Chapter 23: Digital Evidence

Digital Evidence

any stored or transmitted date in binary format that may be useful in a criminal or civil investigation.

Hard drives

data storage devices that have an external logic board connections to external sources of information and power, and some form of storage media.

Thumb Drives

small removable data storage devices with USB connections.

Memory card

very small storage devices used in digital cameras, but can be also used in tablets, computers, phones, game consoles and more.

SIM Card

integrated circuits that store the international mobile subscriber identification identity and the identification and the network information required to authenticate with a mobile carrier network.

Mobile devices

handheld, portable data storage that provide communication, digital photography, navigation systems, entertainment, data storage, and personal information management.

Event data recorder

records real-time data from the vehicle, including braking, acceleration, speed, and other data that can provide investigators with objective data about the vehicle and its status.

Physical media

The analysis of the storage media itself through a standard interface; the recovery of overwritten or deleted data is an example.

Media management

The analysis of the organization of the storage media; determining the file structure or subsections of a storage device.

File system

The analysis of the infrastructure of files (folders, directories) and recovering deleted files.

Application

The analysis of applications and their files, like documents, images, logs, configurations, and others.

Network

The analysis of information systems, networks, connections, and traffic on them.

Memory

The analysis of system memory media, like RAM, and system data.

Steganography

Messages that are hidden “inside” another message.