Forensics

GIF sig

47 49 46 38

JPEG sig

FF D8 FF E0

PDF sig

25 50 44 46

PNG sig

89 50 4E 47

Forensic Computing

the application of scientific methods to the identification, preservation, collection, examination, analysis, and presentation of digital evidence in a legally admissible manner.

Core Evidence Requirements

Admissibility, Authenticity, Completeness, Reliability and Believability

Digital Forensics Process Model

Identification, Preservation, Collection, Examination, Analysis and Presentation

Chain of Custody

The documented chronological record of every person who has had possession of the evidence, from initial seizure to presentation in court

Legal Frameworks

Budapest Convention on Cybercrime, RFC 3227 and CARICOM Cybersecurity Framework

CIA Triad

Confidentiality, Integrity and Availability

2025 Cybercrim Cost projections

$10.5T

Number of new variants of malware per day

560K

Percentage of cyberattacks using fileless or memory-based techniques

77%

Most common cyberattack techniques

fileless or memory-based techniques

RAR Archive Hex signature

52 61 72 21

ZIP hex signature

50 4B 03 04

Windows EXE/DLL

4D 5A (= MZ)

Vonn Neumann vs Harvard

Shared bus for data and instructions and is for general purpose computers while Harvard uses separate buses for data and instructions and is for embedded systems

Order of Volatility (Most to Least)

1. CPU Registers & Cache

2. Routing Table

3. System RAM

4. Temporary File Systems

5. Disk Storage (HDD/SSD)

6. Remote Logging & Archival Media

IMEI

International Mobile Equipment Identity

ICCID

Integrated Circuit Card Identifier

IMSI

International Mobile Subscriber Identity

MSISDN

Mobile Station ISDN Number

ISDN

Integrated Services Digital Network

Write blocker

a forensic tool that allows access to a storage device without altering its data, ensuring evidence remains unchanged.

Anti-forensics

a set of techniques designed to obstruct, mislead, or prevent digital forensic investigations.

Metadata

data that describes, explains or provides context for other data (data about data)

Cache

A small, high-speed memory used to reduce the average time it takes a CPU to access data from RAM by storing frequently used instructions

Cache types

• L1 - The fastest and smallest, built directly into the CPU core.

• L2 - Slightly slower than L1 but larger; it can be shared or dedicated to cores.

• L3 - The slowest and largest, typically shared across all cores of a processor.

types of storage media

1. Magnetic (HDD)

2. Solid State (SSD)

3. Optical (DVD)

4. Flash (USB Drive)

5. Cloud Storage

RAID

Redundant Array of Independent Disks

RAID types

0 - Striping - split data across drives

1 - Mirroring - duplicates data on two or more drives

Physical vs Logical drives

the actual hardware unit while logical is a virtual partition created on a physical drive

Hard Disk Capacity Calculation

Cylinders x Heads x Sectors x Bytes per Sector

File system

a method used by an OS to organize, store, and retrieve files on a storage drive

NTFS

an 8 byte value located at offset 0×48 (72 decimal)

FAT12/16

0x27

FAT32

0x43

exFat

0x64

Retrieve IMEI

1. Dial *#06#

2. Check device settings

3. Check physical label under battery or SIM tray

4. Use forensic tools like Cellebrite UFED

5. Request IMEI from telecommunications company records

BIOS Functions

1. POST (Power-On Self Test) - tests all hardware components to ensure they work correctly before booting

2. Bootstrap Loader - Locates the OS and loads it into RAM

3. CMOS Setup - A configuration program that allows users to alter hardware and system settings

4. Runtime Services - Low-level software that gives the computer basic control over hardware

Anti Forensic Techniques

1. IMEI Spoofing

2. File Signature Modification

3. Steganography

4. Timestomping

5. Data wiping

6. Log deletion

IMEI Spoofing

using a cloned or fake IMEI. Detected by Luhn validation or duplicates IMEIs on network

File Signature Modification

Changing the file header bytes to disguise the file type. Detected by comparing the file extension with the hex signature

Steganography

the practice of hiding information within ordinary digital files. Detected via mismatched file signatures or file size discrepancies

Timestomping

Altering file timestamps. Detected via filesystem journals, registry or memory artefacts

Data wiping

using software to completely overwrite data on a storage device with new, meaningless data. Detected by looking for overwrite patterns and unrecoverable sectors