View metadata, citation and similar papers at core.ac.uk brought to you by CORE provided by Calhoun, Institutional Archive of the Naval Postgraduate School Calhoun: The NPS Institutional Archive Faculty and Researcher Publications Faculty and Researcher Publications 2013 Digital Forensics Garfinkel, Simson L. American Scientist, Volume 101, September - October 2013 http://hdl.handle.net/10945/46063 A reprint from American Scientist the magazine of Sigma Xi, The Scientific Research Society This reprint is provided for personal and noncommercial use. For any other use, please send a request to Permissions, American Scientist, P.O. Box 13975, Research Triangle Park, NC, 27709, U.S.A., or by electronic mail to [email protected]. ©Sigma Xi, The Scientific Research Society and other rightsholders NOTE: The views expressed in this article are those of the author and do not reflect the official policy or position of the Naval Postgraduate School, the Department of the Navy, the Department of Defense or the U.S. Government Feature Article Digital Forensics Modern crime often leaves an electronic trail. Finding and preserving that evidence requires careful methods as well as technical skill. Simson L. Garfinkel ince the 1980s, computers have counts by using an IBM AS/400 mini- data that were created weeks, months or had increasing roles in all aspects computer from the 1980s. The age of the even years before. Such contemporane- of human life—including an in- computer helped perpetuate his crime, ous records can reveal an individual’s volvement in criminal acts. This because few people on Wall Street have state of mind or intent at the time the Sdevelopment has led to the rise of digital experience with 25-year-old technology, crime was committed. forensics, the uncovering and examina- and it created an added complication But whereas pre-computer evidence, tion of evidence located on all things after Madoff was arrested, because in- such as handwritten letters and photo- electronic with digital storage, including vestigators had few tools with which to graphs, could be reproduced and given computers, cell phones, and networks. make sense of his data. to attorneys, judges, and juries, comput- Digital forensics researchers and practi- Today personal computers are so ubiq- erized evidence requires special han- tioners stand at the forefront of some of uitous that the collection and use of digi- dling and analysis. Electronic data are the most challenging problems in com- tal evidence has become a common part easily changed, damaged, or erased if puter science, including “big data” anal- ysis, natural language processing, data visualizations, and cybersecurity. Information on a computer system can be Compared with traditional forensic science, digital forensics poses signifi- changed without a trace, the scale of data cant challenges. Information on a com- puter system can be changed without to be analyzed is vast, and the variety of a trace, the scale of data that must be analyzed is vast, and the variety of data data types is enormous. types is enormous. Just as a traditional forensic investigator must be prepared to analyze any kind of smear or frag- of many criminal and civil investigations. handled improperly. Simply turning on ment, no matter the source, a digital Suspects in murder cases routinely have a consumer GPS may cause the device investigator must be able to make sense their laptops and cell phones examined to delete critical evidence. Additionally, of any data that might be found on any for corroborating evidence. Corporate computers frequently harbor hidden ev- device anywhere on the planet—a very litigation is also dominated by electronic idence that may be revealed only when difficult proposition. discovery of incriminating material. specialized tools are used—for example, From its inception, digital forensics The second class of digital forensics a digital camera may appear to have has served two different purposes, each cases are those in which the crime was 30 photos, but expert examination may with its own difficulties. First, in many inherently one involving computer sys- show another 300 deleted photos that cases computers contain evidence of tems, such as hacking. In these instanc- can be recovered. (When a device “eras- a crime that took place in the physical es, investigators are often hampered es” a file, it doesn’t clear the memory world. The computer was all but inci- by the technical sophistication of the space, but notes that the space is avail- dental—except that computerization has systems and the massive amount of evi- able; the file may not be really deleted made the evidence harder for investiga- dence to analyze. until a new one is written over it.) tors to analyze than paper records. For Digital forensics is powerful because Because they can look into the past example, financial scam artist Bernard computer systems are windows into and uncover hidden data, digital fo- Madoff kept track of his victims’ ac- the past. Many retain vast quantities rensics tools are increasingly employed of information—either intentionally, in beyond the courtroom. Security pro- the form of log files and archives, or in- fessionals routinely use such tools to Simson L. Garfinkel is an associate professor at the Naval Postgraduate School. He holds six advertently, as a result of software that analyze network intrusions—not to U.S. patents for computer-related research and does not cleanly erase memory and files. convict the attacker but to understand has written 14 books, including Database Na- As a result, investigators can frequently how the perpetrator gained access and tion: The Death of Privacy in the 21st Century recover old email messages, chat logs, to plug the hole. Data recovery firms (O’Reilley, 2000). Internet: http://simson.net Google search terms, and other kinds of rely on similar tools to resurrect files 370 American Scientist, Volume 101 © 2013 Sigma Xi, The Scientific Research Society. Reproduction with permission only. Contact [email protected]. Craig Cunningham High-tech crime fighting is now needed everywhere, as shown in this lab belonging to the tried to create a consistent but flexible West Virginia State Police Digital Forensics Unit. Police these days typically use powerful approach for performing investigations, computers and software to copy, analyze, and decrypt data from a suspect’s electronic devices. despite policy variations. Several such digital forensic models have been pro- from drives that have been inadver- could have viewed the laptop files with- posed, but most have common elements. tently reformatted or damaged. Forensic out modifying those timestamps, so the Before data can be analyzed, they tools can also detect the unintentional investigators really determined only that are collected from the field (the “scene disclosures of personal information. In the files had not been opened by con- of the crime”), stabilized, and pre- 2009 the Inspector General of the U.S. ventional means. served to create a lasting record. Un- Department of Defense issued a report These examples emphasize that derstanding the inner workings of stating that many hard drives were not the possibilites of digital forensics are how computers store data is key to properly wiped of data before leaving bounded not by technology but by what accurate extraction and retention. Al- government service. is cost-effective for a particular case. though computers are based entirely Digital evidence can even be exam- Convictions are frequently the measure on computations involving the bi- ined to show that something did not of success. In practice there is a consider- nary digits 0 and 1, more commonly happen. Here they are less powerful, able gap between what is theoretically known as bits, modern computers do for the well-known reason that the ab- possible and what is necessary; even most of their work on groups of eight sence of evidence is not the evidence though there may be an intellectual de- bits called bytes. A byte can represent of absence. In May 2006 a laptop and sire to analyze every last byte, there is the sequences 00000000, 00000001, external hard drive containing sensitive rarely a reason to do so. 00000010, through 11111111, which personal information of 26.5 million corresponds to the decimal numbers veterans and military personnel was Following Procedures 0 through 255 (there are two options, 0 stolen from an employee at the U.S. De- Digital forensics relies on a kit of tools and 1, with eight combinations, so 28 = partment of Veterans Affairs. After the and techniques that can be applied 256). One common use for bytes inside laptop was recovered in June 2006, fo- equally to suspects, victims, and by- the computer is to store written text, rensic investigators analyzed the media standers. A cell phone found on a dead where each letter is represented by a and determined that the sensitive files body without identification would al- specific binary code. UTF-8, a com- probably had not been viewed. most certainly be subjected to analysis, mon representation, uses the binary One way to make such a judgment is but so would a phone dropped during sequence 00100001 to represent the let- by examining the access and modifica- a house burglary. How the analysis is ter A, 00100010 for the letter B, and so tion times associated with each file on performed is therefore more a matter of on. (Computers often use hexadecimal the hard drive. But someone taking ad- legal issues than technological ones. As codes in memory as well; see figure on vantage of the same forensic techniques the field has grown, practitioners have page 373.) www.americanscientist.org © 2013 Sigma Xi, The Scientific Research Society. Reproduction 2013 September–October 371 with permission only. Contact [email protected]. When recorded on a hard drive or Major Convictions, and a Few memory card, these bytes are grouped in blocks called sectors that are typically Gaffes, with Digital Data 512 or 4,096 bytes in length.