Cyber Crime and Cyber Terrorism

Table 7.1 
Digital Evidence Categories
Address Books and 
Contact Lists
 
Configuration Files
 
Databases
Audio files and voice 
recordings
Process
Documents
Backups to various 
programs
Log files
Email and attachments files
Bookmarks and favorites
Organizer items
Registry keys
Browser history
Page files
Events
Chatting log
Network configuration
Hidden and system files
Calendars
Digital images
Videos
Compressed archives
Cookies
Virtual machines
Kernel statistic and modules System files
Temporary files
Videos
Printer spooler files
Type of used applications

---

80
CHAPTER 7
Seizing, imaging, and analyzing digital evidence
as the principle open source command line tool for this purpose (
Ligh, et al. 2014
). 
Tools such as Volatility allow for the analysis of data such as:
• Running and recently terminated processes
• Memory mapped files
• Open and recently closed network connections
• Decrypted versions of programs, data, and information
• Cryptographic key passphrases
• Malware
DATA CARVING AND MAGIC VALUES
One of the principle methods of RAM analysis is achieved via a method referred to 
as “data carving.” Carving is the process of looking for patterns in the data, some-
times referred to as “magic values.” These values are indicative of a certain type of 
data being in memory. For example Skype v3 messages start with the data “l33l,” so 
any area of RAM with these characters has a likelihood that a Skype message fol-
lows. Similarly 
TrueCrypt (2014)
passphrases contain the magic value “0x7d0.” File 
types existing in RAM (as well as in media storage, or traversing a network) can be 
identified by their magic values too. On finding the data of a particular type the data 
carving process may continue, depending on the type of data discovered, to extract 
and present the data in a way that it becomes more intelligible to forensic analyst. 
For example, it may be necessary to organize the data based on field boundaries, to 
separate these out and identify them. In most instances, the forensic examiner can 
be abstracted from the detail of these processes by the forensic tools. However, one 
of the principle benefits of open tools such as Volatility is they allow the forensic 
examiner to code their own modules, allowing the freedom to carve out data of a 
certain type not available natively. This can then be made available for the benefit of 
the open source community (see Chapter 6).