Digital forensics the usual aim is to provide answers to a series of sim- pler questions) often involving complex time-lines or hypotheses.[4] 1 History Prior to the 1980s crimes involving computers were dealt with using existing laws. The first computer crimes were recognized in the 1978 Florida Computer Crimes Act, which included legislation against the unauthorized mod- ification or deletion of data on a computer system.[5][6] Over the next few years the range of computer crimes Aerial photo of FLETC, where US digital forensics standards being committed increased, and laws were passed to were developed in the 1980s and '90s deal with issues of copyright, privacy/harassment (e.g., cyber bullying, cyber stalking, and online predators) and child pornography.[7][8] It was not until the 1980s that Digital forensics (sometimes known as digital foren- federal laws began to incorporate computer offences. sic science) is a branch of forensic science encompassing Canada was the first country to pass legislation in 1983.[6] the recovery and investigation of material found in digi- This was followed by the US Federal Computer Fraud tal devices, often in relation to computer crime.[1][2] The and Abuse Act in 1986, Australian amendments to their term digital forensics was originally used as a synonym crimes acts in 1989 and the British Computer Abuse Act for computer forensics but has expanded to cover inves- in 1990.[6][8] tigation of all devices capable of storing digital data.[1] With roots in the personal computing revolution of the late 1970s and early '80s, the discipline evolved in a hap- 1.1 1980s–1990s: Growth of the field hazard manner during the 1990s, and it was not until the early 21st century that national policies emerged. The growth in computer crime during the 1980s and Digital forensics investigations have a variety of applica- 1990s caused law enforcement agencies to begin estab- tions. The most common is to support or refute a hy- lishing specialized groups, usually at the national level, to pothesis before criminal or civil (as part of the electronic handle the technical aspects of investigations. For exam- discovery process) courts. Forensics may also feature in ple, in 1984 the FBI launched a Computer Analysis and the private sector; such as during internal corporate in- Response Team and the following year a computer crime vestigations or intrusion investigation (a specialist probe department was set up within the British Metropolitan Po- into the nature and extent of an unauthorized network in- lice fraud squad. As well as being law enforcement pro- trusion). fessionals, many of the early members of these groups were also computer hobbyists and became responsible for The technical aspect of an investigation is divided into [9][10] several sub-branches, relating to the type of digital de- the field’s initial research and direction. vices involved; computer forensics, network forensics, One of the first practical (or at least publicized) exam- forensic data analysis and mobile device forensics. The ples of digital forensics was Cliff Stoll’s pursuit of hacker typical forensic process encompasses the seizure, foren- Markus Hess in 1986. Stoll, whose investigation made sic imaging (acquisition) and analysis of digital media and use of computer and network forensic techniques, was not the production of a report into collected evidence. a specialized examiner.[11] Many of the earliest forensic [12] As well as identifying direct evidence of a crime, digi- examinations followed the same profile. tal forensics can be used to attribute evidence to specific Throughout the 1990s there was high demand for these suspects, confirm alibis or statements, determine intent, new, and basic, investigative resources. The strain on identify sources (for example, in copyright cases), or au- central units lead to the creation of regional, and even thenticate documents.[3] Investigations are much broader local, level groups to help handle the load. For exam- in scope than other areas of forensic analysis (where ple, the British National Hi-Tech Crime Unit was set up 1 2 1 HISTORY in 2001 to provide a national infrastructure for computer devices.[20] crime; with personnel located both centrally in London Focus has also shifted onto internet crime, particularly and with the various regional police forces (the unit was the risk of cyber warfare and cyberterrorism. A February folded into the Serious Organised Crime Agency (SOCA) [10] 2010 report by the United States Joint Forces Command in 2006). concluded: During this period the science of digital forensics grew from the ad-hoc tools and techniques developed by these Through cyberspace, enemies will target hobbyist practitioners. This is in contrast to other foren- industry, academia, government, as well as the sics disciplines which developed from work by the scien- military in the air, land, maritime, and space [1][13] tific community. It was not until 1992 that the term domains. In much the same way that airpower “computer forensics” was used in academic literature (al- transformed the battlefield of World War II, though prior to this it had been in informal use); a paper cyberspace has fractured the physical barriers by Collier and Spaul attempted to justify this new disci- that shield a nation from attacks on its com- [14][15] pline to the forensic science world. This swift de- merce and communication.[21] velopment resulted in a lack of standardization and train- ing. In his 1995 book, "High-Technology Crime: Investi- The field of digital forensics still faces unresolved issues. gating Cases Involving Computers", K Rosenblatt wrote: A 2009 paper, “Digital Forensic Research: The Good, the Bad and the Unaddressed”, by Peterson and Shenoi Seizing, preserving, and analyzing evi- identified a bias towards Windows operating systems in dence stored on a computer is the greatest digital forensics research.[22] In 2010 Simson Garfinkel forensic challenge facing law enforcement in identified issues facing digital investigations in the future, the 1990s. Although most forensic tests, including the increasing size of digital media, the wide such as fingerprinting and DNA testing, are availability of encryption to consumers, a growing vari- performed by specially trained experts the ety of operating systems and file formats, an increasing task of collecting and analyzing computer ev- number of individuals owning multiple devices, and le- idence is often assigned to patrol officers and gal limitations on investigators. The paper also identified detectives.[16] continued training issues, as well as the prohibitively high cost of entering the field.[11] 1.2 2000s: Developing standards 1.3 Development of forensic tools Since 2000, in response to the need for standardization, various bodies and agencies have published guidelines for Main article: List of digital forensics tools digital forensics. The Scientific Working Group on Dig- ital Evidence (SWGDE) produced a 2002 paper, "Best During the 1980s very few specialized digital forensic practices for Computer Forensics", this was followed, in tools existed, and consequently investigators often per- 2005, by the publication of an ISO standard (ISO 17025, formed live analysis on media, examining computers General requirements for the competence of testing and from within the operating system using existing sysadmin calibration laboratories).[6][17][18] A European lead inter- tools to extract evidence. This practice carried the risk of national treaty, the Convention on Cybercrime, came into modifying data on the disk, either inadvertently or oth- force in 2004 with the aim of reconciling national com- erwise, which led to claims of evidence tampering. A puter crime laws, investigative techniques and interna- number of tools were created during the early 1990s to tional co-operation. The treaty has been signed by 43 address the problem. nations (including the US, Canada, Japan, South Africa, UK and other European nations) and ratified by 16. The need for such software was first recognized in 1989 at the Federal Law Enforcement Training Center, result- The issue of training also received attention. Commercial ing in the creation of IMDUMP (by Michael White) and companies (often forensic software developers) began to in 1990, SafeBack (developed by Sydex). Similar soft- offer certification programs and digital forensic analysis ware was developed in other countries; DIBS (a hardware was included as a topic at the UK specialist investigator [6][10] and software solution) was released commercially in the training facility, Centrex. UK in 1991, and Rob McKemmish released Fixed Disk Since the late 1990s mobile devices have become more Image free to Australian law enforcement.[9] These tools widely available, advancing beyond simple communica- allowed examiners to create an exact copy of a piece of tion devices, and have been found to be rich forms of digital media to work on, leaving the original disk intact information, even for crime not traditionally associated for verification. By the end of the '90s, as demand for with digital forensics.[19] Despite this, digital analysis of digital evidence grew more advanced commercial tools phones has lagged behind traditional computer media, such as EnCase and FTK were developed, allowing ana- largely due to problems over the proprietary nature of lysts to examine copies of media without using any live 3 forensics.[6] More recently, a trend towards “live memory well as unallocated and slack space), recovering deleted forensics” has grown