Cyber Crime and Cyber Terrorism

88
CHAPTER 7
Seizing, imaging, and analyzing digital evidence
kb309531 (
Microsoft, 2013
). Once the volume has been mounted it can be cap-
tured and analyzed in the same way as physical drive, as previously discussed.
CHAPTER SUMMARY
This chapter offered guidelines and direction for forensic examiners. It discussed 
considerations necessary when forming the case for a search warrant, i.e., that it is 
necessary to show that there is either “reasonable grounds” or “probable cause” that 
an offence has, is or will be taking place. Methods of how to do this such as associ-
ating the alleged crime with the suspects IP address, social media accounts or IRC 
handle are discussed; as are the difficulties that can be encountered when attempting 
to do so. Following on from this best practice in seizing of evidence is proffered; this 
includes how to avoid contaminating digital evidence and minimizing the acquisition 
footprint. The use of write blockers is discussed for media storage devices and the 
need for a risk reward analysis prior to RAM forensics is highlighted. In order to 
offer context, the structure and format of hard drives is documented; including the 
physical structures, e.g., platters and heads, along with the logical structures such as 
sectors and clusters. How file systems and operating systems make use of the media 
is also described, e.g., file tables and master and volume boot records. In the final 
section some of the more fertile search areas for forensic evidence are emphasized 
along with how the data in these areas are formatted, and how it can be rendered. The 
Windows registry, 
hiberfil.sys
, 
pagefile.sys
, and the system volume informa-
tion folders are discussed to this end.
REFERENCES
7Safe, 2007. Good Practice Guide for Computer-Based Electronic Evidence. 7Safe, London.
Access Data, 2014. Access Data. FTK. [Online] Available at: 
http://www.accessdata.com/
products/digital-forensics/ftk
 (accessed 23.02.14).
AccessDataGroup, 2010. Registry Quick Find Chart. AccessDataGroup, London.
Anson, S., Bunting, S., Johnson, R., Pearson, S., 2012. Mastering Windows Networks and 
Forensic Investigations, second ed. John Wiley & Sons, Inc., Indianapolis.
Carrier, B., 2013. Autop
sy
. [Online] Available at: 
http://www.sleuthkit.org/autopsy/
(accessed 
2014 February 2014).
Crown, 1984. Police and Criminal Evidence Act (1984). Her Majesty’s Stationery Office 
(HMSO), London.
FindLaw, 2014. Find Law. Proabable Cause. [Online] Available at: 
http://criminal.findlaw.
com/criminal-rights/probable-cause.html
 (accessed 22.02.14).
Guidance Software, 2014. Guidance Software. [Online] Available at: 
http://www.guid-
ancesoftware.com/
(accessed 24.02.14).
Ligh, M., Case, A., Levy, J., Walters, A., 2014. Volatility an advanced memory forensic frame-
work. [Online] Available at: 
http://code.google.com/p/volatility/
 (accessed 22.02.14).
Microsoft, 2013. How to gain access to the System Volume Information folder. [Online] 
Available at: 
http://support.microsoft.com/kb/309531
(accessed 23.02.14).

---