Digital forensic experts often cite the case of Dennis Rader, the infamous killer, who came undone thanks to a forensic investigation. Often referred to by the sobriquet BKT, because of his preferred modus operandi of binding, torturing, and killing his victims, he committed a series of calculated and heinous murders in the seventies and eighties, leaving cryptic clues that baffled investigators. In the nineties, BKT fell silent, leading sleuths to believe he had stopped his carnage, for some reason. But BKT surfaced again in the early 2000s, this time challenging the police force to snare him with a floppy disk. Digital sleuths sitting in on the investigation, found that metadata on the disk could be traced to a Lutheran Church in Wichita. Further, examination of one of the documents revealed that it was last modified by a ‘Dennis’, enabling investigators to move in and apprehend the notorious killer, thereby bringing closure to the case after almost three full decades.
What is digital evidence
The BKT case highlighted the power of forensics to uncover hidden digital footprints, thereby heralding an era where technology could be successfully used to solve criminal cases. Suddenly, digital evidence was the buzzword in cybersecurity circles.
Let us see now what constitutes digital evidence.
Unlike physical evidence where clues as to the perpetrator of the crime or the reasons for the crime/accident are available in physical form, digital evidence is stored in a ‘container’ like a mobile phone, tablet, or computer. It takes the form of digital files, emails, images, messages, log files, and the like. Each of these has a set of properties and provides an activity trail for the digital forensic expert to interpret and analyze.
Forbes likens it to the contents of the black box in an airplane. Examination of the black box can reveal exactly what happened in the airplane during the flight, right from cockpit discussions, in-flight announcements, altitude and pressure changes, and other crucial flight data that could help determine the cause of the crash.
What it is
Digital forensics is an area of cybersecurity that focuses on the investigation of cyber crime cases. It is a branch of forensic science that involves retrieval, preservation, examination, and analysis of digital data in an electronic device that can help uncover crimes, frauds, and other malicious acts perpetrated by hackers and scammers. Because of the irrefutable evidence that it provides, digital forensics is helpful in a court of law. It also provides organizations with crucial information to prevent further cyber incidents.
Based on the area they address, digital forensics are of the following types:
– Network Forensics
– Mobile Device Forensics
– Cloud Forensics
– Computer Forensics
– Database Forensics
– Memory Forensics
– Malware Forensics
How important it is
Digital forensics plays a pivotal role in the identification and resolution of cyber incidents. The uncovering of evidence in the case of a cybercrime can offer valuable insights for the prevention of future risks and the building up of a more robust digital framework. On account of these wide-reaching contributions in the field of discovery, investigation, and remediation of cybercriminal activity, it is considered invaluable to the security posture of an organization.
Some of the more important touchpoints addressed by its use:
- Mitigating future risks against possible cyberattacks by pinpointing vulnerabilities and system lacunae
- Enforcing accountability of the attackers responsible for the attack
- Supporting compliance so mandates and regulations are met
- Aiding incident response after the incident in terms of remediation
Digital forensics offers:
- An insight into the cause of the cyberattack in terms of a vulnerability being exploited
- A scientific method to preserve the evidence before it is lost or corrupted. This will form the basis of the analysis and enhance the solidity of the case against the attacker
- An insight into the attack vector, the hacker’s digital footprint, and tools deployed to orchestrate the attack, including the time frame for the illegal access, the login, the origin of the attack, etc.
- An estimate of the damage caused due to the attack
- A way forward to contain and remediate the attack
How it is done
In general, the steps involved in its application could be shortlisted as under:
- Imaging of the data to be examined – in other words, the creation of an exact copy of the data for analysis, while retaining the integrity of the original data
- Generation of the forensic request to examine the data
- Preparation of the forensic process, collection of the relevant system files, logs, network and application data for examination, selection of the appropriate investigative tools, and charting of the envisaged plan including documentation
- Analysis of the identified data from various standpoints so a clear picture of the attack emerges
- Creation of the forensic report giving details of the case findings
- Second-level case analysis, if needed, to affirm and revalidate the original findings
Challenges
Digital forensics is not a walk in the park. From the very outset, the expert is required to treat the data with the utmost caution lest the trail is tarnished or lost. He is tasked with following a number of rules so his findings become admissible in a court of law. Here are some of the challenges known to present themselves:
- Humongous data volumes to sort and sift through – logs, emails, texts, images, system and log files, network files etc. can be both time consuming and exhausting
- Dispersed data from multiple sources and locations, and in multiple formats making it arduous and time consuming
- Highly sophisticated encryption techniques used by the attacker and ever-expanding attack surfaces may necessitate special efforts on the part of the forensic expert
- Lack of appropriate tools to conduct the investigation
- Data privacy rules may prevent free and unrestricted access to data, slowing down or making the task of investigation more difficult
- Data preservation is known to present difficulties in forensic work. Failure to maintain the ‘chain of custody’ may result a lack of authenticity of the investigation and reduce its admissibility in a court of law
- Lack of properly-trained specialists to conduct the investigations
- Integration of incident handling with incident response can result in a less than satisfactory forensic report
- Lack of management support and the view that it’s activity is in the nature of a cost center
Conclusion
With the proliferation of cybercrime, it is a given that the emphasis on digital forensics will increase considerably in the coming period. Global Markets Insights (GMI) (1) puts the size of the global market at USD 9.4 billion presently and tips it to grow at a CAGR of 12.5% between 2025 and 2034. On the job front, The Bureau of Labor Statistics estimates computer forensics job openings will increase 31 percent through 2029.
It is doubtful, however, if this growth or the level of sophistication of investigative tools that are likely to accompany it, will stem or deter the wave of attacks. If anything, we will witness an increase of attacks in the face of this growth.
References
Additional Reading:
For some of the best practices in this field, read the Forbes article on the following link:
