Digital forensics

Hardware, software

______: Physical and tangible computer

______: Set of instructions complied into programs

Computer case

The house and protects all internal computer components

Power supply

Converts alternative current from wall outlets to different current at various voltage required by the computer

Motherboard

The primary circuit board containing the system’s core components

System bus

Electrical pathway on the motherboard that facilitates data transfer

Read-only memory (ROM)

Programs essential for system initialization. those non-volatile storage devices retain their contents even when power is removed.

Central processing unit (CPU)

Computer’s processing center, executing instructions and managing system operations. Modern processors contain cache memory that retain certain data.

Random-access memory (RAM)

System performance enhance , providing high speed temporary storage. Dynamic data management, Computer strategically loads frequently accessed data into RAM for immediate availability. Volatile Evidence Concerns, complete lost when power is removed

Input, output

Name the devices…

_____: Keyboard; mouse; joystick; scanner

_____: Monitor; Printer; Speakers

Partitioning

Initial division of storage space into logical sections for organization and management

8, 512

Binary Storage: Data stored as bits (0-1) with _ bits forming one byte and __ bytes forming one sector

File allocation, unallocated space, file fragmentation

____ __________: tables: track file locations and storage status

_________ _____: Areas where deleted files may still exist until overwritten

____ __________: When files are split across non-contiguous sections.

Computer fingerprinting

1. Initial Hash Creation

2. 32-character string generation

3. verification process: Matching string prove the image is comprehensive and unaltered

Visible data

Active file: Documents, images. videos and applications accessible through the operating system’s file

System file: Operating system components, drivers and configuration files that maintain computer function

User-Created content: Personal document, downloads installed programs

Data swapping

User switch between applications and perform multiple tasks, data continuously moves between RAM and the computer’s hard drive through sophisticated memory management

1. Ram storage 2. Memory pressure 3. hard drive swap

Latent data

Hidden information

Includes…

• Deleted files

• File slack- unused space within allocated file clusters

• Registry Remnants

• RAM Artifacts

Investigation value: Often contains the most valuable forensic evidence including deleted files

Internet Cache

Temporary files storing website content, images and scripts

Cookies

Small data files containing user preferences, login info and tracking data from visited web

Android, IOS

_____: Open source platform, making forensic analysis complex

___: Closed ecosystem requiring specialized tool for data extraction

Other platforms: BlackBerry, Windows…