I have a question from one forensic investigator to another.
I am having the following dilemma.
From my law enforcement background, I am hugely focused when it comes to chain of custody.
In other words I will never do straight investigations on a suspicious device, at the federal police we just confiscated everything and looked at it at desk after taking a forensic copy.
Now I sometimes expect to be asked by a customer if it is possible to "take a quick look" to see if there are any traces on a device, usually in the context of data leakage.
Do you have experience with this, is this possible with certain hard and software so that you don't destroy/alter evidence? Because everything in me always shouts - chain of custody always take forensic copy first !!!
Hi Steven,
While it's common practice to first always create a forensic image, there are scenerarios in which you cant or it's impracticable, such as family members and their computers you want to reduce the amount of impact on their privacy. Sometimes asking them to look into their computer will do enough justice to leave it at the scene (Depending on the case type) this also reduces the amount of data you have to work with at a later stage.
In your situation, if you can't first create the forensic image for whatever reason, just note down every step you take. you can also record the screen with a camera (i use a GoPro) so I can always watch back what I did) While the computer is live a lot of files will adjust even files you don't touch, as that's how a computer works and processes rely on other processes, however, if you document everything correctly. you have nothing to be afraid of, at least not the Netherlands and our jurisdictionÂ
Â
Hope this helps,
Lars
... Because everything in me always shouts - chain of custody always take forensic copy first !!!
Chain of Custody yes, but a forensic copy first isn't always possible or practical. If you need to work on a live system document everything you do with an emphasis on you. Never give access to the owner/subject.
Old school forensic copy of a dead (unpowered) system is the classic ideal but may not be viable and live system work may be needed for a number of reasons:
- A quick triage check for targeted material
- A massive SAN or system that cannot be stopped
- A likely encrypted system you may not be able to access after shutdown
- RAM content
- Live critical network connections (very common with compromise investigations)
- Other
Document what you do and why. Expect opposing attorneys to challenge, they would be derelict if they didn't.
Â