Digital forensics: More hiding Places for Computer Investigations

 

digital forensic

Deleted Data

When a file is deleted, it may remain on the hard drive. What are actually deleted are the instructions for finding the file – the pathway – not the file itself. Only if the data is overwritten by new files will it become irretrievable.

By analyzing a device’s hard drive, investigators can recover a wealth of information that is no longer available to a regular user.

Bluetooth/Wi-Fi Pairings

Bluetooth can be a valuable source of potential evidence. Each Bluetooth device has a unique identifier, which is likely to be recorded when it is paired or connected.

Examining a phone’s Bluetooth history could prove vital in proving association between other exhibits in the case – some of which may be attributed to other relevant individuals.

Analyzing the unique identifiers of WiFi networks that a phone device was connected to, can help to prove that a device was present or in use at a certain location.

Cloud Computing and Sync 

Cloud computing allows users to access software, data management and storage without needing to know the location and other details of the infrastructure.

Many people and organisations are now choosing to use the cloud to store data, or to make various settings and favourites portable between devices. This means they can effectively have access to the same data, which can include settings, cookies and preferences, regardless of which device they are using at the time.

So, activity may take place on an individual’s computer which is automatically updated on their smartphone via the cloud. A user’s data and preferences follow them around, providing potential evidence for digital investigators.

Backups

Data from a mobile phone may be backed up onto the user’s computer. Many people use their mobile phones almost as an extra limb, so it’s a good idea to back up the phone on a regular basis just in case it’s lost, stolen or broken.

The evidence from backup files can be used to link a computer and phone as part of the same case, but there may be data on the computer from the phone’s backup than is still stored in the handset itself.

Additionally, many mobile applications are configured to sync with computers, leaving a digital trail and data on both devices. Systems can store a huge amount of data. This can provide valuable evidence. 

Voice mail 

Many modern phones are now capable of having voicemails “pushed” to the handset using an internet connection. They’re stored on the phone for access anywhere. Many phones have the facility to record voice memos which again could provide valuable evidence as part of a computer investigation. As with any data stored on a digital device, it can leave a digital trail, which can be recovered using the correct digital forensic methods.

For more information on computer investigations, digital forensics, or CCL’s other products and services, call us on 01789 261200, email contact@cclgroupltd.com, visit www.cclgroupltd.com, or check out http://www.cclgroupltd.com/digital-forensics/corporate/computer-investigations.