- [Instructor] Digital evidence often comes
from computers, mobile devices, and digital media
that store the information required by investigators.
That's where forensic investigators use system
and file forensics techniques to collect
and preserve digital evidence.
Remember that the first rule of evidence collection
is that investigators must never take any action
that alters the evidence itself and may lead to the
misinterpretation of that evidence.
When it comes to systems and files, forensic investigators
preserve this principle by never working with the
actual physical evidence unless absolutely necessary.
Investigators do this by creating copies, or images,
of the physical evidence and then using those images
for forensic analysis.
When a forensic analyst creates an image of a hard drive
or other media, the analyst must connect a device
to the drive and use that device
to copy off the data stored on the media.
Whenever media is connected to a system,
there is always the risk that the analysis process
will inadvertently write data to the media.
Forensic analysts use special devices known as
write blockers, or forensic disk controllers,
to prevent this from happening.
The write blocker sits in between the forensic system
and the evidence and intercepts all requests
sent to the evidence, removing any requests
that might tamper with the contents of the drive.
You can see an example of a write blocker connected
to a hard drive here.
With the physical evidence, investigators use sealed
containers to demonstrate that the evidence
hasn't been tampered with.
The digital equivalent is using hashing.
A hash is a unique signature of a file generated
by using a mathematical algorithm.
If you take multiple hashes of the same file
over a period of time, you will get identical results.
If the file changes, even slightly,
the hash value changes completely.
Let's take a look at an example.
This web page allows me to input some text
and then generate a hash value using the md5 algorithm.
I'm going to go ahead and paste in here
the preamble to the United States Constitution.
As soon as I did that, notice that down on the bottom
of the screen, the md5 hash value appeared.
It's this really long hexadecimal string.
Digits from zero through nine and letters from A through F.
This hash value is unique to the text that I typed in.
If I make any change to the preamble of the Constitution
here, the hash value is going to change
and it's going to change completely.
Let me show you an example.
I'm going to go ahead and simply change this capital C here
in Constitution from a capital C to a lowercase C.
When I do that, watch the hash value down here.
As you can see, it just changed completely.
The new hash value is completely different
from the value with the uppercase C.
If I go ahead and change this back,
the original hash value is restored.
Hashes provide forensic investigators with the ability
to demonstrate that evidence hasn't been altered.
If the investigators compute hash values at the time
they collect evidence, they can then recompute hash values
when analyzing and presenting evidence or an image
of that evidence to prove that the file they're working on
is identical to the file that was originally collected.
Hashes can be applied to any type of file,
ranging from a simple paragraph of text
like I just showed you, or a file containing an image
of an entire hard drive.
Investigators may collect other details
from a targeted system as well.
This may include taking screen shots with special forensic
software or simply taking photographs of a computer screen.
Investigators may also collect information
about the contents of a systems memory,
it's process table, and system configuration
if they encounter the machine in a running state.
There is one more important rule of system forensics.
Forensics is a highly specialized discipline
and you should never attempt performing a
forensic investigation unless you really know
what you're doing.
The risk of damaging evidence is simply too high.