Five on Forensics Page 1 - Craig Ball

<strong>Five</strong> on Forensics
© 2002-2008 Craig Ball All Rights Reserved
passwords and business correspondence? Chances are Hubby is going to fight you tooth and
nail and, when finally ordered to make the machine available, he will clumsily seek to delete
anything deemed compromising. But even if Hubby isn’t trying to cover his tracks, know that
every time he saves a file, or starts a program—in fact every time he simply boots the
machine—some latent data is altered or overwritten to the point it can never be retrieved. By
way of example, Windows accesses (and thus modifies metadata for) about a thousand files
every time it boots up (and you wondered why booting took so long)!
You must persuade the court that conventional paper discovery is inadequate and that your
client’s interests will be irreparably harmed if she isn’t granted access to Hubby’s computer and
afforded the right to conduct a complete forensic examination of same, starting with the creation
of a sector-by-sector bit stream copy of the hard drive. Because Hubby has hired a savvy
advocate, the judge is being assured that all reasonable steps have been taken to identify and
protect computer data and that print outs of discoverable material will be furnished, subject to
claims of privilege and other objections. If you can’t articulate why your opponent’s proposal is
hogwash and thoroughly educate the judge about the existence and ongoing destruction of
latent data, Missus is out-of-luck.
To be prepared to educate the Court, evaluate and select a computer forensics effort or simply
better understand and advise your clients about “safe” data practices, you need a working
knowledge of how a computer stores data and, more to the point, where and how data lives on
after it’s supposed to be gone.
To get that working knowledge, this section explains (as simply and painlessly as possible) the
nuts and bolts of computer storage, beginning with the bits and bytes that are the argot of all
digital computing, then on to the mechanics of hard drive operation and finally to the nooks and
crannies where data hides when it doesn’t want to be dispatched to that big CPU in the sky.
Bits and Bytes
You can become very facile with computers never knowing the nitty-gritty about bits and bytes,
but when it comes to building a fundamental understanding of computer forensics, you’ve got to
begin with the building blocks of computer data: bits and bytes. You know something of bits and
bytes because every computer ad you’ve seen uses them in some impressive-sounding way.
The capacity of computer memory (RAM), size of computer storage (disks), and the data
throughput speed of modems and networks are all customarily expressed in bits and bytes.
This Little Piggy went to Market
When we express a number like 9,465 in the decimal system, we understand that each digit
represents some decimal multiple. The nine is in the thousands place, the four in the hundreds,
the six in the tens place and so on. You could express 9,465 as: (9 x 1000) + (4 x 100) + (6 x
10) + (5 x 1), but check writing would quickly become an even more tedious chore. We just
know that it is a decimal system and process the string 9,465 as nine thousand four hundred
sixty-five.
Another equivalent method would be to use powers of ten. We can express 9,645 as: (9 x 10 3 )
+ (4 x 10 2 ) + (6 x 10 1 ) + (5 x 10 0 ). This is a “base-ten” system.
Page 11