Cyber Security
Digital Forensics 101: A Career Path to Consider
I By Annu Singh
28 | Australian Security Magazine
am an ardent fan of The X-Files and have always been in awe of detective Dana Scully. I was delighted to recently read an article on a study done by the Geena Davis Institute on Gender in Media, where the researchers found a correlation between women who were familiar with, or fans of, The X-Files and its influence on their career choices. As the study says, 50% of women who watched The X-Files opted for a career in STEM, including getting into forensics. Similarly, other TV dramas such as CSI, NCIS and Bones have all played a role in bringing forensics to the fore as a career choice, by uplifting the image from scientific backwaters to a more glamorous and exciting job. In each of these shows, the sub discipline of digital forensics also plays its part, so we’ve also seen an increase in the number of females entering DFIR careers (digital forensics and incident response). I decided to take a closer look at the enchanting world of digital forensics, to see if it really is as dramatic as its portrayed in the media and crime thrillers. The reality s that digital forensics is the application of forensic science principles to the artefacts we all create through interactions with technology, such as computers, mobile phones, websites and even GPS devices and smart devices. The Digital Forensic Research Workshop (DFRWS) defines digital forensics as: The use of scientifically derived and proven methods toward the preservation, collection, validation, identification, analysis, interpretation, documentation and presentation of digital evidence derived from digital sources for the purpose of facilitating or furthering the reconstruction of events found to be criminal or helping to anticipate unauthorized actions shown to be disruptive to planned operations.
It is important to understand that the term forensic science brings two aspects together; the science component that refers to the scientific method, along with its application to a specific investigation. Universality and repeatability are two key features of a scientific method i.e. if an exercise is carried out properly, it is possible to predict what will happen for all activities within that range of the phenomenon – and anyone else will be able to do the same. The forensic element refers to how courts make their decisions and how evidence will be interpreted, as per rules of law. In TV crime stories, we often see investigators arriving at the crime scene, taking photographs, scribbling a few notes, collecting evidence in Ziploc bags, then within a few television seconds, they hack into the perpetrator’s computer. Almost always in the following scene they have conclusive results. But how realistic is this? How exaggerated are the outcomes, especially on speed, effectiveness and scope of the digital forensics expertise, compared with real-life digital forensics? Formally, the digital forensic process is a systematic and relatively tedious one, consisting of five steps. Investigations start with Identification of sources of evidence or information (devices) that would be relevant to the case, looking at who the information holders might be and where their data is located. In the second step, the focus is on the preservation of electronically stored information (ESI) by protection of the crime scene. Forensic investigators capture photographs of the scene and document relevant information about the evidence, including notes on its acquisition. The third step is the collection of digital information relevant to the investigation, such as taking the electronic device(s) into custody and replicating their content using forensically