Five on Forensics Page 1 - Craig Ball

<strong>Five</strong> on Forensics
© 2002-2008 Craig Ball All Rights Reserved
Active Data: These are the current files on the computer, still visible in directories and
available to applications. Active data may be readily comprehensible using simple translation
techniques (i.e., plain text files), but will more often need to be viewed within an application
(computer program) to be useful. Such applications range from e-mail clients like Outlook, to
database programs like Access or Excel, to word processors like Word or WordPerfect. Active
data may also be password protected or encrypted, requiring further forensic activity to be
accessed. Active data includes system data residing within the recycle bin, history files,
temporary Internet directory, cookie “jar,” system registry files, logs and other obscure but oftrevealing
data caches. One important evidentiary point about data on a hard drive is that no
matter what it may represent, whether simple text or convoluted spreadsheets, it exists only as
infinitesimal magnetic flux reversals representing ones and zeroes which must be processed by
software to be intelligible. Put another way, only the physical level with the magnetic domains is
real; this level is also the least accessible. Words, pages, files, and directories are
abstractions—illusions if you prefer--created by software that may or may not be reliable. The
more levels of abstraction, the more likely evidence will not be, and should not be, admitted
without scrutiny.
Latent Data: Latent data (also called “ambient data”) are deleted files and other data, including
memory “dumps” that have “lodged in the digital cracks” but can still be retrieved. This data
resides on the hard drive or other storage media in, e.g., unallocated clusters (areas marked
available for data storage but not yet overwritten by other data) and slack space. Latent data
also includes information not readily understood absent special techniques and tools, like swap
files, temporary files, printer spool files, metadata and shadow data (all discussed herein). The
recovery of latent data is the art most often associated with computer forensics, but the
identification, preservation, interpretation and management of active data is no less demanding
of a forensic expert’s skill.
Archival Data: This is data that’s been transferred or backed up to peripheral media, like tapes,
CDs, DVDs, ZIP disks, floppy disks, network servers or the Internet. Archival data can be
staggeringly voluminous, particularly in a large organization employing frequent, regular back up
procedures. It is critically important to recognize that an archival record of a source media never
reflects all of the data that can be identified and extracted from the source media because such
back ups don’t carry forward latent data. Accordingly, an opponent’s offer to furnish copies of
back up tapes is, while valuable, no substitute for a forensic examination of a true bit-by-bit copy
of the source disk drive.
Tell It to the Judge
Imagine that a case comes in where the content of a personal computer is critically important.
Perhaps your client’s marriage is on the rocks and infidelity and hidden assets are at issue. If
you represent the wife, do you think that the philandering husband is going to agree to make his
personal computer available to you; handing over the chat room transcripts, cyber-sex sessions,
incriminating e-mails, Quicken balances, Internet history files, brokerage account records, digital
photographs of the fluff on the side, business trip expense records, overseas account
Page 10