BLD Forensics offers many digital investigation services to retrieve data to help uncover digital evidence that can help solve crimes. Digital examinations can involve a mobile phone or another digital device. By using investigative techniques and tools, and the 5 steps digital forensic investigators use to solve digital crimes criminals so they can be convicted of their crimes.
There are five steps involved in digital investigations:
- Identification of the crime itself.
- Preservation of the evidence.
- Collection of the evidence.
- Analysis of the evidence.
- Reporting the evidence so that it can be presented in court.
These five steps can help build a stronger case that will help convict the accused by proving them guilty or proving their innocence in court.
Identification
First, experts must identify what happened. The desired outcome is to determine who the perpetrator was who committed the crime and preserve the evidence so that a conviction can be brought against the correct person. Often digital crimes involve hacks or viruses that can do great financial harm to an individual or a company.
Still, these are only a couple of ways digital crimes can occur. Digital crimes can involve images transmitted across the internet or stored on, transferred, or received on a phone or other devices such as a tablet or computer. Child pornography is one example. Another example of digital crime is copyright infringement. The list of digital crimes is lengthy and growing as criminals develop new and inventive ways to make money illegally using digital data.
Sometimes we see companies that are held hostage to ransomware. Other crimes involve customers being directed to false sites where customers unknowingly give out their banking and other personal data, which gives criminals access to drain money out of their accounts without their knowledge.
Digital forensics experts must pinpoint the type of crime before they can proceed. For instance, in a robbery, the investigators may check for clues that a person was stalking or checking out a place before robbing it by seeing if they had searched Google Maps to case the site before the crime. Are there text messages where they discussed the plan with someone else? Did they take pictures of the building before committing the offense to get a feel for its layout ahead of time?
Each of these can help prove guilt if preserved correctly.
Preservation
The law has several procedures that must be followed carefully to preserve evidence, or a judge may be forced to throw out vital evidence.
When collecting devices where evidence may be stored, the device is turned off and the battery removed when it is seized. Sometimes it is impossible to turn a device off, so it is placed in a unique bag called a Faraday bag to blog it from its cell tower, so the evidence does not get messed with when transporting. Placing it in a paper bag or envelope is vital to avoid static electricity, and plastic should not be used at all.
The type of device and the situation will determine how it is best preserved.
Once the device is in the laboratory, further procedures will be done to help prevent any contamination of the device. They will install write-blocking software to keep the data intact. The investigators will be sure to keep the wireless devices isolated so they cannot accidentally connect to a network and cause the evidence to be distorted. They will decide what else must be done to protect the evidence and prevent damaging or losing valuable information to the case.
Collection
Once they are at the lab and have made sure the evidence is preserved, they will start collecting the evidence. They will look through the files, photos, texts, emails, and other data to see what may or may not be relevant in helping present an accurate picture of the case.
Collecting evidence must be done carefully to ensure it is admissible in court. At first, they will gather all the information before worrying if it is relevant to the case, and each piece of evidence will be carefully retrieved so that it stays useable.
It depends on the case itself as to how they go about collecting the evidence. It may require going to sites on the web and looking at other people who may be connected.
Investigators can use the “cloud” and other places on the internet to collect evidence. Most cell phone texts and photos are automatically sent to these data storage places for backup.
Emails may be deleted but are often stored in the trash for at least thirty days before being permanently erased. Computer documents are another source of evidence when appropriately gathered so that they are admissible in court as evidence.
Investigators can verify locations the suspect was at by checking where cell phone devices have been in the past. This can often either clear or help prove a person was near the area of the crime at the time it occurred.
The person who examines and looks for this information is often a trained police officer certified to collect and preserve digital data. Many police districts are overwhelmed with data or may have too small a budget to have someone full-time on staff, and that is where they may outsource these jobs to specially trained and certified investigators.
Analysis
Once they have gathered everything they can find, they will start analyzing all the evidence to see what significance, if any, it has to the case. Investigators will look for connections to other crimes if they see leads headed that way.
Digital forensics analysis may take a bit of time because some cases may involve thousands of collected pieces of evidence. They will have to sift through it all to see what is relevant and what has nothing to do with the case.
Reporting
Once they have gone over all the pieces of evidence and pieced together what happened, it is time for them to draft a report explaining the evidence to send to whoever they are preparing it for. Often it will be law enforcement, but sometimes it may be the defense who hired them. Either way, they will truthfully report the evidence even if it goes against the client whom the lawyer hoped they could help defend against prosecution.
Often the investigators are required to go to court and testify about their findings to the court. They must be truthful and professional, and credibility is essential when testifying about the evidence.
To Conclude
The 5 steps digital forensics investigators use to solve a digital crime are very important for successfully convicting the perpetrator. When digital forensic specialist follows the evidence and carefully go through the five steps of identifying, preserving, collecting, analyzing, and reporting their findings to the court, they know they have helped accurately solve the case so that justice prevails.
