Advanced Digital Forensics: Essential Artifacts for Investigators and Prosecutors

Introduction to Digital Forensics

• Digital forensics is a three-pronged process consisting of acquisition, data analysis, and reporting.
• Acquisition involves taking a digital device, such as a mobile phone, a DVR, or a computer hard drive, and putting the information into a format that allows a digital forensic examiner to look at the internal data.
• Data analysis is the stage where the examiner looks through the data and makes decisions on what happened to the device based on training and experience. This involves looking at thousands of different computer and phone artifacts.
• Reporting is the final stage where examiners present findings, often through Magnet Axiom reports or similar forensic output.

Data Representation: Binary and Hexadecimal

• Digital devices use binary, a numbering system consisting only of zeros ($0$) and ones ($1$). These represent light switches where $0$ means no electricity is flowing and $1$ means electricity is flowing.
• A bit is a single zero or one.
• A byte ($b-y-t-e$) is comprised of $8$ bits.
• In this context, $1,000$ bytes equal a megabyte, and $1,000$ megabytes equal a gigabyte.
• Hexadecimal (Hex) is a system used to translate binary into a format easier for humans to read. It consists of digits $0$ through $9$ and letters $A$ through $F$ ($A=10, B=11, C=12, D=13, E=14, F=15$).
• Two hex characters represent one byte.
• File Signatures (Magic Numbers) are hex values at the beginning of a file that identify its type regardless of the extension. For example, a JPEG image starts with the file signature $FF\,D8\,FF$.
• Forensic tools can decode hex into timestamps. For example, the string $01D9F3A2$ can be translated into a specific date and time.

Magnet Axiom and Forensic Reporting Tools

• Magnet Axiom is currently the most common forensic software used by investigators. It evolved from a tool called Internet Evidence Finder.
• It allows examiners to combine evidence from computers, external media (USB drives), and mobile phone downloads.
• The tool can reconstruct timelines, find deleted data, and review browser history.
• Other forensic tools include Oxygen Forensics, EnCase, FTK, and Grify. Cellbrite (also referred to as Celebrite or Sellbrite) is a primary tool for mobile phone forensics.

The Windows Registry

• The Windows Registry is a hierarchical database that stores system and application settings. It is structured with hives (top-tier), keys, and subkeys, similar to a folder structure.
• It acts as a notebook for installed programs, startup configurations, user settings, and device information.
• The Most Recently Used (MRU) artifact tracks which files were opened or saved using common dialog boxes.
  • It stores file names, extensions, and the path where the file was saved or opened.
  • Entries remain even if the original file (e.g., a CSAM image named Lolita.jpg) is later deleted.
• UserAssist records every Graphical User Interface (GUI) application executed by the user.
  • It tracks the Run Count (e.g., a BitTorrent client like QTorrent being run $847$ times).
  • It tracks Focus Time, which is the number of seconds an application was the active window (e.g., a video player in focus for $42$ minutes).
  • Data is stored using ROT13 encoding (not encryption).
• Typed URLs track entries made directly into the Microsoft Edge or Internet Explorer address bar. This only records URLs manually typed or searches entered by the user.

ThumbCache Artifacts

• ThumbCache is a hidden database used by Windows to store preview images (thumbnails) of folders and files.
• It caches images for photos, videos (often the first frame), and documents to improve the user experience by speeding up folder browsing.
• A thumbnail remains in the cache even if the original file is deleted or the recycle bin is emptied.
• Thumbnails are saved in different sizes based on the user's view settings (Small, Medium, Extra Large). The same image may appear multiple times in the cache if the user adjusted the view size.
• The file names in ThumbCache (e.g., $1280.db$) are generated by Windows and do not reflect the original file name.

Windows Prefetch

• Prefetch is a performance enhancement that speeds up application launch times by preloading necessary resources during the first $10$ seconds of execution.
• Prefetch files ($.pf$) serve as proof that an application was executed.
• Artifacts include the application name, the run count, the last execution time, and the last $8$ execution timestamps.
• Prefetch can record the volume serial number and path for files opened from external drives.
• It may list directories and files referenced within the first $10$ seconds of an app launching, potentially revealing the names of files looked at (e.g., a file named $Child\_FUGA.jpg$ opened via VLC).

Storage Analysis: Spinning Drives vs. SSDs

• Unallocated space contains sectors of a drive not actively used by the file system, which may hold deleted data.
• On traditional spinning platter drives, data remains until it is physically overwritten. Recovering files from $2,000$ is possible on older drives.
• Solid State Drives (SSDs) and M.2 drives use complex processes to manage data:
  • Trim: The operating system identifies cells that are no longer needed after a file is deleted.
  • Garbage Collection: An automated process that wipes the flagged cells and fills them with zeros to prepare for new data. This is compared to a busboy in a diner clearing a table; the examiner has no control over when it happens.
  • Wear Leveling: A strategy to spread data writes evenly across NAND flash cells to maximize the hardware lifespan. This scatters data across different chips/cells, making "file carving" nearly impossible once the master map is deleted.

Link Files and Jump Lists

• Link Files ($.LNK$) are shortcuts created by Windows automatically when a user opens a non-executable file (document, image, video).
  • They are stored in the Recent Items folder.
  • They contain timestamps for when the file was first opened (Created) and most recently opened (Modified).
  • They survive file deletion and can prove a specific file existed on the drive name and size.
• Jump Lists are references to recently or frequently opened files within specific apps (e.g., right-clicking MS Word to see recent docs).
  • Automatic Destinations are controlled by Windows and contain rich metadata.
  • Custom Destinations are created by third-party apps like VLC or Mega and have varying levels of detail.

ShellBags

• ShellBags are registry keys that store a user's folder view preferences (icon size, window position).
• They act as a log of every folder a user has visited, including on local drives, USBs, and network shares.
• ShellBags are persistent; they remain in the registry after a folder is moved or deleted.
• They provide evidence of folder navigation (e.g., a user navigating to a folder named $Very\,Little\,Ones$ on an external drive).

Browser Forensics and SQLite

• Modern browsers (Chrome, Edge, Opera, Brave) are built on Chromium and store data in SQLite databases.
• SQLite Databases are digital filing cabinets organized into tables, rows, and columns.
• History Databases track URLs, page titles, visit counts, and timestamps ($64-bit$ numeric values).
• Keyword Search terms are often stored in a separate table and typically survive even if the browsing history is cleared.
• Incognito/Private Browsing wipes history and cookies when the browser closes. To capture this data, investigators must collect the RAM (Random Access Memory) while the computer is still running.

Mobile Forensics and App Analysis

• iOS Sandboxing: Apple isolates each app into a "virtual playpen" called a sandbox. Each app has a unique Application ID (a long string of hex characters) unique to that specific device.
• Extraction methods include:
  • Logical: Fastest, shows only what the user sees.
  • Full File System: Recovers internal memory and most application data.
  • Physical: A bit-for-bit copy. This is rare now due to full-disk encryption.
• Notification History: This log can store message previews, even if the primary app (like Kik) has been deleted or messages have been cleared.
• Android Focus/Usage Logs: Tracks which application was in the foreground and for how long.
• Emulated Storage: Android often flags a portion of internal memory as an "SD Card" or "emulated storage," even if no physical card is present.

Questions & Discussion

• Mark (Prosecutor): Inquired about charging ThumbCache images if the original file is missing. The consensus is that while possible with corroborating artifacts (like cloud storage), defense attorneys often argue the client deleted it immediately after discovery.
• Scott: Asked about prosecuting ICAC tips based only on link files. Conclusion: Link files prove a file was opened, and combined with cyber tips/metadata, they build a strong case for intent.
• Noah: Asked if encrypted browsers like Tor are similar to Incognito mode. Tor is built on Firefox and operates in permanent incognito; forensic recovery depends on RAM collection.
• Kisha: Asked if a suspect could claim files were automatically uploaded to the cloud without knowledge. Link files, Jump Lists, and ShellBags distinguish deliberate interaction from automated functions.
• Chad: Asked if Apple products store similar registry info. Apple uses P-list files ($.plist$) instead of a registry, which is a different forensic discipline.
• Dan Barry: Provided personal background including $23.5$ years with Tucson Police, starting the ICAC unit in $2009$, and moving to digital forensics in $2019$ before joining the Zero Abuse Project in $2023$.