Digital Forensics Investigation: Processes, Ethics, Legal Guidelines

This report provides a comprehensive overview of digital forensics, encompassing its core processes, ethical considerations, and legal guidelines. It begins by defining digital forensics and detailing the steps involved in a digital investigation, including identification, preservation, analysis, documentation, and presentation of evidence. The report then explores the advantages and disadvantages of adhering to established digital forensics procedures, highlighting the importance of maintaining evidence integrity and validity. Furthermore, it examines various law enforcement guidelines, such as the Investigatory Powers Act and the Computer Misuse Act, and discusses the legal and ethical requirements for conducting digital forensic investigations, emphasizing the need for objectivity and accurate findings. The report also assesses the ethical implications of conducting digital investigations on suspected individuals, considering their legal rights, and discusses the potential consequences of failing to follow established guidelines, which could jeopardize legal cases. Finally, the report outlines a detailed test plan for conducting tests on digital devices to ensure the timely and accurate collection of evidence.

Forensics

Table of Contents
INTRODUCTION...........................................................................................................................1
MAIN BODY...................................................................................................................................1
TASK 1............................................................................................................................................1
TASK 2............................................................................................................................................3
TASK 4............................................................................................................................................6
CONCLUSION................................................................................................................................8
REFERENCES................................................................................................................................8

INTRODUCTION
The concept of digital Forensics generally involves a process that explains the uncovering
as well as interpreting the electronic information. The main objective of conducting a digital
forensic is to preserve the information as a shred of evidence in its most original form. A digital
investigation is used to identify the possible cause of cyberattacks. These can also be used in
safeguarding the digital pieces of evidence which are used in the cyberattacks before it becomes
outdated. This can help an investigator while performing structured research by collecting,
identifying as well as validating the information digitally so as to reconstruct the past occurring
events. The forensic investigation gathers and can analyse all the crime scenarios, including the
physical pieces of evidence, so that the investigators come to a conclusion about the culprits.
They identify the occurrence of crime by looking out the shreds of evidence such as blood fluids
or fingerprints. In this project, there is a discussion about the merits and demerits of investigating
digital Forensics and the processes which are involved in it. There is also a discussion about the
legislation's information guidelines while conducting digital forensic investigations. It also
includes information about the legal as well as ethical requirement that are needed for conducting
any research. Moreover, it is also discussed in this project that the possible consequences can
occur if the guidelines are not being followed while investigating any crime (Berg and et. al.,
2017).
MAIN BODY
TASK 1
Q1. With the aid of a diagram, explain your understanding of the term' digital Forensics'.
Ans.
1

The term digital forensics is defined as the scientific acquisition, analysis as well as preservation
of the information that is contained in electronic media in which the data can be utilized as a shred of
evidence in the justice system. The main aim of this process is to preserve any of the pieces of evidence
in their most original form while performing a structured investigation by collecting, identifying as well
as validating the digital data to reconstruct the past occurring events. The process of digital forensics
generally involves the steps such as identification of information, preservation of data, analysis of the
crime occurred, documentation of the provided information, and presentation of the data or shred of
evidences to the justice system (Zhang and Choo, 2020).
Q2. Conduct a detailed analysis of the processes and procedures for carrying out digital Forensic
Investigations.
Ans. In digital forensic investigations, the processes and procedures involve the following steps which
are as mentioned below:
Identification: It involves the identification of investigation aims as well as the required
resources. The analyst identifies the evidences, the data types from which the analyst deal with as
well as the devices in which the data is stored. In addition to this, the specialist can work with the
all types of electronic storage devices such as computers, hard drives, phones.
Preservation: It involves the isolation as well as protection of data or information as it
only ensures by the analysts that data is protected. It simply means that no person can use the
electronic devices till the investigation procedure ends. By this means, the shreds of evidence
remain secure (Haldar, 2020).
Analysis: In the step of the investigation, it generally involves deep systematic research
for relevant shreds of evidence. At the same time, it was analysing the specialist work with the
user as well as the system files and the information objects. Moreover, the analyst draws an
overall conclusion based on evidence that is found.
Documentation: It involves the documentation of all the shreds of evidence that are
found. It generally aids to extend the crime investigations. In documentation, it also involves the
evidences which are recorded in the form of photos, sketches and so on.
Presentation: It is the last stage of digital forensic investigation as it includes the records
of all the evidences as well as conclusions that occurs at a crime scene.
2

Q3. Document advantages and disadvantages as well as the importance of following such processes and
procedures when conducting digital Forensics.
Ans. Advantages of processes when conducting digital Forensics are as mentioned below:
 It ensures the integrity of the computer system.
 It can be used to produce evidences in court that punishes the culprit.
 It can help the organisation to capture the important data if computer systems are compromised.
 It helps to track the criminals anywhere across nation.
 It also can help to protect money as well as time of an organization (Eloff and Bella, 2018).
Disadvantages includes:
 It includes the proof of tempering with the evidences which are present in court.
 It involves high cost while producing the electronic evidences and their storage.
 It consists the high knowledge by legal practitioners while using computer system.
 It involves the authentic tools for digital Forensics and if the requirements are not met then the
evidences can be disapproved by the court.
 It includes the lack of knowledge among the investigating officers which can results in breach in
confidentiality.
The importance of conducting the digital forensic investigation is required to ensure the validity,
reliability of the evidences and the processes which are involved in this is basically used to find out the
scenario and can be properly documented in Forensics. The digital investigation can disclose the data
about the crime scenes as well as the movements of the culprits and their associated criminals (Billard
and Bartolomei, 2019).
TASK 2
Q1. Different law enforcement guidelines for conducting digital Forensic Investigations.
Ans. There are the different renege of the polices and legislations which provide the guidelines
for the accomplishment of effective forensic investigation, such as Investigatory Power Act
2000, investigatory Power Act 2014, computer Misuse Act 1990 etc. below is the brief
explanation of the law which is going to be use as the guidelines for Crumlin Computers Limited
Forensic Investigation on network for one of its customer.
3

Investigatory Powers Act 2000- The regulation of investigatory power act 200 provides
the regulatory frameworks for determining whether the range of covert instigation techniques by
public authorities is proportionate and necessary in compliance with 8 of the ECHR. This legal
picse is involving the guidelines for forensic investigation, such as that is incorporating,
authorised interception, interception warrants, restriction in the use of intercepted material,
Lawful acquisition and disclosure of communications data, Procedure for judicial approval,
Investigatory Powers Commissioner for Northern Ireland. Etc (Flaglien, 2017).
Investigatory Powers Act 2014- That is another important law of the investigation which
should follow under the digital investigation task, it makes the provision for the retention of
internet connection records for law enforcement to identify the communication service to which
device has connected.
Computer Misuse Act 1990- The Computer Misuse Act protects personal data held by
organisations from unauthorised access and modification. This guide the securing of computer
from unauthorised access (Shallcross, 2019).
Q2. Various legal and ethical requirements for conducting digital Forensic Investigations.
Ans. In context to the accomplishment of lawful and ethical digital forensic investigation
National Security Agency (NSA), Homeland Security and the FBI have been contacted which
will help to consider the legal and ethical requirement for conducting digital forensic
investigation. It has been recommendation that all the forensic examinations and the
investigations should maintain the greatest objectives and present accurate findings. All the
matters should be testified to truthfully before the court, the investigator should not take any
action that would be a conflict of interest later on. According to the legal and ethical agencies
examination must be based on well-established and validated principles. That is important for
the examiner to reveal any confidential information with the permission of that person or they
completely prohibited for the use of personal information discloser. Investigator have to make
sure that misrepresentation of credentials or associated memberships must be prevented.
According to the IACIS investigation guide the ethical behaviour of the computer forensics
investigator, members should maintain the utmost objective in all forensics investigation and
present the facts accurately. Investigator should examine the evidence and analyse that
thoroughly and that is important to make sure only unbiased opinions should be given.
4

Q3. An assessment of how ethical it is to conduct digital Forensic Investigations on a suspected
individual with reference to their legal rights.
Ans. Within the UK and in other countries there are the different laws and legislation which
defines the ethnicity and possibility of the suspect digital investigation with reference to their
legal rights. There are the same terms and conditions on the basis of which suspect situation
consider under the process of digital forensics investigation. Yes, this is ethical to conduct the
digital Forensic Investigations on a suspected individual with reference to their legal rights,
because that is important to make the analysis of evidence for resolving the problems. There are
the ethical aspects in the digital forensics, under which practitioners find themselves in a position
where they have to make the choices of technical, procedural or ethical dilemmas, but it could
have effect on particular case. That is ethical to conduct the suspect investigation because that
person is found to be involved in the unethical activity, due to which on the basis of forensic Act
2011 and regionalization 107C, that is the responsibility of the forensic investigator to assess and
evaluate the evidence against the suspect. The right to be present at the trial is suspect right,
according to which suspect present during trial and have testimony present in front of them and
they have right to cross examination. In this case also that is becoming ethical to conduct digital
investigation for finding the main suspect and innocence of pre-identified suspect (Munkhondya,
Ikuesan and Venter, 2020).
Q4. A discussion on the consequences of not following guidelines and how this may jeopardise
a legal case with regards to digital Forensic evidence.
Ans. Digital forensics investigation represents the science and legal process of investigating
cybercrime and digital media or object to gather evidence. That is very important for the
investigator to prove that digital evidence must prove that it has been used to commit a crime or
used to gain unauthorized access. The consequence of mishandling the pieces of evidence is can
be charged as misdemeanour or a felony. If the guidelines of digital forensic not get followed
accurately then his can result as the damage of digital information and evidence along with the
legal challenges of prototype information breach. Jurisprudence in the digital forensics
investigation provides a platform to consider the legal complexities in more practical and
realistic approaches. The issues of mutual legal authority to gather digital forensic gathering on
5

behalf of the other country. Digital evidence admissibility at court requires that the evidence is
authentic, accurate, complete and convincing to the juror. But the challenges of dredging the gap
between the judiciary, law enforcement agencies, forensic investigator and the expert witness is
can be major issue due to the lack of robust cybercrime legal framework. That is challenging to
acquire a pre-search and post seizure warrant that meet the required legal objectives, due to the
lack of formalized procedures and stakeholder involvement (Choo, Grispos and Glisson, 2021).
TASK 4
Q1. Produce a detailed Test Plan for conducting a test on digital devices.
Ans. The test plan is used for conducting a test on digital devices so that the shreds of evidence can be
collected in a timely manner. The test plan includes the following steps that include the investigation,
examination, analysis, and reporting. The first step of a test plan, it consists of a breakdown of the
digital devices which is used for the procedures to reveal about the crimes. The next step involved in a
test plan is examination. It is because investigation on digital devices is essential as it can protect as
well as preserve the integrity of pieces of evidence. The primary purpose of the analysis is to extract as
well as analyse the digital elements of information or shreds of evidence. It generally refers to the
recovery of information or data from its media. The next step involved in the test plan is analysis as the
Forensics has found valuable data, which enables cyber security organizations to improve the
technologies, which basically prevents the hackers from approaching a website or network. As it can be
done by analysing these conflicts. The last step included here is a report which involves the outcome
which is taken when the whole investigation is over and the evidences are produced in the justice system
(Aziz and et. al., 2018).
Q2. Suggest recommendations for best practices for conducting digital Forensics.
Ans. As per the diabolical belief of forensic, this is evaluated that to provide some aspect which is based
on digital forensic which is completely aspire with the technology and new cell bounded configuration.
Moreover, the best practice which is reliable and plays the role of authorized and successful digital
forensic is computer forensic. In this, the examiner used to adhere some of the standard and rules which
is helpful to commit and conduct the examination which is designed in such a way that ensures that the
actual evidence is not altered while it is not custody. It also confirms some of the aspects which is
reliable and provides the evidence that is admissible in the courts. Most of the practice are usually
6

conducted with the written policies which is set to be written as the objective in the mind (Caviglione
and et. al., 2017).
There are some of example which is based on sample which is best practice by number of
examiners with the course of examinations. It is essential recommendation that is based on the
examination with original media. Use write blocking technology which help to preserve the original
while it is being copied. The computer forensic are usually examine the aspect with meeting of
minimum proficiency standards. The examination results are also used to review by the supervisor
which help to review the schedule. In this, the forensic examiners must use to observe the ethical
standard which is highest in the peak. Moreover, the forensic examiners are usually conducted itself
which is best in objective all the times. However, the forensic examiner must use strictly observe all the
legal restriction which is based on their examination (Costantini and et. al., 2019).
Q3. Compare the recommendations for best practices for conducting digital Forensics.
Ans. While making the computer forensic comparison with other, the main aspect of the computer
forensic have ability to add towards the practice of sound computer. It helps to ensure the overall
integrity and of the network infrastructure. This help to make the organisation which is based on
consideration of computer forensic as the new basic elements which is known as defence in depth
approach towards the computer and running network. Moreover, it is requiring to take legal
understanding and technical aspect of the computer forensic which make them differ and important with
the others digital aspect of forensic moreover, the computer forensic help to capture the vital information
for the network (Grispos and et. al., 2021).
With other terms, the computer forensic is also used play important key point which help to save the
organisational money. As per this, the international data corporation is used to state that the market for
the intrusion which is based on detection and assessment which is require the vulnerability which used
to reach up to the 1.45 billion over the year. In the enhancing numbers, the organisation is used to
deploy the network security device include intrusion detection system. Firewalls, proxies and report
which is associated with status of network (Scrivens and et. al., 2017).
7

CONCLUSION
The digital forensics in cyber security involves the person who can collect the data, process,
preserve as well as analyse the computer related information. As they help the investigators to determine
the network vulnerability and then improve or develop the methods to mitigate them. It is concluded
from the above repot that the digital forensics can help the investigators to identify the stolen evidences
and also help them to trace whether the data was copied or distributed. In contrast with this, many of the
culprits may intentionally destroy the information to harm their targets. It is also discussion above that
there are various merits and demerits of the processes and procedures which plays part in digital
forensics (Balogun and Zuva, 2017).
8

REFERENCES
Books and Journals
Berg, B. G and et. al., 2017. Digital Forensics, Part.
Zhang, X. and Choo, K. K. R., 2020. Digital Forensic Education. An Experiential Learning
Approach. Switzerland: Springer.
Hoffman, D., 2020. Use of Digital Forensics Within Law Enforcement (Doctoral dissertation,
Utica College).
Haldar, N. A. H., 2020. Advances in Digital Forensics Frameworks and Tools. Cyber Warfare
and Terrorism: Concepts, Methodologies, Tools, and Applications: Concepts,
Methodologies, Tools, and Applications, p.165.
Eloff, J. and Bella, M. B., 2018. A methodology for investigating software failures using digital
forensics and near-miss analysis. In Software Failure Investigation (pp. 39-56). Springer,
Cham.
Billard, D. and Bartolomei, B., 2019. Digital forensics and privacy-by-design. In Privacy
Technologies and Policy: 7th Annual Privacy Forum, APF 2019, Rome, Italy, June 13–14,
2019, Proceedings (No. CHAPTER). Springer.
Flaglien, A. O., 2017. The digital forensics process. Digital Forensics, pp.13-49.
Shallcross, M., 2019. Documenting Digital Forensics Workflows.
Munkhondya, H., Ikuesan, A. R. and Venter, H. S., 2020. A case for a dynamic approach to
digital forensic readiness in an sdn platform. In International Conference on Cyber Warfare
and Security (pp. 584-XVIII). Academic Conferences International Limited.
Choo, K. K. R., Grispos, G. and Glisson, W., 2021. Introduction to the Minitrack on Cyber
Operations, Defence, and Forensics.
Aziz, N. A and et. al., 2018, November. Acquiring and analysing digital evidence-a teaching and
learning experience in class. In 2018 Cyber Resilience Conference (CRC) (pp. 1-4). IEEE.
Balogun, A. M. and Zuva, T., 2017, September. Towards the adoption of software engineering
principles for assessing and ensuring the reliability of digital forensic tools. In Proceedings
of the Computational Methods in Systems and Software (pp. 271-282). Springer, Cham.
Wu, S and et. al., 2017, October. A general forensics acquisition for Android smartphones with
qualcomm processor. In 2017 IEEE 17th International Conference on Communication
Technology (ICCT) (pp. 1984-1988). IEEE.
Tatjana, S and et. al., 2018, February. Application of digital forensics in traffic conditions.
In 2018 23rd International Scientific-Professional Conference on Information Technology
(IT) (pp. 1-4). IEEE.
Khanuja, H. K. and Adane, D., 2018, September. Detection of suspicious transactions with
database forensics and theory of evidence. In International Symposium on Security in
Computing and Communication (pp. 419-430). Springer, Singapore.
Balogun, A. M. and Zuva, T., 2018, December. Criminal profiling in digital forensics:
Assumptions, challenges and probable solution. In 2018 International Conference on
Intelligent and Innovative Computing Applications (ICONIC) (pp. 1-7). IEEE.
Ellison, D., Ikuesan, R. A. and Venter, H. S., 2019, November. Ontology for reactive techniques
in digital forensics. In 2019 IEEE Conference on Application, Information and Network
Security (AINS) (pp. 83-88). IEEE.
9

Reddy, G. U., Bala, M. M. and Padmaja, B., 2020, March. An Overview on Digital Forensics
Tools used in Crime Investigation for Forgery Detection. In 2020 International Conference
on Computer Science, Engineering and Applications (ICCSEA) (pp. 1-5). IEEE.
Song, J. and Li, J., 2020, May. A Framework for Digital Forensic Investigation of Big Data.
In 2020 3rd International Conference on Artificial Intelligence and Big Data
(ICAIBD) (pp. 96-100). IEEE.
Kristyan, S. A. and Juhana, T., 2020, October. Design Framework Forensics Readiness as a
Service for Automatic Processing. In 2020 International Conference on Information
Technology Systems and Innovation (ICITSI) (pp. 370-374). IEEE.
Chen, Y and et. al., 2020, December. Cloud Storage Forensics: BaiduNetDisk, WeiYun, and
115yun on a Wireless Network. In GLOBECOM 2020-2020 IEEE Global
Communications Conference (pp. 1-6). IEEE.
Caviglione and et. al., 2017. The future of digital forensics: Challenges and the road ahead. IEEE
Security & Privacy, 15(6), pp.12-17.
Costantini and et. al., 2019. Digital forensics and investigations meet artificial
intelligence. Annals of Mathematics and Artificial Intelligence, 86(1), pp.193-229.
Grispos and et. al., 2021. A Digital Forensics Investigation of a Smart Scale IoT
Ecosystem. arXiv preprint arXiv:2109.05518.
Scrivens and et. al., 2017, May. Android digital forensics: data, extraction and analysis.
In Proceedings of the ACM Turing 50th Celebration Conference-China (pp. 1-10).
10