What are the challenges facing digital forensic investigators when collecting digital evidence from a crime scene?
|
Mobile forensics is the continuously evolving science which involves using rapidly changing techniques to enable access to and analyzing data from mobile devices. Show An increasing number of crimes are committed digitally, leaving traces that can be important evidence in a criminal investigation. The use of sophisticated information systems is no longer solely the realm of the hacker and the coder, it is now also the realm of the drug dealer, the extortionist, and the illegal gambler. The advanced and constantly improving methods for analyzing technical evidence makes mobile forensics a rapidly growing field. The mobile forensics process aims to recover digital evidence and relevant data from a mobile device in a way that will preserve the evidence in a forensically sound condition. To achieve that, the mobile forensic process needs to set out precise rules for the seizure, isolation, transportation, and storage for analysis and proof, of digital evidence originating from mobile devices. This guide is intended to assist law enforcement and other first responders who may be responsible for preserving an electronic crime scene and for recognizing, collecting, and safeguarding digital evidence. Digital forensics is a technique in the identification of computer based crimes. But digital forensics faces a few major challenges when it comes to conducting investigations. According to Fahdi, Clarke & Furnell (2013), th challenges of digital forensics can be categorized into three parts.
Technical Challenges With the vast development of the computer technologies within the last decade, usage of technology has been defined as both good and bad. While some people use technology to invent things to benefit mankind, criminals also use technology to achieve their own targets. One of the main problems is that as soon as a technology is developed to identify and investigate criminals, there is another technique that helps the criminals to hide themselves. This is a massive challenge forensics officers face today. Get The Latest DFIR News!Join the Forensic Focus newsletter for the best DFIR articles in your inbox every month.Unlike many other sources of physical evidence, digital evidence is easy to modify, remove or hide, possibly without leaving tracks that might identify the criminal. So anti-forensics has become a major challenge for digital forensics. According to Rekhis & Boudriga (2010), anti-forensic techniques can be classified into categories as listed below.
Encryption According to TechTerms (2014), encryption is process of scrambling information that can only be decoded and read by someone who has the correct decoding key. Encryption is used to hide or make the evidence unreadable on the compromised system. Balogh & Pondelic (2011) stated that: In 2007, an incident happened when the US Customs found child pornography on Canadian citizen and legal US resident Sebastian Boucher’s laptop. The laptop was seized as vidence and he was charged with transporting the pornography across borders. The problem appeared when examiners tried to open the incriminating drive Z and found out that it was a Pretty Good Privacy encrypted container. Although a forensic duplicate of hard drive was created after shutdown of the notebook, the examiner could not open the encrypted container. Attackers use many different encryption methods and in order to make the data usable, investigators have to decrypt the encrypted data. It is time consuming and sometimes the encrypted data cannot be decrypted.  Steganography “Steganography is an encryption technique that can be used along with cryptography as an extra-secure method in which to protect data.” (Janssen, 2014). Steganography is a technique that is used to hide any information inside a file carrier without modifying its outward appearance. Attackers use this steganography to hide their hidden data (payloads) inside the compromised system. When investigating computer crimes, the investigator has to identify these hidden data in order to reveal the information for further reference. Covert Channel “Covert channel in communication protocols allows attackers to hide data over the network and possibly bypass intrusion detection techniques. Typically, a network protocol is chosen and its header is modified to leak messages between attackers, exploiting the fact that few fields of the header are modified during transmission.” (Rekhis & Boudriga, 2010). Attackers use these covert channels in order to maintain a hidden connection between the attacker and the compromised system. It is less identifiable. Data hiding in storage space Attackers hide some data inside storage areas and make them invisible to the usual system commands and programs. It makes the investigation more complex and more time consuming and sometimes data can be corrupted too. Rootkit is one of the most popular techniques used to hide data in storage space. According to Microsoft (2014), malware designers use rootkits to hide malware inside victims’ PCs. It is very hard to identify rootkits and most computer users do not know how to remove these rootkits. As mentioned by Kassner (2008), user mode rootkits are capable of hiding “processes, files, system drivers, network ports, and even system services”. Residual Data wiping When the attacker uses a computer for his goal, a few hidden processes (e.g. temporary files, history of commands) are running without the knowledge of the attacker. But an intelligent attacker can avoid this risk by wiping out the tracks that were made by his process and making the system work as if it has not been used for such a purpose. Lee’s 2013 article indicates that 20-year-old Jake Davis “was convicted of computer hacking for his role in the notorious group LulzSec”. Furthermore, Lee (2013) says that he was “forbidden from creating encrypted files, securely wiping any data or deleting his internet history”. Tail Obfuscation – attacking the tools According to Rekhis & Boudriga, (2010), the most common technique is the obfuscation of the source of the attack. Here, the attacker uses some false information in order to mislead the investigator (e.g. false email headers, changing file extensions). Therefore sometimes the investigator might miss some data that has forensic value. Resource Challenges Depending on the scenario, the volume of data involved in the case might be large. In that case the investigator has to go through all the collected data in order to gather evidence. It may take more time for the investigation. Since time is a limiting factor, it becomes another major challenge in the field of digital forensics. In volatile memory forensics, since the data stored in the volatile memory is ephemeral, user activities are overwritten in the volatile memory. Therefore investigators can analyze only recent information that is stored on the volatile memory. This reduces the forensic value of the data for the investigation. When collecting data from the source, an investigator must make sure that none of the data is modified or missed during the investigation, and the data must be well secured. Data sources which are damaged cannot be easily used in investigations. So it is a major issue when an investigator finds a valuable source that is not usable. Legal Challenges Privacy is also important to any organization or victim. In many cases it may be required that the computer forensics expert share the data or compromise privacy to get to the truth. A private company or an individual user might generate lots of private information in their day to day usage. So asking an investigator to examine their data might risk their privacy being revealed. Casey (2011) stated that: In 2000, during an investigation into the notorious online Wonderland Club, Grant argued that all evidence found in his home should be suppressed because investigators had failed to prove that he was the person associated with the illegal online activities in question. However, the prosecution presented enough corroborating evidence to prove their case. It becomes a challenge when the investigator ‘accidently’ figures out or stumbles across some facts related to the crime, but is not allowed to use these against the attacker due to privacy issues. This affects the whole investigation process and limits the investigator to a point. As stated by Bui, Enyeart & Luong (2003), ethical considerations should be examined because of the wealth of information that is collected from forensic investigations. In order to ensure integrity of the data, these should be collected and stored carefully and legally. As mentioned by Bui, Enyeart & Luong (2003) it is important to be aware of the privacy of suspects and victims. Furthermore Bui, Enyeart & Luong (2003) stated that investigators need to have good knowledge of several laws and “statutes that govern electronic evidence collection including the fourth amendment of the constitution.” References
About the Author Chirath De Alwis is an information security professional with more than three years’ experience in Information Security domain. He holds C|EH, C|HFI and Qualys Certified Security Specialist certifications. Currently, Chirath is involved in vulnerability management, incident handling and digital forensics activities in Sri Lankan cyberspace. You can contact him on [email protected] What are the main issues and challenges of the digital forensic field?Challenges for digital forensics. Explosion of complexity. ... . Development of standards. ... . Privacy-preserving investigations. ... . Legitimacy. ... . Rise of antiforensics techniques.. What are the challenges encountered in digital evidence?The two challenges faced in a digital forensic investigation are complexity and quantity. The complexity problem refers to the data collected being at the lowest level or in raw format. Non-technical people will find it difficult to understand such data.
What is one of the challenges that forensic investigators face today?Studies have demonstrated that some forensic methods used in criminal investigations cannot consistently produce accurate results. Bite mark comparison is an example of an analysis that is unreliable and inaccurate. Insufficient validation of a method.
What are the challenges cybercrime presents to digital forensics investigators?Some of the major technical challenges, associated with digital forensics are encryption, a huge volume of data, and incompatibility among diverse forensic tools [20].
|
