Forensic Toolkit – What’s in It?

In the world of digital forensics, the well prepared investigator needs a forensic toolkit. The tools that this person will use will help her or him gather evidence of white collar crime or fraud, document the evidence of the occurrence, and, perhaps, place that investigator on the witness stand for expert testimony in what ever legal proceedings come out of the process. The tools used by these investigators are primarily software tools, though there are a few hardware considerations as well.

The basic computer forensic toolkit will probably be contained on a CD or DVD and be presented primarily in a word processing format. Any computer forensic investigation produces a mammoth amount of paperwork, since the goal of the investigation is to document absolutely everything that is found. These toolkit CD’s are designed to supply the investigator with tried and true forms and templates that will allow to investigator to document everything that is found. They also serve as an effective check list to aid the investigation team in ensuring that no step is missed and that everything is done in the correct order.

Another major component of the toolkit will be templates and tools to assist in the presentation of the findings of the investigation to management. It is vital that all findings be reported in a manner that is professional, unbiased, complete, and scientifically sound. This is the end product of the investigation, and what management sees as being what they paid the investigators to actually do. This reporting may also end up being the basis (and exhibits) of the legal proceedings that may arise from the process, so it is vital that these reports and presentations be accurate, clear, and completely aligned with the law.

The main non software tool that is used in a computer forensic toolkit is an imaging device. Making an exact image of the hard drive (or other storage medium) of the computer is the most common first step in the capture of data. It is absolutely required that a “clean” copy of the computer’s memory and stored data be in place, so that the investigators are sure that they are looking at and analyzing the data in the same precise pattern in which it occurs on the computer in question. There are many brands of device available, and they all have the same basic function.

First, these devices must make an exact copy of the data. Secondly, the usually perform the copy at the sector level of the disk as a bit stream process (as opposed to a simple file copy process). This method makes a more complete and accurate copy of the data, which, in turn, allows for a more thorough and accurate analysis.

Computer Forensics – Criminal vs Civil – What’s The Difference?

In the field of computer forensics, as in the field of law, procedures in civil cases differ somewhat from those in criminal cases. The collection of data and presentation of evidence may be held to different standards, the process of data collection and imaging can be quite different, and the consequences of the case may have very different impacts.

A couple of quick definitions may be in order. Criminal law deals with offenses against the state – the prosecution of a person accused of breaking a law. Such offenses may of course include crimes against a person. A government body, or the representative of a government body accuses the person of having committed the offense, and the resources of the state are brought to bear against the accused. Guilty outcomes can result in fines, probation, incarceration, or even death.

Civil law covers everything else, such as violations of contracts and lawsuits between two or more parties. The loser in such a dispute often must give payment, property or services to the prevailing party. Imprisonment is not at issue in civil cases. As a result, the standard for evidence is not as high in civil cases as in criminal cases.

For the law enforcement computer forensics specialist, a certain amount of extra care should be taken in collecting data and producing results, for the standard of proof is higher. There are advantages on the data collection end, however. For once a court has authorized a search warrant, an officer (and possibly several) with badge and gun can go seize the defendant’s computer by surprise and by force. Once the computer has been seized and imaged, all data is accessible and may result in additional charges being brought against the defendant.

By contrast, in a civil case, there tends to be a lot of negotiation over what computers and what data can be inspected, as well as where and when. There is not likely to be any seizing of computers, and quite a long time may take place between the time the request to inspect a computer is made and the time the computer is made available to be inspected. It is common for one party to have access to a very limited area of data from the other party’s computer. During this time, a defendant may take the opportunity to attempt to hide or destroy data. The author has had several cases wherein the computer needed for analysis was destroyed before the plaintiff had the opportunity to inspect. Such attempts at hiding data are often discovered by the digital forensic sleuth, who may in turn present evidence of such further wrongdoing in expert witness testimony.

Opportunities for learning techniques and interacting with other professionals may differ as well. While some computer forensic software suites and training, such as Access FTK, EnCase, or SMART Forensics are available to most who can pay, others, such as iLook are available only to law enforcement and military personnel. While many support and professional organizations and groups are available to all, some, such as the High Technology Crime Investigation Association (HTCIA) are not open to professionals who provide for criminal defense (with a few minor exceptions).

When law enforcement has a case involving computer forensics, the intention is to locate enough data to find the defendant guilty in court, where the standard for information presented tends to be fairly high. From the time digital data or hardware is seized and acquired, Rules of Evidence must be kept in mind (Cornell University has the complete and voluminous code on its website). Law enforcement personnel must follow accepted procedures or evidence could be thrown out. Acquisition of data and discovery in criminal cases often must follow sometimes strict and differing procedures depending upon whether the jurisdiction is federal, state, or municipality and at times depending upon a judge’s preferences.

In a civil case, the initial processes of electronic discovery may be just to find enough data to show one or the other party whether they are likely to prevail, should the case go all the way to court. As such, the initial presentation of data may be fairly informal, and be just enough to induce the parties to settle the case. On the other hand, the data found may be so minimal the line of inquiry into electronic evidence is dropped.

Although we use many of the same tools, computer forensic professionals in private practice and those in law enforcement are held to different standards, have access to different resources, and their work results in substantially different outcomes between the criminal and civil cases to which they contribute.