Digital Forensics: Principles, Tools, and Procedures

Posted on Feb 26, 2026 in Other university degrees and diplomas

Computer Forensic Services

Computer forensic services involve the professional application of scientific investigation techniques to identify, preserve, extract, and analyze data from digital devices. These services are used to transform raw digital data into “legal evidence” that can be presented in a court of law. For your SPPU exam, remember that these services aren’t just about finding files; they focus on maintaining the integrity of data and a strict chain of custody.

Typical services include:

Data Recovery: Retrieving deleted or corrupted files.
Incident Response: Analyzing a live hack to stop it.
Expert Testimony: Explaining technical findings to a judge.

Professionals in this field use specialized hardware (like write-blockers) and software (like EnCase or FTK) to ensure that the original evidence remains untampered while they work on a forensic bit-stream image.

Applications of Digital Forensics in Military

In a military context, digital forensics moves beyond criminal law and enters the realm of national security, intelligence, and electronic warfare. Here are the primary applications:

Intelligence Gathering (DOMEX): Known as Document and Media Exploitation (DOMEX), military units use forensic tools in the field to rapidly extract tactical data from captured enemy devices (laptops, phones, or GPS units). This provides immediate “perishable” intelligence about enemy positions, plans, or communication networks.
Cyber Warfare and Attribution: When a nation’s critical infrastructure (like power grids or defense systems) is attacked, digital forensics is used to perform attribution. This involves tracing the attack back to a specific state-sponsored group or “APT” (Advanced Persistent Threat) to justify a military or diplomatic response.
Counter-Terrorism: Forensics helps in mapping the digital breadcrumb trails of extremist groups. By analyzing encrypted chats, social media usage, and financial transactions (like crypto-wallets), military intelligence can identify terror cells, recruitment patterns, and funding sources across borders.
Operational Security (OPSEC): The military uses forensics internally to investigate data leaks or “insider threats.” If sensitive blueprints or mission details are leaked, forensic services help identify the source of the breach and determine how the security perimeter was bypassed.
Battlefield Forensics: Modern warfare involves unmanned systems like drones. Digital forensics is used to analyze recovered enemy drones to understand their flight paths, origin points, and the technology used in their guidance systems, which helps in developing counter-measures.

Significance of Data Recovery and Backup

The primary significance of Backup lies in Business Continuity and Risk Mitigation. It ensures that if a system is compromised by ransomware, hardware failure, or human error, an organization can restore operations with minimal downtime (low RTO – Recovery Time Objective) and minimal data loss (low RPO – Recovery Point Objective). In digital forensics, backups are significant because they provide a “snapshot in time,” allowing investigators to compare current altered data with past clean states to detect unauthorized changes or “data diddling.”

Data Recovery, on the other hand, is significant because it is the “last resort” for retrieving evidence that a criminal has attempted to destroy. In a legal context, it allows for the extraction of latent data—information that is not visible to the operating system but still resides on the physical platters or flash cells. Without recovery techniques, critical evidence like deleted chat logs, browsing history, or hidden partitions would be permanently inaccessible to the court.

Various Data Recovery Solutions

Data recovery is generally categorized into two main types based on the nature of the damage: Logical and Physical.

Logical Data Recovery Solutions

This approach is used when the hardware is functional, but the data is inaccessible due to software issues.

File Carving: A technique used to recover files based on their “headers” and “footers” (file signatures) rather than relying on the file system table. This is highly effective for recovering deleted files from unallocated space.
Consistency Checkers: Tools that scan the file system (like NTFS or FAT32) to fix corrupted directory structures or cross-linked files.
Volume/Partition Recovery: Solutions that focus on restoring lost or deleted disk partitions by rebuilding the Master Boot Record (MBR) or GUID Partition Table (GPT).

Physical Data Recovery Solutions

This is required when the storage medium has suffered mechanical or electrical failure.

Component Replacement: Involves replacing failed parts like the read/write head assembly or the PCB (Printed Circuit Board) in a “Clean Room” environment to make the drive temporarily readable.
Chip-Off Recovery: Often used for mobile devices or SSDs, where the memory chip is physically desoldered from the board and read directly using a specialized “chip reader” to bypass a broken controller.
Imaging via Write-Blockers: In a forensic scenario, the first step is always to create a bit-stream image using a hardware write-blocker to ensure the original evidence is not modified during the recovery attempt.

Role of Computer Forensics in Law Enforcement

In modern law enforcement, computer forensics serves as a bridge between high-tech crime and the justice system. It is no longer limited to “cybercrimes” (like hacking); it is now a standard part of investigating traditional crimes like murder, kidnapping, and fraud.

1. Evidence Discovery and Retrieval

The most visible role of computer forensics is the recovery of data that suspects believe they have destroyed. Law enforcement uses specialized techniques like File Carving to retrieve deleted emails, chat logs, and browser histories. This “latent data” often reveals a suspect’s intent, premeditation, or connection to other criminals. For example, search histories can show that a suspect researched “how to bypass a security alarm” or “untraceable poisons” before a crime was committed.

2. Attribution and Suspect Identification

Computer forensics helps investigators answer the question: “Who was behind the keyboard?” By analyzing IP addresses, MAC addresses, and digital artifacts like registry entries or metadata (EXIF data in photos), law enforcement can link a digital action to a specific physical device and, ultimately, a person. In cases of identity theft or online harassment, this attribution is the only way to move the investigation from a screen to a physical arrest.

3. Establishing Timelines and Alibis

Digital devices are persistent witnesses that record time with high precision. Metadata and system logs allow law enforcement to reconstruct a chronological “timeline of events.” If a suspect claims they were at home during a robbery, their mobile phone’s GPS logs, Wi-Fi connection history, or fitness app data (showing steps taken) can either corroborate their alibi or prove they were at the crime scene.

4. Maintaining Legal Integrity (Chain of Custody)

The primary difference between a “tech hobbyist” and a “forensic investigator” is the adherence to legal standards. Law enforcement uses computer forensics to ensure that evidence is admissible in court. This is done through:

Forensic Imaging: Creating a bit-by-bit copy of the original drive so the original remains untouched.
Hashing: Using algorithms (like MD5 or SHA-1) to create a “digital fingerprint” of the evidence to prove it hasn’t been altered.
Chain of Custody: Documenting every person who handled the evidence to prevent claims of tampering.

5. Specialized Investigations

Financial Crimes: Forensic accounting and digital analysis help trace money laundering and “Salami attacks” where tiny amounts are diverted into secret accounts.
Child Protection: Automated forensic tools can scan thousands of images and videos to identify illegal material and trace its distribution source.
Terrorism: Decrypting communications and analyzing “perishable intelligence” from seized mobile devices in the field (often called DOMEX) helps prevent future attacks.

Key Forensic Tools: FTK Imager and EnCase

1. FTK Imager (Forensic Toolkit Imager)

FTK Imager is a data preview and imaging tool used primarily during the Acquisition phase of an investigation. Its main purpose is to create “Forensic Images” or bit-stream copies of a storage device without making any changes to the original evidence.

Key Features: It can create exact copies (forensic images) of local hard drives, floppy diskettes, Zip disks, and even specific folders. It also allows for Live RAM Acquisition, which captures volatile data that would be lost if the computer were turned off.
Integrity Verification: After creating an image, it generates Hash values (like MD5 or SHA-1). These hashes act as digital fingerprints to prove in court that the copy is identical to the original and has not been tampered with.

2. EnCase Forensic

EnCase is considered the “gold standard” of forensic software and is widely used by law enforcement agencies globally. Unlike simple imaging tools, EnCase is a comprehensive Analysis suite that covers the entire investigation lifecycle.

Capabilities: It allows investigators to search for keywords across multiple devices, recover deleted files through File Carving, and analyze the Windows Registry to track user activity. It can process a vast range of file systems (NTFS, FAT32, exFAT, etc.) and even decrypt data if the keys are available.
Reporting: A major advantage of EnCase is its ability to produce automated, detailed reports that document every step of the investigation, which is essential for legal admissibility.

Benefits of Professional Forensics Methodology

Adopting a professional, scientific methodology offers several critical advantages:

Legal Admissibility: The most important benefit is ensuring evidence is accepted in court. Professional methods follow legal standards (like Section 65B of the Indian Evidence Act), making the evidence “admissible.”
Data Integrity & Preservation: It ensures that the original evidence remains unchanged. By using Write-Blockers and Hashing, professionals can prove that the data analyzed is an exact, untampered copy of the original.
Audit Trail and Reproducibility: A professional methodology requires detailed documentation. This creates an audit trail, allowing another expert to follow the same steps and reach the same conclusion, which is vital for verifying the truth.
Bypassing Anti-Forensics: Criminals often use “anti-forensics” (hiding data in slack space, encryption, or steganography). Professional methodologies include specific techniques to uncover these hidden “digital footprints.”
Minimized Bias: By following a structured process, investigators stay objective, focusing on what the data shows rather than trying to “prove” a specific person is guilty.

Steps Taken by a Computer Forensics Specialist

An investigator follows a systematic lifecycle to ensure no evidence is missed or corrupted. In the SPPU syllabus, this is often broken down into these core phases:

Identification: The specialist identifies all potential sources of evidence, such as hard drives, mobile phones, cloud storage, and even “perishables” like volatile RAM data.
Preservation (Seizure): The scene is secured. Devices are seized and placed in Faraday Bags (to block remote wiping signals). A strict Chain of Custody log is started to document every person who touches the evidence.
Acquisition (Imaging): Instead of working on the original device, the specialist creates a “Forensic Image” (bit-stream copy) using a write-blocker. They then calculate a Hash Value (MD5/SHA) to lock the state of the data.
Examination & Analysis: The specialist uses tools like Autopsy or EnCase to search for keywords, recover deleted files (File Carving), and analyze system logs to reconstruct a timeline of the crime.
Reporting & Presentation: Finally, the specialist compiles a detailed technical report. They may also serve as an Expert Witness in court to explain their findings in simple terms to a judge or jury.

Classification of Digital Evidence

In computer forensics, digital evidence is any information stored or transmitted in digital form that has probative value (utility for proving a fact). For your SPPU exam, it is highly recommended to classify these into Volatile and Non-Volatile evidence, as this demonstrates a professional technical understanding.

1. Volatile Evidence (Live Data)

Volatile evidence is data that exists only while the device is powered on. If the system is shut down or “the plug is pulled,” this data is lost forever. In forensic methodology, this is collected first (Order of Volatility).

System RAM (Random Access Memory): Contains active processes, decrypted passwords, clipboard contents, and malware that resides only in memory.
Network Connections: Current connections between the suspect’s computer and other IP addresses, which can prove an ongoing hack or data exfiltration.
Running Processes: A list of every program currently executing, which can reveal unauthorized background scripts or hidden spy software.

2. Non-Volatile Evidence (Data at Rest)

This is “persistent” data stored on physical media. It remains even after the power is turned off and is typically what people think of as “files.”

Active Files: Documents (Word, PDF), spreadsheets, emails, and multimedia (images/videos). These often contain Metadata (data about data), such as the GPS coordinates of a photo or the original author of a document.
System Logs and Registry: Windows Registry files store a history of every USB device ever plugged in, recently opened files, and user login times. System logs (Event Logs) record crashes or unauthorized login attempts.
Browser History & Cache: Includes URLs visited, search queries, and “cookies” that can prove a suspect’s intent or research into a crime.
Hidden/Deleted Data: Digital forensics specialists use “File Carving” to retrieve files that were deleted but not yet overwritten on the hard drive. They also look at Slack Space (the unused space at the end of a file cluster) where data can be hidden.

3. Network and Cloud Evidence

Server Logs: Records from web servers (Apache/Nginx) or email servers that show who accessed a specific account and from where.
Cloud Artifacts: Backups from Google Drive, iCloud, or Dropbox. Since these are stored remotely, they often contain “replicant data” even if the physical phone or laptop was destroyed.

The Digital Forensic Investigation Process

The typical steps followed by a specialist include:

1. Identification and Preparation

The process begins with Identification, where the specialist determines which devices (laptops, mobile phones, IoT devices, or cloud accounts) might contain relevant evidence. This stage also involves Preparation, where the investigator ensures they have the proper legal authority (search warrants) and the necessary tools (forensic workstations, write-blockers) to begin the search without violating privacy laws or contaminating the scene.

2. Search and Seizure (Securing the Scene)

Once the devices are identified, the specialist moves to Search and Seizure. At the crime scene, the specialist must secure the physical area to prevent anyone from touching or remotely wiping the devices. For live systems, they might perform Live Analysis to capture volatile data from RAM. Devices are then tagged and placed in Faraday bags to block all radio signals (Wi-Fi, Cellular), ensuring the evidence remains in its original state during transport.

3. Preservation and Acquisition (Imaging)

A core principle of forensics is “never work on the original evidence.” Specialists use Hardware Write-Blockers to connect the suspect device to their forensic workstation, which physically prevents any data from being written to the evidence. They create a Forensic Image—an exact bit-for-bit clone of the drive. They then calculate a Cryptographic Hash (like MD5 or SHA-1) of both the original and the copy; if the hashes match, it proves the integrity of the evidence.

4. Examination and Analysis

During the Examination phase, specialists use tools like Autopsy or EnCase to uncover hidden data. This includes File Carving (recovering deleted files), checking the Windows Registry for user activity, and analyzing Metadata (timestamps of when files were Created, Accessed, or Modified). In the Analysis phase, the specialist connects these digital “breadcrumbs” to build a timeline of events, attempting to answer the “Who, What, Where, When, and How” of the crime.

5. Reporting and Testimony

The final step is Documentation and Reporting. The specialist compiles a comprehensive, non-technical report detailing every tool used and every action taken. This report must be clear enough for a judge or jury to understand. In many cases, the specialist is called to court as an Expert Witness to provide Testimony, defending their methodology and explaining how the digital evidence proves or disproves the allegations.

Purpose of Collecting Digital Evidence

The primary purpose of collecting evidence in digital forensics is to identify, preserve, and retrieve information from digital devices in a manner that is legally admissible in a court of law. Since digital data is extremely fragile and can be easily altered, deleted, or corrupted, the core goal is to establish the truth of “who did what, when, and how” without compromising the integrity of the original source.

For your SPPU exam, you can explain the detailed objectives as follows:

Proving or Disproving a Fact (Admissibility): The ultimate goal of evidence collection is for it to be accepted by the judiciary. In India, this is governed by Section 65B of the Indian Evidence Act, which requires evidence to be authentic and reliable. Collection ensures that the evidence provides a factual record of events—such as a series of emails, financial transactions, or browser histories—that can either prove a suspect’s guilt or exonerate the innocent.
Attribution and Identity: Collecting evidence helps in attribution, which is the process of linking a digital action to a specific individual. By gathering artifacts like IP addresses, MAC addresses, and user account logs, investigators can move beyond the “device” to identify the “human” behind the keyboard. This is crucial in cases of identity theft, cyberstalking, or unauthorized network access.
Maintaining Data Integrity (Forensic Soundness): A primary purpose of specialized collection (like bit-stream imaging) is to ensure the integrity of the data. By using hardware write-blockers and cryptographic hashing (MD5/SHA), specialists can prove that the digital evidence presented in court is an exact replica of what was found at the crime scene. If the evidence were collected improperly (e.g., simply copying files via Windows Explorer), it would lose its legal value as metadata would be altered.
Reconstructing the Timeline: Digital evidence is collected to perform Event Reconstruction. By analyzing timestamps—specifically MAC times (Modified, Accessed, Created)—investigators can build a chronological sequence of a crime. This helps in determining if a suspect’s alibi is true or if they were active on their computer at the exact time a cyberattack occurred.
Intent and Premeditation: Beyond just the “act,” collection aims to find evidence of intent. Searching for deleted files, “fragments” in unallocated space, or internet searches for “how to hide an IP address” can demonstrate that a crime was planned and not accidental. This often distinguishes a casual user from a motivated criminal.
Incident Response and Prevention: In a corporate setting, the purpose of collection is often root cause analysis. By collecting logs and malware samples during an incident, forensics helps organizations understand how a breach happened, what data was stolen, and how to patch vulnerabilities to prevent future recurrences.

The Systematic Collection Process

In digital forensics, “Collection” is a high-stakes phase where the physical becomes digital. It is not just about picking up a hard drive; it is about ensuring that the data inside remains exactly as it was found.

For your SPPU exam, follow these systematic steps to describe the collection process:

Scene Search and Identification: The specialist first identifies all potential sources of evidence. This includes obvious devices like laptops and servers, but also “hidden” ones like USB drives, IoT devices (smart cameras), and even cloud storage logins. Action: Document the physical layout and take photographs of the computer screen and the back of the CPU (to record cable connections).
Securing the Evidence (Seizure): Once identified, the devices must be physically protected from tampering or remote signals. Faraday Bags are used for mobile devices to block Wi-Fi, Bluetooth, and cellular signals, preventing the suspect from remotely wiping the phone. A critical decision is made: “Plug-in or Plug-out?” If the computer is ON, the specialist may perform a “Live Collection” to capture RAM. If it is OFF, it is left off to prevent metadata changes during boot-up.
Documentation and Chain of Custody: Every piece of evidence is labeled with a unique ID. A Chain of Custody (CoC) form is started immediately. This form records who seized the device, the exact time, and every person who handled it thereafter. Without a perfect CoC, the evidence is usually rejected by the court.
Forensic Imaging (Acquisition): Specialists never work on the original device. They use a Hardware Write-Blocker to connect the suspect’s drive to a forensic workstation. This tool allows data to flow out for copying but prevents any data from flowing in. An exact, bit-for-bit clone of the entire drive (including deleted files and unallocated space) is created using tools like FTK Imager or EnCase.
Verification (Hashing): Once the image is created, its integrity must be verified. The specialist calculates a “Digital Fingerprint” using MD5 or SHA-1 algorithms for both the original drive and the forensic copy. If the two hash values match, it proves that the copy is a perfect replica and no data was altered during collection.

Understanding Chain of Custody

Chain of Custody is the chronological documentation or “paper trail” that records the sequence of custody, control, transfer, analysis, and disposition of physical or electronic evidence. Essentially, it is a logbook that answers four vital questions for every single piece of evidence:

Who had contact with the evidence?
When did they have it (exact date and time)?
What did they do with it (imaging, analysis, storage)?
Why was it transferred or accessed?

Significance for Exam: If there is even a small “gap” in this timeline where the evidence is unaccounted for, the defense can argue that the data was tampered with or planted. This leads to the evidence being ruled inadmissible (rejected) by the court.

The Process of Chain of Custody

The process begins the moment an investigator identifies a device at a crime scene and continues until the evidence is presented in court. Here is the step-by-step breakdown:

Identification and Labeling: Every device (laptop, mobile, USB) is assigned a unique Evidence ID. A physical tag is attached to the device containing the case number, item number, and the investigator’s initials.
Initial Documentation: The investigator fills out the first entry in the Chain of Custody Form. They record the state of the device (On/Off), its serial number, and the exact location where it was found (e.g., “On the mahogany desk in the master bedroom”).
Secure Packaging and Transport: Evidence is placed in tamper-evident bags (like Faraday bags for phones). The bag is sealed, and the investigator signs across the seal. Any attempt to open the bag will be visible. The transfer of the bag from the scene to the forensic lab is logged.
Storage and Access Control: Once at the lab, the evidence is kept in a secure evidence locker. Only authorized personnel have the key. Every time the locker is opened to take the evidence out for analysis, it must be documented in the CoC log.
Forensic Analysis: When an analyst works on the evidence, they document the tools used (e.g., “Created image using FTK Imager v4.5”). They record the Hash Values (MD5/SHA-1) at the start and end of the session to prove that the original data was not modified.
Transfer of Custody: Every time the evidence moves from one person to another (e.g., from the Analyst to the Police Officer for court), both parties must sign and date the CoC form. This maintains the “unbroken chain.”

Procedures for Collection and Archiving

Digital evidence management involves two distinct phases: Collection (the immediate acquisition) and Archiving (the long-term preservation).

1. The Procedure for Collecting Digital Evidence

The collection phase is governed by the “Principle of Least Volatility,” meaning you collect data that disappears the fastest (like RAM) before moving to permanent storage (like Hard Drives).

Step 1: Preparation and Documentation: Before touching any device, the specialist documents the scene with photographs and notes. They record the system’s state (On/Off), cable connections, and any visible data on the screen.
Step 2: Live Acquisition (If System is ON): If the computer is running, the specialist collects Volatile Data first. Using forensic tools, they capture the contents of the RAM, current network connections, and running processes. This is crucial because shutting down the computer would destroy evidence like encryption keys or active malware.
Step 3: Seizure and Isolation: To prevent remote tampering (remote wiping or “kill signals”), mobile devices are placed in Faraday Bags. For desktops, the power is typically cut (or the battery removed) after volatile data is collected to “freeze” the state of the hard drive.
Step 4: Forensic Imaging: The specialist connects the storage media to a Hardware Write-Blocker. This ensures that data can only be read from the drive and nothing can be written to it. They create a bit-stream image (a sector-by-sector clone), including unallocated space and deleted files.
Step 5: Verification (Hashing): Immediately after imaging, a Cryptographic Hash (MD5 or SHA-256) is calculated for both the original and the image. If the values match, it proves that the collection was successful and the evidence is authentic.

2. The Procedure for Archiving Digital Evidence

Archiving is the process of storing the collected forensic images and associated metadata in a way that remains accessible and verifiable for years, as legal cases can take a long time to reach trial.

Step 1: Long-term Storage Media: Forensic images are moved from the temporary “field drive” to specialized archival media, such as Write-Once-Read-Many (WORM) drives, high-quality LTO tapes, or secure, encrypted cloud repositories.
Step 2: Redundancy and Off-site Storage: At least two copies of the archive are made. One is kept in a local, temperature-controlled, and secure evidence room, while the other is stored at an off-site location to protect against physical disasters like fire or flooding.
Step 3: Archival Documentation: Every archive must be accompanied by its “Identity Card,” which includes the case number, evidence ID, original hash values, and the Chain of Custody log. This makes it easy to retrieve and verify the archive years later.
Step 4: Periodic Integrity Checks: Because hardware can degrade over time (bit rot), specialists perform periodic Hash Verification. They re-calculate the hash of the archive and compare it to the original hash recorded at the time of collection to ensure no data corruption has occurred during storage.

Software Validation and Specialized Investigations

a) Validating & Testing Forensics Software

Validating forensic software is the process of proving that a tool produces accurate, reliable, and repeatable results. Since digital evidence can determine the outcome of a court case, the software used must be scientifically sound.

Significance: In court, the defense may challenge the findings by questioning the tool’s reliability. Validation ensures the tool doesn’t alter data or miss critical evidence during the acquisition or analysis phases.
Testing Methods: The NIST (National Institute of Standards and Technology) provides the “Computer Forensic Tool Testing” (CFTT) project, which sets standard criteria. Specialists test tools against Known Data Sets—drives where the data is already known—to see if the tool retrieves it correctly.
Hash Verification: A primary validation method is comparing the MD5 or SHA-1 hash of the original evidence with the hash of the image created by the software. If they match, the tool is validated for integrity.
Repeatability: A validated tool must yield the same results every time it is run on the same data by different investigators.

b) E-mail Investigation

E-mail investigation (or E-mail Forensics) involves analyzing the origin, content, and path of an email to identify the sender or prove a crime like phishing, harassment, or data theft.

Header Analysis: The most critical part of an e-mail investigation is the E-mail Header. It contains the sender’s IP address, the mail servers it passed through (MTA logs), and the date/time stamps. This helps in tracing the actual source, even if the “From” address is spoofed.
Server Logs: Investigators examine logs from the SMTP or IMAP servers. These logs record login times, IP addresses used to access the account, and whether the email was read or deleted.
Metadata and Attachments: Analysis includes looking at the metadata of attached files and the “Message-ID,” which is unique to every email.
Legal Challenges: Investigators must often deal with web-based email (Gmail, Outlook) where the data resides on external servers, requiring legal requests like a “Letter Rogatory” or warrants to the Service Provider.

c) Computer Forensics Software Tools

Forensic tools are specialized applications designed to identify, preserve, and analyze digital evidence. They are generally categorized into Open Source and Proprietary (Commercial) tools.

Proprietary Tools: These are high-end, paid suites like EnCase and FTK (Forensic Toolkit). They are “all-in-one” solutions that handle everything from bit-stream imaging to complex data carving and automated reporting. They are widely preferred by law enforcement because of their extensive validation records.
Open Source Tools: Tools like Autopsy and The Sleuth Kit (TSK) are free and highly customizable. They are excellent for disk analysis and volume management. Wireshark is the standard tool for network forensic analysis (packet sniffing).
Specialized Functions:
- Imaging Tools: FTK Imager (used for creating bit-by-bit copies).
- Memory Forensics: Volatility, used specifically for analyzing RAM to find “fileless” malware or hidden passwords.
- Mobile Forensics: Cellebrite or Oxygen Forensics for bypassing locks and extracting data from smartphones.