Digital Forensic

This document provides study material and assignments on Digital Forensic. It covers topics such as Computer Misuse Act offense, WannaCry Ransomware attack, ACPO guidelines, theft of data, and more.

Running head: DIGITAL FORENSIC
Digital Forensic
Name of the student:
Name of the university:
Author note:

1DIGITAL FORENSIC
Table of Contents
Question 1:.......................................................................................................................................2
S1 Computer Misuse Act offense:...............................................................................................2
b) WannaCry Ransom ware attack of UK National Health Service:...........................................2
Section 3ZA of the Computer Misuse Act 1990.........................................................................3
Question 2:.......................................................................................................................................4
a) Purpose of ACPO guidelines:.................................................................................................4
b) Use of Principle 2 of the ACPO Good Practice Guide for Digital Evidence..........................4
c) TMA O4 oral evidence:..........................................................................................................5
Question 3:.......................................................................................................................................6
a) Reasons for no offence in the English Law of theft of data:...................................................6
b) Alternative available when data is stolen:...............................................................................7
c) Reason for which the telephone intercepts evidence is prohibited in UK...............................7
d) Difference between the use of interception :...........................................................................7
References:....................................................................................................................................10

2DIGITAL FORENSIC
Question 1:
S1 Computer Misuse Act offense:
The liability falling under the offense of the Computer Misuse Act requires points
including at least one significant link that is concerned with the respective home country. The
link should include the fact of either the accused one or the targeted computer of the home
country
Other than the mentioned points some other points that are needed in order to secure a
conviction under the S1 Computer Misuse Act offense should include any one of the following
with domestic jurisdiction:
1. That the unauthorized action was done in relation to a computer based on the home country.
For example: Hacking
2. That the accused of the unauthorized action was in the home nation that is anxious at the exact
period when the unauthorized act took place. For Example: Unauthorized alteration of computer
database pertaining to the internet users of broadband account.
3. That the unauthorized act created a risk significantly damage within the home country. For
example: Data leakage caused at the corporate network of the home country.
If evidence of any particular point is missing then it will show that the act is misapplied
and fine will be imposed accordingly.

3DIGITAL FORENSIC
b) WannaCry Ransom ware attack of UK National Health Service:
The WannaCry ransom ware occurrence that took in May 2017, in the UK National
Health Service, caused the cancellation of about 19000 appointments within the hospital. The
attack caused shut down of thousands of computers across the world with the hackers demanding
ransom payments. The main reason that was pointed out that caused the ransom ware attack was
that at the time of attack the UK NHS was using an outdated IT system that led to the cyber-
attack. In this case the hackers misused the computers and took advantage of the situation
causing major ransom ware attack within the organization.
Section 3ZA of the Computer Misuse Act 1990
Section 3ZA of the Computer Misuse Act 1990 is the new amendment that is inserted
creating new offense related to the unauthorized action causing damage to computers or creating
any type of substantial risk causing severe impairment of the quantifiable kind. The damages that
are included under this section includes-
1. Damage to human welfare
2. Damage to economy of any place
3. Damage to atmosphere of any place
4. Harm to national security of any country.
In case of the Ransom ware attack that took place in UK, is one of the example of
computer misuse as per the Section 3ZA of the Computer Misuse Act of 1990. The attack that
took place was due to the unauthorized actions that hackers conducted causing disruption of the
computer systems worldwide and creating serious damage to the National Health Service of UK.

4DIGITAL FORENSIC
The attack led to the damage of the national security of UK, human welfare of the country as
well as damaging the economy of the state leading to a total loss of $92 million across the state.
Question 2:
a) Purpose of ACPO guidelines:
The ACPO guideline is mainly based on the principles for Computer Based Evidence.
Computer based electronic evidence is held to follow some guidelines and expectations that are
applied before they are presented before a court. As mobile and computer based operating
systems along with other programs often alter causing deletion and creation of unwanted file, the
ACPO guideline is created. To comply with the guidelines of the principles of ACPO, a full bit
copy image of the present memory is taken through digital evidence. The ACPO guideline also
requires acquiring of data using an appropriate write blocking hardware unit. While awarding
indication to the court, it is required that the individual produce appropriate digital evidence
while explaining each process including acquisition and examination of the evidence.
b) Use of Principle 2 of the ACPO Good Practice Guide for Digital Evidence.
The principle 2 of the ACPO recommendation includes that anywhere a person finds its
absolutely essential to access the unique data detained on a digital device, he must also be
capable to do so and should be able to clarify their action and the implication of the action on the
numerical indication in front of the court.
The principle 2 of the ACPO Good Practice Guide is effective to be used for Digital
Evidence as the actions that are achieved by the inspector could be considered to be altered than

5DIGITAL FORENSIC
the original action and thus needs particular description of the details demonstrating the evidence
which can be done based on the principle 2 of the ACPO guideline. The principle helps in
creating scientific copy of the hard disk.
For example, it includes stating of suitable precautions that were taken in order prevent
data being overwritten to the disk. The principle 2 of the ACPO is good to use for Digital
Evidence as it makes use of a hardware write blocking device while making Digital Evidence.
The ACPO guideline is particularly used for electronic evidence and in this respect it
needs to be kept on mind that it might not be always conceivable to find images while using a
documented imaging expedient. This in this conditions, it may become essential to access the
original mechanism in order to recuperate the evidences. In this regarded it needs to be noted that
the on look who is capable to give the indication to the court of law is the ultimate necessity to
make any such access.
The involvement of the third party in the investigation helps in raising the particular
concerns of the investigator of third party. The principle 2 of the ACPO is used in dealing with
the issue of competency that relates two particular points that are-
1. Competency in giving proper evidence
2. Competency being able to handle as well as investigate the evidence.
With the help of the 2nd principle of ACPO, the following domains of digital forensic can be
demonstrated-
1. Advanced study in academic area of the relevant field.

6DIGITAL FORENSIC
2. Experience in the relevant field.
3. Demonstrating adherence to the recognized standards of the digital forensic domain.
c) TMA O4 oral evidence:
Three key responsibilities that fall under the TMA 04 while giving oral evidence
includes:
1. The witness usually should give its testimony orally while taking oath and is subjected to cross
inspection.
2. The witness need to take an oath that is envisioned to help to stop unwanted or thoughtful
false statements while in the sequence of gibing oral indication.
3. The witness need to go through cross examination that helps in guarantying the lack of
thoughtful truth as well as making authentic mistakes while giving oral evidence.
In this case in order to comply with the roles and responsibilities, the evidence that is
presented needs to be held as hearsay evidence unless they are completely authenticated.
According to the hearsay rule, any kind of oral evidence cannot be trusted until and unless it is
protected by one of the expectation in the sections 59 and 60 of the Evidence Act. So in order to
comply with the oral evidence, a documentary evidence needs to be presented otherwise the oral
evidence will not be assumed as too the correctness of the file and thus cannot be likened with
the fillings of the document.

7DIGITAL FORENSIC
The primary duty of an expert giving oral evidence to the court should be independent, unbiased
and objective oriented. In particular, the expert giving oral evidence should not be biased
towards the party who is paying his fee. While providing oral evidence and written report, the
expert needs to be truthful and should be thorough with the technical reasoning while providing
his opinion in an honest way. The oral evidence that the expert is giving should ensure that the
report submitted in correspondence to the oral evidence is complete and covers all the relevant
matters related to the fact. However, the duties of an expert giving witness sometimes owes to
the court with some conflict with the clients. One of the most valid example in this case is when
the expert giving oral evidence may sometimes conclude in contradiction to the client’s case. An
expert witness should not also ignore the information that comes into the light causing damage to
the client’s case. In some point of the event the court requires that the expert maintains his duty
while providing complete evidence while covering relevant matters. The expert giving the oral
evidence should bear in his mind as well as in his duty while accepting instructions, assuming
responsibility to his client and also while providing relevant opinion on the evidence . He should
undertake instructions that are only competent or qualified to be carried out providing opinion on
the area of expertise of the expert. Finally last but not the least, the expert giving oral evidence
should ensure that he is familiar with the Part 35 provision of the Civil Procedure Rules and the
Practice Direction related to it so as to comply with the requirements while preparing the report
based on their evidence.

8DIGITAL FORENSIC
Question 3:
a) Reasons for no offence in the English Law of theft of data:
The English Law of Theft of Data is one of the revised laws of England and Wales meant
for the thefts and the similar kind of offenses that are associated with it. But it is worth to be
mentioned that there is no application of theft of personal data in hacking cases in the Law as a
part of the offense. Instead of that the Section 55 of the Data Protection Act of 1998 provides an
alternative offense related to obtaining of personal data unlawfully where a person may knowing
or irresponsibly obtains or discloses or tries to sells or offer personal data. As with the offense of
theft of personal data, there is no upper limit to the fine that the magistrate can impose, hence the
English law of theft of data included the alternative offense where the offense may carry
maximum sentence of a fine under the DPA as a standalone offense to deter the would be
hackers.
b) Alternative available when data is stolen:
The USB Historian can be used as an alternative in case when the data are stolen. The
USB Historian parses the information in the USB from the Windows registry, providing list of
all the USB drives that were plugged into the system. It helps in displaying information such as
the name of the USN drive, when it was plugged in, its serial number, and the user account that
used it. Gathering this information is of utmost use to the investigators when they need to
understand the data when and where it was stolen. For forensic investigators, it becomes
important to deal with the theft, access of data and its movement as these kinds of artifacts plays

9DIGITAL FORENSIC
an important role in their investigation. In this case the USB historian tool provides relevant
information to the investigators.
c) Reason for which the telephone intercepts evidence is prohibited in UK
Intercept evidence is regarded as the recordings or the transcripts that are intercepted
from communication as part of the evidence in criminal proceedings. The use of interrupt
evidence is prohibited in UK under the section 17 of the Regulation of Investigatory Power Act
2000.
In the law, the government of UK refuses to allow telephone interception as a part of
evidence. According to the government, the forces and the security facilities has the ability to
seize private communication as a substantial tool while fighting against serious crime. This
allows laws or security amenities to gain appreciated acumen based on the activity of the suspect
leading to arrest of the accused. But besides this, this interception evidence, males the criminals
aware of the particular method and would led to the deterioration of the ability to intercept calls
by adopting countermeasure.
d) Difference between the uses of interception:
 The Regulation of Investigatory Powers Act(RIPA) 2000
The Regulation of Investigatory Power Act 2000 is the act based on regulating power to
the public forms while carrying out shadowing and covering seizure via message. The capture of
communication that is used in this act, is used in the interest of national security for averting or
sensing crimes as well as for safeguarding the wellbeing of economy in the United Kingdom.
This type of capture is permitted to be used by the Defense Intelligence, Custom Secret
Intelligence, Territorial police forces and the Revenue and custom department. The Regulation of

10DIGITAL FORENSIC
Investigatory Power Act of 2000 consists of two controversial stipulations one is that the
individuals within an organization may be compelled while disclosing the necessary keys so as to
decrypt the encrypted communication that can provide evidence of the illegal activity and the
second stipulation is that the Internet Service Provider should bear the overall cost of the
technical equipment that are required to assist the law of enforcement along with the interception
of the electronic communications. Based on this act, the RIPA covers the legal entities including
all levels of government, their job centers, local councils and many more.
 Telecommunications Regulations 2000
The Telecommunication Regulation 2000 is also based on the communication interception
but is slightly different from that of the Regulation of Investigatory Powers Act(RIPA) 2000.
The Telecommunication Regulation 2000 gives the business the right to monitor the
communication over the network of their own. This type of interception was considered as
unlawful unless the consent by both the dispatcher and the receiver is received. However the law
became operative on 24th October 2000 under the article 5 of the EU telecom Privacy making it
legal to record the communication over the private networks as a part of the lawful practice oof
the business. The interception law under this act was meant for the purpose of the following:
 It allows business to comply with other regulations
 It helps in establishing existence of facts
 It helps in preventing or identifying criminal activity.
 It helps in ensuring the effectiveness of the communication system
 It acts as the means to verify whether the person who is monitored is performing their
work to standards.
 It also allows business to detect any type of unauthorized use of systems.

11DIGITAL FORENSIC

12DIGITAL FORENSIC
References:
Anton Piller KG v Manufacturing Processes Ltd [1976]. 1 Ch 55 (CA).
Association of Chief Police Officers (ACPO) (2012) Good Practice Guide for Digital Evidence, 5th
version [Online]. Available at http://www.acpo.police.uk/documents/crime/2011/201110-cba-digital-
evidence-v5.pdf (Accessed 28 January 2014).
BBC News (2005) Tsunami web hacker found guilty, 7 October [Online]. Available at:
http://news.bbc.co.uk/1/hi/england/london/4317008.stm (Accessed 24 March 2014).
Crown Prosecution Service (CPS) (2008) Legal Guidance to the Computer Misuse Act 1990
[Online]. Available at: www.cps.gov.uk/legal/a_to_c/computer_misuse_act_1990/#an10 (Accessed
24 April 2014).
Dpp v Bignell [1997] EWCA Civ J0516-4.
Fafinski, S. (2009) Computer Misuse: Response, Regulation and the Law, Cullompton, Willan
Publishing.
Law Commission (1989) Computer Misuse (Report) [1989] EWLC 186, Part IV(A)4.1.
R v Chesterfield Justices and Chief Constable of Derbyshire ex parte Bramley [1999] EWCH J1105-
7.
R v Shephard [1993] 2 WLR 102.
Sommer, P. (2012) Digital Evidence, Digital Investigations and E-Disclosure: a Guide to Forensic
Readiness for Organisations, Security Advisers and Lawyers, 3rd edn [Online], Information
Assurance Advisory Council (IAAC). Available at
www.iaac.org.uk/_media/DigitalInvestigations2012.pdf (Accessed 4 February 2014).

13DIGITAL FORENSIC
The Guardian (2012) ‘Gary McKinnon timeline: events leading up to extradition decision’, 16 October
[Online]. Available at www.theguardian.com/world/2012/oct/16/gary-mckinnon-timeline-extradition
(Accessed 6 February 2014).