External Storage Devices As Evidence

EXTERNALSTORAGEEVIDENCE · AGUIDEFORUKLAWYERS External Storage Devices as Evidence What Memory Sticks, External Drives and Cards Reveal: Copied Files, Timestamps, Deleted Data and Attribution COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the object in the evidence bag 03 Getting the device examined: intake, imaging, integrity 04 What the live file system tells you 05 Timestamps on external media: reading the copy story 06 Deleted data: recycle folders, unallocated space and the SSD problem 07 Whose device, whose hand: attribution on portable media 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : THEDEVICEISDIRECTEVIDENCE ; TREATITLIKETHEEXHIBITIT § 0 2 · FIRSTPRINCIPLES The problem in plain English: the object in the evidence bag § 0 3 · INTAKE Getting the device examined: intake, imaging, integrity § 0 4 · WHATISTHERE What the live file system tells you § 0 5 · WHENITGOTTHERE Timestamps on external media: reading the copy story § 0 6 · WHATWASTHERE Deleted data: recycle folders, unallocated space and the SSD problem § 0 7 · WHOSEHAND Whose device, whose hand: attribution on portable media § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE THE DEVICE SERVERS / SOURCE CORPORATE ONWARD DELETED / MACHINE(S) TOOLING DEVICES RECOVERABLE SOURCE CLOUD § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THETWO - CLOCKSIGNATUREANDTHEINJUNCTIONDATE EXAMPLE2 · THESNAPPEDSTICK , RECOVERED EXAMPLE3 · THEDRIVETHATCLEAREDHER § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · INSTRUCTIONFORDEVICEEXAMIN AT ION § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The external media checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions We have the stick. Do we still need the computers? The files were deleted from the stick before it was handed over. Gone? Can you tell which computer the files came from? The device belongs to the company but lived on a shared desk. Is attribution hopeless? What about memory cards from cameras, dashcams and phones? Our opponent simply has not produced the drive we know exists. What now? § 1 4 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY