Forensic Investigation Methodology

The Computer Forensics and Investigation Methodology is a combination of 8 steps. Initially, the first 3 steps are to acquire some evidence about the system and the crime scene. Then, the followed 4 steps are repeatable and effective steps; and eventually is the final step which is writing the report. The figure below shows the Forensics Investigation Methodology; along with the PowerPoint file that explains each step:

Screen Shot 2017-03-08 at 10.40.47 am.png

The attached PowerPoint file explains the Forensic Methodology step-by-step:



Digital Forensics’ Principles

There are some principles that will lead you to achieve your investigation’s goals. The investigator should be aware of the following Four principles.

  1. Record everything.
  2. Minimise data loss.
  3. Analyse all data collected.
  4. Report your findings.


Now the question is “Where is the data that needs to be analysed?”.

Basically, everything should be analysed and investigated when approaching a crime scene; plus, no one is allowed to access the crime scene area. The following figure shows some of the digital hardware that can analysed with the potential of finding information inside it.Picture1


Everything in the crime scene is valuable and should be subjected to an investigation and analysis carefully; along with the computer itself. Remember: do not despise anything, even the small things. The table below shows two different scenarios when investigating a digital crime scene (Live system and Dead system):


Live System   Dead System
acquisition copies the data using the suspect’s (operating) system. Usually, people try to avoid this acquisition, because the attacker can modify data or software can produce tampered data. In the live system, the power is still on, processes are still running, disks being access, and removable media keeps changing.   acquisition copies the data without the assistance of the suspect’s (operating) system. In the dead system, the power is off, the power id unplugged, no changes in the removable media.



Remember: the evidence is volatile, where the most volatile evidence can be found in (Memory) and the least can be found in (Removable media). Below is the order for the most volatile to the least (from top to bottom):

  1. Memory.
  2. Network Status and Connections.
  3. Processes Running.
  4. Hard Drive Media.
  5. Removable Media such as, floppy drive, zip drive, USB sticks and more.

Note: the evidence in the Memory, Network Status and Connections and Processes Running will be destroyed if the power cut off.

Introduction to Digital Forensics – Part 2/2

There are several types of incident in which they might be discovered by implementing forensics techniques. Below are some examples of these incidents.

  • Malicious Code Attacks – For example, viruses, Trojan horse programs, worms and hacker scripts.
  • Unauthorised Access – For example, an improper logging into the users’ accounts; and unauthorised access to the files.
  • Unauthorised Utilisation of Services – For example, an intruder may also obtain access to information or plant Trojans and sniffers by misusing available services.
  • Disruption of Service – For example, disruption of network services, erase critical processes, spamming, Denial of Service (DoS).
  • Computer Misuse – For example, using the computer services of other than official purposes.
  • Espionage – For example, stealing information to subvert the interests of a company or government.
  • Hoaxes – For example, false information is spread about an incident or threat such as, the good times virus 1995 (Non-existent hoax).


There are many questions that we should ask ourselves such as, why do people do these incidents? what were stolen? and how did they do it? The answers for these questions are known as the Intellectual Property Theft. The statistics show that:

  • Why do people do these incidents?
    • Moved to competitor (70%).
    • Set-up competition (23%).
    • Other purposes (7%).
  • What were stolen?
    • Customer/client information (75%).
    • Financial info (14%).
    • Business Presentations (5%).
    • Other purposes (6%).
  • How did they do it?
    • E-mail (46%).
    • Hard copy (22%).
    • Electronic storage device (9%).
    • Other purposes (23%).


Therefore, the UK has now set up the National Crime Agency (NCA), which is new crime-fighting agency with national and international reach and the mandate and powers to work in partnership with other law enforcement organisations. This will bring the full weight of the law to bear in cutting serious and organised crime.

Introduction to Digital Forensics – Part 1/2

There are Four main principles involved that you need to keep in mind:

  1. No action taken by law enforcement agencies or their agents should change data held on a computer or storage media, which subsequently might be relied on in court.
  2. Only in exceptional circumstances, a person finds it necessary to access original data held on a computer or storage media must be competent to do so; and be able to give evidence explaining the relevance and the implications of their actions.
  3. An audit trail or other record of all processes applied to computer based electronic evidence should be created and preserved. Note: an independent third party should be able to examine those processes and achieve the same result.
  4. The person in charge of the investigation is responsible for ensuring that the law and these principles are adhered to.


Below are some unique characteristics of the digital evidence:

  • The evidence is invisible to the untrained eye – Electronic evidence is often retrieved from places known or accessible only to experts.
  • Sometimes, it might need to be interpreted by a specialist – In many cases information gained requires thorough analysis to uncover properties assuring the information is valid from judicial point of view.
  • The evidence is highly volatile – A powered electronic device modifies its state every time a specific event Also, lack of power or a system overwriting old data with new data requires us to preserve electronic evidence as soon as possible.
  • The evidence might be altered or destroyed through normal use – Devices constantly change the state of memory – allocating it for programs automatically, swapping it to disk or writing chunks of it to a disk file on user request.
  • It can be copied without limits – This property allows many specialists work on the same evidence at the same time in different places. It also enables the possibility of presenting the evidence as-is in the court of law along with the specialist witness report.


In conclusion, computer forensic is a process of reveal the found evidence either by criminal and civil proceedings. Digital evidence can be used by different departments such as, Criminal justice agencies, Corporate Councils, Insurance Companies, Law Enforcement Officials, Company Legal resources, Human Resources department, Auditors, Individuals, Crackers or Hackers and many more.

Computer Forensics


The forensic term can be used in many different areas in where they all agree with the forensic term (the theory behind the investigation and analysis), but they are differ in the final outcome. For example, Dentistry Forensic, Archaeology Forensic, Accounting Forensic, Graphology Forensic, Medicine Forensic, Digital Forensic, Network Forensic, Pathology Forensic, Psychology Forensic, Science Forensic, Toxicology Forensic and more. However, I will be focusing on the Digital and Network Forensics, where you can learn the forensic fundamental basis, forensic methodology, Windows forensic, iOS forensic, mobile phone forensic, network forensic; along with the ability to interact with LINUX System.


The question is “Who Does the Computer Forensic Analysis?

The answer that many people might think of or will come up with is the Police. However, that is not necessary correct nowadays, because more and more companies now realise that they need “in-houseForensics employees as first response to possible, intrusion and malicious intent.


Several facts about the Digital Forensic:

  1. Digital Forensic is not a proactive security, but a reactive scene to an event or request.
  2. Digital Forensic is not about finding the bad guys, but about finding evidences that might be very of valuable.
  3. Digital Forensic is not something you do for fun, but it requires some expertise.
  4. Digital Forensic is not something can be done quickly, but it takes some time to find any malicious activity.

Note: Multi TeraByte drives are becoming available. Thus, it is getting harder and becoming very difficult to find the result. Just imagine the time takes from you when you are looking for specific sheet between more than 5000 sheets. The PowerPoint file explains this in details (Digital Forensics):


In conclusion, Digital Forensic id not CSI (Crime Scene Investigation), but it is more likely to be gathering electronic evidences in the crime scene and analyse them to find any malicious or misuse activities.

Password Protection

Passwords are very popular and widespread in modern computer applications. Passwords are no different than locks, since it is safe as long as you (user/password’s owner) are the only one know it. However, if someone else gets a replica of the password, they will be able to gain access to that place or application.

Previously, I have explained the requirements behind choosing a strong password. In 2010, a study was performed on several websites containing over 32,000,000 passwords shows that the passwords had previously been leaked on the web. This is due to the online attacks, which were performed by the attacker by selecting a set of targets and applies several guesses.


Eventually, try to avoid the blacklist passwords, which contain the popular and unacceptable passwords. For example, Twitter was once compromised due to an administrator’s password being “happiness”.

Pretty Good Privacy (PGP)

PGP is another security mechanism, which is an abbreviation for Pretty Good Privacy. PGP is an application of Cryptographic technology that uses public-key encryption. PGP has been used to protect the privacy in any communication forms such as, email, data, data storage and more.

PGP was designed to provide the security and privacy measures that are not currently presented in many forms of online communication. The email, for example, travels from one destination to another in an encrypted form. The recipient will decrypt the message back to the plaintext using PGP.


PGP works with two keys (public-key and private-key); where the public-key encrypts the message and the private-key decrypts the message. In addition, PGP provides authentication, since the users can use the private-key to digitally sign the message. This will make sure that the recipient knows where the message (mail) came from.

Note: The sensitive data files stored on the hard drive or USB can also be protected by PGP, by using the public-key to encrypt the files; and private-key to decrypt them.