Challenges in Digital Forensics Investigations: A Comprehensive Report

This report provides a comprehensive overview of the challenges encountered in digital forensics investigations, particularly in the context of cybercrime. It begins by examining the impact of cybercrimes on traditional digital forensic methods, exploring how the evolving nature of cyber threats necessitates adaptations in investigation techniques. The report then critically analyzes the challenges associated with evidence collection and analysis in cyberspace, considering new technologies, devices, and digital services. It evaluates the effectiveness of current digital forensic principles, procedures, techniques, and standards in addressing these challenges, offering insights into their limitations and strengths. Finally, the report provides recommendations for improving digital forensic investigations in the modern cyber environment, suggesting strategies to enhance evidence collection, analysis, and overall investigative success. The report also delves into the principles of evidential management, hardware fundamentals, contemporaneous notes, and the myths surrounding file deletion, providing a holistic understanding of the subject matter.

Running head: DIGITAL FORENSICS AND CYBER CRIME
DIGITAL FORENSICS AND CYBER CRIME
Name of the Student
Name of the university
Author note

1DIGITAL FORENSICS AND CYBER CRIME
Table of Contents
Introduction................................................................................................................................2
Impact of cybercrimes to digital forensics investigation methods.............................................2
Digital forensic principles, standards and techniques................................................................6
Conclusion..................................................................................................................................8
References..................................................................................................................................9

2DIGITAL FORENSICS AND CYBER CRIME
Introduction
At present the scenario is such that there is always a need for a computer or another
such digital device in the realms of criminal investigations. While conducting forensic
analysis there are many mistakes made. Forensic has been a important concept since its
inception and refers to scientific tests and the techniques that are made use of in relation to
detection of various crimes. Digital forensics is concerned about the evidences form the
computer systems that are accepted by the court only if they are convincing enough and can
be relied upon. It deals in science of locating, extracting as well as analyzing various types of
data collected from different devices which are then interpreted by the specialists to draw
conclusions from the same (Alenezi et al. 2017). In the broader sense digital forensics can be
considered as the process involved in investigation of a computer system so that cause of a
certain incident can be determined from the same. Computer forensics is referred to a specific
process that helps in recognizing, protecting, extracting and archiving electronic evidences
existing on computer systems or the associated peripherals. In this paper, the various impacts
of cybercrimes to the digital forensics investigation methods will be discussed upon. The
discussion will also include evaluation of existing digital forensic principles, standards and
associated techniques.
Impact of cybercrimes to digital forensics investigation methods
Digital Forensics has a broad scope and is thus divided into different branches so that
in each of the knowledge areas greater knowledge base can be facilitated. The various
branches of digital forensics are as disk forensics, network forensics, database forensics,
scanner forensics, multimedia forensics, digital music device forensics, PDA forensics and
printer forensics (Bates, Pohly and Butler 2016). In the sphere of cybercrimes there is a

3DIGITAL FORENSICS AND CYBER CRIME
specific method for all of these different branches. The branches of digital forensics and the
methods of investigation followed in each of the cases are as follows:
1. Disk Forensics- This refers to the science of extraction of forensic information from the
digital storage media such as the Hard disk, FireWire devices, Floppy disks and many such
devices. The method involved is identifying the storage devices from the crime scene which
can be the hard disks of CD, Floppy disks, DVD and many more. It can also constitute the
flash cards, magnetic tapes and other such things. After this the evidence is acquired which is
done by the help of imaging tool and in this case imaging should be done with the help of
correct and complete data (Breitinger and Baggili 2019). It should be kept in mind that during
this the source media should be kept write protected. Then comes authentication and once the
imaging is done it needs to be verified with original one. Hashing is considered as a
mechanism that helps in proving that the copy is exactly same as that of the original and has
not been altered. After that the evidence should be preserved as there are high chance that the
electronic evidences get modified or tampered and the person doing the same leaves behind
no trace of the same. The evidence is then analyzed and it should be taken care of that no
important information is left out (Cameron 2018). Then comes the final and the most
important stage that is report generation. The value of the collected evidences depends on the
way in which it is presented.
2. Printer Forensics- Printed material is considered as a direct accessory to many of the
criminals as well as terrorists acts. Printed material can be made use of for conducting illicit
or terrorist activities. The criminals those forge passports and other such important
documents come under the purview of printer forensics. The method followed includes
identifying the unique characteristics of the printers and secondly by designing printers to
purposely embed in it the individualized characteristics in the documents (Chen, Takabi and
Le-Khac 2019). The second method is followed by majority of the latest printer

4DIGITAL FORENSICS AND CYBER CRIME
manufacturing companies so that no two printers of same model behave exactly in the same
pattern.
3. Network Forensics- This branch of forensics deals with monitoring as well as analysis of
the traffic in the network (Choo and Dehghantanha 2017). This the process in which raw data
in a network are gathered and examined which in turn helps in tracking as well as monitoring
traffic of network.
4. Database Forensics- Database is branch of digital forensics that is related to forensic study
and follows normal forensic process applying to various investigative techniques, database
contents and metadata. Forensic examination of a certain database related to the timestamps
that are applicable to the update time of a row in the relational table that is being inspected.
5. Scanner Forensics- A large portion of the digital image data that is available is developed
by making use of acquisition devices that include the digital cameras and scanners (Farid
2018). Cameras allow the digital reproduction of natural scenes and the scanners are made
use of to capture the hardcopy art in case of the more controlled scenarios.
The methodological approaches in case of digital forensics comprises of three basic
components that are acquiring evidences, authenticating the evidences and analyzing the
evidences. Some of the steps that are included in general are as follows:
1. Creating hash codes- In this phase, hash codes are created that is usually MD5 or SHA of
drive. In this specific step it is not possible to create hash codes for each of the files that are
present in the device. There is no knowledge about the files that are present inside the drives.
In Linux distribution there are various tools that help in calculating hash codes for example
md5sum and sha1sum.

5DIGITAL FORENSICS AND CYBER CRIME
2. Image copy phase- In this step a copy of the device is created. These images need to be
actual bit-by-bit or rather “mirror” images if the original data. The simple copies of the data
do not support protecting original data from the inadvertent alterations. In order to acquire
such types of exact copies, specialized forensic techniques are required to be made use of.
This image that is generally in the raw format is a file image of analyzed drive (Grajeda
Breitinger and Baggili 2017). File images of the same devices can be created and each of
these form a part of whole image file.
3. Data recovery or the data carving phase- In this specific phase, recovering the removed
data files is the main aim. Carving activity comprises of recovering the files through the files
header and footer identification. There are many tools such as photorec, magicrescue and
scalpel which can be used for this purpose.
4. Disk analysis phase- The disk analysis aims at analyzing the mass memory as well as
verifying the disk partitioning and comprises of two different phases that include partition
recognition and file system identification.
5. Mount partition phase- After the phase of disk analysis comes the mount partition phase
and this is one of the important steps as it helps in avoiding files or anything into the partition
that has the probability of getting distorted (Holt, Bossler and Seigfried-Spellar 2017). The
mount command permits establishing a connection in between a file system and the system
folder.
6. File system analysis- This is considered as the core of the analysis and requires more time
than the other phases. This step has two different sub steps that include the system
operational analysis and files data analysis.

6DIGITAL FORENSICS AND CYBER CRIME
a) System operation analysis- This phase is concerned with a wide argument. The first and
foremost step involved in this is analyzing the internet history, chronology of the browser
along with the temporary internet files. Pasco is considered as a useful program in this case as
it reconstructs individual’s online activity.
b) Files data analysis- This phase takes a lot of time and time is wasted in this phase when
useless files are analyzed or viewed (Htun and Thwin 2017). Thus to avoid this certain
keywords should be made use of to search for only those files that are useful for the user’s
purpose.
Digital forensic principles, standards and techniques
At present the work related to digital forensics is only done by ISO and some of the
standards are given below:
ISO 27037- This provides certain guidelines for activities that are related to handling of
various digital evidences including identification, acquisition, preservation and collection of
some potential digital evidences that have evidential value (Losavio, Chow, Koltay and
James 2018). The devices and circumstances that come under the purview of this are:
a) Digital storage media that are made use of in standard computers such as hard drives, data
devices and similar such things.
b) Mobile phones, PEDs or Personal Electronic Devices and many more.
c) Digital still and video cameras that include CCTV (Samy et al. 2017).
d) Standard computer system with network connections.
ISO 17020- This provides the requirements for operation of the bodies that are performing
inspection. This comprises of eight different sections that are as follows:

7DIGITAL FORENSICS AND CYBER CRIME
 Scope
 Normative References
 Terms and Definitions
 General Requirements
 Structural Requirements
 Resource Requirements
 Process Requirements
 Management System Requirements
The four different phases related to digital evidence handling are given below:
1) Identification- In this phase relevant evidences are searched for and its documentation
done.
2) Collection- In this phase digital devices are collected that consists of data having
evidentiary value.
3) Acquisition- This comprise of acquiring the data that serves as evidence in a proper way so
that no intentional modifications is done to the same.
4) Preservation- This includes preserving the integrity of the digital evidences and is referred
to as processes that investigators make use of to preserve crime scene (Singh, Ikuesan and
Venter 2018).
Quality of Data- In order to ensure the quality of data in case of digital forensics it is
required that an investigator applies different ranges of techniques to retrieve data. The digital
forensic reports must be reviewed by the administration to check that these are consistent
with agency policies (Vincze 2016). The reports once created must be technically reviewed
and tests performed for validating the same.

8DIGITAL FORENSICS AND CYBER CRIME
Chain of custody (Data) - Chain of custody is the process that is made use of to validate the
ways in which evidences are gathered, protected or tracked on its way to the court of law. It is
the forensic link or the chronological documentation of electronic evidences (Watson and
Dehghantanha 2016).
There are some main principles of ACPO and they are as follows:
ACPO Principe 1: According to this principle, there should be no such actions taken that
alters the data on a digital device consisting of computer or mobile phones.
ACPO Principle 2: When a person finds that it is necessary to access the original data that is
held on digital device, the person should be competent to do the same.
ACPO Principle 3: According to this audit trail or other such records of different processes
that are applicable to digital evidences should be preserved (Yoo et al. 2019).
Daubert standard is made use of by trial judge and that refers assessing if an expert’s
scientific testimony depends on reasoning or methodology that in turn should be scientifically
valid at the same time can be properly applied to various facts at issue.
Conclusion
From the above discussion it can be concluded that digital forensics is emerging to be
an essential concept in the field of cyber crimes. It has many different branches along with
specific standards that need to be adhered to while considering digital evidences. From the
main standards it can be understood that the integrity of the evidences is a vital factor. The
data that is collected should reach the courts without being altered in any form. The digital
devices that are collected should not be hampered. From the discussion it can be understood
that digital forensic extends beyond the existing borders of digital crime. It helps in preparing
the environment of a digital crime and there are instances where it also ensures legal

9DIGITAL FORENSICS AND CYBER CRIME
acquisition of evidences that are necessary to be prosecuted. Thus it can be said that
development of international standards in case of digital forensics can help it extending its
processes.

10DIGITAL FORENSICS AND CYBER CRIME
References
Alenezi, A., Zulkipli, N.H.N., Atlam, H.F., Walters, R.J. and Wills, G.B., 2017, April. The
impact of cloud forensic readiness on security. In International Conference on Cloud
Computing and Services Science (Vol. 2, pp. 539-545). Scitepress.
Bates, A., Pohly, D.J. and Butler, K.R., 2016. Secure and Trustworthy Provenance Collection
for Digital Forensics. In Digital Fingerprinting (pp. 141-176). Springer, New York, NY.
Breitinger, F. and Baggili, I., 2019. Digital Forensics and Cyber Crime. Springer
International Publishing.
Cameron, L., 2018. Future of digital forensics faces six security challenges in fighting
borderless cybercrime and dark web tools.
Chen, L., Takabi, H. and Le-Khac, N.A. eds., 2019. Security, Privacy, and Digital Forensics
in the Cloud. John Wiley & Sons.
Choo, K.K. and Dehghantanha, A., 2017. Contemporary Digital Forensics Investigations of
Cloud and Mobile Applications. In Contemporary Digital Forensic Investigations of Cloud
and Mobile Applications (pp. 1-6). Syngress.
Farid, H., 2018. Digital forensics in a post-truth age. Forensic science international, 289,
pp.268-269.
Grajeda, C., Breitinger, F. and Baggili, I., 2017. Availability of datasets for digital forensics–
and what is missing. Digital Investigation, 22, pp.S94-S105.
Holt, T.J., Bossler, A.M. and Seigfried-Spellar, K.C., 2017. Cybercrime and digital forensics:
An introduction. Routledge.

11DIGITAL FORENSICS AND CYBER CRIME
Htun, N.L. and Thwin, M.M.S., 2017. Proposed Workable Process Flow with Analysis
Framework for Android Forensics in Cyber-Crime Investigation. The International Journal
of Engineering and Science (IJES), 6(1), pp.82-92.
Losavio, M.M., Chow, K.P., Koltay, A. and James, J., 2018. The Internet of Things and the
Smart City: Legal challenges with digital forensics, privacy, and security. Security and
Privacy, 1(3), p.e23.
Samy, G.N., Shanmugam, B., Maarop, N., Magalingam, P., Perumal, S. and Albakri, S.H.,
2017, April. Digital forensic challenges in the cloud computing environment. In International
Conference of Reliable Information and Communication Technology (pp. 669-676). Springer,
Cham.
Singh, A., Ikuesan, A.R. and Venter, H.S., 2018, September. Digital Forensic Readiness
Framework for Ransomware Investigation. In International Conference on Digital Forensics
and Cyber Crime (pp. 91-105). Springer, Cham.
Vincze, E.A., 2016. Challenges in digital forensics. Police Practice and Research, 17(2),
pp.183-194.
Watson, S. and Dehghantanha, A., 2016. Digital forensics: the missing piece of the internet of
things promise. Computer Fraud & Security, 2016(6), pp.5-8.
Yoo, C.D., Shi, Y.Q., Kim, H.J., Piva, A. and Kim, G. eds., 2019. Digital Forensics and
Watermarking: 17th International Workshop, IWDW 2018, Jeju Island, Korea, October 22-
24, 2018, Proceedings (Vol. 11378). Springer.