Unboxing the digital forensic investigation process

The Chain of Custody in the Era of Modern Forensics: From the Classic Procedures for Gathering Evidence to the New Challenges Related to Digital Data

The purpose of this work is to renew the interest and attention for the chain of custody in forensic medicine, its establishment and maintenance, protecting the integrity and validity of evidence as well as to analyze how over time the establishment of the chain of custody and the collection of evidence has evolved also in function of the advent of technology and the use of electronic devices connected to the network. The analysis of the various aspects of the chain of custody demonstrates how necessary it is for the professional figures involved in the phases of the investigation (especially those who manage the evidence and who have, therefore, designated the assignment) to know the procedures to follow, trace the movement and the handling of objects subjected to seizure, also for the purposes of toxicological and/or histological investigations. The knowledge of interferences or complications helps to reduce errors and safeguard the validity of the evidence, assuring the proceeding judicial authority that the evidence is authentic and that it is, in other words, the same evidence seized at the scene of the crime. Furthermore, the issue is particularly felt today, with the recent need to guarantee the originality of digital data. Following a careful review and analysis of the literature currently available in this regard, it is worth adding that further efforts are needed to formulate internationally validated guidelines, harmonizing the different reference criteria in forensic science and medical areas, given the current absence of good international practices valid in the field and applicable both in the case of physical evidence and in the case of seizure of digital evidence.

Forensic Investigation of Remnant Data on USB Storage Devices Sold in New Zealand

The digital forensic tools used by law enforcement agencies for forensic investigations are mostly proprietary and commercially expensive; although open-source tools are used, the investigations conducted with such tools are not verified by reputable organisations, and hence, users are reluctant to practice such tools. To address this issue, we experimentally evaluate three open-source forensic tools based on various requirements recommended by the National Institute of Standards and Technology (NIST) framework for forensic investigation. The experimental setup consists of a forensic workstation, write-blocker, and purchased USB hard drives investigated via digital forensic imaging tools, i.e., DC3DD, DCFLDD, and Guymager. We create various test cases, which distribute USB hard drives in different groups and investigate the functional and optional requirements of NIST along with recovering and analysing remnant data. We evaluate these forensic tools by analysing the log information, following, anonymously (to ensure that data were not disclosed or misused during or after the investigations) collecting, examining, and classifying the remnant data restored from the USB hard drives. We observe that the percentage of hardware resources usage and the processing time of each tool are remarkably different, e.g., Guymager was the fastest tool and met all the functional requirements in each test case, but it utilised more CPU and memory resources than DC3DD, DCFLDD. We note that 88.23% of the USB hard drives contained sensitive personal or business information (e.g., personal photos, bank transactions, and contracts). Subsequently, the remnant data analysis shows that consumers in New Zealand are unaware of personal data security and the associated vulnerabilities of data leakages.