1
Introduction

André Årnes

Testimon Forensic Laboratory, Norwegian University of Science and Technology (NTNU), Gjøvik, Norway; and Telenor Group, Oslo, Norway

The world is becoming increasingly interconnected. We find connected devices in virtually every home, and computer networks are the nervous systems of corporate and government organizations everywhere. According to Internet Live Stats (2016), there are almost 3.5 billion Internet users in the world as of August 2016, covering close to 50% of the world's population. The Internet is, however, a network of networks consisting of competing and concurrent technologies with users from different organizations and countries. Unfortunately for the investigator, the Internet was designed for robustness and redundancy, rather than security and traceability. This increases the complexity and uncertainty of digital investigations and represents a formidable challenge for digital forensics practitioners.

Digital forensics is becoming increasingly important with the escalation of cybercrime and other network-related serious crimes. Understanding the laws and regulations governing electronic communications, cybercrimes, and data retention requires the continuous acquisition of new knowledge, methods, and tools. Digital evidence is everywhere and plays an important role in virtually any criminal investigation, from petty crimes to cybercrime, organized crime, and terrorism. It is therefore critically important that students of computer science and security acquire a fundamental understanding of digital forensics, in order to take part in the public debate and to act as experts in a legal context.

1.1 Forensic Science

Forensic science is a branch of science that is widely popularized in fiction and in contemporary media, ranging from Sir Arthur Conan Doyle's first Sherlock Holmes novel A Study in Scarlet published in 1887 to today's CSI and similar crime shows. It is commonly understood that forensic science is both highly inquisitive, requiring a creative mindset, and formalistic, requiring a strict adherence to established processes. An authoritative textbook in the field, Criminalistics (Saferstein, 2007), states that "forensic science in its broadest definition is the application of science to law." The terms criminalistics and forensic science are used interchangeably, although criminalistics has a stronger flavor of the services of a crime laboratory. For the purpose of this book, we will only use the first term, as defined in Definition 1.1.

Definition 1.1: Forensic Science

The application of scientific methods to establish factual answers to legal problems.

A forensic scientist is responsible for the important task of establishing facts related to questions such as: what has happened, how did it happen, who has been involved, and when did it occur? To solve such problems, a forensic scientist draws on methods and tools from a wide range of theoretical and applied sciences, including biology, medicine, physics, geology, computer science, and electrical engineering. As it is often not possible to answer a problem with full certainty, a forensic scientist is also trained to apply statistics to express the results in terms of probabilities (for a comprehensive discussion, see Aitken & Taroni, 2004).

1.1.1 History of Forensic Science

Forensic science was established as a separate scientific domain during the 1800s and early 1900s. The contributions of this new area of science dramatically changed the effectiveness of law enforcement. A comprehensive overview of the contributions is available in Saferstein (2007), but some notable innovators and milestones are:

• Mathieu Orfila (1787-1853), considered the father of forensic toxicology, published the first scientific text on forensic toxicology in 1814.
• Alphonse Bertillon (1853-1914) developed a method for identification through body measurements and published a system on personal identification in 1879.
• Francis Galton (1822-1911) studied fingerprints as a means of identification and published the book Finger Prints in 1892.
• Hans Gross (1847-1915) established the principles for the application of science in investigations in several publications, the first one in 1893.
• Alberts S. Osborn (1858-1946) established scientific principles for document examination and published the book Questioned Documents in 1910.
• Leone Lattes (1887-1954) studied characteristics of blood types for identification and created a method for the analysis of blood groups in blood stains in 1915.
• Edmond Locard (1877-1966), recognized worldwide for promoting the scientific method in criminal investigation, established a police laboratory in Lyon in 1910.

1.1.2 Locard's Exchange Principle

Edmond Locard formulated the famous Locard's exchange principle, which has served as an important principle for subsequent research within forensic science. The principle states that "when a person or object comes in contact with another person or object, a cross-transfer of materials occurs" (Saferstein, 2007). In this way, every criminal can be connected to a crime through trace evidence. It should, however, be noted that the principle cannot necessarily be directly applied to digital forensics, as the dynamics of digital evidence is different from that of physical evidence. In this textbook, we will, nonetheless, adopt Definition 1.2.

Definition 1.2: Locard's Exchange Principle

Whenever two objects come into contact with one another, there is an exchange of materials between them.

1.1.3 Crime Reconstruction

Crime reconstruction (or crime scene reconstruction) is the process of determining the most likely hypothesis, or sequence of events, through the application of the scientific method. For the purpose of this textbook, we apply Definition 1.3, based on the book Crime Reconstruction by Chisum and Turvey (2008).

Definition 1.3: Crime Reconstruction

Crime reconstruction is the determination of the actions and events surrounding the commission of a crime.

A crime reconstruction can leverage a wide range of forensic methods, for example firearm ballistics tests, statistical simulations, and biological experiments. The objective is to establish a hypothesis about the event or sequence of events and then to test whether the hypothesis is possible or not. If the hypothesis is confirmed, then one possible explanation has been identified. If it is refuted, then the explanation is not possible and other hypotheses will have to be considered.

1.1.4 Investigations

An investigation is a systematic examination, typically with the purpose of identifying or verifying facts. A key objective during investigations is to identify key facts related to a crime or incident, and a common methodology used in this textbook is referred to as 5WH (Stelfox, 2013; Tilstone et al., 2013), as defined in Definition 1.4.

Definition 1.4: 5WH

5WH defines the objectives of an investigation as who, where, what, when, why, and how.

The 5WH formula sets the following objectives (Stelfox, 2013):

• Who: Persons involved in the investigation, including suspects, witnesses, and victims
• Where: The location of the crime and other relevant locations
• What: Description of the facts of the crime in question
• When: The time of the crime and other related events
• Why: The motivation for the crime and why it happened at a given time
• How: How the crime was committed.

1.1.5 Evidence Dynamics

Evidence dynamics is defined as "any influence that adds, changes, relocates, obscures, contaminates, or obliterates physical evidence, regardless of intent" (Chisum & Turvey, 2000). The concept is useful in understanding the actual behavior of evidence and plays an important role in crime scene reconstructions. Although the definition is originally intended for physical evidence, it is equally applicable to digital evidence. For example, evidence dynamics can describe the mechanisms for writing to a sector on a hard drive, or the operations for creating, changing, or deleting a file in a file system. For the purpose of this textbook, we will use Definition 1.5, based on Chisum and Turvey (2000).

Definition 1.5: Evidence Dynamics

Evidence dynamics refers to any influence that adds, changes, relocates, obscures, contaminates, or obliterates evidence, regardless of intent.

1.2 Digital Forensics

Digital forensics refers to forensic science applied to digital information, whereas a digital investigation refers to investigations in the digital domain. We will use the definition from the first Digital Forensics Research Workshop (Digital Forensics Research Workshop, 2001), as defined in Definition 1.6.

Definition 1.6: Digital Forensics

The use of scientifically derived and proven methods toward the preservation, collection, validation, identification, analysis, interpretation, documentation, and presentation of digital evidence derived from digital sources for the purpose of facilitating or furthering the reconstruction of events found to be criminal, or helping to anticipate unauthorized actions shown to be disruptive...