Brief introduction to digital forensics

Digital forensics with Kali Linux
Marco Alamanni
Video 1.2
Brief introduction to digital
forensics

In this Video, we are going to take a look at…
• Introduction to digital forensics: definition and applications
• Phases of digital forensics
• Important concepts: Locard's principle, order of volatility, chain of custody
• Commercial vs. open source tools

Introduction to digital forensics - definition
Digital forensics can be defined as “The use of scientifically derived and
proven methods toward the preservation, collection,
validation, identification, analysis, interpretation, documentation and
presentation of digital evidence derived from digital sources for the purpose
of facilitating or furthering the
reconstruction of events [...]”, Digital Forensic Research Workshop
(DFRWS), 2001

Introduction to digital forensics - applications
●
Main application of digital forensics is in criminal or civil investigations
●
Can also be applied to incident response and internal investigations

Introduction to digital forensics – sub-branches
Includes various sub-branches, for example:
•
Disk and filesystem forensics
•
Memory forensics
•
Mobile forensics
•
Network forensics

Phases of digital forensics
Main phases of digital forensics (Kruse and Heiser, 2001):
●
Assessment
●
Acquisition
●
Analysis
●
Reporting

Phases of digital forensics - Acquisition
●
Acquisition involves acquiring a copy or image of the device(s) or data.
●
Always mount the device in read-only mode!
●
Always verify the integrity of the image!

Phases of digital forensics - Analysis
●
Analysis includes extraction and recovery of data from the image
and their subsequent examination and interpretation.
●
It's the most technical part and we are going to cover it for the major part of the
course.
●
Always work on the image and not on the original device or data!

Phases of digital forensics - Reporting
●
Reporting is about documenting and writing the report of all the forensic job
done in the previous phases.
●
The final report documents the findings as well as the procedures and tools
used.
●
Could be very effective for the outcome of the investigation!

Important forensic concepts – Order of volatility
●
The order of volatility (OOV) defines the degree of volatility of data.
●
For example, data in RAM is more volatile than on hard disk.
●
More volatile data should be acquired first.

Important forensic concepts – Locard's principle
●
Locard's exchange principle states that every interaction with the crime
scene leaves something and make something to be taken away
●
This is also true in the digital world and for the forensic examiner too, that
should be careful not to corrupt evidence and minimize the effects of her
actions.

Important forensic concepts – Chain of custody
●
Chain of custody refers to the complete route of the evidence from its
identification and collection to its storage and preservation.
●
The chain of custody must be properly documented and cannot be broken for
the evidence to be admissable in a court.

Commercial vs. open source forensic tools
●
Examples of known commercial forensic suites are Guidance Encase, Access
Data FTK and ProDiscover.
●
But quite expensive, closed source and not available on Linux.
●
Open source tools are free and widely accepted by the digital forensic
community.
●
Kali Linux includes the majority of the forensic open source tools!

Video summary
●
Introduction to digital forensics and its applications.
●
Description of its main phases.
●
Introduction to important forensic concepts.
●
Comparison between commercial and open source tools.

Next Video
Downloading and installing Kali Linux

Brief introduction to digital forensics

More Related Content

What's hot

Similar to Brief introduction to digital forensics

More from Marco Alamanni

Recently uploaded

Brief introduction to digital forensics