SLAMorris Final Thesis After Corrections.pdf - Cranfield University

each stage. One of the most critical steps of an investigation is imaging the
digital media [Stephenson, 2003], as any analysis is performed from an image
to ensure the original evidence is preserved. It is therefore necessary to protect
the original evidence during imaging whilst ensuring an accurate image is
acquired.
Windows operating systems have been shown to leave a variety of traces that
can greatly assist a forensic investigation [Greenfield, 2002]. Greenfield looks at
common sources for finding forensic artefacts in Windows, suggesting that
operating system guide books can provide useful insights into how and where
information is likely to be found. It has been suggested that the new features
found in operating systems such as Windows Vista [Hayes, 2009], may impact
the way forensic examinations are conducted, particularly with the introduction
of technology such as BitLocker [Hargreaves, 2008]. If encryption is used on a
machine it would significantly impact the investigation by potentially making the
evidence inaccessible. Having encryption tools resident within an operating
system does not mean they will have a significant uptake with the general
public; therefore traditional analysis of artefacts on unencrypted systems is still
important.
When considering creating an overall methodology for forensic computing
investigations, or specific parts of the process, it is necessary to ensure that it is
chosen based on the characteristics of the problem [Bogen, 2005]. Selecting
and creating appropriate methodologies will maximise the retrieval of admissible
evidence and the use of resources. Unsafe practices are occurring throughout
investigations due to a lack of standardisation and definitions, which make it
difficult to create appropriate new tools to assist with the analysis of machines
[Carrier, 2006]. Therefore defining the problem allows for tools to be created
which satisfy the necessary requirements, thereby improving the analysis
process.
Page 16