Risk sensitive digital evidence collection

Kenneally, Erin; Brown, Christopher

doi:10.1016/j.diin.2005.02.001

Cited by 49 publications

(22 citation statements)

References 1 publication

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Traditionally, write-blocking hardware combined with bit-stream image copying processes is used (Kenneally & Brown, 2005). This is considered to allow data recovery and is believed to enhance validation of the reliability, accuracy, and completeness of the recovered evidence (Kenneally & Brown, 2005).…”

mentioning

confidence: 99%

Solid State Drives: The Beginning of the End for Current Practice in Digital Forensic Recovery?

Bell¹,

Boddington²

2010

JDFSL

View full text Add to dashboard Cite

Digital evidence is increasingly relied upon in computer forensic examinations and legal proceedings in the modern courtroom. The primary storage technology used for digital information has remained constant over the last two decades, in the form of the magnetic disc. Consequently, investigative, forensic, and judicial procedures are well-established for magnetic disc storage devices (Carrier, 2005). However, a paradigm shift has taken place in technology storage and complex, transistor-based devices for primary storage are now increasingly common. Most people are aware of the transition from portable magnetic floppy discs to portable USB transistor flash devices, yet the transition from magnetic hard drives to solid-state drives inside modern computers has so far attracted very little attention from the research community.Here we show that it is imprudent and potentially reckless to rely on existing evidence collection processes and procedures, and we demonstrate that conventional assumptions about the behaviour of storage media are no longer valid. In particular, we demonstrate that modern storage devices can operate under their own volition in the absence of computer instructions. Such operations are highly destructive of traditionally recoverable data. This can contaminate evidence; can obfuscate and make validation of digital evidence reports difficult; can complicate the process of live and dead analysis recovery; and can complicate and frustrate the post recovery forensic analysis.Our experimental findings demonstrate that solid-state drives (SSDs) have the capacity to destroy evidence catastrophically under their own volition, in the absence of specific instructions to do so from a computer.

show abstract

mentioning

confidence: 99%

Solid State Drives: The Beginning of the End for Current Practice in Digital Forensic Recovery?

Bell¹,

Boddington²

2010

JDFSL

View full text Add to dashboard Cite

show abstract

“…Kenneally and Brown [9] argue that partial acquisition of a source can also be used as valid evidence. When acquiring data from live network sources, this selective collection is indeed the only feasible method.…”

Section: Integrity and Protection Of Collected Datamentioning

confidence: 99%

“…However, not all non-authoritative sources may be useful for evidential purposes. For example, a web browser cache 9 , corporate web proxy cache, or poorly updated server may contain stale or outdated evidence.…”

Section: Identifying Authoritative Sourcesmentioning

confidence: 99%

Improving evidence acquisition from live network sources

Nikkel

2006

Digital Investigation

View full text Add to dashboard Cite

The pervasiveness of network technology is causing a shift in the location of digital evidence. What was once largely found on individual disks tied to single individuals is now becoming distributed across remote networked machines, under the control of multiple organizations, and scattered over multiple jurisdictions.The network interactions between these machines are also becoming recognized as a source of network evidence. These live network sources of evidence bring additional challenges which need to be addressed. This paper discusses these issues and suggests some improvements in the methods used for the collection of evidence from live network sources.

show abstract

“…Eckstein and Jahnke [68] present a study on data hiding in journaling file systems, Gupta et al [92] study hidden disk areas in a hard disk, Barik et al [13] propose a methodology to preserve authentic date and timestamps (ADTS) in EXT2 file system for forensic purposes and Schatz et al [182] propose a method for establishing timestamp provenance in digital evidence by corroborating system timestamps with a universal source such as NTP timestamps. Kenneally and Brown [107] present a risk sensitive approach to evidence collection while adhering to a legal framework and Johnston and Reust [106] highlight the importance of evaluating evidence in a network intrusion case study. Casadei et al [42] present an overview of the SIM card forensics, Laurie [117] analyzes the forensic scope for Bluetooth technology and Nutter [155] examines TomTom records for identifying locations.…”

Section: Forensic Acquisition Toolsmentioning

confidence: 99%

Digital forensic research: current state of the art

Raghavan

2012

CSIT

115

View full text Add to dashboard Cite

Abstract-Digital Forensics is the process of employing scientific principles and processes analyze electronically stored information to determine the sequence of events which led to a particular incident. In this digital age, it is important for researchers to become aware of the recent developments in this dynamic field and understand scope for the future. The past decade has witnessed significant technological advancements to aid during a digital investigation. Many methodologies, tools and techniques have found their way into the field designed on forensic principles. Digital forensics has also witnessed many innovative approaches that have been explored to acquire and analyze digital evidence from diverse sources. In this paper, we review the research literature since 2000 and categorize developments in the field into 4 major categories. In recent years the exponential growth of technological has also brought with it some serious challenges for digital forensic research which is elucidated. Within each category, research is sub-classified into conceptual and practical advancements. We highlight the observations made by previous researchers and summarize the research directions for the future.

show abstract

Risk sensitive digital evidence collection

Cited by 49 publications

References 1 publication

Solid State Drives: The Beginning of the End for Current Practice in Digital Forensic Recovery?

Solid State Drives: The Beginning of the End for Current Practice in Digital Forensic Recovery?

Improving evidence acquisition from live network sources

Digital forensic research: current state of the art

Contact Info

Product

Resources

About