Menu
  • Home
  • Brett's Blog
  • My Books
  • Courses
  • About Me
  • Contact
  • Home
  • Brett's Blog
  • My Books
  • Courses
  • About Me
  • Contact

Brett Shavers | forensics & things

Brett's Ramblings

Subscribe to blog
Unsubscribe from blog
Settings
Sign In
If you are new here, Register
  • Forget Username
  • Reset Password
Font size: + –
Subscribe to this blog post Unsubscribe
Report
Print
3 minutes reading time (697 words)

“Forensically Sound”.  One of those phrases that is commonly used, misused, unused, and abused.

Digital Forensics
Brett Shavers
Friday, 08 September 2017
4230 Hits
0 Comments

Disclaimer: This is my opinion, which is not a legal opinion. I call it Brett's Opinion.  But along with that, I have identified, seized, analyzed, requested analysis, checked-in/out, transferred/assumed custody, and had entered into court cases thousands of items of evidence from electronic data to brain matter.   

This short post is to give my opinion on the use “forensically sound”.  The reason I want to mention this is because I witnessed a DF expert state in public that capturing live (volatile) memory is not forensically sound because you can’t reproduce it or enter it as evidence.  I think we must be careful about some things we say.  

In the most basic sense, any “thing” that is accepted by a court as evidence is forensically sound, since the court accepted the process used and admitted the "thing" as evidence.

We get caught up when performing computer science work in digital forensics and tend to forget that every situation is a bit different from the next situation, in either minor or major ways.  The general processes we use are similar for each situation, but of course we vary a little depending on what we come across.  The situation we approach dictates how we proceed.

There was a time when pulling the plug on a computer to image the hard drive with a hardware write blocker was the only forensically sound method accepted.  Doing it any other way meant you ruined the evidence.  This belief persisted for years even after realizing volatile memory is also valuable evidence (sometimes even more valuable than data on the drive).  Sure, sometimes you need to pull the plug and sometimes volatile memory has nothing to do with what a specific case may need.  That goes to the point of every case being different.  For the must-always-use-a-hardware-writeblocker crowd, I’m not sure what they do with the computers that the hard drive cannot be removed for a multitude of reasons.  Situation dictates choices.

My point is that we all have best intentions and rely upon generally accepted processes; however, we need to also be aware of what evidence is and what evidence is not.  If you can get a ‘thing’ admitted into court that can prove or disprove an allegation, then you have evidence.  Forensically sound more aptly applies to the technical processes and methods, but does not really define whether or not a ‘thing’ is evidence or not or that a court will accept it or not.

Another holdover from days past is that of being able to exactly reproduce an analysis in order to be forensically sound.  On a hard drive that was shut down when you approached it, imaged through a hardware write blocker, and verified using a software that everyone else uses – easy peasy.   On anything else, good luck.   Live memory changes as you capture it.  Shutting down/pulling the plug on a computer changes the data.  Waiting to decide whether or not to shutdown or pull the plug or image live changes the data (it changes as you watch and think about what to do!) A crime lab that tests the content of a drug destroys a portion of the drug that it tests.  An autopsy on a body damages and changes the body (as does the passage of time with decomposition).  A burning building destroys evidence of the cause of the fire, as does the efforts to put out the fire.

When teaching court admissibility of digital evidence, be careful if you are unsure of what is forensically sound, especially when talking about evidence.   You’d be amazed at the types of evidence that can be admitted in a trial along with the evidence that doesn’t.  Best answer: do your best with the evidence seizing situation you encounter, admit it as evidence, and let the court decide if it was forensically sound.  Personally, I believe anyone working in a job where you look at data should be versed in 'evidence'.  Cops have it easy.  They deal with it every day until it becomes second nature.  For everyone else, a short class in 'what is evidence' can make or break a case later.

Then there is the sliding scale of veracity…but that’s another story.

Tweet
Share on Pinterest
0
Some of your cases probably already have cryptocur...
When “intent” is an element of the crime, you bett...

About the author

Brett Shavers

Brett Shavers

 

Comments

No comments made yet. Be the first to submit a comment
Guest
Thursday, 30 June 2022

Captcha Image

By accepting you will be accessing a service provided by a third-party external to https://brettshavers.com/

direct link

Find Brett!

DFIR Training

Be sure to check out my DFIR Training website for practically the best resources for all things Digital Forensics/Incident Response related.


Brett's blog

Most popular posts

When Being Self-Taught Goes Wrong
53844 Hits
Read More
RegRipper
47812 Hits
Read More
Game of Thrones, DFIR Style
46031 Hits
Read More
The Five Stages of the DFIR Career Grief Cycle
39311 Hits
Read More
Should you improve your DFIR skills on your personal time?
36424 Hits
Read More
Well, I didn’t see that coming…
34497 Hits
Read More
Eat your broccoli first
32324 Hits
Read More
The forensic process begins before processing forensics begins
31410 Hits
Read More
Only race cars should burnout.
29438 Hits
Read More
I lived a double life.
26070 Hits
Read More
TikTok is like a big, greasy cheeseburger. We know it is bad for us, but don't care.
25698 Hits
Read More
'You're guilty unless you can prove it'
23422 Hits
Read More
Aren’t we neglecting something in DFIR?
23420 Hits
Read More
Overcommitted in DFIR
21947 Hits
Read More
This is how I know someone will make it in DFIR (or in anything)
20935 Hits
Read More

© 2022 Brett Shavers