Theme 2: Scenes and Acquisition

Question 1

Preparation for Entering a Scene

Answer 1

1. Understand Operational Constraints: Resources and intelligence
2. Consider Legal, Ethical and Media Considerations: Warrants, consider other routes of investigation that you may interfere with e.g. fingerprinting
3. Check Permissions: Check validity of warrants
4. Wear Appropriate Outfits: Health and safety
5. Prepare Equipment: Avoid contaminating equipment e.g. personal phones that can be detected by IoT or magnets. Bring storage. And ensure devices are functional and you are competent with them

Question 2

Entering a Scene

Answer 2

1. Decide on Entry Time: Enter when suspect is likely to be actively using a device to avoid anti forensics
2. Arrival: Dress appropriately, check equipment, ensure documentation is on-hand to prove warrant
3. Map the Scene: Take photographs, identify hazards, identify what data is volatile and understand what is important
4. Communicate: Define roles and follow them to avoid repeating actions and contamination
5. Fill in Documentation: Search log form

Question 3

Searching a Scene

Answer 3

• se a Methodical Approach: Clockwise, top-to-bottom
• Search Suspects: Portable storage and smart wearables
• Cyber Dogs: Can locate hidden devices through chemicals used on electronics
• Understand Potential Devices: May not be the newest devices e.g. floppy disks
• Follow ACPO Guidelines

Question 4

Anti-forensics

Answer 4

used by technically competent people to interfere with digital forensics including

• Complete destruction of data: Chemical or slow-wipe
• Harming investigations: Needles, sharp objects

Question 5

What to Collect

Answer 5

Data collected must be proportional, relevant, and justified due to legal guidelines and resource limitations

Question 6

How to Collect Devices

Answer 6

Signal Emitting Devices: Use a faraday bag or aeroplane mode.

Search for Anti-forensics: To avoid harm

Turned on Devices: Follow ACPO 2

Turned off Devices: Follow ACPO 1

Question 7

How to Turn off Devices

Answer 7

To turn off a device, directly cut power to avoid software-based processes cleaning up volatile data

Question 8

Transporting Evidence

Answer 8

Transport carefully to avoid damage and quickly to ensure the battery does not deplete and cause ACPO 2 to be violated

Question 9

Evidence Bags

Answer 9

They must be labelled, sealed and stored securely. If opened, the old bag must be placed in a new evidence bag and labelled accordingly to preserve provenance

Question 10

Storage Evidence

Answer 10

Store securely.
Should be stored in faraday cages if signal emitting

Question 11

External Review

Answer 11

performed to understand device capabilities

• Type of Device
• Model Numbers
• Contextual Function: What the user used the device for
• Ports
• Customisations: Additions and labels

Question 12

Internal Review

Answer 12

Furthers understanding of the device

1. Identify Hazards
2. Take Apart Devices
3. Search for Hidden Objects
4. Understand Cables
5. Identify Storage Media by Following Cables
6. Extract Storage: Not always possible due to encryption

Question 13

Four Components of Mobile Devices

Answer 13

• Main Handset: Operating system
• Battery: Can hide small objects
• Sim Card: Can store data such as contacts and recent calls
• Expansion Card: Non-apple products, treat as secondary storage

Question 14

Data Provided by Network Providers

Answer 14

• Registered Name and Address
• Associated Numbers
• Payment Details
• Call Information
  
  • Originating and Receiving Number
  • Call Duration

Question 15

Prerequisites to Performing Acquisition

Answer 15

Check Permissions: Device provenance and how it was obtained

Question 16

Generalised Acquisition Framework

Answer 16

1. Determine Investigation Parameters: Define the legal, ethical, organisational, and resource constraints that will guide the acquisition process.
2. Identify Acquisition Target and Output Location: Specify the data to acquire, where it’s located, and where and how it will be securely stored.
3. Identify Acquisition Approaches: Map all possible methods for accessing the data, prioritising those closest to the original source.
4. Validate Acquisition Approaches: Test each method on a similar device to ensure it is reliable, legal, and does not compromise data integrity.
5. Establish the Order of Modification: Rank validated methods based on their likelihood of modifying data and overall suitability.
6. Attempt Data Acquisition: Use validated methods in order of least intrusiveness to acquire the data from the evidential device.
7. Validate Data Acquisition: Confirm the acquired data is correct, intact, and usable; if not, retry using the next validated method.

Question 17

Acquisition Approaches

Answer 17

• Write-blocker with Removed Storage Media: Physically remove the storage media and image with a write blocker to prevent alteration
• Wireless: Capture wirelessly transmitted data in real-time or from network logs
• JTAG: A hardware interface standard used to access and extract memory content at the hardware level
• Chip Off: De-solder memory chips and read directly. High risk of damage
• Man-in-the-Middle: Intercept in-transit data between two devices
• Tool Driven: Use commercial forensic tools to automate acquisition
• Industry Closed: Proprietary methods or tools used by specific vendors

Question 18

Live Acquisition

Answer 18

The process of capturing volatile data, such as RAM, active processes, encryption keys, passwords etc from a system that is running

It is used when powering down the device risks losing volatile data

Follow ACPO principle 2

Question 19

Disk Image Formats

Answer 19

• EnCase .E01: Proprietary, compressed and includes metadata
• Raw Binary .DD: Bit-for-bit copy of storage device

Question 20

Hashing

Answer 20

• Hashing confirms integrity but does not verify authenticity, context, or provenance.
• Proper documentation and secure handling helps ensure the validity of evidence

Question 21

Why disable auto-mounting

Answer 21

Inhibit the risk of the data being modified