result before releasing to t e e uester d Establis a common format for a forensic report ee ix i t si t e en providing an opinion it must be clearly mar ed in t e forensic report f Establis a process for amending a forensic report
b uality ssurance Components C ec list
it ti orensic results impact t e urisdictional system so t ey must be correct and reliable T e can assure and demonstrate confidence in its forensic result by oining t e accreditation programme T e accreditation body ill evaluate t e process on an annual basis to ensure it is meeting t e global standard
lt oug oining t e accreditation programme is recommended in general it is voluntary and not mandatory in most countries t at is interested in t e accreditation programme may refer to its own country’s Accreditation Body for details of the process.
ome notable benefits of being accredited are its b it ti E s i i th si s t en a receives numerous cases in a year it is generally difficult for t e laboratory to monitor t e performance of t e forensic or and of t e Examiners T e standard defines t e process of monitoring t e uality aspect of t e forensic result it accreditation t is process ill be assessed annually to ensure t e laboratory continues to maintain its performance n addition t e process of managing and examining t e evidence must follo t e international standard providing confidence to t e sta e older in t e forensic result produced by t e
age
lo al uidelines for di ital forensics la oratories
s st ti ith st i ss s A with se eral a iners ust ensure that each a iner follows the sa e set of processes. his is to ensure that testi onies in court are coherent and consistent etween each a iner co in fro the sa e thus facilitatin i ediate understandin y the prosecutors ud es and other court staff. a in this accreditation in place ensures that the esta lishes the necessary standard processes and also ensures that a iners i ple ent the . it s ts ne of the re uire ents in is to conduct continuous i pro e ents to the la processes. he can enefit fro accreditation y i ple entin continuous i pro e ents and ensurin the la produces ore uality results. An e a ple of such i ple entation is court testi ony onitorin . a iners are a le to continuously i pro e their ethods of presentin the results in court if they are ein onitored and pro ided with constructi e feed ac . b Benefits of a Accreditation
lectronic e idence has posed challen es to the in esti ation of certain cases due to its nature which is uni ue and different fro traditional types of e idence. herefore it ust e handled with due care. he ai of this docu ent is to pro ide the standard uidelines for the ana e ent of a and for the e a ination of electronic e idence. his is to ensure that the electronic e idence and the result produced y e er countries is accepted in other urisdictions.
he a iner and the ana e ent of the ust always stri e to update ethodolo ies uidelines and procedures with current ad ance ents in technolo y. nly then can we to ether rin down cri inals and ser e ustice as it should e ser ed.
a e
lo al uidelines for di ital forensics la oratories
E E E
he followin is a reco endation of s illsets for the a iner. he reader shall ta e note that the list is non e hausti e and needs to e updated fro ti e to ti e.
t i i s t
oundation o puter r ani ation of co puter ow co puter
oundation stores data Bits ytes olution of di ital edia and stora e syste . ile yste eci al he adeci al inary ittle
endian i endian ectors cluster slac space etadata data filena e A . ntroduction to aw enforce ent and re ulators
n esti ation and ntroduction to forensic science electronic i ital orensics e idence and its nature ate ories of electronic e idence ethodolo y orensics ter inolo ies.
dentification nfor ation ather facts of the case online reser e atherin the athered facts. ollection ollection and irst responder roles and ead and a ination ac uisition and li e ac uisition hoosin a ination the est data ac uisition ethod ria e ethod ria e tool.
Analysis ata eco ery tora e technolo y a a ed hard dis and flash dri e sy pto s o ical and physical reco ery ata reco ery tools eco ery of data usin tools. o puter orensics peratin syste s technolo y etadata
re istry artefact ata traction ata analysis ata hidin techni ue Analytics for lar e sets of data e ory Analysis. o ile hone o ile phone echnolo y and e olution orensics ser teleco unication pro ider technolo y types of data ac uire and analysis tools preser ation of data. etwor orensics etwor ypes nternet history files and
oo ies ser redentials etwor forensic tools eadin pac ets. Audio ideo and nderstandin the technolo y
a e orensics nhance ent ile Authentication o parison. er in nderstandin the technolo y Accessin
echnolo y data fro the de ice ata traction ata
a e
lo al uidelines for di ital forensics la oratories
- ocial edia analysis ata interpretation eportin the orensic findin s. - ata ase orensic - rone orensic - ehicle orensic - hip ourne forensic - ryptocurrency orensic - Bio etric orensic resentation eport ritin he for at of the report ffecti e result presentation to sta eholders. aw oc ourt aws related to cases nternational aw nternational olla oration resentin e pert testi ony in court ntroduction to ourt structure u ittin electronic e idence in court. ti uette ti uette rofessional ode of ethics ethical non ethical code of conduct. a uality ana e ent nderstandin standards onductin ana e ent Audit uality ana e ent yste . ealth afety dentify ha ards ealth and afety easures elf protection.
a e
lo al uidelines for di ital forensics la oratories
E E E E
he followin is a su ested list of asic e uip ent that a should own. he reader should note that the list is non e hausti e and ore ay e re uired dependin on the nature of cases recei ed.
o te
aptop o puter analysis software ata reco ery software
o ile de ice analysis software
nternet artefacts analysis software
irtual achine software
a in ardware
oc in yste
rite loc er
pty stora e edia – to store data e tracted fro electronic e idence in the short and lon ter en dri e ternal hard dis ard dis er er tool it
ower ca le e tension
rinter
ocu ent shredder
a e
E E E E
E E E E
E E E E E
The exhibit, a hard disk, is put in an anti-static plastic bag and a tamper-proof sticker is put at the opening of the bag. The Examiner then puts his/her initials on the sticker, along with the exhibit’s label, date and time that the exhibit is sealed.
In this sample, the exhibit is put in a tamper-proof plastic bag. Details of the exhibit, the Examiner and the chain of custody are available on the plastic bag.
E EE
isiti sh t
E
E E ☐ s t ☐ t ☐ ☐ th ☐ ☐ ☐ ☐ ☐ th ☐ ☐ ☐ ☐ th ☐ s ☐ – s
E See Guidance Notes
☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐
This section is available to add additional notes that are not included in the standard form, or to expand upon notes, i.e. types of errors received, problems encountered during imaging process.
refers to the “code” name assigned by the project manager
is a standalone drive, check ‘other’ and write in ‘ drive’ refers to the date and time from the examiner’s computer
–
lobal guidelines for digital forensics laboratories
c uisition ardware indicate the type of ac uisition it was, whether you used a write block device, cross over cables, boot disk, etc vidence edia refers to the drive where the image will be located ndicate the rive abel, serial number, and the vidence isk rive umber i e of rive total si e of hard drive in or i e of mage indicate the total si e of the image the si e of the hard drive , indicate whether or mage erified when the image is completed and verified, check the box rrors indicate if any errors were found during the verification process f so, use the “Notes” section on the back of the sheet to record the specific errors ash alue record the hash value generated during the imaging process e sure to check that the ac uisition hash value and the verification hash value match
age
N oba i e ines fo i ita fo ensics abo ato ies
ta t
e t e si l i e i e ha wa e w ite bl e
se t wi e ha is i the l i e i e i the e si w stati
e e ate exa t e si i a e si t ali ate ha s twa e t ls
e w ies
e i the l es e si i a es b hash al lati a a is
e el a the i a es
e el t a s t the i a es t the e si s lab e i e e a lt notary’s office or court obtaining the hai st
a e
N oba i e ines fo i ita fo ensics abo ato ies
tart
e ie re uest assess urgency an a ount of ata
rgent or arge onsi er con ucting ata triage
rocess e ibits in or er of riority
eco er e ete artitions
t er case s ecific eco er e ete rocessing tas s fi es fo ers
as fi tering arsing of artefacts
n e ey or ignature na ysis searc es
ount container fi es as ignature ana ysis for ounte containers
na yse ata
n
a e
N oba i e ines fo i ita fo ensics abo ato ies
ANALYSING EXHIBIT’S ARTEFACTS
age i e
entification of artefact categories an rioriti e t e
ffice ictures nternet ai s ser cti ity ncry tion ocu ents i eos ro ser
earc for earc for earc for fu i ter for insta e e ai c ients arse user o u e arious e ia nternet s ecific encry tion i ter for arious for ats bro sers artefacts e g office for ats i e eg g recent y use i e oc o t gif ng a i ocu ents arse arious t o an ounte e ai c ients s base on fi e eg an e ices an earc for fi es for at i e signature base on fi e ost it big si es signature arse bro ser istory cac e fre uent y un no n fi e for fie starte signatures an entries soft are a ig entro y ass or s earc for boo ar s eb ai enerate eb searc es icture an bro sing t u bnai s earc sessions f encry te s it i eos ocu ents o u es fi es eco er into accor ing to reate user ere foun ages t u bnai s for case re uest acti ity gat er faster ie ing ti e ine infor ation inc u ing ogins about ass or s ort ata an ogoffs i ter e ai s inc u ing into rea ab e accor ing to na yse for at i e case re uest t u bnai s accor ing to s rea s eet case re uest ui a ort ort ictionary an ocu ents an ti e ine into use ort e ai s its eta ata i ter ata for ort e ia rea ab e c usters to inc u ing case s ecific an its for at attac t e attac ents eta ata criteria encry tion
nc u e a fin ings into forensic re ort
a e
N oba i e ines fo i ita fo ensics abo ato ies
A EN IX C N RE IRE ENTS F R F RENSIC RE RT
o on e i e ents fo o ensic e o t it e Na e an a ess of abo ato ocation he e co ection an e a ination take ace a e n be an in ication of a e en e este na e an contact info ation etho se fo the case esc i tion of e ect onic e i ence ate hen e i ence as ecei e b ate of e a ination ate of e o t iss ance o ensic es t Na e an f nction of the e son a tho i in the e o t
a e
N oba i e ines fo i ita fo ensics abo ato ies
A EN IX ELECTR NIC E I ENCE HAN LING he fo o in is a basic s estion fo the han in of e ect onic e i ence
heck ist fo e ect onic e i ence han in L i ence st be ni e abe e once it is e i e e to the f it is iffic t to t a abe on the e i ence the DFL can put the label on the evidence’s seal. he abe st sta th o ho t the ifeti e of the e i ence in the abe s st a so be ab e to t ack s b ite s a e fo a obi e hone an fo the i ca containe in the hone S i ence st be sea e sin a o e containe he containe st be ab e to etect an access a e to the e i ence he sea st be si ne an ate b the a ine ach ti e e i ence is accesse the e son oin so st sea the e i ence a ain once the ocessin is co ete bea in his he si nat e an ates f eco of e ect onic e i ence st be estab ishe te s to be eco e inc e e i ence t e se ia n be an fact e an efects an an abe s i ence in ento ist st a so be estab ishe in the chain of c sto eco st be estab ishe fo each iece of e ect onic e i ence t ini it st contain a ni e abe initia s an ate N L i ence not in the ocess of e a ination e to the Examiner’s long leave or a ine s foc sin on hi h io it cases st not be eft natten e in the t st be o e sto e a a to e ent conta ination i ence st a so not be eft natten e in the t ans o tation ocess ect onic e i ence st be o e taken ca e of an be ke t a a f o so ces of conta ination s ch as ate heat e t e e h i it an e ect o a netic fie
S ect onic e i ence st be sto e in a sec e ace ith i ite access eco of check in an check o t of the e i ence f o to a e oo st be ke t ate co of the o i ina e ect onic e i ence st be a e to ese e inte it of the o i ina e i ence ash a e of o i ina e i ence an its co st be the sa e a ination an ana sis st be con cte on the co of e ect onic e i ence
a e
E L lobal guidelines or digital orensics laboratories
A EN IX L INTER L FL SER ICE RE EST F R F FL R A se this orm to ormall re uest assistance rom E L DFL. he orm must be illed out completel and accuratel b the . di erent criminal la en orcement agenc authori ed b the NCB (“Contact Agency”) may fill out the form, however this request must be sent to INTERPOL b the . he in ormation in this orm ill be assessed to determine hether the E L DFL is able to provide assistance. ore detailed in ormation ill allo or a timel response. n case o an uestions E L ill liaise ith the contact person s indicated in this orm.
R E L ember ountr itle an o ontact erson Last ame First ame ontact email address o icial ontact phone pproval to coordinate E . E F ED LL E EL directl ith ontact genc E E . E . D E L E . . D L E .
C A NCB ame o genc ontact address ice phone itle an o ontact erson Last ame First ame ontact email address o icial ontact obile phone
C rimar ence unishment upon conviction under ember ountr la ther ountries nvolved nternational haracter o the ence Exhibit relates to ic all that uspect appl ictim erson o interest. Explain
age
INTERPOL lobal gui elines for igital forensics laboratories
Brief escri tion of Case
R INTER L FL T ( ) Lac of e ertise nowle ge ( ) Lac of resources fun s ( ) Lac of equi ment software ( ) Others Please s ecify
E G ill INTERPOL L Officers be require to interact with ( ) E e hibits ( ) NO If YES…
(1) Will exhibits be “original” exhibits or “copies” ( ) ORI INAL As far as possible, please restrict exhibits to copies. ( ) COPIE ( ) ill INTERPOL staff have to visit the ember ( ) E Country for the assistance ( ) NO ( ) Contact etails of erson(s) from ember Country ( ) ame as Contact Agency who will be resent uring the assistance Please note ( ) ifferent – Please s ecify that INTERPOL will assist an gui e this erson to erform the tas requeste here, an to re are a re ort for ember Country use
INTER L FL T ( ) E traction of information from the e hibits Please escribe the information to be e tracte (Choose all that a ly) ( ) Images vi eos Relating to ( ) iles Relating to ( ) Te t messages Relating to ( ) Technical etails ( ) Others Please s ecify ( ) Information on how to e tract material from the e hibits, the e traction to be one by the ember Country ( ) Information on available software or ro ucts to erform a tas on the e hibits
Page
I E lobal g i elines for igital forensics laboratories
What is the tas (Exa ple nloc ing a loc e obile e ice) nl open so rce free soft are reco en ations ( ) YES ( ) roprietar soft are reco en ations elco e ( ) YES ( )
E H R I
I Exhibits (incl ing riginal Exhibits) are re ire to be han le please pro i e instr ctions in relation to the follo ing (1) lease pro i e specific instr ctions or re ire ents on han ling
( ) lease list an specific acti ities or processes that S be one
( ) lease specif an partic lar instr ctions ith respect to recor ing of the assistance process partic lars of the Exhibit or the chain of c sto
( ) lease pro i e an other infor ation of rele ance for the assistance (For example, is the Exhibit in ‘switched off’ mode? Were any prior attempts made to extract information?)
( ) If I E consi ers that thir part assistance is necessar to pro i e the assistance so ght in this re est oes the agree to see assistance fro another e ber o ntr subject to both NCB’s consent? (*) YES (*) NO
A C he an ontact genc pro i e I E the follo ing ass rances his re est for assistance is la f l as teste against the la s of the ( ) YES applicable Member Country, applicable international laws and INTERPOL’s onstit tion an r les
age
INTERPOL lobal uidelines or di ital orensics laboratories
Specifically, Article 3 of INTERPOL’s Constitution states: (*) YES
“ t is strict y forbidden for the r ani ation to nderta e any inter ention or acti ities of a po itica mi itary re i io s or racia character ”
The assistance re uested here will not any in manner cause an infringement of Article 3 of INTERPOL’s Constitution. Nothing in the Member Country’s laws pre ents the NCB or the Contact (*) YES ency rom obtainin the in ormation re uested throu h this re uest or assistance The o ence to which the re uest relates has an international lin and is a (*) YES serious offence within the Member Country’s laws. The NCB and Contact Agency understand that INTERPOL’s provision of (*) YES assistance is subject to the assessment o this re uest as per criteria applicable under INTERPOL’s Constitution, rules and regulations. I any in ormation is sou ht to be e tracted rom E hibits, the NCB and the (*) YES Contact ency endea our to limit the re uest or e traction to in ormation o rele ance to the o ence concerned, and proportionate to the purpose or which the e traction is sou ht Should INTERPOL a ree to pro ide the assistance sou ht throu h this (*) YES re uest, the Contact ency NCB shall si n an a reement in the orm pro ided by INTERPOL, prior to the pro ision o assistance In case interaction with E hibits is necessary, INTERPOL shall pro ide (*) YES assistance and uidance to desi nated Member Country personnel to per orm the re uest outlined in this re uest or assistance, and prepare necessary reports urther to the same E tractions will not be per ormed in the absence o Member Country personnel, other than in e ceptional circumstances as INTERPOL may consider appropriate The Member Country personnel (whether rom the NCB or Contact (*) YES ency) accompanyin the E hibit(s), i any, shall obser e or ensure the obser ance o all re uirements as per the Member Country’s applicable criminal, procedural and e identiary laws The Member Country personnel (whether rom the NCB or Contact (*) YES ency) accompanyin the E hibit(s) shall certi y that all re uirements under the Member Country’s laws were met, in e tractin the rele ant information from the Exhibit(s), in the report produced using INTERPOL’s assistance or e pertise The NCB and Contact ency ac nowled e that INTERPOL shall not be (*) YES responsible with respect to the use o any in ormation e tracted rom any E hibits, or any reports produced with the assistance o INTERPOL ny use o such in ormation or reports in judicial proceedin s or otherwise, is at the discretion and responsibility o the NCB Contact ency
E S E hibit Type Mobile e ice ard ri e Other Physical escription
Ma e Model
Pa e
INTERPOL lobal guidelines for digital forensics laboratories
Serial
IMEI
Local Exhibit Identifier Passcode Passwords
Any other Relevant Information
E S Exhibit Type Mobile evice ard rive Other: Physical escription
Ma e Model
Serial
IMEI Local Exhibit Identifier Passcode Passwords
Any other Relevant Information
E S Exhibit Type Mobile evice ard rive Other: Physical escription
Ma e Model
Serial
Page
INTERPOL lobal guidelines for digital forensics laboratories
IMEI
Local Exhibit Identifier Passcode Passwords
Any other Relevant Information
E S Exhibit Type Mobile evice ard rive Other: Physical escription
Ma e Model
Serial
IMEI
Local Exhibit Identifier Passcode Passwords
Any other Relevant Information
Page
INTERPOL General Secretariat 200, quai Charles de Gaulle 69006 Lyon France Tel: +33 4 72 44 70 00 Fax: +33 4 72 44 71 63
WWW.INTERPOL.INT INTERPOL_HQ @INTERPOL_HQ INTERPOLHQ INTERPOLHQ