Computers have been used to locate digital evidence for decades. Methodologies have been developed to seize, extract, analyse and present digital evidence and courts have become accustomed to seeing this form of evidence. To assist in the capture and analysis of the wide range of computer-generated evidence, forensic tools such as EnCase^[1], Forensic Tool Kit (FTK)^[2], and Cellebrite^[3] have entered the market and developed as new generations of Operating Systems and technology have evolved.

The time taken to conduct such an investigation is dependent on the size of the drive(s) of the target device (computer) and how deep an analysis is required. The digital examiner can greatly contribute to the progress of your investigation; however, they need direction as to what you are looking for. For example, if they are looking for a single image, the examination stage may be very quick. If they are seeking evidence of computer hacking or complex fraud, this examination may take several days or more.

Computers are everywhere and we are familiar with desktops, laptops and mobile devices. These have large storage capacity, which is increasing exponentially every year, and the way cybercriminals are using these devices is also expanding exponentially. Cloud services connected through the computer contain vast amounts of additional storage, and the evidence you suspected was held in the device may actually be stored within a cloud service accessed through that device. Your digital evidence across a wide range of devices is now stored in these cloud computing services, and the digital investigator needs to be able to operate in this environment as effectively as they do with any other digital device located within a home or office.

Cloud services include the more well-known services such as Microsoft 365 which contains a suite of workplace applications such as Word and Excel, and data storage services such as Dropbox. Apple, Google and Amazon are other major corporations offering cloud storage services. Businesses and individuals purchase cloud services ranging from the use of pre-supplied applications and storage with larger organisations that rent large volumes of empty storage and customise their computer needs to their specific requirements.

A computer is often a tool of the trade of a criminal, whether that is a stalking offence, identity theft, trading criminal products and services or the commission of any offence involving misleading documentation/communication. It is also often used to research the steps involved in the commission of a physical crime or the many offences involving social media. The computer can capture evidence that the person of interest may be unaware of, including search inquiries, log files and web browsing history.

Digital forensic examinations

The art of conducting digital forensic examinations has become a specialist position entrusted to investigators who have developed levels of expertise such as passing intensive training courses as well as courses dedicated to a single or range of forensic tools. They have undertaken extensive courses of study and learnt from the professionals how to conduct their duties to the highest possible standard, how and where to locate their digital evidence and present it in a manner that is understandable to those who do not have their level of technical knowledge or skills. Courts expect to see this form of evidence captured, processed, stored and presented in a manner which they can rely upon as an accurate representation of the evidence which is effectively stored on devices in 0’s and 1’s.

At the completion of a digital forensic examination, detectives receive reports from their examiners which provide leads and evidence of the offence under investigation. However, often despite the best efforts of the examiner, the reports are complex as they serve many audiences as well as the investigator, such as the courts, lawyers, and other technical witnesses. The technical report is evidence in its own right and has to be specific as to its findings and relevance, meaning the digital examiner has to be very precise in their statements and use the appropriate technical language as required. This does not always make easy reading for non-technical audiences.

The detective is expected to be able to understand the report and assimilate it into their investigation. As digital forensic technology uses different terminology than that known to many detectives and civilian investigators, this chapter seeks to introduce to the reader the many forms of evidence that may be obtained from a computer, identify what it means and highlight its potential relevance to the investigation. The many forms of digital evidence will increase as technology evolves and the investigator will benefit from having a detailed conversation with the digital examiners as to what evidence the computer examination can produce before the forensic investigation process commences. With this information, the detective can have a greater understanding of the evidence that may be obtained from a computer and be more precise in what they can ask their forensic investigator to look for in their formal request. The terminology in this chapter is intended to be read and understood by a non-technical audience.

Seizing digital evidence requires more care than most physical items. This is due to the volatile nature of the data operating and stored within a device or network. Obtaining the support of digital forensic experts at the scene alleviates the investigator from the immediate complexity of seizing this evidence and ensures best practice is used. The detective may concentrate on other areas of practice at the scene including speaking to complainants, witnesses, or suspects, obtaining reports from the search team and overseeing team safety, safe in the knowledge the complex technical evidence capture is being conducted by the team expert.

However, not all scenes will have the luxury of having experts in digital evidence available and the investigator will be required to identify digital evidence and seize it in a forensically sound manner as explained later in this chapter.

Other digital devices

Scenes may contain many variations of computers including the familiar-looking desktop computers and laptops, but smaller variations of computers exist such as the Raspberry Pi and the Apple Mac Pro. It is worth being aware computers come in many shapes and forms. Digital storage devices such as USB’s and external hard drives can also be spread throughout crime scenes. In some instances, CDs and DVDs may be found containing digital evidence, especially when detectives are searching for evidence of serious crimes such as possession of Child Exploitation Material (CEM). Initial consideration may be that these forms of data storage are old and not used by suspects any more, however, images of CEM downloaded and stored ten years ago on a CD are as much an offence as those downloaded today and stored on a modern data storage device.

At a scene, it is worth conducting an audit of the technology present and gaining an understanding of what each item does, why it is present, what it records and how it may advance your investigation. Identifying all the connected devices within a smart home may be challenging, however, reviewing the list of devices connected through the Wi-Fi modem/router provides a good starting point. This is discussed in Chapter 11.

Individual jurisdictions have their own rules on what the courts require and the manner in which evidence is seized, preserved, examined, and presented in court. It is the investigators’ responsibility to understand these rules and laws and ensure they are adhered to. The investigator is also required to ensure they keep up to date on the changes to laws and requirements of the courts in the jurisdictions they operate within.

As digital devices are collected, they are to be treated as any other form of evidence, with the understanding that this form of evidence may be highly volatile and subject to remote interference by the device owner or accomplice. Computers provide their own integral threats to the detectives’ investigation as evidence can be easily lost and/or damaged. Digital evidence is easily tainted, and remote access to a connected device where evidence resides is a high-risk environment where evidence can be damaged or destroyed. Remote access to the computer is a hazard and suspects or their associates can log onto the accounts/device of the suspect and delete data whilst the detective is standing next to the device. Also, shutting down a device at the scene for seizure and later analysis deletes potentially valuable evidence such as passwords located in the device’s memory. Obtaining advice from a digital forensics expert prior to the seizure of such evidence is an investment in your investigation.

Suspects wearing smart devices within the scene or when encountered will need to be identified early in the scene search or interview with the technology seized and preserved. Chapter 8 discusses wearable technology and provides examples of the digital evidence of technological devices people can wear as clothing or accessories, as well as implanted into the body such as under the skin within the palm of the hand. There will be obvious logistical difficulty involving the seizure of implantable devices.

Computer Operating Systems (OS) vary by manufacturer and device (for example, desktop, laptop, mobile, server) with industry leaders such as Google, Apple and Microsoft regularly updating their OS. Subsequently, there are many versions of these popular operating systems on the market with many dating back several versions. Another popular OS is Ubuntu which has a very loyal following of Linux users.

What does a detective/investigator need to know about a computer device?

The following section provides a series of considerations a detective or civilian investigator needs to think about before seizing digital evidence from a scene. Many of these considerations are standard to any form of evidence and will be familiar to the experienced investigator, however, are listed for general knowledge.

Initial evidence possession actions

Other considerations regarding seized computers

A goal is to have the evidence as it was when the suspect or device owner last operated it. There should be no changes to the device and/or its operating system. This is where the role of the digital examiner is of immense value as they have the training to ensure there are no changes to the device system files which could potentially contaminate the evidence. If there are any changes such as the shutting down of the device through the formal shutdown procedures, file changes can be easily explained.

There will be instances where the computer to be seized cannot be removed from its location such as the server of a business that is making a complaint. Alternatively, the computer may be a critical part of the functioning of the network and its removal would harm the operation of the business. In a perfect world, the server would be fully imaged, and the image taken for examination, however in reality, this is often not practical as the storage and memory within a server are often beyond the realistic storage capability of the investigation team and the time taken for a full forensic image is prohibitive.

Where can evidence be found on a computer?

Computers contain potentially large volumes of evidence that can support and advance an investigation. This section provides directions as to the evidence that may be located on a computer and how it can be incorporated into an investigation. The lists are not static as new OS are developed and features are added and removed. Also, investigations are varied, and other locations of evidence may be identified and relevant in that instance. However, it is useful to have a starting point of understanding the many examples of evidence a computer device may provide and include the potential of this evidence in your investigation plan.

Operating System

The Operating System (OS) is the basis of a computer system in which applications operate. Common operating systems for computers include the Microsoft Windows range and the Apple Mac OS. Ubuntu is also a very popular Linux OS. Loading of the OS is one of the first activities a computer undertakes when it is powered on, and applications are installed once the OS is loaded and operational.

The OS is important to the examination of the device, as although evidence such as photos and documents may be installed well after the OS is operating, the OS will provide valuable information about the activity involving these documents and images as well as details on the operation of the device.

Digital evidence that the digital examiner can locate for you from the OS includes:

• • • Date and time on the device which can be the default times, user configured or synchronised through the internet.
    • Details on the OS including version numbers. This can help identify a unique device on a network.
    • Time zone the OS is configured as. This can be a default setting, user-configured or synchronised through the internet.
    • When an OS was installed. This may be useful to the investigator when there has been a suspected OS reinstall to delete evidence.
    • A Windows OS formatted with a New Technology File System (NTFS) file system will include a Master File Table (MFT) which contains a record of each file and folder that were ever present on the device, listed in the order in which they were created on the device. This can help an investigator identify the date and time files were created on the device and identify the presence of files that have since been deleted.

Application details

Applications are computer programs that provide functionality to the OS. A common application is the Microsoft Office suite of programs such as Word and Excel. Other examples of applications include databases, email and accounting packages.

Device logs

A computer log is a record of an activity on a computer. The OS creates many logs which may be of benefit to the investigator. Computer logs are considered to be one of the most important sources of evidence of digital devices as they record the essential activities on the system.^[4]

Within a Windows device, event logs capture and record activities within the device as generated by the user, applications, or the OS. They are useful as they can be used to reconstruct an event.^[5]

These record significant events, and are stored under the following headings on a Windows device:

• • • Application logs: Records events as generated by the activity of applications.
    • Forwarded events: These are logs collected that have been generated by remote computers on the network.
    • Security logs: Windows system logs events of suspected security-related events.
    • Setup logs: Contains events relating to the setup of applications.
    • System logs: Records events logged by the Windows system components^[6]

As events occur, they generate a unique number which is an event code. The code describes an event that has happened, such as event code 4720 identifying a new user account created on the device. Event codes provide a valuable understanding of events as they occur.

Another example of valuable log data is when a USB or external device is attached, information about that device is stored including its unique identifier, where available. To the investigator, this is valuable information as it provides a link from the device to a uniquely identifiable external storage device where a copy of valuable Intellectual Property may be stored. An examiner may identify from the OS the external device identifier such as a serial number and see whether that device has been attached to the OS.

Documents and spreadsheets

Documents and spreadsheets are common sources of evidence in the investigation of financial crimes. Corporate investigations conduct a comprehensive analysis of documents. Documents may also apply to other investigations such as identity theft and the creation of fraudulent identities. Understanding the evidence that may reside within documents and financial records is the cornerstone of many of these forms of investigation.

Several of the items listed in the schedule were mentioned in the previous section “Application details”, however, as they are highly relevant to this section, they are included for completeness.

Examples of evidence that may be found within a document or spreadsheet include:

• • • Content of document/spreadsheet.
    • Date and time the document or spreadsheet was created.
    • Details about who the application such as Microsoft Word/Excel is registered to (Company/individual/fake name).
    • Details of who has last modified a document and when.
    • Details of an image being modified by a program such as Photoshop.
    • File and folder size.
    • Folder name. This is a unique name generated by the user unless they have copied a folder completely from another source. If the folder name bears no reflection on what is in it, it indicates an intention to hide the folder’s contents.
    • Location sourced including recycle bin.
    • The number of times it has been accessed. Regularity of access shows the level of interest a person may have in an image or document.
    • Previous versions of a document (Not always available).
    • Whether a document or image has had its extension changed. This tactic is used to hide data potentially damaging to the device owner.

Relevant questions:

• • • Has the file or folder been renamed? A file name change can be seen as evidence of knowledge of the file and its contents.
    • How many times has it been accessed and by whom?
    • Was it a user-generated document/spreadsheet or downloaded?
    • When was it last accessed?
    • When was it last saved?
    • When was the document/spreadsheet last printed?
    • Who created the document or spreadsheet?
    • Who has viewed the document/spreadsheet?
    • Was the document/spreadsheet created on the device or copied from another location?
    • Were temporary files created when the application was in use?

Emails

One of the interesting things about email communication is it provides information about the writer as well as their relationship with the recipient. Emails can be rich in metadata and are useful for linking a person to the originating computer at a specific time.

Emails may be found on a computer using a local service or linked to a cloud computing service such as Microsoft 365. Alternatively, emails may be found in free web-based services such as Gmail, Yahoo or Hotmail.

The information that can be obtained from an email includes:

• • • Attachments to other sites of relevance to the communication.
    • An understanding of the relationship between sender and the receiver.
    • An understanding of the motivations of the sender and the receiver.
    • Dates of communication.
    • Email trail of communication showing how a conversation has progressed and dates and times of communication. The gaps in time from email receipt to reply may provide some guidance to the importance of the communication to the parties which can be confirmed in the message contents.
    • Information as to whether the email address has been modified to that which is shown (Within the email header).
    • Links to other events.
    • Links to other people.
    • Links to other sites of relevance to the communication.
    • Looking at the account details of a web-based email account such as Outlook or Gmail may find other email accounts or phone numbers used for account recovery, opening new lines of investigation.
    • Message contents that may provide evidence of the matter under investigation or motivations of persons who are party to the communication.
    • Message subject.
    • Others copied into the communication and their email addresses.
    • Receiver email address.
    • Route an email has travelled through including time stamps (Within the email header).
    • Sender email address.
    • Sender’s Internet Protocol address (Within the email header).
    • Signature blocks may provide extra information such as phone numbers.
    • The email address can be used to locate online accounts linked to the subject. This is discussed in the chapter on open-source evidence.
    • Time zone they are located in (Within the email header).
    • The application used to send the email for example Outlook and the version number (Within the email header).
    • Uncommonly used words that may link to an individual.
    • User or nicknames used in communication.
    • Words repeatedly misspelt which may help in providing a unique identifier as to the writer.

The metadata available from web-based email services may be restricted due to the protocols of the service provider. So, in some instances, examination of the email on a web-based service may provide excellent metadata evidence, however, the exact same examination on a competing web-based service can provide literally no metadata evidence of any value.

Files and folders

Folders are where documents or images are stored. The name of a folder or file may be indicative of the contents, or it may be an innocuous name aimed at diverting the attention of anyone viewing it.

Files and folders are generally created by the user but can be imported from an external source which can indicate that they are of importance to the device owner or user account.

Evidence that may be obtained from folders and files includes:

• • • Dates, times and number of views of folders and files. This can show the significance of a file or folder to the user or whether a folder or file has been downloaded accidentally using a service such as a Peer-to-Peer network and deleted once they find it contains unlawful content such as Child Exploitation Material (CEM).
    • Details on files and folders which have been copied from the computer including the device to which they have been transferred.
    • Encrypted folders.
    • Files downloaded from online sources. These can show a specific decision by the account user.
    • File extensions changed in an attempt to deceive investigators, i.e. extensions that are not identified by the forensic software.
    • Files and/or folders transferred to or from an external device.
    • Files that were opened remotely.
    • Folder names which have been created by a user. These may be valuable when people who are in possession of CEM create folders and sub-folders detailing their particular interests.
    • Hidden directories and files. These may show the intent of a user to hide incriminating evidence or a level of technical knowledge.
    • Recently opened files aka “Most Recently Used.” These may be used to show the recent activity of a user including whether folders or files subject to an investigation have been recently viewed by the user.
    • Users who have access to files/folders. On a domestic device, the option to share documents may be open to other people on the network, which is particularly difficult when using an open and shared network such as a public library.
    • Temporary files created when a file is in use.

Images

Images recovered from a computer can provide interesting information. The metadata, also known as Exchangeable Image File (EXIF) stored within an image can provide details such as the camera/phone make and model, its serial number, capture and shutter speed, GPS location where the photo was taken and any camera settings.

This information can link an image found on a computer to the camera/phone that took the photo.

The camera make and model can also be used online to find other images with metadata resident which were taken by the same camera/phone.

• • • Folder names may identify interests by the folders they are stored in, including names.
    • Images stored and in memory.
    • Metadata of camera make, model, and serial number.
    • Sorting of images within a folder including creating subfolders. Particularly with images, users may create sub-folders based on criteria that make sense to them. Viewers of CEM often like to collect a series of images of a child or categorise images under criteria such as age, gender, location etc. This shows deliberate action by the user and removes the defence of having no knowledge that the images were on the computer.
    • The file log may also provide evidence of the times the sub-folders were created, and when the images were moved into the folders.

Also:

• • • When images were accessed and how often.
    • When images were downloaded.
    • Whether the images were altered by applications such as Photoshop.

Internet history and usage

A person’s internet history provides insight into the person they are and can be relevant to the investigation team as they research facets of a crime.

A person’s internet history may produce evidence including:

• • • Access to cloud computing accounts. These may locate new sources of evidence.
    • Bookmarks.
    • Browser configuration details (Can indicate a level of technical sophistication).
    • Browser extensions available from online stores.
    • Browser history.
    • Cookies.
    • Details relating to online chat accounts.
    • How the user reached a specific website for example by typing the URL, clicking a bookmark, via a specific search engine or link.
    • Links to Peer-to-Peer accounts which show a user’s interests including their account search history.
    • Links to online email or storage accounts.
    • Maps history.
    • Number of times a specific site has been visited including dates and times.
    • Passwords stored in web browsers.
    • Peer-to-peer applications.
    • Searches conducted including phrases used. May be valuable in revealing subjects of interest to the user.
    • Thumbnail images and web cache downloaded from the websites visited.
    • Web sites subscribed to, including passwords, may be stored within the browser settings.
    • Web history.
    • When a site was visited and how many times.
    • Whether an image was accidentally downloaded or viewed.

Network

A computer device may be connected to many networks throughout its life.

The evidence available includes:

• • • Connected devices such as printers and external storage device identifiers. External devices may contain further sources of evidence.
    • Every network it has been connected to is retained and is ready to reconnect should the device be within range of the network. This information can provide details as to where the device and user have recently been.
    • For a network device, the Internet Protocol addresses of devices logged into it (local and remote) and details of the device they are using.
    • Network configuration.
    • Networks the device is or has been connected to. This information is called mapped drives.
    • On a network, whether the documents can be shared with other devices on the network.
    • Schedule of those accounts logged on at the time of seizure/examination. This can include those at the location as well as remotely.
    • Unique network connection identifiers are called the Media Access Control Addresses (MAC). A separate MAC address exists for each Ethernet (blue cable), wireless and Bluetooth connector.

Recycle bin

This is where documents, files, folders etc. are placed to be disposed of by the OS. Metadata can show when the item was placed into the recycle bin and where it was resident on the device before being placed into the recycle bin.

A benefit of examining the recycle bin is suspects sometimes do not understand the recycle bin does not usually automatically clear its contents, so documents, images etc they thought had been disposed of may still be easily found. The recycle bin also provides a small insight into the thoughts of the user when they have tried to dispose of data.

The recycle bin can show:

• • • When an image was accidentally downloaded and immediately deleted.
    • Deleted documents and spreadsheets.
    • When and by whom, and
    • Were they recovered post-deletion?

Registry

Within the OS is the registry which provides a detailed level of evidence. The registry is the location where the OS is configured for individual users. Each registered user will have an individual registry entry, and these are created by the device or network administrator who has administrator access. This may provide direction to the activity of a specific user who shares a device such as in an office where desk space and computer devices are shared amongst users. Also, the computer network OS will have a separate registry folder for each of the many users on the corporate network.

The registry stores data of users, devices attached to the OS and peripherals such as printers. It records logs of all activity. You will notice some of the evidence mentioned is similar to that mentioned in the description of OS evidence, however, evidence at this level is more specific to an individual user, especially on a device that is shared amongst multiple users, each of which has an individual account.

This information provides the investigator with unique knowledge about the activities and profile of a specific user and how this user operates through their individual accounts, as they have a unique identifier that is linked to their activity.

Slack space

This is the area of the hard drive that is available to be used to install new applications, store documents etc. It is in effect the space on a drive that is available for storage.

Deleted evidence resides in the slack space. It is not necessarily totally removed from the device unless specific applications such as CCleaner^[7] or Bleach Bit ^[8] have been used to wipe the slack space clean by overwriting it.

This area is an excellent location to find valuable evidence such as deleted images, movies, documents, spreadsheets etc as many people do not understand this evidence can be recovered. Computer logs that have been deleted by an attacker may also be resident in this space. It is a worthwhile investment in time and resources to request your digital examiner to examine the slack space to see what evidence resides there.

As well as locating the evidence, it is also valuable in showing the intent of a person’s attempt to delete what may be considered incriminating evidence.

As this chapter shows, computers have the potential to contain valuable evidence. Experienced criminals will be aware of this and attempt to reduce the potential for this data to be used against them and will regularly clear evidence such as internet history and event logs. Some may change file extensions such as changing an image from the extension .jpeg to .docx in the hope that the investigator looking for suspect images will not look at that file. Experienced digital investigators will be aware of these methodologies and have their own methodologies to identify such evidence. To the investigator this is valuable evidence as it shows a specific attempt by the suspect criminal to hide compromising evidence.

System data including memory

Analysis of the system data and memory includes the examination of volatile data that resides in the device memory which may be lost when a device is turned off.

Examples of data the system and memory may store include:

• • • Commands issued by an attacker will be of value when investigating a data intrusion event.
    • Deleted files.
    • Error codes that show problems with the system or applications.
    • Log files.
    • Malicious software resident on the device.
    • Partitioned section of the drive which may be hidden where criminal offending is stored.
    • Passwords in plain text if recovered from memory prior to the device being shut down.
    • Processes running that can lead to the identification of malware being on the device, its location and when it was installed.
    • When a user has logged on and off.
    • People who have remote access.

As we can see, the computer can present a large volume of factual material to the investigator. It can also present a timeline of activity to show what was happening on the device at a specific time and what the user was doing. For example, a person may deny sending a malicious email from a web-based account at a specific time, however, an examination of the OS timeline shows that they were logged onto the web service when the subject email was sent, and they had their personal online banking open in another window. This helps solve a key question an investigator needs to prove in court which is “Who was using the device at the time a specific event under investigation took place”.

Preparing for challenges 

As discussed, digital evidence is everywhere and can assist your investigation. This chapter has raised considerations that may affect the collection of digital evidence. This section provides several potential problems that may require a plan.

1: Completeness of evidence^[9]

Device storage grows rapidly, and storage limitations seen as acceptable today will be exponentially larger in 12 months. Imaging a complete copy of a storage device may take more time than the investigation team has available, especially when a device needs to be imaged at a specific location.

In this instance, a portion of the device may be imaged after discussions to identify where the evidence is likely to be found. This is not always the best option when seeking completeness of the evidence, but allowances need to be applied for the individual circumstances and environment an investigator may find themselves. A complainant company system administrator may be able to direct the digital examiner exactly to where the evidence is resident meaning a complete image may not be required.

Another factor may be a complainant organisation that has been the victim of a crime may not want the investigation team to have copies of valuable corporate data including Intellectual Property, email communication, personnel records etc.

Computer servers may be shared amongst a multitude of clients. This is particularly so with cloud computing services. Imaging a shared tenancy server will not be practical or legally allowed in many circumstances.

Document the reasons why a complete image was not taken so justification can be provided should you be asked in court why the complete image was not taken. A lawyer for the other party may use the excuse that the valuable evidence that would prove their client’s innocence was not collected or was maliciously excluded. Detailed notes will provide an explanation of the circumstances that existed at the time of evidence capture and the discussions that took place leading to the decisions made.

2: Live forensics^[10]

This involves capturing digital evidence from a device that is not turned off and continues to operate or a network.

Live forensics can involve capturing data as it travels over a network, or from the memory of a device on a network. When a network is under attack from an external attacker, a highly skilled incident responder may capture the attack as it occurs live over the network, thus obtaining evidence as to the methodology of the attacker, their skill set and objectives.

Capturing the contents of the memory of a device provides the opportunity to obtain passwords that will be lost when the device is shut down. This is a particularly valuable consideration when you are at a scene with physical access to a suspect’s computer which is turned on and password access can be obtained.

Computers may operate a virtual instance which will be lost when the device is powered off. There will be only one opportunity to obtain this data and that is at the time of seizing the device before the virtual server or instance is turned off.

3: Volatility^[11]

Volatility refers to data being lost when a device is powered down, a virtual machine is closed or evidence such as computer logs being overwritten. When devices have a small storage capacity, the data can be overwritten quickly depending upon device operator usage.

4: Logical versus physical acquisition^[12]

A logical acquisition involves obtaining only the user data as the examiner is not able to obtain a complete image for reasons such as a complainant’s direction to protect certain information.

A physical acquisition involves a bit-by-bit image of the device and is a more complete standard of digital evidence.

5: Speed of technology evolution^[13]

Technology changes rapidly with OS being regularly updated or replaced. New devices such as Internet of Things devices store little evidence on the physical device, as they use cloud computing services to store the operational data the investigation team requires.

The digital examiner needs to keep up with the many emerging technologies, their file systems and how to obtain digital evidence.

6: Cloud computing services^[14]

There are different structures for Cloud Service Providers (CSP) and the ability to access evidence. These are discussed in the Cybercrime Investigators Manual.

Several considerations include the ability to access the remote storage service, the level of access to computer logs which are often under the sole control of the CSP, the legality of viewing and downloading contents of a cloud account resident within a separate legal jurisdiction as well as the large contents of data which are stored in cloud accounts.

Obtaining digital evidence involves using forensic tools that may not be able to fully access the evidence sought. The tools may also not be known or accepted by the courts.

Key Takeaways

Scenario