The words “Access Denied” over a digital composite of a data stream

Digital Forensics Problem-solving

In the world of digital forensics, often, the most challenging part of the process is getting to the data. You need to first acquire the data in order to analyze it completely and effectively. This is where problem-solving comes into play.

Problem-solving is an ever-evolving issue in the fields of computer forensics and mobile device forensics and will continue to be so as the industry progresses. The thing about problem-solving skills, though, is that they aren’t so much as taught as they are acquired over time with experience.

In this piece, we discuss what you need to know about problem-solving in computer and mobile device forensics. Let’s dive right into it.

Continue reading

a cyber forensic expert

How is Digital Evidence Gathered?

In 2021, digital devices are quite common, with the most common ones being mobile phones, tablets, and computers. However, the emergence of IoT has made a plethora of electronic devices a source of digital evidence. For example, a digital camera can be used to view or store illegal images. The first responders in this case are digital forensic experts, who should identify and seize every electronic device to acquire evidence.

But how is this digital evidence gathered? Hear what our digital forensic engineer has to say!

Collection of digital evidence

Numerous sources can be used to collect digital evidence. Some of these sources are servers, cloud computers, USB memory sticks, CD-ROM, hard drives, digital cameras, mobile phones, computers, and the like. Some of the more non-obvious sources include web pages that should be preserved because they can change, as well as RFID tags. It’s important to ensure that extra care of data sources is taken so that nothing can modify or contaminate them as they’ll be used for digital forensic investigations.

Since the majority of digital information is volatile, it’s subject to change. Once it’s modified, identifying the changes or rolling back the data to its original state becomes a lot more difficult. Therefore, a cryptographic hash of digital evidence can be carried out and calculated. This hash must be recorded in a safe place to ensure there’s no contamination of digital evidence. This is crucial because it would allow computer forensic experts to establish whether someone fiddled with the original data evidence or not.

Imaging evidence within the electronic media

During the initial phases of the investigation, it’s a good practice to duplicate the original evidentiary media. Now, a combination of software imaging tools and standalone hard-drive duplicators can be used to fully close the entire hard drive. This can be done at the sector level, where a bit-stream copy of all parts of the hard drive’s user-accessible areas will be made. This means there won’t be any need to duplicate the file system. In order to prevent tampering, the original drive can be transferred to secure storage. While this imaging process is underway, a write-blocking or write-protection application or device can be used to make sure no information is made part of the evidentiary media during the computer forensic investigation.

a forensic computer analyst

Why preserving the sources of investigation is important?

It’s important to preserve the sources from which evidence is gathered so that the chain of custody remains intact. Otherwise, it won’t be possible to validate the results of the digital forensic investigation.

Turn to Eclipse Forensics – your certified digital forensic consultant

Since 2005, we’ve worked on hundreds of cases for a variety of individuals, private attorneys, and law enforcement jurisdictions. We’re ready and poised to help in the analysis and development of mobile device forensics, authenticate audio and video forensics, court-certified forensics in FL. Contact us now for more information!

Forensics expert looking for files on a computer.

Digital Forensics – A Guide

Ever wondered how a digital forensics team operates? How do the experts find those incriminating files or suspicious activity only using a person’s data? Here’s a breakdown of how the digital forensics process works, giving you an idea of how your own case could play out:

Continue reading

Forensics expert looking for files on a computer

3 Common Digital Forensic Myths

To many, digital forensics seems like magic as they are unable to understand how experts can pull vital data from devices like a rabbit out of a hat. With dramatized depictions of digital forensics, there have been various misconceptions regarding the industry. Several creative liberties are taken, which differ wildly from the reality of it all.

These are some of the most common myths related to digital forensics, which might be crucial to know about whether you’re considering a career in the field or want to hire digital forensic experts for your case:

Continue reading

a digital forensic engineer discusses a report with their client

The Best Hardware and Software Tools for Computer Forensics

If there’s one important source of forensic evidence, it’s computers. However, newer criminals aren’t the only ones taking advantage of the technology—their traditional counterparts, too, have turned to computers.

But there’s one silver lining here: these criminals can be caught and prosecuted by a digital forensic engineer who can reliably extract the forensic information from these machines.

Thanks to a range of computer forensics tools, extracting reliable and accurate information is no longer a distant dream. Here are some of the best hardware and software tools you can use for computer forensics.

Continue reading

smartphone forensics

Smartphones as Witnesses for Digital Forensics

Smartphones have taken the world by storm ever since their introduction. This is because they accessibly provide several functions that are similar to that of a computer.

They also have the capacity to store crucial evidence related to a crime scene that can be later be presented in a court of law. Smartphones are ubiquitous, which means it’s very possible that one was in use at a crime scene.

Continue reading