Forensics Image Acquisition Process of Digital Evidence

Abstract

Abstract-For solving the crimes committed on digital materials, they have to be copied. An evidence must be copied properly in valid methods that provide legal availability. Otherwise, the material cannot be used as an evidence. Image acquisition of the materials from the crime scene by using the proper hardware and software tools makes the obtained data legal evidence. Choosing the proper format and verification function when image acquisition affects the steps in the research process. For this purpose, investigators use hardware and software tools. Hardware tools assure the integrity and trueness of the image through write-protected method. As for software tools, they provide usage of certain write-protect hardware tools or acquisition of the disks that are directly linked to a computer. Image acquisition through writeprotect hardware tools assures them the feature of forensic copy. Image acquisition only through software tools do not ensure the forensic copy feature. During the image acquisition process, different formats like E01, AFF, DD can be chosen. In order to provide the integrity and trueness of the copy, hash values have to be calculated using verification functions like SHA and MD series. In this study, image acquisition process through hardware-software are shown. Hardware acquisition of a 200 GB capacity hard disk is made through Tableau TD3 and CRU Ditto. The images of the same storage are taken through Tableau, CRU and RTX USB bridge and through FTK imager and Forensic Imager; then comparative performance assessment results are presented.

Liability for Aviation Crimes: Criminal Law and Criminological Aspects

“…The main regulations aimed at ensuring aviation security operate at three levels: Speaking of crimes in the field of aviation, it should be noted that the current Criminal Code of Ukraine contains a wide list of such crimes. However, forensic [8,9] It should be added that simultaneously with the indictment against citizen A., the prosecutor sent to the court a plea agreement concluded in September 2018 during the pre-trial investigation between the prosecutor of the Globinsky department and the suspected citizen A. According to the agreement, the accused citizen A. fully admits his guilt in committing a crime under Part 1 of Art.…”

Experimental Investigation of Frozen Solid State Drive on Digital Evidence with Static Forensic Methods

“…The DD file format is also referred to as the raw image type. This is a copy of data from the media save by byte by byte without having to be formulated [13]. Copy size and copied disk are the same.…”

“…Investigation of digital crime is very necessary to assist the process of an investigation [11]. Likewise, digital evidence analysis needs to be carried out in accordance with specific handling procedures and appropriate methods of forensic analysis, to obtain good digital evidence, so that from the digital evidence obtained evidence in the form of valid information to support the legal decision of a case of computer crime [12], [13].…”

“…Static forensics refers to traditional forensic investigations carried out with the device not active or not working [7]. Static forensics focuses on examining duplicate copies of storage media to retrieve existing data, for example, such as deleted files, website history, user history, and computer log history [13]. [2].…”

Analisis Forensik Digital Storage pada Owncloud Drive

“…Pengambilan data secara ilegal atau melanggar hukum adalah salah satu usaha tindak kejahatan yang dapat dilakukan, yakni masuk ke dalam Nextcloud tanpa mempunyai ID dan Password terverifikasi sehingga mencoba masuk secara paksa dengan Tools Forensics seperti aktivitas hacking serta menghapus semua data penting perusahaan yang sebelumnya sudah di ambil alih oleh si pelaku. Proses penanganan dalam kasus seperti itu diperlukan untuk menggunakan penyelidikan forensik digital untuk mendapatkan informasi dari bukti digital [7]. Proses investigasi untuk mengembalikan data yang sudah dihilangkan atau dihapus oleh pelaku serta menemukan jejak pelaku kejahatan tersebut agar bisa dijadikan barang bukti dalam persidangan maka proses Analisa Forensik Digital Storage Pada Owncloud Drive dilakukan.…”