In this chapter, we will cover the following recipes:
We would all like our cases to be one hundred percent perfect all the time, but unfortunately things do go wrong sometimes. Whether its because of a technical fault with a product you're using, a mistake made by an investigator, a faulty dataset in the first place, or some kind of legislative issue encountered when a case goes to court, it is all too common to come up against obstacles in your investigations.
In this chapter, we highlight some of the most common things that can go wrong with popular forensic suites and how to fix them. We will then take a look at what you can do when processes fail, and when you come up against legislative or jurisdictional challenges.
Finally, we will provide you with a short guide to taking your first steps in digital forensics, and recommend some advanced further reading - if you haven't been put off yet!
...Digital forensics is a very complex field. This means that you are likely to face different problems while working on your cases. Problems may be of different natures: you could fail to install a tool because your workstation doesn't have additional third-party software (usually it's included in the package by the developers); you could fail to process the data source properly because it's damaged or the format or file system is unsupported; you could fail to parse some forensic artifacts because their format has been changed and isn't supported by your piece of software yet, and so on.
Thanks to the developers of commercial forensic software, including EnCase, FTK, AXIOM, Evidence Center, Intella, and so on, you can solve almost any problem quickly and easily (most of the time) with the help of their customer support services...
Of course, free and open source tools don't have customer support services, but they have developers. Often, you can contact the developer directly and ask your questions, or even share (if possible) the data source problems you have with them. This helps developers to improve their tools and help the community.
Some tools, such as The Sleuth Kit and Autopsy for example, have mailing lists: you can ask your question and the developer or active users will answer it, as shown in the following screenshot:
Since investigative and judicial processes are put together by humans, from time to time they fail; sometimes quite spectacularly. In this section, we will look at a couple of common examples and discuss what to do when situations like these arise.
One of the most frequent criticisms levelled at digital forensic investigators comes in the form of a challenge to the soundness of the evidence they are presenting. This includes the common It wasn't me defense, wherein a defendant insists that they were not the one using the device in question; the suggestion that the evidence itself is somehow faulty; either because of a virus or malware having infected a device before...
During your computer forensic examination with different tools, both commercial and free or open source, you will face so-called false positives, especially if you are planning to use data carving techniques.
So why do we all face them? No, it's not bugs in your forensic software. The thing is, these false positives just match the criteria used by your piece of software to carve data from, for example, unallocated space of the hard drive or its forensic image.
You will most likely face false positives working with tools which support a large number of different apps, for example Magnet AXIOM. But you must understand, it's better to have a number of false positives than one false negative!
As you can see in the preceding figure, it's not difficult...
If you've read this far and you're not yet a digital forensics practitioner but are thinking about it as a potential career path, congratulations! You're looking at working in a growing industry with a wealth of opportunities and a lot of different areas to pursue.
Your next steps in digital forensics will depend how far along the journey you are right now, and what you'd ultimately like to get into.
Ask yourself the following questions:
The following books and websites will prove useful to anyone with an interest in the digital forensics field.
For an advanced, in-depth, yet accessible introduction to the topic, Eoghan Casey's Digital Evidence and Computer Crime is a must-read.
Other good general introductions to the subject area include:
For more in-depth reading on specific topics, you could try some of the following:
© 2017 Packt Publishing Limited All Rights Reserved
