Although digitization has revolutionized the commercial landscape, it has also given rise to threats like online fraud, phishing attacks, and other data breaches. As the Statista records, data breaches have increased yearly since 2006. There were around 446 million records exposed in 2018 compared to 19 million in 2006.
No business growing on the back of technological advancements is safe from cybercrime. Thus, the need for digital forensics and investigation has become critical as it helps forensics experts to collect evidence based on the analysis of digital devices.
What is Digital Forensics?
Digital forensics is a branch of forensic science that involves identifying, collecting, analyzing, and documenting information found on digital devices that can be used as evidence in a court of law about a cybercrime.
Digital forensics investigators are usually consulted to investigate crimes that involve the Internet and digital devices, such as computers and mobile phones. These professionals use digital forensics to extract data from devices and emails, access encrypted or hidden data, organize evidence files for references, and prevent data tampering.
Digital forensics can be divided into the following subcategories:
- Computer Forensics: A branch of forensic science that deals with the identification, analysis, collection, and reporting of evidence found in laptops, computers, and storage devices for investigation.
- Mobile Devices Forensics: It is a branch of digital forensics related to extracting digital evidence from mobile devices, viz. smartphones, gaming devices, GPS devices, tablets, etc.
- Memory Forensics: It analyzes computer memory (RAM) to identify and investigate advanced attacks.
- Network Forensics:It is a sub-branch of digital forensics related to monitoring, identifying, and analyzing network activities/events for locating the origin of a security attack.
- Digital Image Forensics: It is a new field of research aimed at analyzing and authenticating the validity of digital images (typically using metadata).
- Video/Audio Forensics: It is related to investigating digital sound and video recordings to establish their authenticity.
- Email Forensics: Email forensics is the practice of analyzing email content for evidence collection. It investigates email-related crimes, such as phishing attacks, data leaks, etc.
Why is Digital Forensics Important?
"Technology touches just about everything already and computer forensics is rapidly becoming a daily part of the investigative process. From a law enforcement perspective, it is difficult to find a case today that does not have a nexus to computer technology."
- Brian Scavotto (computer forensics expert and instructor at NU, California)
Data breaches and other cyberattacks have multiplied over the past few years, not just in the number of instances but also in terms of the costs involved (often in millions of dollars). So, it is only sensible for forward-thinking companies to take the necessary steps to mitigate these risks. In addition, investing in digital forensics can help them investigate potential frauds that are underway and arrest culprits in cases where the damage has already occurred. The following are some significant reasons why organizations need to use digital forensics:
- It Facilitates Legal Proceedings
- It Makes Financial Sense
- It Can Reduce Legal Costs and Ease Litigation Procedures
- Robust Data Security and Familiarity with Digital Forensics is the Need of the Hour
If and when a data breach occurs in a company, whether by an outsider or an insider, the 'story' of how it happened is of little significance in court. The legal process accepts only facts and data, which can only be produced with the help of a professional and trusted digital forensics procedure. Forensic investigators use specialized procedures and digital forensics tools to collect evidence in its original untampered form. This evidence can be used to solve the cases decisively.
Digital forensics can help an organization save money. For instance, a data breach in a company can compromise sensitive business records worth considerable strategic or financial value. With certified and tested forensics tools, the company can assess the attack's root cause and exact impact. It can segregate the affected records and the forensic evidence and line them up for legal proceedings to claim the damages. Further, organizations can more precisely estimate financial losses with the help of certified forensics solutions.
The 2019 Cost of Data Breach report by IBM informs that the global average cost of a data breach is USD 3.92 million. And, the average cost of a breach in the US is USD 8 million, which is the highest worldwide.
There can be diverse root causes and threat actors for a data breach. However, they mostly obligate the organization to compensate for the damages. A solution that can systematically analyze the root cause of the breach and collect evidence can help an organization keep off legal actions and hefty penalties imposed by regulatory bodies. In addition, forensically preserving the data can help it prove innocence in court or reduce the extent of damages.
We are becoming more and more data-dependent with each passing day. For organizations, the change is even more significant in scale. This means that those who fail to establish protective mechanisms for their databases and networks stand to lose critical business information and may even face insurmountable losses both in terms of capital and credibility. To adapt to the changing times and to be future-ready, leading companies need to get familiar with the latest trends in data security and digital forensics. They also need to upgrade their company security to prepare for the worst disasters. That's the least they can do in the interest of the company's growth and to sustain market viability.
Real-World Cases in Which Digital Forensics Was Used in Legal Investigations
Digital forensics has helped solve countless big and small cases across the globe. A few of them are as follows:
- Ross Comptown (Ohio, US) - Pacemaker Data Leads to Conviction
- Xiaolang Zhang (US) - Apple Employee Steals Trade Secrets, Nabbed Just in Time
- Krenar Lusha (Derbyshire, England) - Terrorist Put Behind Bars, Thanks to His Online Activities
Ross Compton, a 59-year-old man from Middletown, Ohio, was charged with insurance fraud and aggravated arson. He claimed that when he saw the fire in his house, he packed some of his belongings and ran out. Compton mentioned that he had a cardiac pacemaker. So, the police took him into custody for investigation. Applying the techniques of digital forensics, they were able to collect the data of
Compton's heart rate and cardiac rhythms from the pacemaker before and after the fire. Later, a cardiologist asserted that based on the data and Compton's medical condition, it was highly unlikely that he was able to collect, pack and carry the items from his house in such a short period. With this critical information, the police were able to prove Compton guilty of insurance fraud.
Xiaolang Zhang, an employee of Apple's autonomous car division (electrical engineering), was arrested by the FBI in 2019 for stealing trade secrets of the company.
After 2.5 years with Apple, Zhang suddenly resigned, citing that he wants to go back to China, his native country, to take care of his aging mother. He also mentioned that he will join an electric vehicle manufacturer in China. The sudden announcement, coupled with the thought of him joining a rival company, made the manager suspicious. As a result, the company's security team initiated an investigation and found suspicious online activities during his last few days in the company. He had downloaded tons of information from the company's databases, mainly over 2,000 files that included the company's proprietary schematics, manuals, diagrams, etc. The matter was immediately handed over to the FBI which arrested him just one day before he was about to leave for China.
Krenar Lusha, a 30-year old asylum seeker who worked illegally in a factory in Derby, was convicted in five of 10 terrorism-related charges. His laptop, when scanned by UK computer forensics experts, was found to have tell-tale documents called The Bomb Book and Ragar's Detonators, etc. The investigators also found downloaded instructions on building suicide belts and other kinds of explosives. Interestingly, Lusha was arrested by the police while he was downloading Hezbollah videos relating to bombs.
How is Email Forensics Investigation conducted?
Email forensics investigators use various techniques to acquire and process digital evidence. For instance, they may use specialized software to scan the data for specific keywords, document the correct dates and times of important files, and location details like IP addresses, MAC addresses of remote servers, and computers involved in the crimes. They also work closely with the legal department so that investigation is conducted in compliance with the law.
Using a third-party Email Forensics software
Stellar Email Forensic is an advanced eDiscovery and email investigation software that analyzes and investigates mailbox data of various email clients, email services (such as Exchange, Office 365, GroupWise Server, Google Mail, Notes, etc.), and email backup files with 100% accuracy.
Stellar Email Forensic allows the recovery of deleted mailboxes across more than 25 file formats, including EDB, PST, OST, DBX, NSF, MBOX, OLM, TBB, EML, etc., through a single interface. In addition, this software supports investigation at the granular level, meaning, Boolean and Regular Expression search is accomplished in a few clicks. Another great feature of this tool is that it allows case management during criminal investigations through tagging, bookmarking, and log management.
This tool generates customized litigation reports; hence it preserves the evidence in a legally acceptable format. For producing evidence in a court of law, bulk email forensics is also required, which is one of the advanced features of this product (as there are high chances that the after-effects of the cyberattacks have spread at a large scale).
Stellar Email Forensic is an advanced email forensics software in which the evidence is preserved with MD5 and SHA1 hash values while extracting and analyzing the data. Apart from this, this software works for deleted email recovery. This software comes with a 60-day trial period.
9 min read
