Digital Forensics Analysis and Validation

Scope Creep

An investigation expands beyond the original description because of unexpected evidence you find, prompting the attorney to ask you to examine other areas to recover more evidence.

Block Wise Hashing

This process builds a data set of hashes of sectors from the original file, and then examines sectors on the suspect’s drive to see whether any other sectors match.

Known File Filter (KFF)

* Own hashing databases of AccessData that is only available with FTK.
* It compares known file hash values with files on your evidence drive or image files to see whether they contain suspicious data.

Bit-shifting

It changes data from readable code to data that looks like binary executable code.

Steganography

Hiding messages in such a way that only the intended recipient knows the message is there.

Digital watermarking

Marking that was developed as a way to protect file ownership.

Stego-only attack

Used when only the file containing the possible steganography content is available for analysis. This attack is one of the most difficult to perform because all you have to analyze is the suspected steganography file.

Known cover attack

Used when the cover-media, the original file with no hidden message, and the stego-media, the converted cover-media file that stores the hidden message, are available for analysis.

Known message attack

Used when the hidden message is revealed later, allowing further analysis of new messages.

Chosen stego attack

Used when a steganography tool and stego-media were used to hide the message content.

Chosen message attack

Used to identify corresponding patterns used in stego-media. This technique creates stego-media and then analyzes them to determine how data is configured in the file.

Key Escrow

Designed to recover encrypted data if users forget their passphrases or if the user key is corrupted after a system failure.

Bruteforce attacks

Attacks that use every possible letter, number, and character found on a keyboard.

Hybrid attacks

* These programs consider information such as names of relatives or pets, favorite colors, and schools attended.
* The principle behind these programs is that people have a habit of using things they’re comfortable with, especially if it requires memorizing something secret, such as a password.

Rainbow Table

A file containing the hash values for every possible password that can be generated from a computer’s keyboard.

Salting passwords

A new scheme of protecting passwords has been developed that adds extra bits to a password and then hashes it.