Digital Forensics: Investigating Cyber Crimes

Digital forensics is the practice of identifying, preserving, analyzing, and presenting digital evidence in a manner that is legally admissible. As cyber crimes become more sophisticated, forensic investigators must follow rigorous methodologies to ensure evidence integrity and withstand legal scrutiny.

The Forensic Process

Identification

The first step is recognizing that an incident has occurred and determining its scope. Identify which systems are affected, what type of evidence may exist, and the order of volatility — collect the most volatile data first.

Order of Volatility:
1. CPU registers and cache
2. Running processes and network connections
3. Memory (RAM)
4. Temporary file systems
5. Disk storage
6. Archived backups

Preservation

Evidence must be collected without altering the original. Create forensically sound copies (bit-for-bit images) of storage media using write blockers:

# Create a forensic image using dd
sudo dd if=/dev/sda of=/evidence/disk.img bs=4M conv=noerror,sync

# Verify integrity with SHA-256
sha256sum /evidence/disk.img > /evidence/disk.img.sha256

A write blocker prevents any data from being written to the source drive during acquisition. Hardware write blockers connect between the drive and the forensic workstation. Software write blockers mount the filesystem as read-only.

Analysis

Examine the acquired evidence to reconstruct events, recover deleted data, and identify indicators of compromise. Analysis can be timeline-based (what happened when), file-based (malicious files, modified binaries), or behavior-based (network connections, process creation).

Presentation

Document findings in a clear, objective report suitable for technical and non-technical audiences. Include chain of custody documentation, tools used, procedures followed, and conclusions with supporting evidence.

Evidence Collection Tools

Disk Imaging and Analysis

FTK Imager creates forensic images and previews evidence without modifying the source. Autopsy is an open-source digital forensics platform with timeline analysis, keyword search, and file carving capabilities.

# Recover deleted files with foremost
foremost -i disk.img -o /output

# Analyze file system timelines with sleuthkit
fls -r -p /evidence/disk.img > bodyfile.txt
mactime -b bodyfile.txt > timeline.csv

Memory Analysis

Volatility is the premier memory forensics framework. It analyzes RAM dumps to identify running processes, network connections, loaded drivers, and injected code:

# Capture memory with LiME
sudo insmod lime.ko "path=/evidence/mem.dump format=lime"

# Analyze with Volatility
volatility -f mem.dump windows.info
volatility -f mem.dump windows.pstree
volatility -f mem.dump windows.malfind
volatility -f mem.dump windows.netscan

Network Forensics

Capture and analyze network traffic to identify command-and-control communications, data exfiltration, and attack patterns:

# Capture live traffic
tcpdump -i eth0 -w capture.pcap -s 65535

# Analyze with Wireshark (CLI: tshark)
tshark -r capture.pcap -Y "http.request" -T fields -e http.host -e http.request.uri

Log Analysis

Centralized logging systems provide a rich source of forensic data:

# Search authentication logs for brute force attempts
grep "Failed password" /var/log/auth.log | awk '{print $11}' | sort | uniq -c | sort -rn

Chain of Custody

The chain of custody documents every person who handled evidence, when, why, and what changes were made. A broken chain of custody can render evidence inadmissible in court.

Maintain a detailed log for each piece of evidence including a unique identifier, description of the item, source location, collection date and time, collector’s name, hash values (SHA-256) for integrity verification, and signatures for each transfer of custody.

File Carving and Data Recovery

Deleted files remain on disk until overwritten. File carving recovers files based on their headers and footers without relying on filesystem metadata:

# Carve JPEG files
foremost -t jpeg -i disk.img -o /carved

# Carve multiple file types
foremost -t all -i disk.img -o /carved

# Recover files with scalpel (uses config file)
scalpel disk.img -o /carved

Forensic Analysis Techniques

Timeline Analysis

Construct a timeline of file system activity to identify when malware was installed, when files were accessed, and when data was exfiltrated:

# Create super timeline with plaso
log2timeline.py timeline.plaso /evidence/disk.img

# Export timeline
psort.py timeline.plaso -o l2tcsv -w timeline.csv

Keyword Search

Search across disk images, memory dumps, and file caches for keywords related to the investigation:

# Search raw disk image for strings
strings disk.img | grep -i "password\|secret\|confidential" > hits.txt

Mobile Device Forensics

Mobile forensics presents unique challenges: encryption, app-specific data formats, cloud synchronization, and locked devices. Tools like Cellebrite and Oxygen Forensic extract data from iOS and Android devices.

Key considerations include maintaining Faraday isolation to prevent remote wiping, documenting device state (locked/unlocked, network connectivity), and capturing cloud data that may not exist on the device itself.

Anti-Forensics and Countermeasures

Attackers may attempt to destroy or obfuscate evidence using disk wiping, encryption, steganography, log deletion, and timestamp manipulation. Experienced investigators recognize these techniques and look for artifacts left behind — partial overwrites, RAM remnants, and metadata inconsistencies.

Legal Considerations

Forensic investigations must comply with applicable laws regarding search and seizure, data privacy, and cross-border data access. Obtain proper authorization before acquiring evidence. Document every step for legal proceedings. Work with legal counsel to ensure admissibility.

Digital forensics is a constantly evolving field. New technologies bring new challenges and new opportunities for evidence collection. Staying current with tools, techniques, and legal requirements is essential for effective investigations.

Forensic Investigation Methodology

Digital forensics follows a structured process to ensure evidence integrity and admissibility:

1. Identification — Recognize potential evidence sources: hard drives, RAM, network logs, cloud storage, mobile devices.
2. Collection — Acquire evidence using forensically sound methods. Create bit-for-bit disk images using tools like dd or FTK Imager. Always use write blockers to prevent modification.
3. Preservation — Maintain chain of custody. Document who handled evidence, when, and why. Store images on tamper-evident media with cryptographic hashes.
4. Examination — Analyze the acquired data. Recover deleted files, examine file system metadata, parse logs, and extract artifacts.
5. Analysis — Correlate findings to build a timeline of events. Identify indicators of compromise (IOCs) and determine the attack vector.
6. Reporting — Document methodology, findings, and conclusions in clear, defensible language suitable for technical and non-technical audiences.

Memory Forensics

Volatile memory (RAM) contains valuable evidence: running processes, open network connections, loaded kernel modules, passwords, and encryption keys. Volatility is the industry-standard memory analysis framework:

# Identify the operating system profile
volatility -f memory.dump imageinfo
# List running processes
volatility -f memory.dump --profile=Win10x64 pslist
# Extract network connections
volatility -f memory.dump netscan

Memory forensics can reveal malware that only exists in RAM (fileless malware), processes hidden from the operating system, and evidence of rootkit installation.

File System Forensics

Common file system artifacts include:

• $MFT (NTFS) — Master File Table contains metadata about every file
• Journal — Records file system changes with timestamps
• Prefetch files — Application execution history on Windows
• Recent files — User activity records
• Deleted files — Data that persists after deletion until overwritten

Understanding these artifacts allows investigators to reconstruct user activity, determine when files were accessed, and recover deleted evidence critical to building a case.

FAQ

What is the CIA triad? Confidentiality (data accessible only to authorized parties), Integrity (data not tampered with), Availability (systems accessible when needed). These three principles form the foundation of all cybersecurity practices.

How do I start a career in cybersecurity? Learn networking, operating systems, and basic security concepts. Set up a home lab. Earn entry-level certifications like CompTIA Security+. Build hands-on skills through CTF challenges and bug bounty programs.

What is the difference between a vulnerability and an exploit? A vulnerability is a weakness in a system that could be exploited. An exploit is code or technique that takes advantage of a vulnerability to cause unintended behavior.

How often should I change my passwords? Current guidance recommends strong, unique passwords for each account and a password manager. Change passwords immediately if you suspect compromise rather than on a fixed schedule.

What is multi-factor authentication? MFA requires two or more verification factors — typically something you know (password), something you have (phone), and something you are (fingerprint). It dramatically reduces account takeover risk.

Forensic Investigation Methodology

Digital forensics follows a structured process to ensure evidence integrity and admissibility:

1. Identification — Recognize potential evidence sources: hard drives, RAM, network logs, cloud storage, mobile devices.
2. Collection — Acquire evidence using forensically sound methods. Create bit-for-bit disk images using tools like dd or FTK Imager. Always use write blockers to prevent modification.
3. Preservation — Maintain chain of custody. Document who handled evidence, when, and why. Store images on tamper-evident media with cryptographic hashes.
4. Examination — Analyze the acquired data. Recover deleted files, examine file system metadata, parse logs, and extract artifacts.
5. Analysis — Correlate findings to build a timeline of events. Identify indicators of compromise (IOCs) and determine the attack vector.
6. Reporting — Document methodology, findings, and conclusions in clear, defensible language suitable for technical and non-technical audiences.

Memory Forensics

Volatile memory (RAM) contains valuable evidence: running processes, open network connections, loaded kernel modules, passwords, and encryption keys. Volatility is the industry-standard memory analysis framework:

# Identify the operating system profile
volatility -f memory.dump imageinfo
# List running processes
volatility -f memory.dump --profile=Win10x64 pslist
# Extract network connections
volatility -f memory.dump netscan

Memory forensics can reveal malware that only exists in RAM (fileless malware), processes hidden from the operating system, and evidence of rootkit installation.

File System Forensics

Common file system artifacts include:

• $MFT (NTFS) — Master File Table contains metadata about every file
• Journal — Records file system changes with timestamps
• Prefetch files — Application execution history on Windows
• Recent files — User activity records
• Deleted files — Data that persists after deletion until overwritten

Understanding these artifacts allows investigators to reconstruct user activity, determine when files were accessed, and recover deleted evidence critical to building a case.

For a comprehensive overview, read our article on Cloud Security Architecture.

For a comprehensive overview, read our article on Cloud Security Guide.