Regular recovery attempts ask, ‘Did the files come back?’ Forensic recovery asks an even tougher question, “Can you provide evidence at some point down the line when challenged by others that what you created is identical to what existed on the original device and that you did not make any changes?”
The actual technical processes involved are essentially the same. However, what differs is that each stage is restricted from being written to and hashed (for documentation purposes) to validate that the file(s) were created without altering anything during the process, while creating a paper trail to support this validation for months later.
Most connections from an external storage device to a workstation are active. When you connect your external drive to a workstation, your operating system may mount the drive, update the last accessed time stamps for each file, create recovery files (or even index them), etc. In order to eliminate this activity during collection of evidence, you need a hardware write blocker. A hardware write blocker connects directly between the workstation and your external drive, thus blocking all write commands to the external drive. As such, the original data stored on the drive can now be completely viewed without altering it, making it possible to prove that the original was left unchanged during examination.
Any subsequent activity occurs on the captured image rather than the original. Both practices (examining and recovering images) support the idea that the original evidence should only have to be readable once.
After an image is taken, a hash (typically in SHA-256) is generated from both the original and image. If the hashes match, the copy is identical on a bit-for-bit basis. This hash value is then logged and checked again with each processing step; therefore, if even one bit changes during this process it would immediately become apparent through a hash difference and thus easily verifiable.
A forensic finding is defendable due to the fact that you are able to demonstrate that the evidence analysed is definitively the same as what was seized.
Once you have started to work from a verified image, most of the information that can be found about an interesting event is typically hidden in areas that are normally invisible to a casual user such as: USB connection records within the registry detailing which devices were connected to the computer at what time; link files/jump lists showing which documents were accessed; shellbags documenting which folders were opened; file system timestamps that show when a document was created, modified or last accessed; and, even after a document has been deleted, it may still remain recoverable in unallocated space on the hard drive.
In departing employee cases, all of these artefacts collectively indicate to you which peripheral devices were connected at some point in time, when they were used, as well as what was being viewed/used/accessed around that time; this is often more information about the files accessed than the actual files provide.
Digital forensics work within the UK follows ACPO’s guidelines on how to treat digital evidence (i.e., do nothing that would alter it) and if you have to alter the evidence, then there needs to be someone who can provide an explanation of why you did so, in addition to keeping an audit log that allows another independent third party to replicate your actions and obtain the same results. This will typically require exhibit record documentation with signatures, documented handling of the evidence, hashing of evidence, and a forensic examination report written from a perspective intended to allow others (who may not have technical experience) to understand the findings.
Forensic work starts from £800 +VAT. We will give you a quote once we have had the scoping discussion. Our forensic work is charged whatever the outcome; in addition if we find out nothing has occurred this still has value and therefore the cost still applies. The 50% deposit is also payable at time of engagement as there is always some analysis that will be undertaken regardless of whether or not anything has been found.
Ordinary recovery is used to recover files. Forensic recovery is used to establish that no alterations were made to your files. To do this we must create an exact copy of the original by reading the source through a write blocker then hash the copy to confirm that it is identical to the original. Every single action taken during the recovery process is recorded to allow anyone else to replicate the steps taken to achieve the final results.
This hardware sits between the drive and the workstation and prevents any write commands being written to the original device. This is important as merely attaching the drive to a normal PC can cause it to mount and write to the device (update access times, write files etc.) thus degrading the evidence prior to analysis commencing.
Often. It is possible to show which devices were connected, when they were connected and what was accessed near that time via USB connection logs, link files, jump lists, shell bag entries and file system time stamps; what can be established varies depending upon the operating system being used and the amount of activity since.
For digital evidence in the UK, the guidance states that no action taken on the data should alter it; where change is unavoidable then the person who made the changes must be competent to explain them; an audit trail must be maintained so that an independent third party could repeat the process and reach the same conclusion.
From £800 + VAT (quoted after a scoping discussion). Forensic work is charged regardless of outcome and carries a 50% deposit because there is value in the analysis regardless of what it finds, including whether or not anything improper happened.