Digital Forensics 2.0
Changing World, Changing Way
As today’s cyber space continues to evolve, so must the way we conduct cyber investigations. Sources of evidence are growing rapidly. For those who fail to keep up, collecting and authenticating evidence during a cyber investigation will prove to be a difficult task. For those with a clear understanding of how to leverage advances in technology and the wealth of information available online, the evidence collected during a cyber investigation can help create a solid court case.
Digital Forensics 2.0
Digital Forensics 2.0 is to gather evidence from applicable online and offline sources, suitable for presentation in a court of law.
Sources of Evidence of Digital Forensics 2.0
Emerging Sources of Online Evidence
- Social Media (e.g. Facebook, LinkedIn, Twitter, etc.)
- Government websites
- Archival sites (e.g. www.archive.org)
- Online services
- Company or personal websites
- Group, club or special interest forums
Traditional Sources of Digital Evidence
- Computer hard disks
- Mobile phones
- Network devices
- Databases and files
Evidence Collection Methods
- Screen shot
- Video recording
- Forensic recovery of online evidence (e.g. IEF)
- Commercial tools for social media and online evidence (e.g. PageFreezer)
- Data duplicator / write-blocker & data acquisition software for traditional sources
Investigator Turns Eyewitness on Online Evidence
In today’s world of social media and rapidly changing online environment, investigators are taking on a new role; they are becoming a form of eyewitness. As the eyewitness, an investigator observes evidence that might not be visible to any other available investigator. The investigator is wise to create a record of what he or she sees at any particular point in time, including print outs of screenshots.
Video Records of Investigations in Social Media
Additionally, video recording technology can be very useful in substantiating eyewitness testimony. When investigators need an efficient way to capture what is happening on a dynamic blog or Facebook wall these solutions can come in handy.
There are other new tools like PageFreezer to capture Social Media and Online Evidence.
Consider Local Laws and Privacy Issues
Equally important, an investigator should bear in mind that the laws of foreign countries may apply to their investigation. The World Wide Web can be accessed from anywhere in the world. While you may not need to register with a data protection authority in the United States, if you are looking at postings from someone’s friend over in France you may be required to register under the terms of the French Data Protection authority before gathering information. European or other privacy laws may apply. Be aware of the laws relevant to any country your investigation reaches.
It is a brave new world. Cyber criminals are acting very fast. Digital forensic investigators need to continuously polish their skills and adopt new tools in order fight back.