Digital evidence, cyber forensics and enforcement notes — Unit 4

Digital evidence is any information of probative value that is either stored or transmitted in binary form. It differs fundamentally from physical evidence (like a bloody knife) in three dangerous ways:

• Latent: It cannot be seen directly by the human eye without specialized translation software.
• Volatile: Evidence in RAM disappears instantly upon power loss. Even accessing a file on a hard drive alters its 'Last Accessed' metadata, potentially ruining it as evidence.
• Easily Alterable/Duplicated: A file can be copied or modified without leaving obvious physical traces.

⇒2.1 Locard's Exchange Principle

'Every contact leaves a trace.' In the physical world, a criminal leaves DNA and takes away carpet fibers. In the digital world, connecting to a server leaves an IP log, and taking a file alters registry keys or event logs. Forensics is the science of finding those traces.

⇒2.2 The Order of Volatility

When an investigator secures a live computer, they must extract data starting from the most fragile to the most permanent:

• 1. CPU Registers and Cache (disappears in nanoseconds)
• 2. System RAM / Routing tables / ARP Cache (disappears on reboot)
• 3. Temporary File Systems / Swap Space
• 4. Hard Drives / Solid State Drives
• 5. Remote Logs / Network Backups

Courts require a mathematically rigorous process to guarantee that the evidence presented has not been tampered with by the police.

• 1. Seizure & Isolation: Isolate the device from the network immediately (e.g., Faraday bags) to prevent remote wiping.
• 2. Write Blocking: Connect the hard drive to a hardware Write-Blocker. This ensures the investigator's computer can only read the drive, physically preventing any accidental modification.
• 3. Bit-Stream Imaging: Never analyze the original drive. Create a bit-for-bit clone (an image) of the original drive. This copies everything, including deleted files and unallocated slack space.
• 4. Hashing: Generate a cryptographic hash (e.g., SHA-256) of the original drive and the image. If the hashes match, mathematical proof exists that the copy is identical.
• 5. Analysis: Search the image for deleted files, browser history, and hidden partitions using tools like EnCase or FTK.

⇒4.1 Chain of Custody

The Chain of Custody is a chronological paper trail documenting exactly who seized the evidence, who transported it, who analyzed it, and where it was stored at every single minute. If there is a gap in the timeline, a defense attorney will argue the evidence could have been planted, and the judge will throw it out.

⇒4.2 Section 65B (Indian Evidence Act)

Electronic records are considered 'secondary evidence'. To be admissible in an Indian court without presenting the original physical hard drive, a certificate under Section 65B of the Indian Evidence Act must be filed. It requires a signed statement by the person managing the computer confirming that the computer was operating properly and the output is a true reproduction of the data.

This unit focuses on procedural correctness and the technical vulnerability of data.

• Volatility: Memorize the Order of Volatility. Know why you pull RAM before pulling the plug on a machine.
• Imaging vs Copying: Be able to explain why a 'Bit-Stream Image' is legally and technically different from just copy-pasting files in Windows (imaging captures deleted files and empty space).
• Chain of Custody: Define it and explain its critical importance in legal admissibility.
• Hashing: Explain how hashing provides mathematically irrefutable proof of evidence integrity.