digital forensic case study for students

Navigation Menu

Search code, repositories, users, issues, pull requests..., provide feedback.

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly.

To see all available qualifiers, see our documentation .

• Notifications

Free hands-on digital forensics labs for students and faculty

frankwxu/digital-forensics-lab

Folders and files, repository files navigation, digital forensics lab & shared cyber forensic intelligence repository.

Features of Repository

• Interactive Digital Forensics Labs: Tailored for students and faculty engagement
• Linux-Centric Lab Environment: Utilizes Kali Linux exclusively for all labs
• Visual Learning Support: Each lab includes PowerPoint presentations, associated files, and instructional screenshots
• Holistic Coverage: Encompasses a wide array of topics within the field of digital forensics
• Open Source Tools: All tools utilized are freely available and open source
• Ongoing Updates: Supported by grants from the DOJ, DHS, and NSF, the team is committed to regularly updating the repository
• Forensic Intelligence Integration: Two structured forensic intelligence datasets in JSON format derived from real case studies

For feedback or to express your usage of the course materials, please reach out via email at wxu at ubalt dot edu. Your collaboration is sincerely valued

Please cite our paper :

W. Xu, L. Deng, and D. Xu, "Towards Designing Shared Digital Forensics Instructional Materials," in Proceeding of the 46st Annual International Computer Software and Applications Conference (COMPSAC 2022), pp. 117-122, July 2022. ( Video Presentation )

or in BibTeX

@inproceedings{xu2022forensics,  title={Towards Designing Shared Digital Forensics Instructional Materials},  author={Xu, Weifeng and Deng, Lin, and Xu, Dianxiang},  booktitle={46st Annual International Computer Software and Applications Conference (COMPSAC 2022)},  volume={1},  pages={117--122},  year={2022},  organization={IEEE} }

Table of Contents (Major Holidy release Dec 25, 2023: Echo Show investigations preview)

Basic Computer Skills for Digital Forensics

• Number Systems (add Python code for data conversion 1/2023)
• PC Introduction
• Windows Command Line Tutorial
• Linux Command Line Tutorial
• Advanced Linux Command Line Tutorial

Basic Networking Skills for Digital Forensics (added 3/17/2023. Use Paython Scapy and netfilterqueue libraries.)

• HTTP Analysis using Wireshark (text)
• HTTP Analysis using Wireshark (image)
• SYN Flood Attack Investigation using tshark
• SMTP Forensics
• ARP Poisoning Forensics
• DNS Introduction
• DNS Spoofing Forensics
• WEP40 Wireless Aircrack

Computer and Digital Forensics (updated on Oct. 2021)

• Introduction to Digital Forensics
• Sleuth Kit Tutorial
• USB Image Acquisition
• Evidence Search - A Pattern Match Game (updated on May 2022)
• Evidence Search - File Metadata
• Data Carving
• Steganography
• Forensic Report Template

Computer Forensics Case Study

• Investigating NIST Data Leakage (Windows XP)
• Investigating P2P Data Leakage (Windows 10)
• Investigating Illegal Possession of Images ("Networking forensics")
• Investigating Email Harassment (updated on Feb 2023)
• Investigating Illegal File Transferring (Memory Forensics)

Investigating Hacking Case

• Investigating Morris Worm Attack (updated on Jan 2023, POSTER )

Mobile/IoT Forensics Case Study

• Investigating Echo Show 8 (added on 12/25/2023)
• Investigating Android 10 (added on 10/24/2021)
• Investigating iPhone iOS 13 (updated on 6/18/2022)
• Investigating Drone (add on 12/07/2021)

Forensic Intelligence Repository

• Email forensics
• Illegal Possession of Images

AI for Forensics

• Identifying IP Addresses using a Fine-tuned AI Model

Tool Installation

Method 1: importing customized kali vm image.

The customized Kali VM = Kali ( 2021.4 ) + tools used for completing most of the labs listed above (except p2p Data Leakage case)

Install Virtualbox

• Import the customized Kali 2021.4 . Notes: the default harddisk size is 80G.

Method 2: Installing tools using the customized script (the script ONLY is tested on Kali 2021.4)

The following script will install tools needed for completing most of the labs listed above (except p2p Data Leakage case, which has its own script described in PPTs). Please let us know if you need us to add more tools to the script.

Install Kali 2021.4 . Notes: Suggest You configure the disk size of Kali VM 80G because the size of each leakage cases image is 30G+

Run a tool installation script instructions , or you can simply follow the commands below

• Installed tools . Note that most of the commands for tools can executed globally. Now you can skip most of tool installation steps in PPTs.

Method 3: Using a Docker container based on Ubuntu 22.04 LTS (added in 09/23, may need more testing, report any issues please)

• The host machine of the Docker container is Ubuntu 22.04 LTS.
• The container is built on top of Ubuntu 22.04 LTS as well.
• All tools are pre-install on the Ubuntu container.
• You can follow the tuturial Docker for Digital Forensic Investgiation

Investigating NIST Data Leakage

The case study is to investigate an image involving intellectual property theft. The study include

• A large and complex case study created by NIST. You can access the Scenario, DD/Encase images . You can also find the solutions on their website.
• 14 hands-on labs/topics in digital forensics

Topics Covered

Investigating P2P Data Leakage

The P2P data leakage case study is to help students to apply various forensic techniques to investigate intellectual property theft involving P2P. The study includes

• A large and complex case involving a uTorrent client. The case is similar to NIST data leakage lab. However, it provides a clearer and more detailed timeline.
• Solid evidence with explanations. Each evidence that is associated with each activity is explained along with the timeline.
• 10 hands-on labs/topics in digital forensics

Investigating Illegal Possession of Images

The case study is to investigate the illegal possession of Rhino images. This image was contributed by Dr. Golden G. Richard III, and was originally used in the DFRWS 2005 RODEO CHALLENGE. NIST hosts the USB DD image . A copy of the image is also available in the repository.

Investigating Email Harassment

The case study is to investigate the harassment email sent by a student to a faculty member. The case is hosted by digitalcorpora.org. You can access the senario description and network traffic from their website. The repository only provides lab instructions.

Investigating Illegal File Transferring

The case study aims to examine computer memory to reconstruct a timeline of unauthorized data transfers. The scenario involves the illicit transfer of sensitive files from a server to a USB device.

The case study , including a disk image provided by NIST is to investigate a hacker who intercepts internet traffic within range of Wireless Access Points.

Investigating Morris Worm Attack

The case study is an investigation of the Morris Worm Attacking . We are using the VM provided by SeedLab . The goal of the lab is to find all evidence related to Morris Worm attacking.

Investigating Echo Show 8

The case study outlines the use of the chip-off technique to extract evidence from an Amazon Echo Show device. Different types of evidence are produced and inserted into the Echo Show 8 (2nd generation). The investigative process includes the utilization of a reverse engineering approach to retrieve the implanted evidence from the embedded MultiMediaCard (eMMC) of the Echo Show device.

eMMC Images

• Echo Show eMMC Image
• Echo Show Userdata Partition Image

Investigating Android 10

The image is created by Joshua Hickman and hosted by digitalcorpora .

Investigating iPhone iOS 13.4.1

Investigating drone dji.

The dataset includes logical files extracted from a DJI controller (mobile device) and a SD card image used by the device. The Drone dataset is created by VTO Labs . The lab covers GPS investigation and cached image retrieval. Note that it is a draft. We will improve the lab later.

• Other tools installed via apt install python3-pip, leafpad, terminator, sqlite3, tree, xmlstarlet, libhivex-bin, pasco, libhivex-bin, npm, binwalk, foremost, hashdeep, ewf-tools, nautilus

Contribution

• Dr. Frank Xu (Email: fxu at ubalt dot edu)
• Sarfraz Shaikh (Echo Show)
• Danny Ferreira (iPhone)
• Harleen Kaur (Partial of Android)
• Malcolm Hayward (P2P Leakage)
• Richard (Max) Wheeless (Hacking case)
• Chimezie Onwuegbuchulem (Docker for Digital Forensics)
• Etinosa Osawe (AI for Forensics - Identifying IPs with a Fine-tuned Language Model)

Star History

Sponsor this project

• Jupyter Notebook 22.1%
• Python 4.7%
• Rich Text Format 3.9%
• ColdFusion 3.7%
• DIGITAL Command Language 3.7%

7 Real-Life Cases Solved Using Digital Forensics [References]

Today, we will dive into the fascinating world of real-life cases that digital forensics technology has helped to crack open.

As you probably know, the power of digital forensics is immense and has revolutionized how we solve crimes.

So, buckle up and get ready for a thrilling journey through 7 real-life cases that digital forensics technology helped solve .

But first, let’s quickly remind ourselves of the various branches of digital forensics and who uses digital forensics in today’s world.

Digital forensics is vital for law enforcement, private investigators, and even corporations looking to protect their digital assets.

It’s incredible how this field has grown, and it’s only getting more important as technology evolves.

Case 1: The BTK Serial Killer

Get ready because we’re diving into one of American history’s most infamous criminal cases.

The BTK serial killer, also known as Dennis Rader, terrorized the people of Kansas for over three decades. But it wasn’t until digital forensics stepped in that the long, dark chapter in Kansas history finally came to a close.

Profiling the Killer

Between 1974 and 1991, Rader took the lives of ten innocent people, leaving behind a trail of fear and unsolved mysteries.

The killer got his nickname, “BTK,” from his chilling method of operation: Bind, Torture, Kill.

As the years went by, Rader managed to elude capture, taunting law enforcement with letters and clues, but never quite revealing his identity.

The Digital Breakthrough

Fast forward to 2004, when Rader made a fatal mistake. He sent a floppy disk to the police, believing it was untraceable. However, he was wrong.

Digital forensics experts were able to recover deleted data from the disk, which led them to a computer at a local church.

This critical piece of evidence allowed investigators to zero in on Rader, ultimately leading to his arrest and conviction.

The BTK case is a prime example of how digital forensics can help solve even the most long-standing mysteries.

And as technology continues to advance, it’s becoming increasingly essential for investigators to develop their digital forensics skills .

But that’s just the tip of the iceberg. Let’s move on to our next case, where digital forensics played a crucial role in bringing terrorists to justice.

Case 2: The Boston Marathon Bombing

On April 15, 2013, a day that should have been filled with joy and celebration, tragedy struck the city of Boston.

Two homemade bombs detonated near the finish line of the Boston Marathon, killing three people and injuring hundreds more.

It was a day that would forever be etched in the memories of those affected, but digital forensics would soon play a pivotal role in bringing the perpetrators to justice.

The Tragic Event

The bombings were the work of two brothers, Tamerlan and Dzhokhar Tsarnaev.

In the days following the attack, law enforcement launched a massive manhunt to capture the suspects, using every resource available to them.

This is where digital forensics would prove to be an invaluable tool in their quest for justice.

Analyzing Digital Evidence

Investigators turned to the vast amount of digital evidence available to help them identify the suspects.

Surveillance footage, cellphone data, and social media activity were all analyzed using advanced digital forensics techniques.

This allowed them to piece together the Tsarnaev brothers’ movements before, during, and after the attack.

But it wasn’t just traditional digital forensics at work here. Cloud forensics and mobile forensics also played a significant role in the investigation, as experts scoured the suspects’ online activities and cellphone records for vital clues.

Ultimately, digital forensics helped investigators to apprehend Dzhokhar Tsarnaev, who was later convicted and sentenced to death. His brother, Tamerlan, was killed during a police shootout.

The Boston Marathon bombing case is a powerful reminder of the importance of digital forensics in modern criminal investigations.

Now, let’s explore a case where digital forensics was used to unmask a deceptive online predator.

Case 3: Catching the Catfish

The internet can be a fantastic place to connect with people worldwide, but it can also be a breeding ground for deception and malicious intent.

In this case, we’ll explore how digital forensics was used to catch a “catfish” who had been fooling people into believing he was someone else entirely.

The Deceptive Online Relationship

A woman named Sarah met a man named “Chris” online and quickly fell for his charming persona. They exchanged messages and photos and even spoke on the phone.

But as their relationship progressed, Sarah started to feel that something wasn’t quite right. She decided to hire a private investigator, who soon discovered that “Chris” was not who he claimed to be.

He was, in fact, a catfish who created fake online profiles to deceive others.

Uncovering the Truth Through Digital Forensics

Digital forensics played a crucial role in exposing the catfish’s true identity. The private investigator used various digital forensics tools and software to analyze the images and messages sent by “Chris.”

By examining the EXIF metadata of the photos, the investigator was able to determine that they had been manipulated, and the phone number “Chris” had been using was linked to several other catfishing schemes.

Additionally, the investigator was able to trace the catfish’s online activities back to his real identity by analyzing his IP address and other digital footprints.

In the end, the catfish is confronted and forced to admit his deception, allowing Sarah to move on with her life.

This case is a prime example of how digital forensics can be used to solve serious crimes and help everyday people protect themselves from online deception.

Now, let’s take a look at a high-profile murder case where digital evidence played a critical role in the trial.

Case 4: The Murder of Laci Peterson

In 2002, the disappearance of Laci Peterson, a pregnant woman from Modesto, California, captured the nation’s attention.

The case took several twists and turns, but ultimately, digital forensics helped build a case against her husband, Scott Peterson.

The Disappearance

Laci was reported missing on Christmas Eve, and her husband, Scott, quickly became the prime suspect.

As the investigation unfolded, evidence began to mount against him, including suspicious behavior and extramarital affairs. But it was the digital evidence that would prove crucial in the courtroom.

The Role of Digital Evidence in the Trial

Investigators used digital forensics to analyze Scott’s computer, cellphone records, and GPS data, which painted a damning picture of his movements and activities before and after Laci’s disappearance.

For example, they discovered that Scott had researched fishing locations and currents in the San Francisco Bay, where Laci’s body was eventually found.

Another critical piece of digital evidence came from forensic imaging .

Experts created a detailed digital reconstruction of the crime scene, which helped the jury visualize and understand the complex timeline of events leading up to Laci’s murder.

In the end, Scott Peterson was convicted of first-degree murder for the death of his wife, Laci, and second-degree murder for the death of their unborn son.

He was sentenced to death, but his sentence has since been overturned, and he is currently awaiting a new trial.

The Laci Peterson case highlights the power of digital forensics in providing key evidence that can sway a jury and ensure that justice is served.

Let’s move on to another case that has captured the world’s attention for over a decade.

Case 5: The Disappearance of Madeleine McCann

In 2007, the world was shocked by the disappearance of three-year-old Madeleine McCann from her family’s holiday apartment in Praia da Luz, Portugal.

Despite countless leads and extensive investigations, Madeleine has never been found. However, digital forensics has played an essential role in the ongoing search for answers.

A Long-Running Mystery

Over the years, the case has generated numerous theories and suspects but no definitive answers.

As time has passed, the role of digital forensics in the investigation has become increasingly important, with experts analyzing vast amounts of data to find any clue that might lead to a breakthrough.

Digital Forensics: A Ray of Hope

One such instance where digital forensics played a crucial role in the Madeleine McCann case was when investigators analyzed the computers of a key suspect.

They discovered that the suspect had searched for information about the disposal of bodies and the effects of certain drugs on children.

This information and other evidence led to the suspect being named as a prime person of interest in Madeleine’s disappearance.

Additionally, digital forensics experts have examined countless images and videos from the area where Madeleine vanished, using data recovery techniques to recover and analyze deleted or damaged files.

They’ve also utilized database forensics tools to search through massive amounts of data in an attempt to find any potential leads.

While Madeleine McCann’s case remains unsolved, the tireless work of digital forensics experts continues to offer hope that one day, the truth will be uncovered, and justice will be served.

Now, let’s explore a case where digital forensics brought down a notorious online criminal empire.

Case 6: The Takedown of Silk Road

The Silk Road was once the most infamous online black market, a hidden corner of the internet where users could buy and sell drugs, weapons, and other illegal goods.

But in 2013, a daring operation led by the FBI brought the entire operation crashing down, thanks in large part to digital forensics.

The Rise and Fall of an Online Empire

Founded by Ross Ulbricht in 2011, Silk Road quickly gained notoriety as the go-to place for illegal transactions.

As the site grew, so did the attention of law enforcement agencies, who were determined to bring the operation to an end.

Digital Forensics to the Rescue

To build their case against Ulbricht, the FBI used advanced digital forensics techniques to trace the flow of money and communications through the anonymous network that Silk Road operated on.

This involved the use of file carving tools and other specialized software to analyze encrypted data and reveal the hidden connections between users and transactions.

By following the digital breadcrumbs, investigators were able to link Ulbricht to the Silk Road operation and eventually track him down in a public library in San Francisco, where he was arrested.

Ulbricht was later convicted of multiple charges, including money laundering, computer hacking, and drug trafficking. He was sentenced to life in prison without parole.

The Silk Road takedown is a prime example of how digital forensics can help law enforcement dismantle criminal networks operating in the shadows of the internet.

Now, let’s move on to our final case, where digital forensics played a key role in solving a heartbreaking murder mystery.

Case 7: The Murder of April Jones

In 2012, the small town of Machynlleth, Wales, was rocked by the abduction and murder of five-year-old April Jones.

The case quickly gained national attention, and the desperate search for April captured the hearts of millions. Once again, digital forensics would prove to be instrumental in securing a conviction.

A Town’s Worst Nightmare

April was last seen playing outside her home before being abducted by Mark Bridger, a local man with a history of violence.

Despite a massive search effort involving hundreds of volunteers, April’s body was never found. But the evidence against Bridger continued to mount.

Digital Forensics at Work

In the days following April’s disappearance, investigators turned to digital forensics to build their case against Bridger.

They discovered that he had attempted to destroy evidence by deleting files and wiping his computer’s hard drive.

But digital forensics experts were able to recover critical data, including images of April and internet searches related to child abduction and murder.

Digital forensics also played a role in linking Bridger’s vehicle to the crime scene. By analyzing GPS data from his car, investigators were able to place him at the scene of April’s abduction and track his movements afterward.

The recovered digital evidence helped secure Bridger’s conviction for April’s murder, and he was sentenced to life in prison.

The April Jones case is a tragic reminder of the importance of digital forensics in the pursuit of justice. It demonstrates how even the most determined criminals can be brought to justice through the diligent work of digital forensics experts.

These seven real-life cases offer a glimpse into the remarkable power of digital forensics in solving crimes and bringing criminals to justice.

As technology continues to evolve, so too will the methods and techniques used by digital forensics experts, ensuring that they remain a vital tool in the fight against crime.

References Used

Here are the references for each of the seven cases discussed in the blog post:

• Ramsland, K. (2006). Inside the Minds of Sexual Predators. Greenwood Publishing Group.
• Douglas, J. E., & Dodd, J. (2007). Inside the Mind of BTK: The True Story Behind the Thirty-Year Hunt for the Notorious Wichita Serial Killer. John Wiley & Sons.
• NPR (2015). What We Know About The Boston Marathon Bombings, 2 Years Later. Retrieved from https://www.npr.org/sections/thetwo-way/2015/04/15/399751623/what-we-know-about-the-boston-marathon-bombings-2-years-later
• CBS News (2019). Boston Marathon bombing timeline of events. Retrieved from https://www.cbsnews.com/news/boston-marathon-bombing-timeline-of-events/
• The Guardian (2013). The perfect man who wasn’t: when the man you love is a conman. Retrieved from https://www.theguardian.com/lifeandstyle/2013/nov/23/the-perfect-man-who-wasnt
• Crier, C. (2005). A Deadly Game: The Untold Story of the Scott Peterson Investigation. Harper Collins.
• CNN (2004). Peterson jury sees pictures of Laci’s remains. Retrieved from https://edition.cnn.com/2004/LAW/09/29/peterson.trial/index.html
• The Telegraph (2021). Madeleine McCann: The key events in the search for the missing girl. Retrieved from https://www.telegraph.co.uk/news/0/madeleine-mccann-key-events-search-missing-girl/
• BBC News (2020). Madeleine McCann: Suspect investigated over other missing girls. Retrieved from https://www.bbc.com/news/uk-53044605
• Greenberg, A. (2015). The Untold Story of Silk Road, Part 1. Wired. Retrieved from https://www.wired.com/2015/04/silk-road-1/
• U.S. Department of Justice (2015). Ross Ulbricht, the Creator and Owner of the “Silk Road” Website, Found Guilty in Manhattan Federal Court on All Counts. Retrieved from https://www.justice.gov/usao-sdny/pr/ross-ulbricht-creator-and-owner-silk-road-website-found-guilty-manhattan-federal-court
• BBC News (2013). April Jones: The schoolgirl who disappeared from her street. Retrieved from https://www.bbc.com/news/uk-wales-24384394
• The Guardian (2013). Mark Bridger found guilty of abducting and murdering April Jones. Retrieved from https://www.theguardian.com/uk/2013/may/30/mark-bridger-guilty-april-jones

Related Posts

Does Digital Forensics Require Coding or Programming Skills?

A career as a digital forensics analyst sounds exciting, especially when it involves uncovering digital evidence, helping to apprehend suspects, and testifying in a court…

Who Benefits From Using Digital Forensics: 5 Types of People

Digital forensics is an important field that involves recovering, analyzing, and preserving digital evidence from electronic devices. It can be used to investigate cybercrimes, data…

The 9 Different Branches Of Digital Forensics [Explained]

Digital forensics is crucial in investigating and prosecuting cybercrime, fraud, and other illegal activities. As technology advances, the need for specialized digital forensics expertise becomes…

How Long Is Chat History Saved In WhatsApp? [Explained]

If you use WhatsApp frequently, you may be wondering how long the app keeps your chat history. WhatsApp is a popular messaging app that is…

A Comprehensive Guide to Digital Forensics [Tools & Career]

Hey there! If you’ve ever wondered, “What is digital forensics in simple terms?” you’ve come to the right place. Digital forensics is the process of…

VPN Comparision Between Private Internet Access vs.Hide.ME

Hey there, fellow VPN enthusiasts! You might be wondering, “Is Hide.Me a legit VPN?” or even, “Is there a better VPN than PIA?” Well, you’re…

13 Benefits of Using Telegram App for Business [Guide]

Hey there! Are you wondering why Telegram is good for business? Look no further! In today’s fast-paced world, businesses are always on the lookout for…

Does Telegram Show Your Location? [App Settings & Sharing]

Telegram is an increasingly popular messaging app that’s been gaining traction for its focus on privacy and security. Unsurprisingly, many people wonder, “Does Telegram show…

Leave a Comment Cancel Reply

Your email address will not be published. Required fields are marked *

Save my name, email, and website in this browser for the next time I comment.

• The Open University
• Guest user / Sign out
• Study with The Open University

My OpenLearn Profile

Personalise your OpenLearn profile, save your favourite content and get recognition for your learning

About this free course

Become an ou student, download this course, share this free course.

Start this free course now. Just create an account and sign in. Enrol and complete the course for a free statement of participation or digital badge if available.

2.3 Case study: The Shirley McKie story

In February 1997, a British policewoman, Shirley McKie, was charged with perjury after testifying at a murder trial that she had not been in the victim’s house, where her thumbprint was supposedly found. McKie’s house was searched and she was taken back to the police station where she was strip-searched and detained because of the controversial thumbprint.

The Scottish Criminal Record Office produced four fingerprint experts who certified that the thumbprint definitely belonged to McKie. However, she maintained her innocence and was acquitted, saved from a potential eight years’ imprisonment, after two American fingerprinting experts endorsed that the thumbprint did not belong to her.

After much media activity, legal action and controversy, Michael Russell, a member of the Scottish parliament, asked fingerprinting experts from around the world to verify the ownership of this thumbprint and had 171 certifications from 18 different countries that the thumbprint did not belong to McKie.

The main concern with the entire issue was not only about its effect on McKie’s career, but also about the accuracy of the Scottish Criminal Record Office’s earlier assertions. A civil trial against the Scottish Executive was due to be heard in early 2006. On the morning of the trial, the Executive offered McKie a settlement of £750,000 without admitting liability. She accepted the offer and the trial did not go ahead. Following the end of legal proceedings, the Scottish Parliament held an inquiry during 2006, which identified fundamental weaknesses in the Scottish fingerprinting service. Before the inquiry reported, the Scottish Criminal Record Office offered early retirement to four of its fingerprint officers, three of whom accepted the offer. The officer who refused early retirement was subsequently sacked, but later won a case for unfair dismissal.

A public inquiry into the case was held in 2009, with the report being published in 2011. The inquiry blamed human error and inadequate procedures for the misidentification of McKie’s thumbprint. It found no evidence of a conspiracy by the police against McKie, nor did it find any weaknesses in the theory of identification using fingerprints. However, it warned:

Practitioners and fact-finders alike require to give due consideration to the limits of the discipline.

Among its recommendations, the inquiry said ‘fingerprint evidence should be recognised as opinion evidence, not fact’ (p. 741).

Shirley McKie received a full personal apology from Strathclyde Police Chief Constable Stephen House in April 2012, more than 14 years after the murder of Marion Ross. Ross’s murder has never been solved.

Based on your current knowledge of digital forensics, what lessons do you think the McKie case has for digital forensic investigations?

Digital evidence can only show what a computer did, not what a person did, and the conclusions of a digital forensics investigators need to distinguish clearly between facts and opinion. It is also important to know what your assumptions are based on. The fingerprint experts assumed that Bertillon’s claim about 16 ridge points making a print unique was true, but it turned out not to be.

Academia.edu no longer supports Internet Explorer.

To browse Academia.edu and the wider internet faster and more securely, please take a few seconds to  upgrade your browser .

Enter the email address you signed up with and we'll email you a reset link.

• We're Hiring!
• Help Center

The Use of Digital Forensic Case Studies for Teaching and Assessment

4th International Conference on Cybercrime Forensics Education and Training, Canterbury Christchurch University

This study analyses the use and development of Digital Forensic case studies for the purpose of teaching and assessing Digital Forensics students and practitioners. Within this study, case studies are categorised and a number of available case studies are explored. The importance of evidentiary and non-evidentiary artefacts within the case study are examined. Mechanisms for integrating case study development and/or investigation with student assessment are proposed, the benefits and the challenges of this approach are examined. Practical and technical issues involved in the development of case studies are examined. The study concludes by proposing guidelines for the development of Digital Forensic case studies. Please cite as follows: Lallie H., (2010), Developing Usable hard disk images for Forensic training, education and research, 4th International Conference on Cybercrime Forensics Education and Training, Canterbury Christchurch University

Related Papers

Mark Scanlon , Xiaoyu Du

Education and training in digital forensics requires a variety of suitable challenge corpora containing realistic features including regular wear-and-tear, background noise, and the actual digital traces to be discovered during investigation. Typically, the creation of these challenges requires overly arduous effort on the part of the educator to ensure their viability. Once created, the challenge image needs to be stored and distributed to a class for practical training. This storage and distribution step requires significant time and resources and may not even be possible in an online/distance learning scenario due to the data sizes involved. As part of this paper, we introduce a more capable methodology and system as an alternative to current approaches. EviPlant is a system designed for the efficient creation, manipulation, storage and distribution of challenges for digital forensics education and training. The system relies on the initial distribution of base disk images, i.e., images containing solely base operating systems. In order to create challenges for students, educators can boot the base system, emulate the desired activity and perform a " diffing " of resultant image and the base image. This diffing process extracts the modified artefacts and associated metadata and stores them in an " evidence package ". Evidence packages can be created for different personae, different wear-and-tear, different emulated crimes, etc., and multiple evidence packages can be distributed to students and integrated into the base images. A number of additional applications in digital forensic challenge creation for tool testing and validation, proficiency testing, and malware analysis are also discussed as a result of using EviPlant.

Bill Buchanan

International Journal of Computer Science & Information Technology (IJCSIT)

In this survey paper the author explores the technical as well as high level conceptual trust issues that arise in acquiring log forensic evidence from the virtual machine (VM) hosted operating systems within the data clouds. This specific survey work is done at the University of Technology [UTECH], Jamaica, which currently functions as its own independent private data cloud provider. The data acquisition is particular to the hypervisor system logs that can be used to track VM incidences which are later used to compile potential evidence for a cloud investigation. This work also presents a model to show the layers of virtualization trust that can arguably be used to support the collection of such log evidence. The paper provides the context for the support of such cloud digital investigations and analyzes the choices available to a forensic investigator using proof of concept experiments. The experimental work is achieved by making a comparative evaluation of popular forensic acquisition tools including Guidance EnCase and AccessData Forensic Toolkit, as to how volatile and non-volatile hypervisor log data can be collected. Finally the paper explores three solutions for the managed log evidence data acquisition phase within a cloud investigation.

Justin Brecese

ADFSL Conference on Digital Forensics, Security and Law

Somaya Ali , Sumaya AlHosani

Due to their usage increase worldwide, iPads are on the path of becoming key sources of digital evidence in criminal investigations. This research investigated the logical backup acquisition and examination of the iPad2 device using the Apple iTunes backup utility while manually examining the backup data (manual examination) and automatically parsing the backup data (Lantern software - automated examination). The results indicate that a manual examination of the logical backup structure from iTunes reveals more digital evidence, especially if installed application data is required for an investigation. However, the researchers note that if a quick triage is needed of an iOS device, then automated tools provide a faster method for obtaining digital evidence from an iOS device. The results also illustrate that the file names in the backup folders have changed between iOS 3 and iOS 4. Lastly, the authors note the need for an extensible software framework for future automated logical iPad examination tools.

Digital Investigation

Ikhwan Ardianto

The Basics of Digital Forensics

Beginners Guide Towards Building a Digital Forensic Skills Framework, A Digital Forensic Skills Survey

Chris Gatsi CFE, CISA

Many a times, it has been argued that over dependency on technology leads to deskilling, lack of innovation and creativity thus resulting in inferior or substandard work. With a field growing in both demand for personnel and market for forensic software, 'digital forensics' is certainly not spared. Lately, there has been an increase in the number of digital forensic tools being developed to aid the extraction, analysis and management of digital evidence. Various comparisons, opinions and debates on the effectiveness of digital forensic software tools and their forensic soundness continue to dominate forensic investigator networks, white papers and publications. Given this context, many digital forensic investigators have unfortunately placed an over reliance on 'push the button' tools whilst overlooking the importance of other skills attributes to the digital forensic process. This issue has been exacerbated by a number of digital forensic course providers who are placing an over-emphasis on computer forensic software tools at the expense of other skills in their curriculum. In this paper, the author will make the case that a digital forensic investigation is not solely dependent on software tools but is also affected by various other soft skills. In presenting this argument the author will first discuss the usefulness and shortcomings in the use of software tools. This will be followed by a study of other relevant digital forensic skills. The last section of the paper will present theoretical and field based findings leading to the proposed 'Digital Forensic Skills Framework' intended to act as a general guide for course providers, recruiters as well as practising and prospective digital forensic investigators in measuring skills maturity levels and optimal digital forensic skills set.

Mark Scanlon

Due to budgetary constraints and the high level of training required, digital forensic analysts are in short supply in police forces the world over. This inevitably leads to a prolonged time taken between an investigator sending the digital evidence for analysis and receiving the analytical report back. In an attempt to expedite this procedure, various process models have been created to place the forensic analyst in the field conducting a triage of the digital evidence. By conducting triage in the field, an investigator is able to act upon pertinent information quicker, while waiting on the full report. The work presented as part of this paper focuses on the training of front-line personnel in the field triage process, without the need of a forensic analyst attending the scene. The premise has been successfully implemented within regular/non-digital forensics, i.e., crime scene investigation. In that field, front-line members have been trained in specific tasks to supplement the trained specialists. The concept of front-line members conducting triage of digital evidence in the field is achieved through the development of a new process model providing guidance to these members. To prove the model's viability, an implementation of this new process model is presented and evaluated. The results outlined demonstrate how a tiered response involving digital evidence specialists and non-specialists can better deal with the increasing number of investigations involving digital evidence.

Levan Agniashvili

RELATED PAPERS

Kariuki Paul

Jean-Paul Van Belle

… , Networks, Systems and …

Social Semiotics

Kelly Gates

SDIWC Organization

Annals of Emerging Technologies in Computing (AETiC)

Annals of Emerging Technologies in Computing (AETiC) , Andy Jones

Professsor Kelly M U A Kingsley

Talal Al Esmaiel, M.Sc

Emmanuel S Dandaura

Journal of Digital Forensics Security and Law

Diriri Diri

Jeanet Salamanca

Francesca Murialdo

Information and Beyond: Part I

Kevin Johnston

Simson Garfinkel

Alexandra M. Chassanoff

Craig Valli

Interdisciplinary Science Reviews (ISR)

A. S. Aurora Hoel

Oheneba Appiah-Kubi , Shahzad Saleem , Oliver Popov

Emily A Norton , Paul Cheetham

Andrew Marrington

Prof Norbik

Criminal Justice Studies

John J Sloan III

Luciana Duranti

2nd International Engineering Conference (IEC2017),

Shafi'i Muhammad ABDULHAMID , Olawale Adebayo

Glenn Voelz

Mitko Bogdanoski

Alastair Irons

Zakir Hussain Mansuri , Azimuddin Khan

vasilios katos , Tina Barbatsalou

TECHNICAL EXPLOITATION IN THE GRAY ZONE: EMPOWERING NATO SOF FOR STRATEGIC EFFECT

chace falgout

Saurabh Sahaji

shweta tripathi

RELATED TOPICS

•   We're Hiring!
•   Help Center
• Find new research papers in:
• Health Sciences
• Earth Sciences
• Cognitive Science
• Mathematics
• Computer Science
• Academia ©2024

Digital Forensics Association

• DFA Discussion Board
• Volunteering
• Start a Chapter
• A word on Education
• Certificates
• Free Training
• Vendor Training
• Open Source
• Case Studies
• Presentations
• Professional Journals
• Publications
• Articles & Papers
• Community Sites
• Discussion Groups
• Forensic Blogs
• Resource Sites
• Evidence Files
• Forensic Challenges
• Common Body of Knowledge
• Testimony Archive
• Tools Research
• DFA Research Publications
• Contact the DFA
• Connect with Us

Case Studies

• Analysis of a FAT-16 formatted image using Linux, TSK and Autopsy by Ove Hansen, 2005.
• Analysis of Italian Malware, Romanian Rootkits, and United States Computer Law by Michael Ford, 2003.
• Analysis of a Serial Based Digital Voice Recorder by Craig Wright, 2005.
• Analysis of WinHex by Jessica Dillinger, 2004.
• Analyze an Unknown Image and Perform Forensic Tool Validation by Patricia Watson, 2004.
• Autopsy of a Successful Intrustion (Well, Two Actually) by Floydman, 2001.
• Camouflaged and Attacked? by Bertha Marasky, 2005.
• CC Terminals, Inc., Forensic Examination Report: Examination of a USB Hard Drive by Mark Mawer, 2005.
• CC Terminals Computer Forensic Analysis Report by George Do, 2005.
• Computer Forensics Investigation: Analyze an Unknown Image by Raul Siles Pelaez, 2004.
• Discovery of a Rootkit: A Simple Scan Leads to a Complex Solution by John Melvin, 2005.
• Examining an Unknown Image & Analysis of a Compromised Honeypot by Siti Faten Farina Hj. Ramli, 2005.
• Forensic Analysis of Camouflage and Validation of X-Ways Forensic Tool by Mike Aylor, 2005.
• Forensic Analysis of a Compromised Intranet Server by Roberto Obialero, 2006.
• Forensic Analysis of the Contents of Nokia Mobile Phones by B. Williamson, P. Apeldoorn, B. Cheam & M. McDonald, Edith Cowan University, 2006.
• Forensic Analysis of a Live Linux System, Pt. 1 by Mariusz Burdach, 2004.
• Forensic Analysis of a Live Linux System, Pt. 2 by Mariusz Burdach, 2004.
• Forensic Analysis of a Misused System by David Shettler, 2005.
• Forensic Analysis of a Shared Workstation by Michael Kerr, 2003.
• Forensic Examination of a RIM (BlackBerry) Wireless Device by Michael Burnette, 2002.
• Forensic Analysis of a USB Flash Drive by Norrie Bennie, 2005.
• Foregetting to Lock the Back Door: A Break-in Analysis on a Red Hat Linux 6.2 Machine by Gary Belshaw, 2003.
• FTP Attack Case Study Part I: the Analysis by Anton Chuvakin, 2002.
• FTP Attack Case Study Part II: The Lessons by Anton Chuvakin, 2002.
• Investgating an Internal Case of Internet Abuse by Mal Wright, 2003.
• iPod Forensics: Forensically Sound Examination of an Apple iPod by Andrew Przibilla.
• Norton Ghost 2003 as a Forensic Image Acquisition Tool by John Brozycki, 2002.
• Open Source Forensics Analysis - Windows 2000 Server by Andre Arnes, 2003.
• Oracle Database Forensics Using LogMiner by Paul Wright, 2005.
• Steganography for Spies and Sypbots for Hackers by Andrew Christensen, 2005.
• Unspoken Truths - Forensic Analysis of an Unknown Binary by Louie Velocci.

Joshua I. James

Digital Forensic Scientist

• Custom Social Profile Link
• VOTE DFIR Science Show of the Year -->

Starting a New Digital Forensic Investigation Case in Autopsy

less than 1 minute read

This is a mini-course on Autopsy. You might want to see the description on YouTube for chapter links.

Autopsy is a free, open-source, full-features digital forensic investigation tool kit. It is developed by Basis Technology and a large open-source community. You can use Autopsy as the basis to conduct a full digital forensic investigation. You can also expand Autopsy with modules written in Java and Python.

We take you through how to start a digital investigation case in Autopsy. From organizing your data, starting your forensic documentation, processing case data, forensic analysis workflow, and generating reports.

Learn how to do forensic keyword searching, entropy testing, YARA basics, file carving, and more with Autopsy digital forensic software.

You may also enjoy

iLEAPP and RLEAPP updates and dev thoughts

Alex (@kviddy) has been pushing some extremely useful updates to the open-source Android forensic tool - [ALEAPP](https://github.com/abrignoni/ALEAPP]. Speci...

What data can you find in RAM?

To determine if you need to collect Random Access Memory on-scene, it is useful to know what kinda of investigation-relevant data is often available in RAM.

Modular artifact scripts coming to iLEAPP

kviddy has been pushing some great core updates to ALEAPP. Specifically, artifact scripts are now self-contained. This means that script authors no longer ne...

Forensic 4:Cast Awards - The real award is DFriends we made along the way

Come hang out with the nominees for the Forensic 4:Cast “Best DFIR Show of the Year”: 13Cubed, I Beg to DFIR, and DFIR Science!

phone_android +91 78385 89466 +91 92894 59589

India’s notable case studies involving digital forensic.

Digital Forensics Harshita Choudhary today January 10, 2024

Of course! Digital Forensic plays a crucial role in investigating cybercrimes, analysing electronic evidences and locating important information or data stored in digital devices. Let’s explore some well-known digital forensic case studies of India, that emphasise on the significance and challenges of this specific field in solving complicated criminal cases. 

The Aarushi Talwar-Hemraj Double murder case:

In the Aarushi Talwar-Hemraj double murder case of 2008, digital forensics played a very important role in the examination of electronic evidences. Investigators were able to reconstruct the communication and interactions between the victims and possible suspects with the help of computer data, emails, and mobile phone records. Analysis of digital footprints provides information on the victim’s activities and possible leads in spite of certain data handling and integrity challenges.

The SSR- Rhea Chakraborty case: 

Digital Forensic was used in the investigation and case of actor Sushant Singh Rajput’s death. Analysis of digital devices including mobile phones and computers, aimed to determine communication pattern, online activity and potential leads. Digital forensics assisted in tracking digital trails and social media activity providing insights into possible motives and connection, despite some challenges in data encryption and access to certain platforms. 

The IPL Spot-Fixing Scandal:

The Indian Premier League (IPL) spot-fixing scandal in 2013 involved the use of digital forensic in recovering electronic evidences. Investigators were able to identify the people involved in match fixing and unlawful betting activities through the examination of mobile phones, phone logs, text messages, and money transitions. Digital forensics played a significant role in order to establish the communication networks and revealing the complexity of the scandal.

The 26/11 Mumbai Terror Attacks:

The 2008 Mumbai terror attacks witnessed the application of digital forensics in analysing communication networks and electronic data. Investigation of phones, emails, GPS data, and internet usage helped in the reconstruction of perpetrators’ activities, communication channels and coordination patterns. Digital forensics overcame difficulties with encrypted communications and cross-border data access to assist the authorities in piecing together the timeline of events and identify the individuals who were involved.

The Vyapam Scam:

The Vyapam scam, a massive admission and recruitment scandal in Madhya Pradesh involved digital forensics in examining electronic records and online transitions. Analysis of computers, emails and financial transition, helped in uncovering irregular and fraudulent practices in the examination and recruitment processes. Digital forensic played a crucial role in establishing the trail of evidence and locating major parties involved in it.

The Nirav Modi-PNB Bank Fraud case:  

The Nirav Modi-PNB Bank Fraud case demonstrated how digital forensic can be used to uncover electronic transitions and financial irregularities. Analysis of bank records, emails, and digital transition revealed the fraudulent practices and manipulation of the financial systems. Digital forensics helped in tracing the flow of funds, by which the officials were able to understand the extent of the fraud. 

The Patiala House Court Leak case:

The Leak case in Patiala House court involved the leaking of sensitive documents and information. Digital forensics played an important role in tracking down the source of leak, in analysis of electronic communication, and in the identification of those responsible for the sacrifice of confidential information. The case highlighted the importance of securing digital infrastructure in order to prevent data leaks. 

Sunanda Pushkar Death case:

The investigation into the death of Sunanda Pushkar, the wife of politician Shashi Tharoor, involved digital forensic. Examination of electronic devices such as mobile phones, laptops, etc was done to piece together what happened before her death. In order to identify possible motives and relations, digital forensics helped in the analysis of connections, social media activities and online activity. Even though it was difficult to access some protected data, forensic digital analysis revealed details on the scenario. 

Kerala Gold Smuggling Case: 

The Kerala Gold Smuggling case which unfolded in 2020, involved smuggling of gold through diplomatic channels. Digital forensics played an important role in examining electronic communications such as emails, phone records and chats to trace the network which was involved in illegal activities. Examination of digital evidences revealed important links, helping investigators in unravelling the smuggling network and in identifying key individuals involved in the case.

Pegasus Spyware Scandal:

In 2021, India was entangled in the controversy surrounding the use of  Pegasus spyware. Digital forensic experts played a very crucial role in investigating allegations of unauthorised surveillance by analysing mobile devices to trace the spyware. This case demonstrated the importance of digital forensic in uncovering the sophisticated cyber espionage activities. 

The Unnao Rape case:

In the Unnao Rape case of Uttar Pradesh, where a legislator was accused of sexual assault, digital forensic analysis was performed to analyse electronic data. Investigators examine the victim’s mobile phone, social media accounts and correspondence logs to establish the sequence of events and communication patterns. Digital forensic experts retrieved the crucial data and helped in strengthening the case against the accused.

In India, digital forensic has become a vital tool in everyday criminal investigations. These case studies demonstrate how important digital forensic is for uncovering digital evidences, reconstructing timelines, communication networks, and establishing links between suspect and criminal activities. 

However, challenges persist in digital investigations such as data encryption, data integrity issues, and the need for specialised training to stay up to date with rapidly evolving digital platforms and cyber threats. 

Since digital technologies are always evolving, it is necessary to keep improving digital forensic techniques to protect the integrity of the evidence and the rule of law. One cannot underestimate the importance of digital forensics in India’s law enforcement and judicial system considering the continuous advancements in digital crimes. Its ability to track digital footprints and provide crucial evidence will continue to remain essential in solving complex crimes. 

Written by: Harshita Choudhary

Tagged as: Examination ,  Digital Evidence Recovery ,  Sunanda Pushkar Death ,  digital footpribts ,  Patiala House Court Leak ,  digital footprints ,  Digital forensics ,  Nirav Modi-PNB Fraud Case ,  evidence ,  Crime Scene Investigation ,  Vyapam Scam ,  Digital devices ,  Cyber Forensics ,  26/11 Mumbai Attacks ,  Investigation ,  IPL Spot-Fixing Scandal ,  Crime Scene Examination ,  SSR-Rhea Chakraborty Case ,  Cybercrimes ,  Aarushi Talwar-Hemraj Case ,  Electronic Evidence ,  case studies ,  Forensic Science ,  Pegasus Spyware Scandal ,  Analysis ,  mobile forensics ,  Kerala Gold Smuggling .

Previous post

today January 10, 2024

Computer Forensics Jay Ravtole

The Complete Overview of iOS System Artifacts: What You Need to Know

Introduction In the field of digital forensics, mobile devices are critical in discovering key evidence. Among these gadgets, Apple’s iOS systems stand out for their unique collection of artifacts that ...

Similar posts

Digital Forensics Anjali Singhal / May 20, 2024

• Exploring the Complexities of Malware Forensic Analysis

Introduction In the modern digital landscape, the threat of malware looms large over individuals, businesses, and governments alike. Malware, short for malicious software, encompasses a variety of harmful programs designed to disrupt, damage, or gain unauthorized access to computer systems. With cyber threats becoming more sophisticated, the field of malware forensic analysis has become crucial. ...

Read more trending_flat

today May 6, 2024

Digital Forensics Jay Ravtole

• Here are 30 reasons why Cyber Forensics is growing

Post comments (0)

Leave a reply cancel cancel, your email address will not be published. required fields are marked *.

Save my name, email, and website in this browser for the next time I comment.

Search in the site

• Questioned Documents Analysis
• Fingerprint Analysis
• Mobile Forensic
• Audio Forensic
• Computer Forensic
• Email Forensic
• Data Erasing
• Image/Video Forensic
• Network Penetration Test
• Web Application Testing
• Mobile Application Assessment
• Red Team Operations
• Client Security Evaluation
• Server Build Review

today November 20, 2023

Computer Hacking Forensic Investigator (CHFIv10)

Training Overview: CHFI v10 includes all the essentials of digital forensics analysis and evaluation required for today’s digital world. From identifying the footprints of a breach to collecting evidence for a prosecution, CHFI v10 walks students through every step of the process with experiential learning. This course has been tested and approved by veterans and [...]

HEF Certified Mobile Forensic Examiner (HEF-CMFE)

Training Program Overview: The HEF Certified Cyber Forensic Investigator (CCFI) training program is designed to equip individuals with the essential skills and knowledge required to excel in the field of digital forensics and cybercrime investigation. In an increasingly digital world, cyber threats are on the rise, making it vital for organizations and law enforcement agencies [...]

HEF Certified Computer Forensic Examiner (HEF-CCFE)

Training Program Overview: The HEF Certified Computer Forensic Examiner (HEF-CCFE) Training is a specialized and comprehensive program designed to equip professionals with the necessary skills and expertise to excel in the field of computer forensics. Recognized globally, this training program provides participants with the knowledge and capabilities required to conduct effective digital investigations, analyze digital [...]

HEF Certified Cyber Forensic Investigator (HEF-CCFI)

today December 18, 2023

HEF Certified Questioned Document Examiner

A questioned document can take various forms, such as identification cards, contracts, wills, titles, deeds, seals, stamps, bank checks, handwritten correspondence, machine-generated documents (from photocopiers, fax machines, and printers), or currency. Forensic document examiners, when conducting examinations, require known specimens for comparison. In cases involving handwriting, samples are categorized into specimen writing (dictated by investigators) [...]

HEF Certified Forensic Fingerprint Examination

Fingerprints, both at crime scenes and in forensic labs globally, serve as integral elements, weaving connections between individuals and specific pieces of evidence like a captivating detective story. Our training program is designed to provide students with professional insights into the fundamentals of fingerprint science. Given its comparative nature, the examination heavily relies on the [...]

today December 21, 2023

Crime Scene Investigation Training

Crime Scene Investigation (CSI) is a crucial element of forensic science, playing a pivotal role in ensuring justice and uncovering the truth. Proper handling of a crime scene is essential, as it significantly impacts evidence integrity once other individuals, including law enforcement officials, enter the area. Our comprehensive training covers various critical actions during a [...]

Articles Categories

• General Forensics
• Computer Forensics
• Document Analysis
• Digital Forensics
• Fingerprint Examination
• Digital Forensic Glossary

Recent Posts

• Most Common Challenges while doing iOS Forensics
• Fingerprints as Forensic Evidence in Document Authentication
• Importance of Email header and Metadata in Forensic Investigations

Copyright 2023 all rights reserved by Hawk Eye Forensic .

We use cookies on our website to support technical features that enhance your user experience, and to help us improve our website. By continuing to use this website, you accept our privacy policy .

• Student Login
• No-Cost Professional Certificates
• Call Us: 888-549-6755
• 888-559-6763
• Search site Search our site Search Now Close
• Request Info

Skip to Content (Press Enter)

Cracking Cases with Digital Forensics

By Kristina Ericksen on 03/22/2018

In the not-too-distant past, if you wanted to keep tabs on what someone was doing, you’d have to stealthily follow them around town with a camera. Today, however, a quick look at their digital devices would provide you with more information than you ever imagined.

With the infiltration of digital devices into all aspects of daily living—from mobile phones to wearable devices and vehicle connectivity—you amass data simply by going through your 21 st -century life. Individuals leave a data-rich, digital footprint wherever they go; whatever they do.

The field of digital forensics emerged as an answer to all this data. Tapping into the wealth of information, investigators use it to unveil the truth even in the murkiest of cases. To help you better understand digital forensics, we spoke with three seasoned experts in the field to get the inside scoop. Keep reading to learn about the field and the critical role digital forensics plays in investigations—as well as some examples of high-profile cases cracked by it.

What is digital forensics?

Digital forensics is the act of recovering data from a digital device or system and then providing context for it, such as explaining the source and purpose of it for civil or criminal proceedings and internal investigations.

Private investigator David Nalley of Nalley Private Investigations sums it up as this: Digital forensics is a threefold process that includes:

• Preserving and recording the state of a digital device, such as a hard drive, mobile phone, network device or laptop,
• Analyzing the state of a digital device, and
• Reporting on it to glean useful information.

For example, a digital forensics investigator may dig into a device, such as a cell phone, to determine whether data proves or disproves an alleged action, explains Hazelwood Police Department Forensic Examiner Andy Hrenak.

"Digital forensics is really the marriage of art and a science."

“Digital forensics is really the marriage of art and a science,” says Hrenak. “It’s an application of scientific process to the art of data recovery.”

And in such a data-rich world, digital forensics examiners can analyze computer storage devices, network servers and other types of digital media to track down hackers, investigate an intrusion, gather evidence of a crime or uncover fraud, explains Edward J. Ajaeb, president of Nighthawk Strategies .

“Information obtained from digital devices, social media platforms and mobile apps can be crucial in an investigation. This information can include dates, times, locations and other important information that may be a key piece in an investigation,” he says.

And because data is so abundant, digital forensics is becoming an increasingly critical component to investigations everywhere.

Why digital forensics is important now more than ever

“Digital devices provide an unbiased, objective viewpoint on selective slices of our lives,” says Nalley.

Information derived from digital forensics plays a role in almost all cases today. With 95 percent of American adults owning cellphones , the prevalence of data is staggering, explains Hrenak. But it’s not just cell phones—it’s laptops and wearables, vehicle black boxes and smart appliances. It’s your search history and everything you click. It’s the Wi-Fi networks you connect to and the metadata in the photos you upload online.

“Technology is so integrated into society, and very few people live off the grid,” says Hrenak. “Because people communicate digitally, they leave a digital footprint.”

And as technology changes, digital forensics must also adapt to meet the needs of systems and their users. For example, devices have evolved from desktop computers to laptops and tablets, and now mobile phones.

“As more and more Americans shift their digital usage from home desktop computers to mobile apps and devices, the field of digital forensics has expanded to include these platforms and applications. Mobile devices and apps store valuable information about a user that may be useful in an investigation,” explains Ajaeb.

Famous cases cracked with digital forensics

Be it a text message, Google searches or GPS information, a person’s digital footprint can provide plenty of ammunition in the courtroom. Here are a few cases where digital forensics played a critical role in bringing about justice.

1. The BTK Killer, Dennis Rader

Perhaps the most famous case to be solved through digital forensics is that of the BTK Killer Dennis Rader , with “BTK” referring to his MO of “bind, torture and kill.” Rader enjoyed taunting police during his killing sprees in Wichita, KS. But this also proved to be his fatal flaw. A floppy disk Rader sent to police revealed his true identity. He was soon arrested, pled guilty and was put behind bars for life, much to the relief of his long-terrorized community.

2. Dr. Conrad Murray’s lethal prescriptions

Another recent case solved with digital forensics was that of Dr. Conrad Murray, personal physician of Michael Jackson . Digital forensics played a crucial role in the trial. After Jackson passed away unexpectedly in 2009, the autopsy found Jackson’s death to be the result of prescription drugs. Investigators discovered documentation on Dr. Murray's computer showing his authorization of lethal amounts of the drugs, and he was convicted of involuntary manslaughter for Jackson’s death. He served two years in prison and lost his medical license.

3. The Craigslist Killer, Philip Markoff

When one woman was killed and another attacked after meeting individuals through Craigslist, Boston was on high alert. Fortunately, law enforcement had their suspect within a week of the murder, thanks to digital forensics . Investigators tracked the IP address from the emails used in the Craigslist correspondence to an unlikely suspect: 23-year-old medical student Philip Markoff. Without the digital trail of evidence, who knows how prolific Markoff could have become.

Getting into digital forensics

How would you like to solve cases like these? If you’re intrigued by digital forensics, you’re in luck. Law enforcement needs tech-savvy investigators to dig into data and provide insights for investigations.

“There’s a huge demand for folks who can recover data and provide meaningful analysis,” Nalley says.

"There's a huge demand for folks who can recover data and provide meaningful analysis."

In fact, employment of forensic science technicians is projected to grow 17 percent through 2026 , which is about two and a half times the average rate of growth for all occupations. And the work’s not just in-demand—it’s also rewarding and impactful. It’s something that can allow you to use your talent for technology while making a difference in your community.

“Locating the truth is the most rewarding part—sometimes truth isn’t what you expect it to be,” Hrenak says.

“Understanding how technology works is rewarding in itself. You’re able to use all the geeky, fun stuff and translate it into something actionable that helps a person or a company,” Nalley adds.

Whether you derive satisfaction from revealing the truth or helping others, digital forensics is sure to offer you new challenges to tackle, all through your curiosity and affinity for technology.

Follow the digital trail…

Now that we’ve piqued your interest in digital forensics, does it sound like something you could make a career out of? If you’re interested in the world of criminal justice, why not join it? Two of the most compelling careers in the field are those of investigators and detectives. They each get the benefit of solving cases and making a critical impact in keeping their communities safe.

Check out our article, “ Private Investigator vs. Police Detective: Making the Case , ” to scope out more about these two intriguing investigative careers.

• Share on Facebook
• Share on Twitter
• Share on Pinterest
• Share on LinkedIn

Request More Information

Talk with an admissions advisor today. Fill out the form to receive information about:

• Program Details and Applying for Classes
• Financial Aid and FAFSA (for those who qualify)
• Customized Support Services
• Detailed Program Plan

There are some errors in the form. Please correct the errors and submit again.

Please enter your first name.

Please enter your last name.

There is an error in email. Make sure your answer has:

• An "@" symbol
• A suffix such as ".com", ".edu", etc.

There is an error in phone number. Make sure your answer has:

• 10 digits with no dashes or spaces
• No country code (e.g. "1" for USA)

There is an error in ZIP code. Make sure your answer has only 5 digits.

Please choose a School of study.

Please choose a program.

Please choose a degree.

The program you have selected is not available in your ZIP code. Please select another program or contact an Admissions Advisor (877.530.9600) for help.

The program you have selected requires a nursing license. Please select another program or contact an Admissions Advisor (877.530.9600) for help.

Rasmussen University is not enrolling students in your state at this time.

By selecting "Submit," I authorize Rasmussen University to contact me by email, phone or text message at the number provided. There is no obligation to enroll. This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

About the author

Kristina Ericksen

Kristina is a Digital Writer at Collegis Education where she creates informative content on behalf of Rasmussen University. She is passionate about the power of education and enjoys connecting students to bright futures

Posted in General Justice Studies

• criminal justice

Related Content

Hope Rothenberg | 05.16.2024

Noelle Hartt | 04.16.2024

Brianna Flavin | 09.19.2022

Patrick Flavin | 07.18.2022

This piece of ad content was created by Rasmussen University to support its educational programs. Rasmussen University may not prepare students for all positions featured within this content. Please visit www.rasmussen.edu/degrees for a list of programs offered. External links provided on rasmussen.edu are for reference only. Rasmussen University does not guarantee, approve, control, or specifically endorse the information or products available on websites linked to, and is not endorsed by website owners, authors and/or organizations referenced. Rasmussen University is accredited by the Higher Learning Commission, an institutional accreditation agency recognized by the U.S. Department of Education.

Digital Forensic Investigation of a Damaged Drone: A Case Study

• Conference paper
• First Online: 11 April 2024
• Cite this conference paper

• Naveen Kumar Chaudhary 14  

Part of the book series: Lecture Notes in Networks and Systems ((LNNS,volume 890))

Included in the following conference series:

• International Conference on Advances in Data-driven Computing and Intelligent Systems

51 Accesses

The security personals are facing serious challenges in handling rouge drones. There have been many reported incidents wherein drones were used for illegal activities like arms, ammunition and contraband smuggling. The rouge drones, if sighted, are engaged and made to land forcefully or shot down by the security personals; however in this process, the drone incurs partial or complete damage. The damaged drones have limited forensic value; however, the partially damaged drones, if investigated properly, can yield many useful digital artefacts and reveal information about the drone’s capabilities and its mission. This paper presents a case study and proposes a methodology for damaged drone digital forensics.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Institutional subscriptions

Al-Dhaqm A, Ikuesan RA, Kebande VR, Razak S, Ghabban FM (2021) Research challenges and opportunities in drone forensics models. Electronics 2021(13):1519. https://doi.org/10.3390/electronics10131519

Valavanis KP, Vachtsevanos GJ (2015) The handbook of unmanned aircraft vehicle. Springer. https://doi.org/10.1007/978-90-481-9707-1

Article   Google Scholar  

Giones F, Brem A (2017) From toys to tools: The coevolution of technological and entrepreneurial developments in the drone industry. Bus Horiz 60(6):875–884. https://doi.org/10.1016/j.bushor.2017.08.00

Cracknell AP (2017) UAVs: regulations and law enforcement. Int J Remote Sens 38(8–10):3054–3067

Ravich TM (2015) Courts in the drone age. Northern Kentucky Law Rev 42(2):161

Google Scholar  

Buckley LE (2014) Recreational UAVs: going rogue with Pennsylvania’s strict products liability law Posttincher. Univ Pittsburgh J Technol Law Policy 15:243

Maddox S, Stuckenberg D (2015) Drones in the U.S. National Airspace System: a safety and security assessment. Harvard Law School National Security Journal. [Online]. Available: https://harvardnsj.org/2015/02/drones-in-the-u-s-national-airspace-system-a-safety-and-security-assessment/

George S, Hinnant L (2017) ISIS using drones, other innovating tactics with deadly effect. The Associated Press. [Online]. Available: https://www.militarytimes.com/flashpoints/2017/02/01/isis-using-drones-other-innovating-tactics-with-deadly-effect/

Lt Gen R S Panag (Retd) (2019) Beyond sea and land, India’s next defence challenge is drone terrorism. The Print, 07 Feb 2019. [Online]. Available: https://theprint.in/opinion/beyond-sea-and-land-indias-next-defence-challenge-is-droneterrorism/188749/

Sehgal M (2019) 8 days, 10 sorties: Pakistan drones dropped AK-47 rifles, 80 kg ammunition in Punjab. India Today, 25 Sep 2019. [Online]. Available: https://www.indiatoday.in/indi/story/pakistan-drones-ak47-rifles-ammunition-tarn-taran-1602906-2019-09-25

Khajuria RK (2020) Arms-laden Pak drone shot down by BSF along International Border in J&K’s Kathua. Hindustan Times News, 20 June 2020. [Online]. Available: https://www.hindustantime.com/india-news/pakistani-drone-shot-down-by-bsf-alonginternational-border-in-jammu-and-kashmir-s-kathua

Kovar D, Bollo J (2018) Drone forensics. Digital Forensics Magazine, issue 34. [Online]. Available: https://www.msab.com/.download/case_studies/Digital_Forensics_Feb-2018-MSAB.pdf

Enisa (2013) Digital forensics handbook, documents for teachers. [Online]. Available. https://www.enisa.europa.eu/topics/trainings-for-cybersecurity-specialsits/online-training-material/documents/digitalforensics-handbook

College of Policing (2016) Computerbased electronic evidence. [Online]. Available: https://www.app.college.police.uk/appcontent/investigations/investigativestrategies/passive-datagenerators/#computer-based-electronicevidence

College of Policing (2016) Computer based electronic evidence. [Online]. Available: https://www.app.college.police.uk/appcontent/investigations/investigativestrategies/passive-datagenerators/#computer-based-electronicevidence

Ayers RP, Brothers S, Jansen W (2014) Guidelines on mobile device forensics. [Online]. Available: https://www.nist.gov/publications/guidelines-mobile-device-forensics

Rodar A et al (2018) Unmanned aerial vehicle forensic investigation Process as a case study. In: Annual ADFSL conference on digital forensic, security and law. [Online]. Available: https://commons.erau.edu/cgi/viewcontent.cgi?article=1405&context=adfsl

Gülataş İ, Baktir S (2018) Unmanned aerial vehicle digital forensic investigation framework. J Naval Sci Eng 14(1):32–53

Clark D, Meffert C, Baggili I, Breitinger F (2017) DROP (drone open source parser) your drone: forensic analysis of the DJI Phantom III. Digit Investig 22:3–14. https://doi.org/10.1016/j.diin.2017.06.013

Horsman G (2016) Unmanned aerial vehicles: a preliminary analysis of forensic challenges. Digit Investig 16:1–11

Jain U, Rogers M, Matson ET (2017) Drone forensic framework: sensor and data identification and verification. In: Sensors Applications Symposium (SAS), pp 1–6

Kovar D, Dominguez G, Murphy C (2017) UAV (aka drone) forensics. In: SANS DFIR summit in Austin, TX, 7 July 2016

Maarse M, Sangers L, van Ginkel J, Pouw M (2016) Digital forensics on a DJI Phantom 2 Vision+ UAV. M.Sc. System and Network Engineering, University of Amsterdam

Samland F, Fruth J, Hildebrandt M, Hoppe T, Dittmann J (2012) AR. Drone: security threat analysis and exemplary attack to track persons. In: Proceedings, intelligent robots and computer vision XXIX: algorithms and techniques, vol 8301, p 83010G

Valjarevic A, Venter HS (2016) Introduction of concurrent processes into the digital forensic investigation process. Aust J Forensic Sci 48(3):339–357. https://doi.org/10.1080/00450618.2015.1052754

The Drone Rule, 2021 (2021). [Online]. Available: https://www.civilaviation.gov.in/sites/default/files/Draft_Drones_Rules_14_Jul_2021.pdf

Download references

Author information

Authors and affiliations.

National Forensic Sciences University, Gandhinagar, Gujarat, India

Naveen Kumar Chaudhary

You can also search for this author in PubMed   Google Scholar

Corresponding author

Correspondence to Naveen Kumar Chaudhary .

Editor information

Editors and affiliations.

Electronics and Communication Sciences, Indian Statistical Institute, kolkata, West Bengal, India

Swagatam Das

Info Systems, New Academic Building, Dept Office of Computer Science and, Mormugao, Goa, India

Snehanshu Saha

Computer Science Department, CINVESTAV-IPN, Ciudad De Mexico, Mexico

Carlos A. Coello Coello

Department of CS & IS, Birla Institute of Technology & Science, Sancoale, Goa, India

Hemant Rathore

Department of Mathematics, South Asian University, New Delhi, Delhi, India

Jagdish Chand Bansal

Rights and permissions

Reprints and permissions

Copyright information

© 2024 The Author(s), under exclusive license to Springer Nature Singapore Pte Ltd.

About this paper

Cite this paper.

Chaudhary, N.K. (2024). Digital Forensic Investigation of a Damaged Drone: A Case Study. In: Das, S., Saha, S., Coello, C.A.C., Rathore, H., Bansal, J.C. (eds) Advances in Data-Driven Computing and Intelligent Systems. ADCIS 2023. Lecture Notes in Networks and Systems, vol 890. Springer, Singapore. https://doi.org/10.1007/978-981-99-9531-8_36

Download citation

DOI : https://doi.org/10.1007/978-981-99-9531-8_36

Published : 11 April 2024

Publisher Name : Springer, Singapore

Print ISBN : 978-981-99-9530-1

Online ISBN : 978-981-99-9531-8

eBook Packages : Engineering Engineering (R0)

Share this paper

Anyone you share the following link with will be able to read this content:

Sorry, a shareable link is not currently available for this article.

Provided by the Springer Nature SharedIt content-sharing initiative

• Publish with us

Policies and ethics

• Find a journal
• Track your research