CO2517 Digital Evidence 2023 Part 1

Which of these is NOT an example of Digital Evidence

• E-mails and attachments

• Event logs

• Printed, faxed or scanned documents

• Telephone logs

• DNA, fingerprints, or blood samples

Answer explanation

Digital evidence refers to any information or data that is stored or transmitted electronically and can be used in a court of law to support or refute a legal case.

Physical evidence - Evidence that can be seen, touched, or analyzed in a laboratory, such as DNA, fingerprints, or blood samples.

Match the ACPO principle to the definition

• Where it is necessary to access original data 'live' - a component person must do so.

• ACPO Principle 3

• No action taken should change data held on a computer which may then be relied upon in court.

• ACPO Principle 1

• An audit trail or other record of all processes applied, recorded, and preserved.

• ACPO Principle 4

• The person in charge of the investigation has overall responsibility to ensure all laws are followed

• ACPO Principle 2

Answer explanation

ACPO Principle 1 • No action taken should change data held on a computer or storage media which may subsequently be relied upon in court

ACPO Principle 2 • In circumstances where a person finds it necessary to access original data held on a computer or on storage media, that person must be competent to do so and be able to give evidence explaining the relevance and implications of their actions

ACPO Principle 3 • An audit trail or other record of all processes applied to a computer-based electronic evidence should be created and preserved.

ACPO Principle 4 • The person in charge of the investigation has overall responsibility for ensuring that the law and these principles are adhered to.

Which of these is not a test of evidence admissibility?

• Weight of evidence

• Authenticity/integrity

• Hearsay

• Proper handling

• Credibility

Answer explanation

Credibility - The credibility or believability of evidence is also a matter for the trier of fact to decide and is not considered a test of evidence admissibility.

Which document records the transfer of evidence?

• Audit Trail

• Chain of Custody

• Evidence Tags

• Evidence Logs

Answer explanation

Chain of Custody It is a document that records the transfer of evidence It should provide the chronology of the movement and handling of the potential digital evidence up to its current state

How can we resolve the issue of collision attacks by just using MD5 or SHA-1, to confirm evidence integrity?

• Two (or more) hash algorithms are often used.

• The hash is ran more than once.

• The integrity is confirmed throughout the process

Answer explanation

Although largely used, these algorithms are known to be subject to collision attacks since 2005/2006 − i.e., two different files can be manipulated to generate matching hashes

• To address this issue, in Forensics, two (or more) hash algorithms are often used − Some tools automatically generate MD5 and SHA-1 hash values and others allow the selection of algorithms.

What is the purpose of the Chain of Custody ? Choose three

• All analysis activities are recorded step by step.

• Legal requirement to show any transfer of ownership must be well documented.

• Accountability is recorded

• This will also be used to strengthen the assurance of Principle 1, 2, 3 & 4

Reorder the following actions in this Audit Form.

• Confirm HDD is attached to your analysis unit correctly and in read only configuration, prior to powering up.

• Power up HDD and begin analysis

• Confirm the evidence bag and chain of custody are valid

• Confirm HDD external details/marks etc

• Remove HDD from evidence bag

Why are audit forms vital? Choose two answers

• – Demonstrates all actions taken to comply with Principle 3.

• Evidence Handling Process is overseen and reviewed

• Actions can be reviewed to ensure company framework /processes were compiled with or progress status

• Legal requirement to show any transfer of ownership must be well documented

A dead acquisition is performed while the storage medium (e.g., a computer) is​ (a)  

• powered  off
• powered on
• unavailable

Reorder these in terms of volatility in a live analysis event. Starting with the most volatile.

• Solid-state drive (SSD) data

• Temporary files

• System memory (RAM)

• Network connections, routing and ARP cache tables

• Cache

Answer explanation

Generally, volatile data is more likely to change or be lost than non-volatile data, so volatile data should be collected first. The order of volatility typically starts with data that is most volatile, such as data that resides only in memory, followed by data that is less volatile, such as data stored on hard drives or other persistent storage media.