Hi and welcome to the video brief introduction to digital forensics in this video we introduce digital
forensics.
I cover the fundamental concepts that should be learned to fully understand the hands on part of the
course.
The first part of the video gives a definition of what digital forensics is the application areas.
It could have and the various subbranches in which it is divided.
The second part covers the four main steps of digital forensics which are assessment acquisition analysis
and reporting.
Next the video explains important concepts like Lockhart's principle order of volatility.
Chain of custody.
They not only apply to digital forensics but for forensic science in general.
Finally there's a comparison between commercial and open source forensic tools.
A definition of digital forensics is rather complete and prepared the one given by the digital forensics
research workshop in 2001 has defined it as the use of scientifically derived and proven methods towards
the preservation collection validation identification analysis interpretation documentation and presentation
of digital evidence derived from digital sources for the purpose of facilitating or furthering or furthering
the reconstruction of events.
The main application of digital forensics is to conduct civil or criminal investigations whose trials
will then be submitted to a court.
These investigations may not be necessarily related to computer or internet crimes but may involve evidence
stored on digital devices which could represent the trials in the lawsuit.
Another application of digital forensics is in private investigations.
For example in an instant response where we have to investigate on an intrusion or a malware infection
or in an internal investigation on an employee digital forensics includes various subbranches depending
on the type of devices and data to analyze disk of biosystem forensics memory forensics mobile forensics
network forensics and so on.
As we've seen the digital forensics process can be divided into four main steps assessment acquisition
analysis and reporting in this course.
We're not going to cover the first step assessment because it's about the identification collection
and preservation of the devices to be analyzed.
This doesn't mean it's not important as if we miss something at this step we may not be able to collect
and analyze it afterwards.
The acquisition base involves acquiring a copy or image of the device or data we want to analyze.
This is a crucial phase because we must be able to demonstrate that the acquired image is an identical
copy of the original and it has not been tampered or corrupted.
So it's necessary to hash the image to be able to verify its integrity.
It's essential saying that we must always mount the device as read only when we acquire the image to
avoid accidentally writing to the device and corrupting the original evidence.
This could be accomplished using hardware forensic duplicators or software right blocking techniques.
The next step is analysis that could be split in different spaces like extraction and recovery examination
and subsequent interpretation of data from the acquired image to find evidence relevant for the case.
These steps could be carried on using different tools depending on the type of analysis the analysis
phase is the core and most technical part of the digital forensics process and is going to take the
major part of the course.
Remember that to preserve the evidence we must always work on the image and not on the original device
or data.
Lastly there's the reporting phase which is about documenting and reporting the findings and the procedures
and tools used in the previous phases as the analysis should be repeatable by other forensic examiners.
The resulting report should be as accurate and detailed as possible because especially in the case of
criminal investigations it could be used to make very important decisions.
It's worth mentioning some important concepts that not only applied to digital forensics but forensic
sciences in general.
One is the order of volatility that defines the order according to which the data should be acquired
from the most volatile least stable to the less volatile most stable.
For example data residing in RAM memory is more volatile than that on hard disks and so it should be
acquired first.
Another important concept is the Lockhart's exchange principle that states every interaction that occurs
with a crime scene leaves a trace behind and at the same time make something to be taken away.
This is also true in the digital world and for the forensic examiner who should always be careful not
to corrupt the evidence and try to minimize the effects of their actions.
There's one more important concept to underline.
Chain of custody.
It refers to the complete route that the evidence follows from the initial identification and collection
through the storage and acquisition to storage and preservation.
Though we haven't mentioned it before.
Preservation is very important as the evidence must be preserved in its original state and all the guidelines
specific to the type of evidence must be followed.
Carefully the chain of custody must not be broken and must be properly documented in order for the evidence
to be admissible in a court.
Finally we say something about digital forensic software as usual.
It could be divided into commercial and open source.
Some of the best no commercial tools are guidance in case access data STK and pro discover these are
complete suites for the acquisition and analysis of forensic images but are quite expensive clotheshorse
and not available on Linux.
On the other side open source tools are free their code could be tested and analyzed by everyone and
are widely accepted by the digital forensic community Linux includes the majority of the forensic open
source tools available in the next video we're going to see how to install this great distribution break.