Unit 1: Computer Forensics and Investigation Process

I. Orientation: The Governing Principles of Computer Forensics

Computer forensics (emerging as a discipline in the late 1980s alongside the U.S. Computer Fraud and Abuse Act, 1986) is the application of scientific method to the identification, collection, preservation, examination, and presentation of digital evidence in a manner that is legally admissible. Everything that follows depends on the principle that evidence must survive courtroom scrutiny.

• Locard's Exchange Principle (adapted): every digital interaction leaves a trace — log entries, timestamps, cache, registry keys — so the investigator's task is recovery, not creation.
• Chain of custody: an unbroken, documented record of who handled evidence, when, and why; a single undocumented gap can render evidence inadmissible.
• Integrity via hashing: an original and its forensic copy must share an identical cryptographic hash (MD5 or SHA-256) to prove nothing changed.
• Order of volatility: collect the most transient data first — CPU registers and cache, then RAM, then disk, then archived media.
• Repeatability and defensibility: a second examiner following the same steps must reach the same result.

II. Fundamentals, Crimes, Evidence, and Readiness

A. Understand the fundamentals of computer forensics

Computer forensics turns raw storage into legally usable fact.

• Objectives: identify the perpetrator, reconstruct the sequence of events, recover deleted or hidden data, and produce a report supporting legal action.
• Core process pillars: acquire a bit-stream image, authenticate it by hash, analyse on the copy only, report findings — never work on the original.
• Types of forensics: disk, memory, network, mobile, cloud, email, and malware forensics, each with distinct acquisition tools.
• Enterprise motive: breaches cause direct loss, regulatory penalty, and reputational damage; forensics limits liability and supports insurance and prosecution.

B. Understand cyber crimes and their investigation procedures

Cyber crime is any offence where a computer is the target, tool, or repository.

• Categories:
  • Against individuals: identity theft, cyberstalking, phishing.
  • Against organisations: ransomware, data theft, DoS attacks.
  • Against society/state: cyberterrorism, espionage.
• Investigation procedure: verify an offence occurred, define scope, obtain legal authority (warrant or consent), secure the scene, acquire evidence by volatility order, analyse, and report.
• Two examination approaches:
  1. Static (post-mortem): the system is powered off and a disk image analysed offline — reproducible but loses volatile data.
  2. Live: the running system is examined to capture RAM, active connections, and encryption keys — richer but alters state, so every action is logged.

C. Understand digital evidence

Digital evidence is any probative information stored or transmitted in binary form.

• Defining traits: latent (not directly readable), easily altered or destroyed, time-sensitive, and often duplicable without loss.
• Types:
  • Volatile: RAM contents, running processes, network sockets — lost on shutdown.
  • Non-volatile: files, slack space, unallocated clusters, logs, metadata.
• Best Evidence Rule: courts prefer the original, but a verified forensic image with matching hash is accepted as equivalent.
• Sources: hard disks, SSDs, mobile devices, cloud accounts, IoT sensors, network captures.

D. Understand forensic readiness

Forensic readiness is an organisation's capability to gather and use digital evidence with minimal cost before an incident occurs.

• Goal: maximise evidential value while minimising business disruption during a later investigation.
• Ten-step planning (Rowlingson framework, summarised): define scenarios, identify available evidence sources, determine collection requirements, establish secure storage and handling, and document escalation to law enforcement.
• Benefits: faster response, lower investigation cost, deterrence, and stronger legal standing.
• Enablers: centralised logging, synchronised NTP time, defined retention policy, and pre-authorised legal procedures.

III. Response, Roles, Challenges, and Law

A. Incident response and the role of SOC in computer forensics

Incident response (IR) contains and eradicates threats while forensics preserves the evidence IR generates.

• IR lifecycle (NIST SP 800-61): Preparation → Detection & Analysis → Containment, Eradication & Recovery → Post-Incident Activity.
• SOC function: a 24/7 team using a SIEM to correlate logs, detect anomalies, triage alerts, and trigger investigation.
• Forensic intersection: SOC analysts often perform first response — isolating hosts and capturing memory — so their actions must preserve chain of custody, not just restore service.
• Tension: IR pressure to restore uptime can destroy volatile evidence; forensic readiness resolves this by pre-defining what to capture first.

B. Identify the roles and responsibilities of a forensic investigator

The investigator is the neutral technical expert who ensures evidence integrity end to end.

• Duties: secure the scene, image media, maintain custody logs, analyse artefacts, and testify.
• Responsibilities:
  • Technical: master acquisition tools, file systems, and recovery methods.
  • Procedural: follow SOPs, document every action, use write-blockers.
  • Legal/ethical: remain impartial, stay within warrant scope, protect privacy, and never fabricate.
• Qualities: attention to detail, analytical reasoning, and clear communication for non-technical courts.

C. Understand the challenges faced in investigating cyber crimes

Digital investigations face obstacles absent in physical crime.

• Technical: strong encryption, anti-forensic tools (wiping, steganography), and huge data volumes.
• Jurisdictional: evidence stored across countries with conflicting laws; cloud data has no fixed physical location.
• Temporal: volatile evidence vanishes in seconds; log retention may lapse before discovery.
• Attribution: proxies, VPNs, Tor, and spoofing obscure the true actor.
• Legal: privacy laws and inconsistent admissibility standards restrict collection.

D. Understand legal compliance in computer forensics

Investigations must satisfy statutory and evidentiary rules to be usable.

• Warrants and authority: searches generally require a warrant or informed consent; scope must be respected or evidence is suppressed.
• Key frameworks (varying by jurisdiction): rules of evidence governing authenticity and reliability, data-protection statutes such as GDPR, and industry mandates like HIPAA and PCI-DSS.
• Standards: ISO/IEC 27037 guides identification and preservation; ACPO-style principles state that no action should change data relied upon in court.
• Privacy balance: personal and privileged data must be filtered so collection stays proportionate.

IV. The Forensic Investigation Process

A. Understand the forensic investigation process and its importance

The process is the structured, phased methodology that keeps evidence defensible from seizure to court.

• Three macro-phases: pre-investigation (preparation), investigation (acquisition and analysis), and post-investigation (reporting and testimony).
• Importance: structure guarantees repeatability, protects the chain of custody, prevents evidence spoliation, and withstands cross-examination.
• Consequence of failure: skipping documentation or working on originals makes findings inadmissible regardless of technical accuracy.

B. Understand the pre-investigation phase

This phase builds capability and authority before any evidence is touched.

• Setup: establish a forensic lab, validated tools, and write-blockers; define SOPs.
• Authorisation: obtain the warrant or management approval and confirm legal jurisdiction.
• Team formation: assign roles — first responder, investigator, evidence custodian.
• Risk assessment: plan for encryption, remote wipe, and volatile data before arriving on scene.

C. Understand first response

First response is the earliest on-scene action, where evidence is most fragile.

• Secure the scene: restrict access, photograph the setup, and document device states.
• Volatile capture: if the system is running, image RAM, list active connections and processes before shutdown.
• Power decision: pull the plug for desktops to prevent malicious shutdown scripts; use graceful methods where volatile keys matter.
• Documentation: record every action with time, tool, and operator to open the chain of custody.
• Rule: the first responder must minimise changes — an ill-judged mouse click can overwrite evidence.

D. Understand the investigation phase

This is the core acquisition and analysis stage performed in the lab.

• Imaging: create a bit-stream copy through a write-blocker and verify by hash.

Verify integrity:
  hash_original  = SHA-256(source_disk)
  hash_image     = SHA-256(forensic_image)
  admissible     = (hash_original == hash_image)

• SHA-256: 256-bit cryptographic digest; identical hashes prove the copy is bit-for-bit faithful.
  • Examination: recover deleted files, carve unallocated space, parse registry and logs, and reconstruct a timeline from timestamps.
  • Analysis: correlate artefacts to establish who did what, when, and how, distinguishing fact from inference.
  • Working copy only: all analysis runs on a verified duplicate so the original stays pristine.

E. Understand the post-investigation phase

This phase converts technical findings into legally usable output.

• Reporting: produce a clear, factual report — methodology, tools, hashes, findings, and conclusions — understandable to a non-technical court.
• Expert testimony: the investigator may explain findings under oath, defending method and integrity under cross-examination.
• Evidence retention: store originals securely for the retention period; log any access.
• Review: conduct lessons-learned to refine SOPs and strengthen future forensic readiness.