Notes on Digital Forensics Tools, Evidence Formats, and Workflows (Paraben, Magnet, VM, Autopsy)

Overview

• This session covers setup, access issues, and practical workflow for digital forensics labs using Paraben and Magnet, with emphasis on VM access, networking, and handling large evidence files.
• Key goal: become comfortable navigating evidence folders, understanding typical file formats, and applying correct loading practices in forensic tools.
• Real-world context: evidence is often split or segmented across multiple files by the tool that created it; prioritize loading the leading piece to pull in all related segments.

Key Tools and Access Issues

• Paraben (mobile forensics tool)
  • Evidence files often end with a DS suffix indicating a Device Seizure from Paraben or similar sources.
  • Example: Android evidence file may be named with a DS ending and will be used to identify the device seizure within the Paraben workflow.
  • If you see a DS suffix, it typically means the evidence was acquired via a device-seizure workflow in Paraben.
  • In class discussion, a common practice is to ensure the Paraben output matches the expected suffix (e.g., DS) to verify correct acquisition.
• EnCase/EXO suffixes (ENCASE context mentioned informally)
  • E01, E02, E03, etc., are common segmentation suffixes used by EnCase-style acquisitions; these indicate split or segmented images.
  • E01 is typically the primary image file; subsequent E02, E03, … are additional segments that belong to the same evidence set.
• Magnet (another forensics tool)
  • Mentioned as an additional tool available to students; there is ongoing discussion about licensing and access (e.g., university funding, credential updates).
  • A real-world case example involving Magnet (a two-person murder scenario) was used to illustrate how investigative datasets can be constructed for training.
• Login and environment considerations
  • Some users experienced invalid account IDs or password prompts; older credentials from prior semesters may not work with newer software versions.
  • There was mention of a recent renewal and a potential upgrade to a higher version of the software; the older version (e.g., v3.0 or similar) might still be installed for now.
  • If access is flaky, switching to the newer credential once activated may resolve issues, but incomplete installation can limit features.
• VM stability and network
  • The VM and the lab network can be unstable; wireless connections can contribute to disconnects and slow performance.
  • A recommendation given: use a wired Ethernet connection when handling large evidence files to improve reliability and speed.
  • Large files (e.g., > $20\,\text{GB}$) are more reliably handled over Ethernet than over Wi-Fi due to potential packet loss and throughput variability.

Hardware, Networking, and Performance Considerations

• Ethernet recommendation
  • Use a direct Ethernet connection when working with large evidence files and multiple forensic tools that are resource-intensive.
  • Rationale: large evidence sets and simultaneous tool usage require stable, high-throughput network access to avoid transfer interruptions.
• Large evidence files and resource usage
  • Expect to work with very large files (e.g., up to $40\,\text{GB}$ for iPhone backups or images).
  • Some cases or devices (e.g., iPhone 11 image) can be exceptionally large (example given ~$40\,\text{GB}$).
  • Lab configuration may provide smaller starter datasets (e.g., Android image around $4\,\text{GB}$) to help students get hands-on practice before tackling larger datasets.
• VM access and folder structure (mobile forensics data)
  • Students are instructed to locate the “mobile forensics” folder within the C: drive of the VM.
  • Inside that folder will be subordinate folders and evidence packages (e.g., Android and iPhone images) used for assignments.
  • Directory naming can vary (e.g., seven twenty vs six twenty); graduate students typically access a different set of folders than undergraduates.
• File and evidence organization principles
  • The evidence tree commonly includes a top-level device (Android or iPhone) with additional sub-files representing artifacts and partitions.
  • It’s important to identify file extensions and the corresponding tool used to acquire them (e.g., DS for Paraben device seizure, E01/E02 segmentation for EnCase-like exports).

Evidence Formats and Data Structures

• Common image types and extensions
  • Raw disk images or images from devices may come as:
  • .IMG (raw single image)
  • .DD (disk image file used by some tools)
  • Split images indicated by segments such as .E01, .E02, .E03, … (EnCase-style segmentation)
  • Paraben-related outputs may include a DS file suffix denoting a Device Seizure artifact.
• EnCase segmentation and data integrity
  • Segmentation occurs when the imaging process runs out of space and pieces are split across multiple files (E01, E02, E03, …).
  • The lead piece (E01) is the entry point; loading E01 should pull in or reference the rest of the segments so you don’t need to load every piece manually.
  • If you load a non-leading segment (e.g., E02) alone, you may not access the complete evidence set; always begin with E01.
• Data sources in Autopsy
  • Autopsy uses “Data Sources” to add disk images or mobile backups as investigators begin analysis.
  • Types to be aware of:
  • Raw single images (extension .IMG)
  • DD images (legacy disk images, extension .DD or similar)
  • EnCase-style segmented images (.E01, .E02, …)
  • Mobile device extractions packaged with DS suffix (Paraben)
  • The user guide for Autopsy (data sources section) explains how to add and interpret each type, including how to recognize a raw image vs a segmented one.
• Interpreting evidence metadata
  • The DS file (Device Seizure) is a logical construct representing the seizure event and metadata recorded by the tool used for acquisition.
  • EO1 in EnCase cases often corresponds to a logical set that groups multiple physical segments together.
  • When using multiple tools (Paraben, EnCase, etc.), expect different metadata markers (DS vs EO1/EO2) but designed to reference the same underlying data.
• Practical takeaway
  • If you see DS (Paraben) or EO1 (EnCase), treat them as the lead indicators of a corresponding evidence set.
  • Ensure you understand the tool that produced the file, so you know how to load it properly in Autopsy or your chosen forensic toolkit.

Android vs iPhone Evidence: Content and Access

• Android evidence
  • Android devices often appear with a suffix indicating device seizure and may be accompanied by further segmentation files (EO1, EO2, etc.).
  • Look for the DS suffix and verify that the file is the lead piece (EO1) before loading the rest.
  • Example: Android evidence packaged as DS followed by EO1, EO2, etc., where EO1 loads the entire chain.
• iPhone evidence
  • iPhone backups/images can be very large (e.g., ~ $40\,\text{GB}$ for a modern iPhone backup), requiring substantial VM resources.
  • A smaller Android dataset (e.g., ~ $4\,\text{GB}$) is typically used for initial exercises to help students acclimate to the workflow.
• Workflow implications
  • You may be assigned both Android and iPhone evidence pieces in a given task (as noted with the teen drug case assignment).
  • Early tasks are designed to be approachable (smaller datasets) to build familiarity before introducing multi-device complexity.
• Practical tips for handling both platforms
  • For Android: focus on how device seizure data is represented (DS suffix, EO1/EO2 structure) and how to load the dataset in your forensic tool.
  • For iPhone: anticipate larger images; plan for VM resources and potential segmentation; ensure you have room to work with the 40 GB scale if applicable.

Autopsy and Data Sources: Practical Guide

• Autopsy user guide and data sources
  • Access Autopsy user guide and navigate to the Data Sources section to understand how to add different image types.
  • The guide details how raw images (.IMG) and segmented images (.E01, .E02, …) should be added as data sources and how to interpret the resulting data layout.
  • It also clarifies that certain images (e.g., .DS or device-seizure data) are metadata and may not be loaded directly as a data source in all cases but indicate acquisition provenance.
• Why this matters
  • Knowing how to identify the correct data source and loading sequence prevents errors that can corrupt the workspace or lead to incomplete analysis.
  • Recognizing the nature of each piece of evidence (raw vs segmented vs device-seizure metadata) helps in planning the analysis and ensuring chain-of-custody integrity.

Forensics Workflow: Best Practices and Concepts

• Loading strategy for segmented images
  • Always start with the leader piece (e.g., E01 or EO1).
  • The leader should pull in the remaining segments so you don’t manually load each part.
  • If a segment is missing or incorrectly loaded, you may not access the full dataset correctly.
• Metadata and evidence provenance
  • DS (Device Seizure) indicates the device-held evidence obtained via a specific tool’s seizure workflow.
  • EO1/EO2 segmentation indicates the dataset is split; the data is intended to be treated as a single evidence set.
• The importance of “nothing is truly erased” in forensics
  • In the lab discussion, it was noted that tools can reacquire data even after deletion attempts; this underscores the importance of proper seizure, imaging, and preservation practices.
  • Students should be aware of how apps and permissions on devices can leave traces in multiple artifacts and how tools can recover those traces.
• Practical lab workflow reminders
  • Ensure you have access to the required folders: the main VM folders (e.g., mobile forensics) and any 7xx/6xx subfolders depending on your course level (graduate vs undergraduate).
  • Confirm that you have Paraben and Magnet installed and accessible in the VM before attempting to load device images.
  • If Zoom screen sharing or screen access is an issue during the session, rely on the VM desktop and ensure file navigation is clear for your GA or instructor assistance.

Reading, Assignments, and Course Context

• First assignment and datasets
  • Initial task involves a teen drug case with an Android device and an iPhone device.
  • Both Android and iPhone evidence will be used; students should locate and inspect the Android device folder first to identify the DS/EO1 indicators.
• Recommended reading and preparation
  • If you already have the textbook, review Chapter 7 to understand Android device architecture and how evidence resides within Android systems.
  • For foundational understanding, become familiar with the structure of Android apps, permissions, and how forensic artifacts are stored.
  • If you do not have the book yet, consider affordable options (rental or used copies) or, when permissible, look for legitimate PDF access or library provisions.
• Expected workload progression
  • Early datasets are smaller (to warm up students) and later datasets will be larger (e.g., 14–20 GB per device, and potentially much more).
  • The instructor plans to increase dataset size over the semester to reflect real-world forensic workloads.

Class Logistics, Scheduling, and Support

• Class logistics and schedule flexibility
  • There were notes about adjusting due dates and potentially moving to a Saturday class to better accommodate student schedules.
  • If students feel confident, they may begin working on assignments independently while awaiting instructor guidance.
• Instructor and TA support expectations
  • Instructors may coordinate with graduate assistants to help students resolve login issues or VM access problems.
  • Students are encouraged to reach out if they are stuck, but there is recognition that some may proceed with available resources if they are prepared.

Quick Reference: Key Terminology

• DS suffix: Device Seizure file indicator from Paraben output.
• EO1, EO2, EO3: Segmented evidence pieces (EnCase-style); EO1 is the leader, used to pull the rest.
• E01, E02, E03: EnCase-style segmentation suffixes; similar concept to EO1/EO2 but named in EnCase conventions.
• .IMG: Raw disk image format.
• .DD: Disk image format (older or alternative to .IMG).
• Autopsy: Forensic platform used to analyze data sources and evidence sets; supports various image types.
• Magnet: Another forensic tool used in the course; licensing and access may be in flux; used for casework examples.
• DS: Device Seizure metadata/file designation indicating Paraben-origin data.
• 40 GB / 4 GB: Large vs small dataset sizes used as examples to illustrate workload scaling; expressed as $40\,\text{GB}$ and $4\,\text{GB}$ in this note.

Summary Takeaways

• Know your evidence formats and how to load them correctly (start with EO1/E01, then the rest should load automatically).
• Recognize DS and EO/EO1 naming as indicators of how the data was acquired and how it should be handled in Autopsy and other tools.
• Prioritize stable network connections (prefer Ethernet) when working with large datasets to avoid data transfer issues.
• Build familiarity with Android and iPhone architectures (Chapter 7 as a starting point) to understand where artifacts reside and how permissions affect artifact discovery.
• Stay adaptable with course logistics (assignment dates, class format) and utilize available resources (TAs, GAs, office hours) as needed.

Appendix: Notable Equations and Numerical References

• Large file size examples:
  • iPhone dataset size example: $40\,\text{GB}$
  • Android dataset example: $4\,\text{GB}$
  • Typical progressive dataset growth: $14\,\text{GB} \leq \text{dataset size} \leq 20\,\text{GB}$
• File type representations discussed:
  • .IMG, .DD, .E01, .E02, .E03, .DS
• Data-speed and networking guidance (qualitative): Ethernet reduces risk of data loss when handling large datasets; no explicit numerical equation provided beyond the GB references above.

If you’d like, I can tailor these notes to a specific exam focus (e.g., Autopsy workflows, EO/EO1 handling, or Android data structures) or condense them into a shorter study sheet.