Digital Forensics: Image, Network, and Cloud Analysis
Digital Image Forensics
Raw Image File: An unprocessed image format from high-end cameras. It is proprietary and preserves the most complete sensor data. Demosaicing is the process of converting raw sensor data into a standard, viewable image format.
Metadata and File Structure:
- EXIF Data: Stores metadata like camera make, model, and serial number.
- File Header: The beginning portion of a file containing hexadecimal values (e.g., JPEG is FFD8).
- Bitmap Files: Store graphic information as a grid of individual pixels.
- Raster Image: A collection of pixels in rows, optimized for printing.
- Vector Graphic: Uses lines rather than dots to preserve quality.
- Metafile Graphics: Combine raster and vector elements.
Graphic File Types
Standard: PNG, GIF, JPEG/JPG, TIFF/TIF, BMP (Bitmap); .hpgl & AutoCAD .dxf (Vector).
Nonstandard: PCX, RTL, PSD/AI, FH11, SVG, TGA.
File Manipulation and Security
Compression: Coding data into smaller forms to save storage. Lossless (e.g., 7zip) removes no data, while Lossy (e.g., Lzip) permanently discards information.
Steganography: Hiding data in plain sight. Investigators use specialized tools to detect hidden data by comparing altered files to originals.
Bit-Shifting: Shifting binary digits to obscure code. Malware often uses this to evade antivirus detection.
Encryption: Encodes files requiring a password. Investigators may use brute-force, dictionary, profiling, or rainbow table attacks to recover data.
Virtual Machine Forensics
A Virtual Machine (VM) emulates a computer system. Type 1 hypervisors run on bare metal, while Type 2 run on an existing OS. Evidence may exist on both the host and inside the VM. Key files include .vmx (configuration), .vmdk (virtual hard drive), and .vmem (RAM).
Network and Live Acquisition
Live Acquisition: Collecting data from a running system to preserve volatile evidence like RAM. The Order of Volatility (OOV) dictates that the most fragile data is collected first.
Network Forensics: Analyzing traffic to identify intrusions. Tools like Wireshark are used to analyze packet captures (pcap). IDS identifies threats, while IPS actively blocks them.
Cloud Forensics and E-Discovery
Cloud Service Levels: SaaS (applications), PaaS (server/OS), and IaaS (hardware/infrastructure). Cloud forensics involves organizational, legal, and technical dimensions.
E-Discovery: The process of requesting data for litigation. The Electronic Discovery Reference Model (EDRM) provides a framework for processing Electronically Stored Information (ESI) through stages like identification, preservation, and analysis.
Legal and Professional Standards
Legal Frameworks: The Electronic Communications Privacy Act (ECPA) and the Stored Communications Act (SCA) govern access to digital communications. FIRAC (Facts, Issues, Rules, Analysis, Conclusions) is a structured method for legal case evaluation.
Expert Witness Conduct: Examiners must provide truthful, unbiased findings. Disqualification can be avoided by identifying conflicts of interest early and maintaining clear documentation.