What is the core idea of Locard’s Exchange Principle?
“Every contact leaves a trace.” Evidence is transferred in a two-way exchange between the perpetrator, the victim, and the scene.
In the physical world, what are the two types of trace evidence according to Locard?
Physical - hair, fibres, glass
Biology - blood, saliva, skin cells
How does Locard’s principle apply to the digital world?
A trace is “any modification, subsequently observable, resulting from an event.”
A digital trace is “a change to the state of a computer system resulting from user actions.”
Two-way exchange (digital)
Data left behind
Data taken
Give examples of data taken vs. data left in digital forensics
Left: Logs, metadata, browser history.
Taken: Exfiltrated files, cloud sync data, downloads.
List types of digital evidence with examples (5)
Files/data residues - temp files, cahce, browsing history
Logs - audit logs, systems
Metadata - GPS, device info, timestamps
Network traffic - data packets, IP addresses
Device forensics - call logs, drives
Define Digital Forensics
The process of determining past actions on a computer system using preservation, collection, validation, and analysis to reconstruct events.
What are the key processes involved in a DF investigation?
Preservation, collection, validation, identification, analysis, interpretation, documentation, and presentation
List technological challenges for digital forensics (3)
Speed of technology changes
Criminal/public awareness
Communications ….
Why is encryption a challenge for digital forensics?
It makes data unreadable without the specific key, hindering the analysis and interpretation stages
What are the main forensic requirements for evidence in court?
Documentation of process & ownership
Who did what to collect & analyse
Reliable & repeatable analysis
Open to challenge & criticism
Name common ways digital forensic investigations can go wrong. (5)
Crime scene mishandling
Not safeguarding evidence
Allowing systems to change/overwrite data
Inappropriate tools
Assumptions/cognitive bias
What is Cognitive Bias in forensics
A pitfall where an investigator makes assumptions or interprets data to fit a preconceived theory rather than following the evidence.
What do the ACPO principles govern?
Good practice guide for computer-based electronic evidence – ensure integrity of digital evidence for court
State ACPO Principle 1
No action by law enforcement/agencies should change data on computer or storage media that may be relied upon in court
State ACPO Principle 2
If accessing original data is necessary that person must be competent and explain relevance/implications in evidence
State ACPO Principle 3
An audit trail/record of all processes must be created and preserved. An independent third party should be able to examine those processes and achieve the same result
State ACPO Principle 4
The person in charge of the investigation (the case officer) has overall responsibility for law adherence and these principles
What are the four main ways digital forensics helps?
Attribution (who did what, where, when, how, why?)
Reconstruction (understanding crime)
Prevention (pre-emptive)
Prosecution (reporting results)
List the four core processes in digital forensics
Collection: identify, secure, store evidence
Examination: obtain & explain info from devices/data
Analysis: significance & probative value
Reporting: process, record, testify
In what types of cases/applications is digital forensics used?
Digital-enabled crimes (devices help commit crime)
Digital crimes (only exist digitally)
E-discovery (civil disputes, forensic readiness)
Intrusion investigation (digital security)
Magistrates’ court
Start of most criminal cases
Crown Court
Serious offences, appeals/sentencing from magistrates
County Court
Civil matters (e.g. debt recovery, compensation, trespass orders)
-
Week 1 - Intro35
-
Week 2 - Digital Forensics Process27
-
Week 3 - Disk and Filesystem Forensics57
-
Week 4 - Data Encoding and Basic File Forensics20
-
Week 5 - Documents, Emails and Image Forensic32
-
Week 6 - OS and Memory Forensics35
-
Week 7 - Network Forensics36
-
Week 8 - Mobile Forensics35
-
Week 9 - Case Studies, Challenges and Legal Aspects5
